Play interactive tour

Edit tour

Windows Analysis Report PSnPApRPsG

Overview

General Information

Sample Name:	PSnPApRPsG (renamed file extension from none to dll)
Analysis ID:	492695
MD5:	ed37656551984cf5c1196d88c282e4aa
SHA1:	1475e0b8fd14a3a13160dc8ab28d228f3027c8b9
SHA256:	4bbd6db4f6bdad3bbcb134c53fb0886197c2880f9e9dd7a630707dbf333623f4
Tags:	Dridexexe
Infos:
Most interesting Screenshot:

Detection

Dridex

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Dridex unpacked file

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Changes memory attributes in foreign processes to executable or writable

Machine Learning detection for sample

Queues an APC in another process (thread injection)

Machine Learning detection for dropped file

Uses Atom Bombing / ProGate to inject into other processes

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Queries the installation date of Windows

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Uses the system / local time for branch decision (may execute only at specific dates)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Contains functionality for execution timing, often used to detect debuggers

PE file contains an invalid checksum

PE file contains strange resources

Drops PE files

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to launch a program with higher privileges

Binary contains a suspicious time stamp

PE file contains more sections than normal

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 7012 cmdline: loaddll64.exe 'C:\Users\user\Desktop\PSnPApRPsG.dll' MD5: E0CC9D126C39A9D2FA1CAD5027EBBD18)

cmd.exe (PID: 7056 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\PSnPApRPsG.dll',#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 7092 cmdline: rundll32.exe 'C:\Users\user\Desktop\PSnPApRPsG.dll',#1 MD5: 73C519F050C20580F8A62C849D49215A)

explorer.exe (PID: 3424 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

tcmsetup.exe (PID: 6868 cmdline: C:\Windows\system32\tcmsetup.exe MD5: 0DDA495155D552D024593C4B3246C8FA)

tcmsetup.exe (PID: 6980 cmdline: C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe MD5: 0DDA495155D552D024593C4B3246C8FA)

RdpSaUacHelper.exe (PID: 5052 cmdline: C:\Windows\system32\RdpSaUacHelper.exe MD5: DA88A7B872B1A52F2465D12CFBA4EDAB)

RdpSaUacHelper.exe (PID: 6204 cmdline: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe MD5: DA88A7B872B1A52F2465D12CFBA4EDAB)

msdt.exe (PID: 1568 cmdline: C:\Windows\system32\msdt.exe MD5: 8BE43BAF1F37DA5AB31A53CA1C07EE0C)

msdt.exe (PID: 5628 cmdline: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe MD5: 8BE43BAF1F37DA5AB31A53CA1C07EE0C)

bdechangepin.exe (PID: 6688 cmdline: C:\Windows\system32\bdechangepin.exe MD5: 013D00A367D851B0EC869F209337754E)

bdechangepin.exe (PID: 6608 cmdline: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe MD5: 013D00A367D851B0EC869F209337754E)

ProximityUxHost.exe (PID: 4584 cmdline: C:\Windows\system32\ProximityUxHost.exe MD5: E7F0E9B3779E54CD271959C600A2A531)

ProximityUxHost.exe (PID: 5376 cmdline: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe MD5: E7F0E9B3779E54CD271959C600A2A531)

psr.exe (PID: 3064 cmdline: C:\Windows\system32\psr.exe MD5: 3B8262EB45E790BF7FA648CEE2CCCB7B)

psr.exe (PID: 5152 cmdline: C:\Users\user\AppData\Local\Tp5KLY\psr.exe MD5: 3B8262EB45E790BF7FA648CEE2CCCB7B)

psr.exe (PID: 1716 cmdline: C:\Windows\system32\psr.exe MD5: 3B8262EB45E790BF7FA648CEE2CCCB7B)

psr.exe (PID: 5520 cmdline: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe MD5: 3B8262EB45E790BF7FA648CEE2CCCB7B)

wlrmdr.exe (PID: 5688 cmdline: C:\Windows\system32\wlrmdr.exe MD5: 4849E997AF1274DD145672A2F9BC0827)

wlrmdr.exe (PID: 5696 cmdline: C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe MD5: 4849E997AF1274DD145672A2F9BC0827)

DevicePairingWizard.exe (PID: 5468 cmdline: C:\Windows\system32\DevicePairingWizard.exe MD5: E23643C785D498FF73B5C9D7EA173C3D)

DevicePairingWizard.exe (PID: 2832 cmdline: C:\Users\user\AppData\Local\YaR\DevicePairingWizard.exe MD5: E23643C785D498FF73B5C9D7EA173C3D)

PresentationSettings.exe (PID: 2108 cmdline: C:\Windows\system32\PresentationSettings.exe MD5: 76086DD04B6760277A2B897345A0B457)

PresentationSettings.exe (PID: 1072 cmdline: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe MD5: 76086DD04B6760277A2B897345A0B457)

rundll32.exe (PID: 7120 cmdline: rundll32.exe C:\Users\user\Desktop\PSnPApRPsG.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 4388 cmdline: rundll32.exe C:\Users\user\Desktop\PSnPApRPsG.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6328 cmdline: rundll32.exe C:\Users\user\Desktop\PSnPApRPsG.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ MD5: 73C519F050C20580F8A62C849D49215A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.677061553.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000009.00000002.691449064.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000028.00000002.1082755771.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000017.00000002.846583663.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000026.00000002.1056321571.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000014.00000002.818480177.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000021.00000002.982719749.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000001F.00000002.955848713.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000004.00000002.761772602.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000012.00000002.791585057.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000001A.00000002.885485800.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000024.00000002.1017398501.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000001D.00000002.924400956.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000008.00000002.684710947.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
Click to see the 10 entries

Sigma Overview

System Summary:

Sigma detected: Possible Applocker Bypass

Show sources

Source: Process started

Author: juju4: Data: Command: C:\Windows\system32\msdt.exe, CommandLine: C:\Windows\system32\msdt.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\msdt.exe, NewProcessName: C:\Windows\System32\msdt.exe, OriginalFileName: C:\Windows\System32\msdt.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 3424, ProcessCommandLine: C:\Windows\system32\msdt.exe, ProcessId: 1568

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: PSnPApRPsG.dll

ReversingLabs: Detection: 80%

Antivirus / Scanner detection for submitted sample

Show sources

Source: PSnPApRPsG.dll

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\a5Q9CELTE\VERSION.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\br5u0t\WINMM.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\PVSXo\DUI70.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\YaR\MFC42u.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Tp5KLY\XmlLite.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\TQbOBk\DUser.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\a5Q9CELTE\VERSION.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\PVSXo\DUI70.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\72PXeqK\TAPI32.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\nmYaGulOu\UxTheme.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\PVSXo\DUI70.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\HtmF\credui.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\hUhx9Ta\WINSTA.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen

Machine Learning detection for sample

Show sources

Source: PSnPApRPsG.dll

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\a5Q9CELTE\VERSION.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\br5u0t\WINMM.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\PVSXo\DUI70.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\YaR\MFC42u.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Tp5KLY\XmlLite.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\TQbOBk\DUser.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\a5Q9CELTE\VERSION.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\PVSXo\DUI70.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\72PXeqK\TAPI32.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\nmYaGulOu\UxTheme.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\PVSXo\DUI70.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\HtmF\credui.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\hUhx9Ta\WINSTA.dll	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe	Code function: 20_2_00007FF677471AC4 CryptAcquireContextW,GetLastError,CryptGenRandom,GetLastError,CryptReleaseContext,	20_2_00007FF677471AC4
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB1DF30 CertGetCertificateContextProperty,GetLastError,CryptHashCertificate,GetLastError,GetLastError,CertFreeCertificateContext,	23_2_00007FF6EDB1DF30
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C03CE10 memset,memcpy,BCryptEncrypt,BCryptDestroyKey,BCryptCloseAlgorithmProvider,CoTaskMemFree,	29_2_00007FF70C03CE10
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C032A04 BCryptDecrypt,memset,BCryptDecrypt,memcpy,BCryptDestroyKey,BCryptCloseAlgorithmProvider,CoTaskMemFree,	29_2_00007FF70C032A04
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C032E8C BCryptDestroyKey,BCryptCloseAlgorithmProvider,CoTaskMemFree,CoTaskMemFree,	29_2_00007FF70C032E8C
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C03CC10 BCryptGenRandom,memcpy,BCryptEncrypt,memcpy,BCryptEncrypt,	29_2_00007FF70C03CC10
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C032CA0 BCryptOpenAlgorithmProvider,BCryptGetProperty,BCryptGetProperty,BCryptGenerateSymmetricKey,BCryptDestroyKey,BCryptCloseAlgorithmProvider,CoTaskMemFree,	29_2_00007FF70C032CA0

Source: PSnPApRPsG.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: RdpSaUacHelper.pdbGCTL source: RdpSaUacHelper.exe, 00000014.00000000.796651470.00007FF677475000.00000002.00020000.sdmp
Source:	Binary string: ProximityUxHost.pdbGCTL source: ProximityUxHost.exe, 0000001D.00000002.933995077.00007FF70C042000.00000002.00020000.sdmp
Source:	Binary string: tcmsetup.pdbGCTL source: tcmsetup.exe, 00000012.00000000.769914241.00007FF708133000.00000002.00020000.sdmp
Source:	Binary string: psr.pdbGCTL source: psr.exe, 0000001F.00000000.933928652.00007FF631DDC000.00000002.00020000.sdmp, psr.exe, 00000021.00000002.984523696.00007FF6A2D9C000.00000002.00020000.sdmp
Source:	Binary string: bdechangepin.pdb source: bdechangepin.exe, 0000001A.00000000.863440344.00007FF7A2AF9000.00000002.00020000.sdmp
Source:	Binary string: msdt.pdbGCTL source: msdt.exe, 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp
Source:	Binary string: bdechangepin.pdbGCTL source: bdechangepin.exe, 0000001A.00000000.863440344.00007FF7A2AF9000.00000002.00020000.sdmp
Source:	Binary string: PresentationSettings.pdb source: PresentationSettings.exe, 00000028.00000002.1084790071.00007FF7B1F46000.00000002.00020000.sdmp
Source:	Binary string: wlrmdr.pdbGCTL source: wlrmdr.exe, 00000024.00000002.1020091961.00007FF70E3F6000.00000002.00020000.sdmp
Source:	Binary string: wlrmdr.pdb source: wlrmdr.exe, 00000024.00000002.1020091961.00007FF70E3F6000.00000002.00020000.sdmp
Source:	Binary string: DevicePairingWizard.pdb source: DevicePairingWizard.exe, 00000026.00000002.1057768214.00007FF621237000.00000002.00020000.sdmp
Source:	Binary string: RdpSaUacHelper.pdb source: RdpSaUacHelper.exe, 00000014.00000000.796651470.00007FF677475000.00000002.00020000.sdmp
Source:	Binary string: tcmsetup.pdb source: tcmsetup.exe, 00000012.00000000.769914241.00007FF708133000.00000002.00020000.sdmp
Source:	Binary string: psr.pdb source: psr.exe, 0000001F.00000000.933928652.00007FF631DDC000.00000002.00020000.sdmp, psr.exe, 00000021.00000002.984523696.00007FF6A2D9C000.00000002.00020000.sdmp
Source:	Binary string: msdt.pdb source: msdt.exe, 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp
Source:	Binary string: PresentationSettings.pdbGCTL source: PresentationSettings.exe, 00000028.00000002.1084790071.00007FF7B1F46000.00000002.00020000.sdmp
Source:	Binary string: ProximityUxHost.pdb source: ProximityUxHost.exe, 0000001D.00000002.933995077.00007FF70C042000.00000002.00020000.sdmp
Source:	Binary string: DevicePairingWizard.pdbGCTL source: DevicePairingWizard.exe, 00000026.00000002.1057768214.00007FF621237000.00000002.00020000.sdmp

Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014005D290 FindFirstFileExW,	1_2_000000014005D290
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB16720 memset,GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,	23_2_00007FF6EDB16720
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB2A65C memset,GetProcessHeap,HeapAlloc,FindFirstFileW,GetProcessHeap,HeapAlloc,GetLastError,FindClose,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,	23_2_00007FF6EDB2A65C
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB2BD48 memset,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,CopyFileW,GetLastError,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,	23_2_00007FF6EDB2BD48
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB17784 memset,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,CloseHandle,FindFirstFileW,_wcsicmp,_wcsicmp,GetFileAttributesW,SetFileAttributesW,GetLastError,GetFileAttributesW,SetFileAttributesW,GetLastError,DeleteFileW,CreateFileW,GetLastError,CloseHandle,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,	23_2_00007FF6EDB17784
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB12770 memset,GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,	23_2_00007FF6EDB12770
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB16494 memset,GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,FindNextFileW,FindClose,#13,GetLastError,GetProcessHeap,HeapFree,	23_2_00007FF6EDB16494
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB17C3C GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,SetFileAttributesW,GetLastError,DeleteFileW,GetLastError,FindNextFileW,FindClose,RemoveDirectoryW,GetLastError,GetProcessHeap,HeapFree,	23_2_00007FF6EDB17C3C
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DC7A2C memset,PathCombineW,FindFirstFileW,GetLastError,PathCombineW,FindClose,	31_2_00007FF631DC7A2C
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DD15A8 GlobalAlloc,CharLowerA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,lstrlenA,FileTimeToLocalFileTime,FileTimeToDosDateTime,lstrlenA,FindNextFileA,FindNextFileA,FindClose,GlobalLock,GlobalUnlock,GlobalLock,GlobalUnlock,lstrlenA,FileTimeToLocalFileTime,FileTimeToDosDateTime,lstrlenA,lstrlenA,lstrlenA,GlobalFree,	31_2_00007FF631DD15A8
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DD1168 memset,lstrlenA,lstrlenA,lstrlenA,FindFirstFileA,lstrcmpA,lstrcmpA,FindNextFileA,FindClose,FindNextFileA,lstrcmpA,lstrcmpA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,FindClose,	31_2_00007FF631DD1168
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D87A2C memset,PathCombineW,FindFirstFileW,GetLastError,PathCombineW,FindClose,	33_2_00007FF6A2D87A2C
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D915A8 GlobalAlloc,CharLowerA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,lstrlenA,FileTimeToLocalFileTime,FileTimeToDosDateTime,lstrlenA,FindNextFileA,FindNextFileA,FindClose,GlobalLock,GlobalUnlock,GlobalLock,GlobalUnlock,lstrlenA,FileTimeToLocalFileTime,FileTimeToDosDateTime,lstrlenA,lstrlenA,lstrlenA,GlobalFree,	33_2_00007FF6A2D915A8
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D91168 memset,lstrlenA,lstrlenA,lstrlenA,FindFirstFileA,lstrcmpA,lstrcmpA,FindNextFileA,FindClose,FindNextFileA,lstrcmpA,lstrcmpA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,FindClose,	33_2_00007FF6A2D91168
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Code function: 40_2_00007FF7B1F44518 PathAppendW,FindFirstFileW,PathAppendW,GetLastError,PathFindExtensionW,StrCmpICW,FindNextFileW,FindClose,GetLastError,	40_2_00007FF7B1F44518

Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe

Code function: 23_2_00007FF6EDB13120 GetProcessHeap,HeapAlloc,CreateStreamOnHGlobal,OpenClipboard,GetLastError,EmptyClipboard,GetHGlobalFromStream,SetClipboardData,CloseClipboard,GetProcessHeap,HeapFree,

23_2_00007FF6EDB13120

E-Banking Fraud:

Yara detected Dridex unpacked file

Show sources

Source: Yara match	File source: 00000005.00000002.677061553.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.691449064.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.1082755771.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.846583663.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.1056321571.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.818480177.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.982719749.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.955848713.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.761772602.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.791585057.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.885485800.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.1017398501.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.924400956.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.684710947.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, type: MEMORY

Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140034870	1_2_0000000140034870
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140035270	1_2_0000000140035270
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140048AC0	1_2_0000000140048AC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014005C340	1_2_000000014005C340
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140065B80	1_2_0000000140065B80
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006A4B0	1_2_000000014006A4B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400524B0	1_2_00000001400524B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140026CC0	1_2_0000000140026CC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014004BD40	1_2_000000014004BD40
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400495B0	1_2_00000001400495B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140036F30	1_2_0000000140036F30
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140069010	1_2_0000000140069010
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140001010	1_2_0000000140001010
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140066020	1_2_0000000140066020
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002F840	1_2_000000014002F840
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014005D850	1_2_000000014005D850
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140064080	1_2_0000000140064080
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140010880	1_2_0000000140010880
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400688A0	1_2_00000001400688A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002D0D0	1_2_000000014002D0D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400018D0	1_2_00000001400018D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140016100	1_2_0000000140016100
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014001D100	1_2_000000014001D100
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002A110	1_2_000000014002A110
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014001D910	1_2_000000014001D910
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140015120	1_2_0000000140015120
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014000B120	1_2_000000014000B120
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014004F940	1_2_000000014004F940
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140039140	1_2_0000000140039140
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140023140	1_2_0000000140023140
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140057950	1_2_0000000140057950
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014001E170	1_2_000000014001E170
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140002980	1_2_0000000140002980
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400611A0	1_2_00000001400611A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400389A0	1_2_00000001400389A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400381A0	1_2_00000001400381A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002E1B0	1_2_000000014002E1B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400139D0	1_2_00000001400139D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400319F0	1_2_00000001400319F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002EA00	1_2_000000014002EA00
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140022A00	1_2_0000000140022A00
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014003B220	1_2_000000014003B220
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140067A40	1_2_0000000140067A40
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140069A50	1_2_0000000140069A50
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140007A60	1_2_0000000140007A60
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014003AAC0	1_2_000000014003AAC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014003A2E0	1_2_000000014003A2E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140062B00	1_2_0000000140062B00
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140018300	1_2_0000000140018300
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002FB20	1_2_000000014002FB20
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140031340	1_2_0000000140031340
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140022340	1_2_0000000140022340
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140017B40	1_2_0000000140017B40
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014000BB40	1_2_000000014000BB40
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014004EB60	1_2_000000014004EB60
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140005370	1_2_0000000140005370
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002CB80	1_2_000000014002CB80
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B390	1_2_000000014006B390
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140054BA0	1_2_0000000140054BA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140033BB0	1_2_0000000140033BB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400263C0	1_2_00000001400263C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400123C0	1_2_00000001400123C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140063BD0	1_2_0000000140063BD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400663F0	1_2_00000001400663F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140023BF0	1_2_0000000140023BF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B41B	1_2_000000014006B41B
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B424	1_2_000000014006B424
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B42D	1_2_000000014006B42D
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B436	1_2_000000014006B436
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B43D	1_2_000000014006B43D
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140024440	1_2_0000000140024440
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140005C40	1_2_0000000140005C40
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B446	1_2_000000014006B446
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014005F490	1_2_000000014005F490
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140022D00	1_2_0000000140022D00
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140035520	1_2_0000000140035520
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140019D20	1_2_0000000140019D20
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140030530	1_2_0000000140030530
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140023530	1_2_0000000140023530
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140031540	1_2_0000000140031540
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140033540	1_2_0000000140033540
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014007BD50	1_2_000000014007BD50
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140078570	1_2_0000000140078570
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140019580	1_2_0000000140019580
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400205A0	1_2_00000001400205A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140025DB0	1_2_0000000140025DB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140071DC0	1_2_0000000140071DC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014000C5C0	1_2_000000014000C5C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002DDE0	1_2_000000014002DDE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140031DF0	1_2_0000000140031DF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014000DDF0	1_2_000000014000DDF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140001620	1_2_0000000140001620
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140018630	1_2_0000000140018630
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140032650	1_2_0000000140032650
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140064E80	1_2_0000000140064E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140016E80	1_2_0000000140016E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140007EA0	1_2_0000000140007EA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400286B0	1_2_00000001400286B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140006EB0	1_2_0000000140006EB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400276C0	1_2_00000001400276C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002FEC0	1_2_000000014002FEC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002EED0	1_2_000000014002EED0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002B6E0	1_2_000000014002B6E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140053F20	1_2_0000000140053F20
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140022730	1_2_0000000140022730
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140029780	1_2_0000000140029780
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140018F80	1_2_0000000140018F80
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014003EFB0	1_2_000000014003EFB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400067B0	1_2_00000001400067B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400667D0	1_2_00000001400667D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140060FE0	1_2_0000000140060FE0
Source: C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe	Code function: 18_2_00007FF708131A38	18_2_00007FF708131A38
Source: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe	Code function: 20_2_00007FF6774727F8	20_2_00007FF6774727F8
Source: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe	Code function: 20_2_00007FF677471180	20_2_00007FF677471180
Source: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe	Code function: 20_2_00007FF677471BF4	20_2_00007FF677471BF4
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB0C6FC	23_2_00007FF6EDB0C6FC
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB17F18	23_2_00007FF6EDB17F18
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB0A6A4	23_2_00007FF6EDB0A6A4
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDAF5678	23_2_00007FF6EDAF5678
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDAF9678	23_2_00007FF6EDAF9678
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB31E04	23_2_00007FF6EDB31E04
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB0D618	23_2_00007FF6EDB0D618
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB2E5CC	23_2_00007FF6EDB2E5CC
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB15DEC	23_2_00007FF6EDB15DEC
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB1AD3C	23_2_00007FF6EDB1AD3C
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB0C0E4	23_2_00007FF6EDB0C0E4
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB080F8	23_2_00007FF6EDB080F8
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB1C878	23_2_00007FF6EDB1C878
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB12050	23_2_00007FF6EDB12050
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB297D8	23_2_00007FF6EDB297D8
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB137E0	23_2_00007FF6EDB137E0
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB17784	23_2_00007FF6EDB17784
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB06AF0	23_2_00007FF6EDB06AF0
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDAFBAEC	23_2_00007FF6EDAFBAEC
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB02300	23_2_00007FF6EDB02300
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB352B0	23_2_00007FF6EDB352B0
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB0CA38	23_2_00007FF6EDB0CA38
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB1BA58	23_2_00007FF6EDB1BA58
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB1D25C	23_2_00007FF6EDB1D25C
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDAF99D8	23_2_00007FF6EDAF99D8
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB219B8	23_2_00007FF6EDB219B8
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB06150	23_2_00007FF6EDB06150
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB1B1A4	23_2_00007FF6EDB1B1A4
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDAF69B0	23_2_00007FF6EDAF69B0
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDAF7D18	23_2_00007FF6EDAF7D18
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB0F4DC	23_2_00007FF6EDB0F4DC
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB1CCE8	23_2_00007FF6EDB1CCE8
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB2D440	23_2_00007FF6EDB2D440
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB13440	23_2_00007FF6EDB13440
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB1FBEC	23_2_00007FF6EDB1FBEC
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDAF6360	23_2_00007FF6EDAF6360
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDAFFB90	23_2_00007FF6EDAFFB90
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB12360	23_2_00007FF6EDB12360
Source: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe	Code function: 26_2_00007FF7A2AF3364	26_2_00007FF7A2AF3364
Source: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe	Code function: 26_2_00007FF7A2AF6640	26_2_00007FF7A2AF6640
Source: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe	Code function: 26_2_00007FF7A2AF2264	26_2_00007FF7A2AF2264
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C039530	29_2_00007FF70C039530
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C01913C	29_2_00007FF70C01913C
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C024158	29_2_00007FF70C024158
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C034960	29_2_00007FF70C034960
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C0245BC	29_2_00007FF70C0245BC
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C03B260	29_2_00007FF70C03B260
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C029A7C	29_2_00007FF70C029A7C
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C03D6B0	29_2_00007FF70C03D6B0
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C0292C0	29_2_00007FF70C0292C0
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C015B08	29_2_00007FF70C015B08
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C039F38	29_2_00007FF70C039F38
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C02CF68	29_2_00007FF70C02CF68
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C028408	29_2_00007FF70C028408
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C037400	29_2_00007FF70C037400
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C030800	29_2_00007FF70C030800
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C021018	29_2_00007FF70C021018
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C01B868	29_2_00007FF70C01B868
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C01F0B4	29_2_00007FF70C01F0B4
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C02ECB8	29_2_00007FF70C02ECB8
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C03A8E0	29_2_00007FF70C03A8E0
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DC3B24	31_2_00007FF631DC3B24
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DCAF20	31_2_00007FF631DCAF20
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DC86E8	31_2_00007FF631DC86E8
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DB8AC0	31_2_00007FF631DB8AC0
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DB32C4	31_2_00007FF631DB32C4
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DD02D0	31_2_00007FF631DD02D0
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DCE678	31_2_00007FF631DCE678
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DD2DD8	31_2_00007FF631DD2DD8
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DBD9A0	31_2_00007FF631DBD9A0
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DCCDA8	31_2_00007FF631DCCDA8
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DC9144	31_2_00007FF631DC9144
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DD310C	31_2_00007FF631DD310C
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DBE0C0	31_2_00007FF631DBE0C0
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DC3CA0	31_2_00007FF631DC3CA0
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DC8C98	31_2_00007FF631DC8C98
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DC6840	31_2_00007FF631DC6840
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DC4420	31_2_00007FF631DC4420
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DC8428	31_2_00007FF631DC8428
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DD2004	31_2_00007FF631DD2004
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DC4BD8	31_2_00007FF631DC4BD8
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DC3FC4	31_2_00007FF631DC3FC4
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DB73C8	31_2_00007FF631DB73C8
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DC5388	31_2_00007FF631DC5388
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DB4B8C	31_2_00007FF631DB4B8C
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DB9770	31_2_00007FF631DB9770
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DB7F44	31_2_00007FF631DB7F44
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D84420	33_2_00007FF6A2D84420
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D88428	33_2_00007FF6A2D88428
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D92004	33_2_00007FF6A2D92004
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D84BD8	33_2_00007FF6A2D84BD8
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D83FC4	33_2_00007FF6A2D83FC4
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D773C8	33_2_00007FF6A2D773C8
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D74B8C	33_2_00007FF6A2D74B8C
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D85388	33_2_00007FF6A2D85388
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D79770	33_2_00007FF6A2D79770
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D77F44	33_2_00007FF6A2D77F44
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D9310C	33_2_00007FF6A2D9310C
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D7E0C0	33_2_00007FF6A2D7E0C0
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D88C98	33_2_00007FF6A2D88C98
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D83CA0	33_2_00007FF6A2D83CA0
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D86840	33_2_00007FF6A2D86840
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D92DD8	33_2_00007FF6A2D92DD8
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D7D9A0	33_2_00007FF6A2D7D9A0
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D8CDA8	33_2_00007FF6A2D8CDA8
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D89144	33_2_00007FF6A2D89144
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D8AF20	33_2_00007FF6A2D8AF20
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D83B24	33_2_00007FF6A2D83B24
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D886E8	33_2_00007FF6A2D886E8
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D732C4	33_2_00007FF6A2D732C4
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D78AC0	33_2_00007FF6A2D78AC0
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D902D0	33_2_00007FF6A2D902D0
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D8E678	33_2_00007FF6A2D8E678
Source: C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe	Code function: 36_2_00007FF70E3F1B64	36_2_00007FF70E3F1B64
Source: C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe	Code function: 36_2_00007FF70E3F15EC	36_2_00007FF70E3F15EC
Source: C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe	Code function: 36_2_00007FF70E3F2BE8	36_2_00007FF70E3F2BE8
Source: C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe	Code function: 36_2_00007FF70E3F3778	36_2_00007FF70E3F3778
Source: C:\Users\user\AppData\Local\YaR\DevicePairingWizard.exe	Code function: 38_2_00007FF6212331D0	38_2_00007FF6212331D0
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Code function: 40_2_00007FF7B1F3441C	40_2_00007FF7B1F3441C
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Code function: 40_2_00007FF7B1F43034	40_2_00007FF7B1F43034
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Code function: 40_2_00007FF7B1F4354C	40_2_00007FF7B1F4354C
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Code function: 40_2_00007FF7B1F44374	40_2_00007FF7B1F44374
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Code function: 40_2_00007FF7B1F33278	40_2_00007FF7B1F33278
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Code function: 40_2_00007FF7B1F32D90	40_2_00007FF7B1F32D90
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Code function: 40_2_00007FF7B1F3649C	40_2_00007FF7B1F3649C
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Code function: 40_2_00007FF7B1F356A4	40_2_00007FF7B1F356A4
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Code function: 40_2_00007FF7B1F439C8	40_2_00007FF7B1F439C8
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Code function: 40_2_00007FF7B1F43CDC	40_2_00007FF7B1F43CDC
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Code function: 40_2_00007FF7B1F336DC	40_2_00007FF7B1F336DC

Source: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe	Code function: String function: 00007FF7A2AF1400 appears 70 times
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: String function: 00007FF6EDB3410C appears 37 times
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: String function: 00007FF6EDAF4474 appears 37 times
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: String function: 00007FF6EDAF419C appears 54 times
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: String function: 00007FF6EDAFCF60 appears 903 times

Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140046C90 NtClose,	1_2_0000000140046C90
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006A4B0 NtQuerySystemInformation,	1_2_000000014006A4B0
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB25580 NtOpenThreadToken,NtOpenProcessToken,NtQueryInformationToken,NtClose,	23_2_00007FF6EDB25580
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB254EC NtQueryInformationToken,NtQueryInformationToken,	23_2_00007FF6EDB254EC
Source: C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe	Code function: 36_2_00007FF70E3F2F58 memset,GetCurrentProcessId,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,CloseHandle,	36_2_00007FF70E3F2F58
Source: C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe	Code function: 36_2_00007FF70E3F2E0C NtQuerySystemInformation,NtQuerySystemInformation,LocalFree,LocalAlloc,GetLastError,LocalFree,RtlNtStatusToDosError,RtlCompareUnicodeString,	36_2_00007FF70E3F2E0C

Source: RdpSaUacHelper.exe.7.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msdt.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bdechangepin.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bdechangepin.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bdechangepin.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: psr.exe0.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wlrmdr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wlrmdr.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DevicePairingWizard.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationSettings.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationSettings.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationSettings.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationSettings.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationSettings.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationSettings.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationSettings.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationSettings.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: EaseOfAccessDialog.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: EaseOfAccessDialog.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: EaseOfAccessDialog.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: perfmon.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: perfmon.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: perfmon.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: DUI70.dll.7.dr	Static PE information: Number of sections : 40 > 10
Source: DUI70.dll1.7.dr	Static PE information: Number of sections : 40 > 10
Source: WINMM.dll.7.dr	Static PE information: Number of sections : 40 > 10
Source: WINSTA.dll.7.dr	Static PE information: Number of sections : 40 > 10
Source: credui.dll.7.dr	Static PE information: Number of sections : 40 > 10
Source: VERSION.dll0.7.dr	Static PE information: Number of sections : 40 > 10
Source: TAPI32.dll.7.dr	Static PE information: Number of sections : 40 > 10
Source: UxTheme.dll.7.dr	Static PE information: Number of sections : 40 > 10
Source: MFC42u.dll.7.dr	Static PE information: Number of sections : 40 > 10
Source: PSnPApRPsG.dll	Static PE information: Number of sections : 39 > 10
Source: DUI70.dll0.7.dr	Static PE information: Number of sections : 40 > 10
Source: VERSION.dll.7.dr	Static PE information: Number of sections : 40 > 10
Source: XmlLite.dll.7.dr	Static PE information: Number of sections : 40 > 10
Source: DUser.dll.7.dr	Static PE information: Number of sections : 40 > 10

Source: PSnPApRPsG.dll	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: TAPI32.dll.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WINSTA.dll.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: UxTheme.dll.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DUI70.dll.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DUI70.dll0.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: XmlLite.dll.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: VERSION.dll.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DUI70.dll1.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: MFC42u.dll.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WINMM.dll.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DUser.dll.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: credui.dll.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: VERSION.dll0.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: PSnPApRPsG.dll

ReversingLabs: Detection: 80%

Source: PSnPApRPsG.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe 'C:\Users\user\Desktop\PSnPApRPsG.dll'
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\PSnPApRPsG.dll',#1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\PSnPApRPsG.dll',#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\PSnPApRPsG.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\PSnPApRPsG.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\PSnPApRPsG.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\tcmsetup.exe C:\Windows\system32\tcmsetup.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\RdpSaUacHelper.exe C:\Windows\system32\RdpSaUacHelper.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\msdt.exe C:\Windows\system32\msdt.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\bdechangepin.exe C:\Windows\system32\bdechangepin.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\ProximityUxHost.exe C:\Windows\system32\ProximityUxHost.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\psr.exe C:\Windows\system32\psr.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Tp5KLY\psr.exe C:\Users\user\AppData\Local\Tp5KLY\psr.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\psr.exe C:\Windows\system32\psr.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wlrmdr.exe C:\Windows\system32\wlrmdr.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\DevicePairingWizard.exe C:\Windows\system32\DevicePairingWizard.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\YaR\DevicePairingWizard.exe C:\Users\user\AppData\Local\YaR\DevicePairingWizard.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\PresentationSettings.exe C:\Windows\system32\PresentationSettings.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\PSnPApRPsG.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\PSnPApRPsG.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\PSnPApRPsG.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\PSnPApRPsG.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\PSnPApRPsG.dll',#1	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\tcmsetup.exe C:\Windows\system32\tcmsetup.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\RdpSaUacHelper.exe C:\Windows\system32\RdpSaUacHelper.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\msdt.exe C:\Windows\system32\msdt.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\bdechangepin.exe C:\Windows\system32\bdechangepin.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\ProximityUxHost.exe C:\Windows\system32\ProximityUxHost.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\psr.exe C:\Windows\system32\psr.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Tp5KLY\psr.exe C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\psr.exe C:\Windows\system32\psr.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wlrmdr.exe C:\Windows\system32\wlrmdr.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\DevicePairingWizard.exe C:\Windows\system32\DevicePairingWizard.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\YaR\DevicePairingWizard.exe C:\Users\user\AppData\Local\YaR\DevicePairingWizard.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\PresentationSettings.exe C:\Windows\system32\PresentationSettings.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe

Code function: 20_2_00007FF677471BF4 memset,GetCurrentProcessId,ProcessIdToSessionId,GetLastError,OpenProcess,GetLastError,RegDeleteKeyValueW,CoSetProxyBlanket,CreateFileMappingW,GetLastError,MapViewOfFile,GetLastError,SysAllocStringByteLen,SysFreeString,CreateEventW,DuplicateHandle,UnmapViewOfFile,DuplicateHandle,RegSetKeyValueW,WaitForMultipleObjects,GetLastError,RegDeleteKeyValueW,OpenProcessToken,GetLastError,AdjustTokenPrivileges,GetLastError,CloseHandle,WaitForSingleObject,GetLastError,SysFreeString,GetLastError,GetLastError,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,

20_2_00007FF677471BF4

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@57/27@0/0

Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe

Code function: 23_2_00007FF6EDB28F0C SysAllocString,SetDllDirectoryW,GetLastError,SetDllDirectoryW,GetLastError,CoCreateInstance,SysFreeString,SysFreeString,

23_2_00007FF6EDB28F0C

Source: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe

Code function: 26_2_00007FF7A2AF3364 InitializeCriticalSection,GetCommandLineW,CommandLineToArgvW,GetLastError,iswalpha,towupper,EnterCriticalSection,FormatMessageW,GetModuleHandleW,#344,LeaveCriticalSection,LeaveCriticalSection,CoInitialize,InitProcessPriv,InitThread,FormatMessageW,GetLastError,CreateMutexW,GetLastError,CloseHandle,FindWindowW,SetForegroundWindow,LocalFree,LocalFree,UnInitThread,UnInitProcessPriv,CoUninitialize,CloseHandle,DeleteCriticalSection,GetSystemMetrics,GetSystemMetrics,GetModuleHandleW,LoadImageW,?Create@NativeHWNDHost@DirectUI@@SAJPEBGPEAUHWND__@@PEAUHICON__@@HHHHHHIPEAPEAV12@@Z,EnterCriticalSection,LeaveCriticalSection,?EndDefer@Element@DirectUI@@QEAAXK@Z,?SetVisible@Element@DirectUI@@QEAAJ_N@Z,?EndDefer@Element@DirectUI@@QEAAXK@Z,?Host@NativeHWNDHost@DirectUI@@QEAAXPEAVElement@2@@Z,?ShowWindow@NativeHWNDHost@DirectUI@@QEAAXH@Z,StartMessagePump,

26_2_00007FF7A2AF3364

Source: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe

Code function: 20_2_00007FF6774732D4 OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,StartServiceW,GetLastError,QueryServiceStatus,Sleep,GetLastError,CloseServiceHandle,CloseServiceHandle,

20_2_00007FF6774732D4

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\PSnPApRPsG.dll',#1

Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Mutant created: \Sessions\1\BaseNamedObjects\{ddb7b3dd-cda9-ef67-3c9a-2a105a068b1d}
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Mutant created: \Sessions\1\BaseNamedObjects\{aa9aa00c-1782-a05e-a9f4-d03ba02d4f4c}

Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe

Code function: 23_2_00007FF6EDB256C4 FindResourceW,GetLastError,LoadResource,GetLastError,LockResource,SizeofResource,GetLastError,GlobalAlloc,GetLastError,GlobalLock,GetLastError,memcpy,CreateStreamOnHGlobal,FreeResource,GlobalUnlock,GlobalFree,

23_2_00007FF6EDB256C4

Source: PresentationSettings.exe	String found in binary or memory: /stop
Source: PresentationSettings.exe	String found in binary or memory: /stop

Source: PSnPApRPsG.dll

Static PE information: More than 4320 > 100 exports found

Source: PSnPApRPsG.dll

Static PE information: Image base 0x140000000 > 0x60000000

Source: PSnPApRPsG.dll

Static file information: File size 1519616 > 1048576

Source: PSnPApRPsG.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: RdpSaUacHelper.pdbGCTL source: RdpSaUacHelper.exe, 00000014.00000000.796651470.00007FF677475000.00000002.00020000.sdmp
Source:	Binary string: ProximityUxHost.pdbGCTL source: ProximityUxHost.exe, 0000001D.00000002.933995077.00007FF70C042000.00000002.00020000.sdmp
Source:	Binary string: tcmsetup.pdbGCTL source: tcmsetup.exe, 00000012.00000000.769914241.00007FF708133000.00000002.00020000.sdmp
Source:	Binary string: psr.pdbGCTL source: psr.exe, 0000001F.00000000.933928652.00007FF631DDC000.00000002.00020000.sdmp, psr.exe, 00000021.00000002.984523696.00007FF6A2D9C000.00000002.00020000.sdmp
Source:	Binary string: bdechangepin.pdb source: bdechangepin.exe, 0000001A.00000000.863440344.00007FF7A2AF9000.00000002.00020000.sdmp
Source:	Binary string: msdt.pdbGCTL source: msdt.exe, 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp
Source:	Binary string: bdechangepin.pdbGCTL source: bdechangepin.exe, 0000001A.00000000.863440344.00007FF7A2AF9000.00000002.00020000.sdmp
Source:	Binary string: PresentationSettings.pdb source: PresentationSettings.exe, 00000028.00000002.1084790071.00007FF7B1F46000.00000002.00020000.sdmp
Source:	Binary string: wlrmdr.pdbGCTL source: wlrmdr.exe, 00000024.00000002.1020091961.00007FF70E3F6000.00000002.00020000.sdmp
Source:	Binary string: wlrmdr.pdb source: wlrmdr.exe, 00000024.00000002.1020091961.00007FF70E3F6000.00000002.00020000.sdmp
Source:	Binary string: DevicePairingWizard.pdb source: DevicePairingWizard.exe, 00000026.00000002.1057768214.00007FF621237000.00000002.00020000.sdmp
Source:	Binary string: RdpSaUacHelper.pdb source: RdpSaUacHelper.exe, 00000014.00000000.796651470.00007FF677475000.00000002.00020000.sdmp
Source:	Binary string: tcmsetup.pdb source: tcmsetup.exe, 00000012.00000000.769914241.00007FF708133000.00000002.00020000.sdmp
Source:	Binary string: psr.pdb source: psr.exe, 0000001F.00000000.933928652.00007FF631DDC000.00000002.00020000.sdmp, psr.exe, 00000021.00000002.984523696.00007FF6A2D9C000.00000002.00020000.sdmp
Source:	Binary string: msdt.pdb source: msdt.exe, 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp
Source:	Binary string: PresentationSettings.pdbGCTL source: PresentationSettings.exe, 00000028.00000002.1084790071.00007FF7B1F46000.00000002.00020000.sdmp
Source:	Binary string: ProximityUxHost.pdb source: ProximityUxHost.exe, 0000001D.00000002.933995077.00007FF70C042000.00000002.00020000.sdmp
Source:	Binary string: DevicePairingWizard.pdbGCTL source: DevicePairingWizard.exe, 00000026.00000002.1057768214.00007FF621237000.00000002.00020000.sdmp

Source: C:\Windows\System32\loaddll64.exe

Code function: 1_2_0000000140056A4D push rdi; ret

1_2_0000000140056A4E

Source: PSnPApRPsG.dll	Static PE information: section name: .qkm
Source: PSnPApRPsG.dll	Static PE information: section name: .cvjb
Source: PSnPApRPsG.dll	Static PE information: section name: .tlmkv
Source: PSnPApRPsG.dll	Static PE information: section name: .wucsxe
Source: PSnPApRPsG.dll	Static PE information: section name: .wnx
Source: PSnPApRPsG.dll	Static PE information: section name: .weqy
Source: PSnPApRPsG.dll	Static PE information: section name: .yby
Source: PSnPApRPsG.dll	Static PE information: section name: .ormx
Source: PSnPApRPsG.dll	Static PE information: section name: .dhclu
Source: PSnPApRPsG.dll	Static PE information: section name: .xmiul
Source: PSnPApRPsG.dll	Static PE information: section name: .tlwcxe
Source: PSnPApRPsG.dll	Static PE information: section name: .get
Source: PSnPApRPsG.dll	Static PE information: section name: .hzrd
Source: PSnPApRPsG.dll	Static PE information: section name: .qzu
Source: PSnPApRPsG.dll	Static PE information: section name: .nhglos
Source: PSnPApRPsG.dll	Static PE information: section name: .itzo
Source: PSnPApRPsG.dll	Static PE information: section name: .nmsaom
Source: PSnPApRPsG.dll	Static PE information: section name: .rvhi
Source: PSnPApRPsG.dll	Static PE information: section name: .ucrzce
Source: PSnPApRPsG.dll	Static PE information: section name: .ijc
Source: PSnPApRPsG.dll	Static PE information: section name: .ohvs
Source: PSnPApRPsG.dll	Static PE information: section name: .rlvrc
Source: PSnPApRPsG.dll	Static PE information: section name: .yjv
Source: PSnPApRPsG.dll	Static PE information: section name: .clbcyy
Source: PSnPApRPsG.dll	Static PE information: section name: .xcyn
Source: PSnPApRPsG.dll	Static PE information: section name: .boqx
Source: PSnPApRPsG.dll	Static PE information: section name: .rnlia
Source: PSnPApRPsG.dll	Static PE information: section name: .ctip
Source: PSnPApRPsG.dll	Static PE information: section name: .fkv
Source: PSnPApRPsG.dll	Static PE information: section name: .pczrv
Source: PSnPApRPsG.dll	Static PE information: section name: .ibglr
Source: PSnPApRPsG.dll	Static PE information: section name: .uirkq
Source: PSnPApRPsG.dll	Static PE information: section name: .nzhxgg
Source: ProximityUxHost.exe.7.dr	Static PE information: section name: .imrsiv
Source: psr.exe.7.dr	Static PE information: section name: .didat
Source: psr.exe0.7.dr	Static PE information: section name: .didat
Source: wlrmdr.exe.7.dr	Static PE information: section name: .imrsiv
Source: ie4uinit.exe.7.dr	Static PE information: section name: .didat
Source: TAPI32.dll.7.dr	Static PE information: section name: .qkm
Source: TAPI32.dll.7.dr	Static PE information: section name: .cvjb
Source: TAPI32.dll.7.dr	Static PE information: section name: .tlmkv
Source: TAPI32.dll.7.dr	Static PE information: section name: .wucsxe
Source: TAPI32.dll.7.dr	Static PE information: section name: .wnx
Source: TAPI32.dll.7.dr	Static PE information: section name: .weqy
Source: TAPI32.dll.7.dr	Static PE information: section name: .yby
Source: TAPI32.dll.7.dr	Static PE information: section name: .ormx
Source: TAPI32.dll.7.dr	Static PE information: section name: .dhclu
Source: TAPI32.dll.7.dr	Static PE information: section name: .xmiul
Source: TAPI32.dll.7.dr	Static PE information: section name: .tlwcxe
Source: TAPI32.dll.7.dr	Static PE information: section name: .get
Source: TAPI32.dll.7.dr	Static PE information: section name: .hzrd
Source: TAPI32.dll.7.dr	Static PE information: section name: .qzu
Source: TAPI32.dll.7.dr	Static PE information: section name: .nhglos
Source: TAPI32.dll.7.dr	Static PE information: section name: .itzo
Source: TAPI32.dll.7.dr	Static PE information: section name: .nmsaom
Source: TAPI32.dll.7.dr	Static PE information: section name: .rvhi
Source: TAPI32.dll.7.dr	Static PE information: section name: .ucrzce
Source: TAPI32.dll.7.dr	Static PE information: section name: .ijc
Source: TAPI32.dll.7.dr	Static PE information: section name: .ohvs
Source: TAPI32.dll.7.dr	Static PE information: section name: .rlvrc
Source: TAPI32.dll.7.dr	Static PE information: section name: .yjv
Source: TAPI32.dll.7.dr	Static PE information: section name: .clbcyy
Source: TAPI32.dll.7.dr	Static PE information: section name: .xcyn
Source: TAPI32.dll.7.dr	Static PE information: section name: .boqx
Source: TAPI32.dll.7.dr	Static PE information: section name: .rnlia
Source: TAPI32.dll.7.dr	Static PE information: section name: .ctip
Source: TAPI32.dll.7.dr	Static PE information: section name: .fkv
Source: TAPI32.dll.7.dr	Static PE information: section name: .pczrv
Source: TAPI32.dll.7.dr	Static PE information: section name: .ibglr
Source: TAPI32.dll.7.dr	Static PE information: section name: .uirkq
Source: TAPI32.dll.7.dr	Static PE information: section name: .nzhxgg
Source: TAPI32.dll.7.dr	Static PE information: section name: .ehmk
Source: WINSTA.dll.7.dr	Static PE information: section name: .qkm
Source: WINSTA.dll.7.dr	Static PE information: section name: .cvjb
Source: WINSTA.dll.7.dr	Static PE information: section name: .tlmkv
Source: WINSTA.dll.7.dr	Static PE information: section name: .wucsxe
Source: WINSTA.dll.7.dr	Static PE information: section name: .wnx
Source: WINSTA.dll.7.dr	Static PE information: section name: .weqy
Source: WINSTA.dll.7.dr	Static PE information: section name: .yby
Source: WINSTA.dll.7.dr	Static PE information: section name: .ormx
Source: WINSTA.dll.7.dr	Static PE information: section name: .dhclu
Source: WINSTA.dll.7.dr	Static PE information: section name: .xmiul
Source: WINSTA.dll.7.dr	Static PE information: section name: .tlwcxe
Source: WINSTA.dll.7.dr	Static PE information: section name: .get
Source: WINSTA.dll.7.dr	Static PE information: section name: .hzrd
Source: WINSTA.dll.7.dr	Static PE information: section name: .qzu
Source: WINSTA.dll.7.dr	Static PE information: section name: .nhglos
Source: WINSTA.dll.7.dr	Static PE information: section name: .itzo
Source: WINSTA.dll.7.dr	Static PE information: section name: .nmsaom
Source: WINSTA.dll.7.dr	Static PE information: section name: .rvhi
Source: WINSTA.dll.7.dr	Static PE information: section name: .ucrzce
Source: WINSTA.dll.7.dr	Static PE information: section name: .ijc
Source: WINSTA.dll.7.dr	Static PE information: section name: .ohvs
Source: WINSTA.dll.7.dr	Static PE information: section name: .rlvrc
Source: WINSTA.dll.7.dr	Static PE information: section name: .yjv
Source: WINSTA.dll.7.dr	Static PE information: section name: .clbcyy
Source: WINSTA.dll.7.dr	Static PE information: section name: .xcyn
Source: WINSTA.dll.7.dr	Static PE information: section name: .boqx
Source: WINSTA.dll.7.dr	Static PE information: section name: .rnlia
Source: WINSTA.dll.7.dr	Static PE information: section name: .ctip
Source: WINSTA.dll.7.dr	Static PE information: section name: .fkv
Source: WINSTA.dll.7.dr	Static PE information: section name: .pczrv
Source: WINSTA.dll.7.dr	Static PE information: section name: .ibglr
Source: WINSTA.dll.7.dr	Static PE information: section name: .uirkq
Source: WINSTA.dll.7.dr	Static PE information: section name: .nzhxgg
Source: WINSTA.dll.7.dr	Static PE information: section name: .elcx
Source: UxTheme.dll.7.dr	Static PE information: section name: .qkm
Source: UxTheme.dll.7.dr	Static PE information: section name: .cvjb
Source: UxTheme.dll.7.dr	Static PE information: section name: .tlmkv
Source: UxTheme.dll.7.dr	Static PE information: section name: .wucsxe
Source: UxTheme.dll.7.dr	Static PE information: section name: .wnx
Source: UxTheme.dll.7.dr	Static PE information: section name: .weqy
Source: UxTheme.dll.7.dr	Static PE information: section name: .yby
Source: UxTheme.dll.7.dr	Static PE information: section name: .ormx
Source: UxTheme.dll.7.dr	Static PE information: section name: .dhclu
Source: UxTheme.dll.7.dr	Static PE information: section name: .xmiul
Source: UxTheme.dll.7.dr	Static PE information: section name: .tlwcxe
Source: UxTheme.dll.7.dr	Static PE information: section name: .get
Source: UxTheme.dll.7.dr	Static PE information: section name: .hzrd
Source: UxTheme.dll.7.dr	Static PE information: section name: .qzu
Source: UxTheme.dll.7.dr	Static PE information: section name: .nhglos
Source: UxTheme.dll.7.dr	Static PE information: section name: .itzo
Source: UxTheme.dll.7.dr	Static PE information: section name: .nmsaom
Source: UxTheme.dll.7.dr	Static PE information: section name: .rvhi
Source: UxTheme.dll.7.dr	Static PE information: section name: .ucrzce
Source: UxTheme.dll.7.dr	Static PE information: section name: .ijc
Source: UxTheme.dll.7.dr	Static PE information: section name: .ohvs
Source: UxTheme.dll.7.dr	Static PE information: section name: .rlvrc
Source: UxTheme.dll.7.dr	Static PE information: section name: .yjv
Source: UxTheme.dll.7.dr	Static PE information: section name: .clbcyy
Source: UxTheme.dll.7.dr	Static PE information: section name: .xcyn
Source: UxTheme.dll.7.dr	Static PE information: section name: .boqx
Source: UxTheme.dll.7.dr	Static PE information: section name: .rnlia
Source: UxTheme.dll.7.dr	Static PE information: section name: .ctip
Source: UxTheme.dll.7.dr	Static PE information: section name: .fkv
Source: UxTheme.dll.7.dr	Static PE information: section name: .pczrv
Source: UxTheme.dll.7.dr	Static PE information: section name: .ibglr
Source: UxTheme.dll.7.dr	Static PE information: section name: .uirkq
Source: UxTheme.dll.7.dr	Static PE information: section name: .nzhxgg
Source: UxTheme.dll.7.dr	Static PE information: section name: .rjcvy
Source: DUI70.dll.7.dr	Static PE information: section name: .qkm
Source: DUI70.dll.7.dr	Static PE information: section name: .cvjb
Source: DUI70.dll.7.dr	Static PE information: section name: .tlmkv
Source: DUI70.dll.7.dr	Static PE information: section name: .wucsxe
Source: DUI70.dll.7.dr	Static PE information: section name: .wnx
Source: DUI70.dll.7.dr	Static PE information: section name: .weqy
Source: DUI70.dll.7.dr	Static PE information: section name: .yby
Source: DUI70.dll.7.dr	Static PE information: section name: .ormx
Source: DUI70.dll.7.dr	Static PE information: section name: .dhclu
Source: DUI70.dll.7.dr	Static PE information: section name: .xmiul
Source: DUI70.dll.7.dr	Static PE information: section name: .tlwcxe
Source: DUI70.dll.7.dr	Static PE information: section name: .get
Source: DUI70.dll.7.dr	Static PE information: section name: .hzrd
Source: DUI70.dll.7.dr	Static PE information: section name: .qzu
Source: DUI70.dll.7.dr	Static PE information: section name: .nhglos
Source: DUI70.dll.7.dr	Static PE information: section name: .itzo
Source: DUI70.dll.7.dr	Static PE information: section name: .nmsaom
Source: DUI70.dll.7.dr	Static PE information: section name: .rvhi
Source: DUI70.dll.7.dr	Static PE information: section name: .ucrzce
Source: DUI70.dll.7.dr	Static PE information: section name: .ijc
Source: DUI70.dll.7.dr	Static PE information: section name: .ohvs
Source: DUI70.dll.7.dr	Static PE information: section name: .rlvrc
Source: DUI70.dll.7.dr	Static PE information: section name: .yjv
Source: DUI70.dll.7.dr	Static PE information: section name: .clbcyy
Source: DUI70.dll.7.dr	Static PE information: section name: .xcyn
Source: DUI70.dll.7.dr	Static PE information: section name: .boqx
Source: DUI70.dll.7.dr	Static PE information: section name: .rnlia
Source: DUI70.dll.7.dr	Static PE information: section name: .ctip
Source: DUI70.dll.7.dr	Static PE information: section name: .fkv
Source: DUI70.dll.7.dr	Static PE information: section name: .pczrv
Source: DUI70.dll.7.dr	Static PE information: section name: .ibglr
Source: DUI70.dll.7.dr	Static PE information: section name: .uirkq
Source: DUI70.dll.7.dr	Static PE information: section name: .nzhxgg
Source: DUI70.dll.7.dr	Static PE information: section name: .eerfji
Source: DUI70.dll0.7.dr	Static PE information: section name: .qkm
Source: DUI70.dll0.7.dr	Static PE information: section name: .cvjb
Source: DUI70.dll0.7.dr	Static PE information: section name: .tlmkv
Source: DUI70.dll0.7.dr	Static PE information: section name: .wucsxe
Source: DUI70.dll0.7.dr	Static PE information: section name: .wnx
Source: DUI70.dll0.7.dr	Static PE information: section name: .weqy
Source: DUI70.dll0.7.dr	Static PE information: section name: .yby
Source: DUI70.dll0.7.dr	Static PE information: section name: .ormx
Source: DUI70.dll0.7.dr	Static PE information: section name: .dhclu
Source: DUI70.dll0.7.dr	Static PE information: section name: .xmiul
Source: DUI70.dll0.7.dr	Static PE information: section name: .tlwcxe
Source: DUI70.dll0.7.dr	Static PE information: section name: .get
Source: DUI70.dll0.7.dr	Static PE information: section name: .hzrd
Source: DUI70.dll0.7.dr	Static PE information: section name: .qzu
Source: DUI70.dll0.7.dr	Static PE information: section name: .nhglos
Source: DUI70.dll0.7.dr	Static PE information: section name: .itzo
Source: DUI70.dll0.7.dr	Static PE information: section name: .nmsaom
Source: DUI70.dll0.7.dr	Static PE information: section name: .rvhi
Source: DUI70.dll0.7.dr	Static PE information: section name: .ucrzce
Source: DUI70.dll0.7.dr	Static PE information: section name: .ijc
Source: DUI70.dll0.7.dr	Static PE information: section name: .ohvs
Source: DUI70.dll0.7.dr	Static PE information: section name: .rlvrc
Source: DUI70.dll0.7.dr	Static PE information: section name: .yjv
Source: DUI70.dll0.7.dr	Static PE information: section name: .clbcyy
Source: DUI70.dll0.7.dr	Static PE information: section name: .xcyn
Source: DUI70.dll0.7.dr	Static PE information: section name: .boqx
Source: DUI70.dll0.7.dr	Static PE information: section name: .rnlia
Source: DUI70.dll0.7.dr	Static PE information: section name: .ctip
Source: DUI70.dll0.7.dr	Static PE information: section name: .fkv
Source: DUI70.dll0.7.dr	Static PE information: section name: .pczrv
Source: DUI70.dll0.7.dr	Static PE information: section name: .ibglr
Source: DUI70.dll0.7.dr	Static PE information: section name: .uirkq
Source: DUI70.dll0.7.dr	Static PE information: section name: .nzhxgg
Source: DUI70.dll0.7.dr	Static PE information: section name: .jpg
Source: XmlLite.dll.7.dr	Static PE information: section name: .qkm
Source: XmlLite.dll.7.dr	Static PE information: section name: .cvjb
Source: XmlLite.dll.7.dr	Static PE information: section name: .tlmkv
Source: XmlLite.dll.7.dr	Static PE information: section name: .wucsxe
Source: XmlLite.dll.7.dr	Static PE information: section name: .wnx
Source: XmlLite.dll.7.dr	Static PE information: section name: .weqy
Source: XmlLite.dll.7.dr	Static PE information: section name: .yby
Source: XmlLite.dll.7.dr	Static PE information: section name: .ormx
Source: XmlLite.dll.7.dr	Static PE information: section name: .dhclu
Source: XmlLite.dll.7.dr	Static PE information: section name: .xmiul
Source: XmlLite.dll.7.dr	Static PE information: section name: .tlwcxe
Source: XmlLite.dll.7.dr	Static PE information: section name: .get
Source: XmlLite.dll.7.dr	Static PE information: section name: .hzrd
Source: XmlLite.dll.7.dr	Static PE information: section name: .qzu
Source: XmlLite.dll.7.dr	Static PE information: section name: .nhglos
Source: XmlLite.dll.7.dr	Static PE information: section name: .itzo
Source: XmlLite.dll.7.dr	Static PE information: section name: .nmsaom
Source: XmlLite.dll.7.dr	Static PE information: section name: .rvhi
Source: XmlLite.dll.7.dr	Static PE information: section name: .ucrzce
Source: XmlLite.dll.7.dr	Static PE information: section name: .ijc
Source: XmlLite.dll.7.dr	Static PE information: section name: .ohvs
Source: XmlLite.dll.7.dr	Static PE information: section name: .rlvrc
Source: XmlLite.dll.7.dr	Static PE information: section name: .yjv
Source: XmlLite.dll.7.dr	Static PE information: section name: .clbcyy
Source: XmlLite.dll.7.dr	Static PE information: section name: .xcyn
Source: XmlLite.dll.7.dr	Static PE information: section name: .boqx
Source: XmlLite.dll.7.dr	Static PE information: section name: .rnlia
Source: XmlLite.dll.7.dr	Static PE information: section name: .ctip
Source: XmlLite.dll.7.dr	Static PE information: section name: .fkv
Source: XmlLite.dll.7.dr	Static PE information: section name: .pczrv
Source: XmlLite.dll.7.dr	Static PE information: section name: .ibglr
Source: XmlLite.dll.7.dr	Static PE information: section name: .uirkq
Source: XmlLite.dll.7.dr	Static PE information: section name: .nzhxgg
Source: XmlLite.dll.7.dr	Static PE information: section name: .zuvehe
Source: VERSION.dll.7.dr	Static PE information: section name: .qkm
Source: VERSION.dll.7.dr	Static PE information: section name: .cvjb
Source: VERSION.dll.7.dr	Static PE information: section name: .tlmkv
Source: VERSION.dll.7.dr	Static PE information: section name: .wucsxe
Source: VERSION.dll.7.dr	Static PE information: section name: .wnx
Source: VERSION.dll.7.dr	Static PE information: section name: .weqy
Source: VERSION.dll.7.dr	Static PE information: section name: .yby
Source: VERSION.dll.7.dr	Static PE information: section name: .ormx
Source: VERSION.dll.7.dr	Static PE information: section name: .dhclu
Source: VERSION.dll.7.dr	Static PE information: section name: .xmiul
Source: VERSION.dll.7.dr	Static PE information: section name: .tlwcxe
Source: VERSION.dll.7.dr	Static PE information: section name: .get
Source: VERSION.dll.7.dr	Static PE information: section name: .hzrd
Source: VERSION.dll.7.dr	Static PE information: section name: .qzu
Source: VERSION.dll.7.dr	Static PE information: section name: .nhglos
Source: VERSION.dll.7.dr	Static PE information: section name: .itzo
Source: VERSION.dll.7.dr	Static PE information: section name: .nmsaom
Source: VERSION.dll.7.dr	Static PE information: section name: .rvhi
Source: VERSION.dll.7.dr	Static PE information: section name: .ucrzce
Source: VERSION.dll.7.dr	Static PE information: section name: .ijc
Source: VERSION.dll.7.dr	Static PE information: section name: .ohvs
Source: VERSION.dll.7.dr	Static PE information: section name: .rlvrc
Source: VERSION.dll.7.dr	Static PE information: section name: .yjv
Source: VERSION.dll.7.dr	Static PE information: section name: .clbcyy
Source: VERSION.dll.7.dr	Static PE information: section name: .xcyn
Source: VERSION.dll.7.dr	Static PE information: section name: .boqx
Source: VERSION.dll.7.dr	Static PE information: section name: .rnlia
Source: VERSION.dll.7.dr	Static PE information: section name: .ctip
Source: VERSION.dll.7.dr	Static PE information: section name: .fkv
Source: VERSION.dll.7.dr	Static PE information: section name: .pczrv
Source: VERSION.dll.7.dr	Static PE information: section name: .ibglr
Source: VERSION.dll.7.dr	Static PE information: section name: .uirkq
Source: VERSION.dll.7.dr	Static PE information: section name: .nzhxgg
Source: VERSION.dll.7.dr	Static PE information: section name: .aehm
Source: DUI70.dll1.7.dr	Static PE information: section name: .qkm
Source: DUI70.dll1.7.dr	Static PE information: section name: .cvjb
Source: DUI70.dll1.7.dr	Static PE information: section name: .tlmkv
Source: DUI70.dll1.7.dr	Static PE information: section name: .wucsxe
Source: DUI70.dll1.7.dr	Static PE information: section name: .wnx
Source: DUI70.dll1.7.dr	Static PE information: section name: .weqy
Source: DUI70.dll1.7.dr	Static PE information: section name: .yby
Source: DUI70.dll1.7.dr	Static PE information: section name: .ormx
Source: DUI70.dll1.7.dr	Static PE information: section name: .dhclu
Source: DUI70.dll1.7.dr	Static PE information: section name: .xmiul
Source: DUI70.dll1.7.dr	Static PE information: section name: .tlwcxe
Source: DUI70.dll1.7.dr	Static PE information: section name: .get
Source: DUI70.dll1.7.dr	Static PE information: section name: .hzrd
Source: DUI70.dll1.7.dr	Static PE information: section name: .qzu
Source: DUI70.dll1.7.dr	Static PE information: section name: .nhglos
Source: DUI70.dll1.7.dr	Static PE information: section name: .itzo
Source: DUI70.dll1.7.dr	Static PE information: section name: .nmsaom
Source: DUI70.dll1.7.dr	Static PE information: section name: .rvhi
Source: DUI70.dll1.7.dr	Static PE information: section name: .ucrzce
Source: DUI70.dll1.7.dr	Static PE information: section name: .ijc
Source: DUI70.dll1.7.dr	Static PE information: section name: .ohvs
Source: DUI70.dll1.7.dr	Static PE information: section name: .rlvrc
Source: DUI70.dll1.7.dr	Static PE information: section name: .yjv
Source: DUI70.dll1.7.dr	Static PE information: section name: .clbcyy
Source: DUI70.dll1.7.dr	Static PE information: section name: .xcyn
Source: DUI70.dll1.7.dr	Static PE information: section name: .boqx
Source: DUI70.dll1.7.dr	Static PE information: section name: .rnlia
Source: DUI70.dll1.7.dr	Static PE information: section name: .ctip
Source: DUI70.dll1.7.dr	Static PE information: section name: .fkv
Source: DUI70.dll1.7.dr	Static PE information: section name: .pczrv
Source: DUI70.dll1.7.dr	Static PE information: section name: .ibglr
Source: DUI70.dll1.7.dr	Static PE information: section name: .uirkq
Source: DUI70.dll1.7.dr	Static PE information: section name: .nzhxgg
Source: DUI70.dll1.7.dr	Static PE information: section name: .xejymf
Source: MFC42u.dll.7.dr	Static PE information: section name: .qkm
Source: MFC42u.dll.7.dr	Static PE information: section name: .cvjb
Source: MFC42u.dll.7.dr	Static PE information: section name: .tlmkv
Source: MFC42u.dll.7.dr	Static PE information: section name: .wucsxe
Source: MFC42u.dll.7.dr	Static PE information: section name: .wnx
Source: MFC42u.dll.7.dr	Static PE information: section name: .weqy
Source: MFC42u.dll.7.dr	Static PE information: section name: .yby
Source: MFC42u.dll.7.dr	Static PE information: section name: .ormx
Source: MFC42u.dll.7.dr	Static PE information: section name: .dhclu
Source: MFC42u.dll.7.dr	Static PE information: section name: .xmiul
Source: MFC42u.dll.7.dr	Static PE information: section name: .tlwcxe
Source: MFC42u.dll.7.dr	Static PE information: section name: .get
Source: MFC42u.dll.7.dr	Static PE information: section name: .hzrd
Source: MFC42u.dll.7.dr	Static PE information: section name: .qzu
Source: MFC42u.dll.7.dr	Static PE information: section name: .nhglos
Source: MFC42u.dll.7.dr	Static PE information: section name: .itzo
Source: MFC42u.dll.7.dr	Static PE information: section name: .nmsaom
Source: MFC42u.dll.7.dr	Static PE information: section name: .rvhi
Source: MFC42u.dll.7.dr	Static PE information: section name: .ucrzce
Source: MFC42u.dll.7.dr	Static PE information: section name: .ijc
Source: MFC42u.dll.7.dr	Static PE information: section name: .ohvs
Source: MFC42u.dll.7.dr	Static PE information: section name: .rlvrc
Source: MFC42u.dll.7.dr	Static PE information: section name: .yjv
Source: MFC42u.dll.7.dr	Static PE information: section name: .clbcyy
Source: MFC42u.dll.7.dr	Static PE information: section name: .xcyn
Source: MFC42u.dll.7.dr	Static PE information: section name: .boqx
Source: MFC42u.dll.7.dr	Static PE information: section name: .rnlia
Source: MFC42u.dll.7.dr	Static PE information: section name: .ctip
Source: MFC42u.dll.7.dr	Static PE information: section name: .fkv
Source: MFC42u.dll.7.dr	Static PE information: section name: .pczrv
Source: MFC42u.dll.7.dr	Static PE information: section name: .ibglr
Source: MFC42u.dll.7.dr	Static PE information: section name: .uirkq
Source: MFC42u.dll.7.dr	Static PE information: section name: .nzhxgg
Source: MFC42u.dll.7.dr	Static PE information: section name: .hfqwpo
Source: WINMM.dll.7.dr	Static PE information: section name: .qkm
Source: WINMM.dll.7.dr	Static PE information: section name: .cvjb
Source: WINMM.dll.7.dr	Static PE information: section name: .tlmkv
Source: WINMM.dll.7.dr	Static PE information: section name: .wucsxe
Source: WINMM.dll.7.dr	Static PE information: section name: .wnx
Source: WINMM.dll.7.dr	Static PE information: section name: .weqy
Source: WINMM.dll.7.dr	Static PE information: section name: .yby
Source: WINMM.dll.7.dr	Static PE information: section name: .ormx
Source: WINMM.dll.7.dr	Static PE information: section name: .dhclu
Source: WINMM.dll.7.dr	Static PE information: section name: .xmiul
Source: WINMM.dll.7.dr	Static PE information: section name: .tlwcxe
Source: WINMM.dll.7.dr	Static PE information: section name: .get
Source: WINMM.dll.7.dr	Static PE information: section name: .hzrd
Source: WINMM.dll.7.dr	Static PE information: section name: .qzu
Source: WINMM.dll.7.dr	Static PE information: section name: .nhglos
Source: WINMM.dll.7.dr	Static PE information: section name: .itzo
Source: WINMM.dll.7.dr	Static PE information: section name: .nmsaom
Source: WINMM.dll.7.dr	Static PE information: section name: .rvhi
Source: WINMM.dll.7.dr	Static PE information: section name: .ucrzce
Source: WINMM.dll.7.dr	Static PE information: section name: .ijc
Source: WINMM.dll.7.dr	Static PE information: section name: .ohvs
Source: WINMM.dll.7.dr	Static PE information: section name: .rlvrc
Source: WINMM.dll.7.dr	Static PE information: section name: .yjv
Source: WINMM.dll.7.dr	Static PE information: section name: .clbcyy
Source: WINMM.dll.7.dr	Static PE information: section name: .xcyn
Source: WINMM.dll.7.dr	Static PE information: section name: .boqx
Source: WINMM.dll.7.dr	Static PE information: section name: .rnlia
Source: WINMM.dll.7.dr	Static PE information: section name: .ctip
Source: WINMM.dll.7.dr	Static PE information: section name: .fkv
Source: WINMM.dll.7.dr	Static PE information: section name: .pczrv
Source: WINMM.dll.7.dr	Static PE information: section name: .ibglr
Source: WINMM.dll.7.dr	Static PE information: section name: .uirkq
Source: WINMM.dll.7.dr	Static PE information: section name: .nzhxgg
Source: WINMM.dll.7.dr	Static PE information: section name: .dva
Source: DUser.dll.7.dr	Static PE information: section name: .qkm
Source: DUser.dll.7.dr	Static PE information: section name: .cvjb
Source: DUser.dll.7.dr	Static PE information: section name: .tlmkv
Source: DUser.dll.7.dr	Static PE information: section name: .wucsxe
Source: DUser.dll.7.dr	Static PE information: section name: .wnx
Source: DUser.dll.7.dr	Static PE information: section name: .weqy
Source: DUser.dll.7.dr	Static PE information: section name: .yby
Source: DUser.dll.7.dr	Static PE information: section name: .ormx
Source: DUser.dll.7.dr	Static PE information: section name: .dhclu
Source: DUser.dll.7.dr	Static PE information: section name: .xmiul
Source: DUser.dll.7.dr	Static PE information: section name: .tlwcxe
Source: DUser.dll.7.dr	Static PE information: section name: .get
Source: DUser.dll.7.dr	Static PE information: section name: .hzrd
Source: DUser.dll.7.dr	Static PE information: section name: .qzu
Source: DUser.dll.7.dr	Static PE information: section name: .nhglos
Source: DUser.dll.7.dr	Static PE information: section name: .itzo
Source: DUser.dll.7.dr	Static PE information: section name: .nmsaom
Source: DUser.dll.7.dr	Static PE information: section name: .rvhi
Source: DUser.dll.7.dr	Static PE information: section name: .ucrzce
Source: DUser.dll.7.dr	Static PE information: section name: .ijc
Source: DUser.dll.7.dr	Static PE information: section name: .ohvs
Source: DUser.dll.7.dr	Static PE information: section name: .rlvrc
Source: DUser.dll.7.dr	Static PE information: section name: .yjv
Source: DUser.dll.7.dr	Static PE information: section name: .clbcyy
Source: DUser.dll.7.dr	Static PE information: section name: .xcyn
Source: DUser.dll.7.dr	Static PE information: section name: .boqx
Source: DUser.dll.7.dr	Static PE information: section name: .rnlia
Source: DUser.dll.7.dr	Static PE information: section name: .ctip
Source: DUser.dll.7.dr	Static PE information: section name: .fkv
Source: DUser.dll.7.dr	Static PE information: section name: .pczrv
Source: DUser.dll.7.dr	Static PE information: section name: .ibglr
Source: DUser.dll.7.dr	Static PE information: section name: .uirkq
Source: DUser.dll.7.dr	Static PE information: section name: .nzhxgg
Source: DUser.dll.7.dr	Static PE information: section name: .scy
Source: credui.dll.7.dr	Static PE information: section name: .qkm
Source: credui.dll.7.dr	Static PE information: section name: .cvjb
Source: credui.dll.7.dr	Static PE information: section name: .tlmkv
Source: credui.dll.7.dr	Static PE information: section name: .wucsxe
Source: credui.dll.7.dr	Static PE information: section name: .wnx
Source: credui.dll.7.dr	Static PE information: section name: .weqy
Source: credui.dll.7.dr	Static PE information: section name: .yby
Source: credui.dll.7.dr	Static PE information: section name: .ormx
Source: credui.dll.7.dr	Static PE information: section name: .dhclu
Source: credui.dll.7.dr	Static PE information: section name: .xmiul
Source: credui.dll.7.dr	Static PE information: section name: .tlwcxe
Source: credui.dll.7.dr	Static PE information: section name: .get
Source: credui.dll.7.dr	Static PE information: section name: .hzrd
Source: credui.dll.7.dr	Static PE information: section name: .qzu
Source: credui.dll.7.dr	Static PE information: section name: .nhglos
Source: credui.dll.7.dr	Static PE information: section name: .itzo
Source: credui.dll.7.dr	Static PE information: section name: .nmsaom
Source: credui.dll.7.dr	Static PE information: section name: .rvhi
Source: credui.dll.7.dr	Static PE information: section name: .ucrzce
Source: credui.dll.7.dr	Static PE information: section name: .ijc
Source: credui.dll.7.dr	Static PE information: section name: .ohvs
Source: credui.dll.7.dr	Static PE information: section name: .rlvrc
Source: credui.dll.7.dr	Static PE information: section name: .yjv
Source: credui.dll.7.dr	Static PE information: section name: .clbcyy
Source: credui.dll.7.dr	Static PE information: section name: .xcyn
Source: credui.dll.7.dr	Static PE information: section name: .boqx
Source: credui.dll.7.dr	Static PE information: section name: .rnlia
Source: credui.dll.7.dr	Static PE information: section name: .ctip
Source: credui.dll.7.dr	Static PE information: section name: .fkv
Source: credui.dll.7.dr	Static PE information: section name: .pczrv
Source: credui.dll.7.dr	Static PE information: section name: .ibglr
Source: credui.dll.7.dr	Static PE information: section name: .uirkq
Source: credui.dll.7.dr	Static PE information: section name: .nzhxgg
Source: credui.dll.7.dr	Static PE information: section name: .ihemj
Source: VERSION.dll0.7.dr	Static PE information: section name: .qkm
Source: VERSION.dll0.7.dr	Static PE information: section name: .cvjb
Source: VERSION.dll0.7.dr	Static PE information: section name: .tlmkv
Source: VERSION.dll0.7.dr	Static PE information: section name: .wucsxe
Source: VERSION.dll0.7.dr	Static PE information: section name: .wnx
Source: VERSION.dll0.7.dr	Static PE information: section name: .weqy
Source: VERSION.dll0.7.dr	Static PE information: section name: .yby
Source: VERSION.dll0.7.dr	Static PE information: section name: .ormx
Source: VERSION.dll0.7.dr	Static PE information: section name: .dhclu
Source: VERSION.dll0.7.dr	Static PE information: section name: .xmiul
Source: VERSION.dll0.7.dr	Static PE information: section name: .tlwcxe
Source: VERSION.dll0.7.dr	Static PE information: section name: .get
Source: VERSION.dll0.7.dr	Static PE information: section name: .hzrd
Source: VERSION.dll0.7.dr	Static PE information: section name: .qzu
Source: VERSION.dll0.7.dr	Static PE information: section name: .nhglos
Source: VERSION.dll0.7.dr	Static PE information: section name: .itzo
Source: VERSION.dll0.7.dr	Static PE information: section name: .nmsaom
Source: VERSION.dll0.7.dr	Static PE information: section name: .rvhi
Source: VERSION.dll0.7.dr	Static PE information: section name: .ucrzce
Source: VERSION.dll0.7.dr	Static PE information: section name: .ijc
Source: VERSION.dll0.7.dr	Static PE information: section name: .ohvs
Source: VERSION.dll0.7.dr	Static PE information: section name: .rlvrc
Source: VERSION.dll0.7.dr	Static PE information: section name: .yjv
Source: VERSION.dll0.7.dr	Static PE information: section name: .clbcyy
Source: VERSION.dll0.7.dr	Static PE information: section name: .xcyn
Source: VERSION.dll0.7.dr	Static PE information: section name: .boqx
Source: VERSION.dll0.7.dr	Static PE information: section name: .rnlia
Source: VERSION.dll0.7.dr	Static PE information: section name: .ctip
Source: VERSION.dll0.7.dr	Static PE information: section name: .fkv
Source: VERSION.dll0.7.dr	Static PE information: section name: .pczrv
Source: VERSION.dll0.7.dr	Static PE information: section name: .ibglr
Source: VERSION.dll0.7.dr	Static PE information: section name: .uirkq
Source: VERSION.dll0.7.dr	Static PE information: section name: .nzhxgg
Source: VERSION.dll0.7.dr	Static PE information: section name: .dbai

Source: DUI70.dll.7.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x1c4f03
Source: DUI70.dll1.7.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x1c4995
Source: WINMM.dll.7.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x178e04
Source: WINSTA.dll.7.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x181df2
Source: credui.dll.7.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x1794c1
Source: VERSION.dll0.7.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x177cd8
Source: TAPI32.dll.7.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x183dcc
Source: UxTheme.dll.7.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x174d23
Source: MFC42u.dll.7.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x17a777
Source: PSnPApRPsG.dll	Static PE information: real checksum: 0x7d786c40 should be: 0x176961
Source: DUI70.dll0.7.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x1c7e5d
Source: VERSION.dll.7.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x1778c6
Source: XmlLite.dll.7.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x17dc29
Source: DUser.dll.7.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x183b87

Source: msdt.exe.7.dr

Static PE information: 0xFF860234 [Fri Nov 6 17:41:08 2105 UTC]

Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\nmYaGulOu\UxTheme.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\HtmF\credui.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\YaR\MFC42u.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\ifnj9zHVv\VERSION.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\TQbOBk\DUser.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\TQbOBk\EaseOfAccessDialog.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\a5Q9CELTE\VERSION.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\YaR\DevicePairingWizard.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\HtmF\perfmon.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Tp5KLY\XmlLite.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\a5Q9CELTE\ie4uinit.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\72PXeqK\TAPI32.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\RjGeORx\DUI70.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\hUhx9Ta\WINSTA.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\yC4r\DUI70.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\br5u0t\WINMM.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\PVSXo\DUI70.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe

Code function: 20_2_00007FF6774732D4 OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,StartServiceW,GetLastError,QueryServiceStatus,Sleep,GetLastError,CloseServiceHandle,CloseServiceHandle,

20_2_00007FF6774732D4

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\explorer.exe TID: 6672

Thread sleep count: 56 > 30

Jump to behavior

Source: C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Last function: Thread delayed

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\a5Q9CELTE\ie4uinit.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\HtmF\credui.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TQbOBk\EaseOfAccessDialog.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\HtmF\perfmon.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DB9770 GetSystemTimeAsFileTime followed by cmp: cmp eax, 03h and CTI: jne 00007FF631DB9EC7h	31_2_00007FF631DB9770
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DB9770 GetSystemTimeAsFileTime followed by cmp: cmp rdi, 02h and CTI: jne 00007FF631DB9C68h	31_2_00007FF631DB9770
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D79770 GetSystemTimeAsFileTime followed by cmp: cmp eax, 03h and CTI: jne 00007FF6A2D79EC7h	33_2_00007FF6A2D79770
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D79770 GetSystemTimeAsFileTime followed by cmp: cmp rdi, 02h and CTI: jne 00007FF6A2D79C68h	33_2_00007FF6A2D79770

Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe

Code function: 40_2_00007FF7B1F3649C rdtsc

40_2_00007FF7B1F3649C

Source: C:\Windows\System32\loaddll64.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 1_2_000000014005C340 GetSystemInfo,

1_2_000000014005C340

Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014005D290 FindFirstFileExW,	1_2_000000014005D290
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB16720 memset,GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,	23_2_00007FF6EDB16720
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB2A65C memset,GetProcessHeap,HeapAlloc,FindFirstFileW,GetProcessHeap,HeapAlloc,GetLastError,FindClose,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,	23_2_00007FF6EDB2A65C
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB2BD48 memset,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,CopyFileW,GetLastError,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,	23_2_00007FF6EDB2BD48
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB17784 memset,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,CloseHandle,FindFirstFileW,_wcsicmp,_wcsicmp,GetFileAttributesW,SetFileAttributesW,GetLastError,GetFileAttributesW,SetFileAttributesW,GetLastError,DeleteFileW,CreateFileW,GetLastError,CloseHandle,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,	23_2_00007FF6EDB17784
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB12770 memset,GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,FindNextFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,	23_2_00007FF6EDB12770
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB16494 memset,GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,FindNextFileW,FindClose,#13,GetLastError,GetProcessHeap,HeapFree,	23_2_00007FF6EDB16494
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB17C3C GetProcessHeap,HeapAlloc,FindFirstFileW,_wcsicmp,_wcsicmp,SetFileAttributesW,GetLastError,DeleteFileW,GetLastError,FindNextFileW,FindClose,RemoveDirectoryW,GetLastError,GetProcessHeap,HeapFree,	23_2_00007FF6EDB17C3C
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DC7A2C memset,PathCombineW,FindFirstFileW,GetLastError,PathCombineW,FindClose,	31_2_00007FF631DC7A2C
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DD15A8 GlobalAlloc,CharLowerA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,lstrlenA,FileTimeToLocalFileTime,FileTimeToDosDateTime,lstrlenA,FindNextFileA,FindNextFileA,FindClose,GlobalLock,GlobalUnlock,GlobalLock,GlobalUnlock,lstrlenA,FileTimeToLocalFileTime,FileTimeToDosDateTime,lstrlenA,lstrlenA,lstrlenA,GlobalFree,	31_2_00007FF631DD15A8
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DD1168 memset,lstrlenA,lstrlenA,lstrlenA,FindFirstFileA,lstrcmpA,lstrcmpA,FindNextFileA,FindClose,FindNextFileA,lstrcmpA,lstrcmpA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,FindClose,	31_2_00007FF631DD1168
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D87A2C memset,PathCombineW,FindFirstFileW,GetLastError,PathCombineW,FindClose,	33_2_00007FF6A2D87A2C
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D915A8 GlobalAlloc,CharLowerA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,lstrlenA,FileTimeToLocalFileTime,FileTimeToDosDateTime,lstrlenA,FindNextFileA,FindNextFileA,FindClose,GlobalLock,GlobalUnlock,GlobalLock,GlobalUnlock,lstrlenA,FileTimeToLocalFileTime,FileTimeToDosDateTime,lstrlenA,lstrlenA,lstrlenA,GlobalFree,	33_2_00007FF6A2D915A8
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D91168 memset,lstrlenA,lstrlenA,lstrlenA,FindFirstFileA,lstrcmpA,lstrcmpA,FindNextFileA,FindClose,FindNextFileA,lstrcmpA,lstrcmpA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,FindClose,	33_2_00007FF6A2D91168
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Code function: 40_2_00007FF7B1F44518 PathAppendW,FindFirstFileW,PathAppendW,GetLastError,PathFindExtensionW,StrCmpICW,FindNextFileW,FindClose,GetLastError,	40_2_00007FF7B1F44518

Source: explorer.exe, 00000007.00000000.704198002.000000000A64D000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.704139453.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.719832561.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.704139453.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.687193904.000000000A897000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}""
Source: explorer.exe, 00000007.00000000.687343282.000000000A9AD000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATA\|
Source: explorer.exe, 00000007.00000000.679017493.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000007.00000000.723286294.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000007.00000000.686537822.000000000A784000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@

Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe

Code function: 29_2_00007FF70C018454 GetCurrentThreadId,memset,IsDebuggerPresent,OutputDebugStringW,

29_2_00007FF70C018454

Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe

Code function: 23_2_00007FF6EDB0C6FC GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,SysFreeString,SysFreeString,SysFreeString,FreeLibrary,

23_2_00007FF6EDB0C6FC

Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe

Code function: 40_2_00007FF7B1F3649C rdtsc

40_2_00007FF7B1F3649C

Source: C:\Windows\System32\loaddll64.exe

Code function: 1_2_0000000140048AC0 LdrLoadDll,FindClose,

1_2_0000000140048AC0

Source: C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe	Code function: 18_2_00007FF708132330 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_00007FF708132330
Source: C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe	Code function: 18_2_00007FF708132530 SetUnhandledExceptionFilter,	18_2_00007FF708132530
Source: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe	Code function: 20_2_00007FF677474010 SetUnhandledExceptionFilter,	20_2_00007FF677474010
Source: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe	Code function: 20_2_00007FF677473E18 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_00007FF677473E18
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB35E58 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_00007FF6EDB35E58
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Code function: 23_2_00007FF6EDB36140 SetUnhandledExceptionFilter,	23_2_00007FF6EDB36140
Source: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe	Code function: 26_2_00007FF7A2AF7480 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_00007FF7A2AF7480
Source: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe	Code function: 26_2_00007FF7A2AF7680 SetUnhandledExceptionFilter,	26_2_00007FF7A2AF7680
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C0409B4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_2_00007FF70C0409B4
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C040740 SetUnhandledExceptionFilter,	29_2_00007FF70C040740
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DDA730 SetUnhandledExceptionFilter,	31_2_00007FF631DDA730
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Code function: 31_2_00007FF631DDA368 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_00007FF631DDA368
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D9A368 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	33_2_00007FF6A2D9A368
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Code function: 33_2_00007FF6A2D9A730 SetUnhandledExceptionFilter,	33_2_00007FF6A2D9A730
Source: C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe	Code function: 36_2_00007FF70E3F4014 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	36_2_00007FF70E3F4014
Source: C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe	Code function: 36_2_00007FF70E3F3D90 SetUnhandledExceptionFilter,	36_2_00007FF70E3F3D90
Source: C:\Users\user\AppData\Local\YaR\DevicePairingWizard.exe	Code function: 38_2_00007FF621236340 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	38_2_00007FF621236340
Source: C:\Users\user\AppData\Local\YaR\DevicePairingWizard.exe	Code function: 38_2_00007FF621236630 SetUnhandledExceptionFilter,	38_2_00007FF621236630
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Code function: 40_2_00007FF7B1F45460 SetUnhandledExceptionFilter,	40_2_00007FF7B1F45460
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Code function: 40_2_00007FF7B1F451B0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	40_2_00007FF7B1F451B0

HIPS / PFW / Operating System Protection Evasion:

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: TAPI32.dll.7.dr

Jump to dropped file

Changes memory attributes in foreign processes to executable or writable

Show sources

Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFABD58EFE0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFABD58E000 protect: page execute read	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFABB012A20 protect: page execute and read and write	Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Windows\System32\rundll32.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Uses Atom Bombing / ProGate to inject into other processes

Show sources

Source: C:\Windows\System32\rundll32.exe

Atom created: 405553565741544156488D6C24D14881EC98 0x00000000 inc eax 0x00000001 push ebp 0x00000002 push ebx 0x00000003 push esi 0x00000004 push edi 0x00000005 inc ecx 0x00000006 push esp 0x00000007 inc ecx 0x00000008 push esi 0x00000009 dec eax 0x0000000a lea ebp, dword ptr [esp-2Fh] 0x0000000e dec eax 0x0000000f sub esp, 00000098h

Jump to behavior

Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe

Code function: 23_2_00007FF6EDAFFF54 memset,GetModuleFileNameW,GetLastError,memset,ShellExecuteExW,CreateThread,GetLastError,GetProcessHeap,HeapFree,GetLastError,

23_2_00007FF6EDAFFF54

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\PSnPApRPsG.dll',#1

Jump to behavior

Source: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe

Code function: 20_2_00007FF6774727F8 memset,InitializeSecurityDescriptor,GetLastError,GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetLastError,LocalAlloc,memset,GetTokenInformation,GetLastError,GetTokenInformation,GetLastError,LocalAlloc,memset,GetTokenInformation,GetLastError,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,InitializeAcl,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,LocalFree,CloseHandle,

20_2_00007FF6774727F8

Source: C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe

Code function: 18_2_00007FF708131618 HeapSetInformation,GetModuleHandleW,LoadStringW,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,GetCommandLineW,

18_2_00007FF708131618

Source: explorer.exe, 00000007.00000000.678272412.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000007.00000000.730825412.0000000001080000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000007.00000000.730825412.0000000001080000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000007.00000000.730825412.0000000001080000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000007.00000000.730825412.0000000001080000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000007.00000000.723286294.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\YaR\DevicePairingWizard.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\YaR\DevicePairingWizard.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe	Queries volume information: unknown VolumeInformation

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe

Code function: 23_2_00007FF6EDB1A0D0 GetProcessHeap,HeapAlloc,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateEventW,CreateNamedPipeW,ConnectNamedPipe,GetLastError,GetLastError,GetLastError,GetProcessHeap,HeapFree,LocalFree,

23_2_00007FF6EDB1A0D0

Source: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe

Code function: 20_2_00007FF6774741B0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

20_2_00007FF6774741B0

Source: C:\Users\user\AppData\Local\Tp5KLY\psr.exe

Code function: 31_2_00007FF631DC98B0 memset,GetVersionExW,GetProductInfo,SHCreateStreamOnFileEx,CreateXmlWriter,

31_2_00007FF631DC98B0

Source: C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe

Code function: 23_2_00007FF6EDAF7970 GetProcessHeap,HeapAlloc,GetUserNameExW,GetLastError,SysFreeString,GetProcessHeap,HeapFree,

23_2_00007FF6EDAF7970

Source: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe	Code function: 20_2_00007FF677473218 RpcBindingFree,NdrClientCall3,	20_2_00007FF677473218
Source: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe	Code function: 20_2_00007FF677473648 memset,CreateBindCtx,StringFromCLSID,MkParseDisplayName,CoTaskMemFree,	20_2_00007FF677473648
Source: C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe	Code function: 20_2_00007FF6774733E8 memset,RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcStringFreeW,LocalAlloc,CreateWellKnownSid,GetLastError,RpcBindingSetAuthInfoExW,LocalFree,RpcBindingFree,	20_2_00007FF6774733E8
Source: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe	Code function: 26_2_00007FF7A2AF459C memset,RpcStringBindingComposeW,RpcBindingFromStringBindingW,AllocateAndInitializeSid,GetLastError,RpcBindingSetAuthInfoExW,RpcStringFreeW,FreeSid,RpcBindingFree,	26_2_00007FF7A2AF459C
Source: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe	Code function: 26_2_00007FF7A2AF47F9 RpcBindingFree,	26_2_00007FF7A2AF47F9
Source: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe	Code function: 26_2_00007FF7A2AF4932 RpcBindingFree,	26_2_00007FF7A2AF4932
Source: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe	Code function: 26_2_00007FF7A2AF4730 NdrClientCall3,RpcBindingFree,	26_2_00007FF7A2AF4730
Source: C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe	Code function: 26_2_00007FF7A2AF4868 NdrClientCall3,RpcBindingFree,	26_2_00007FF7A2AF4868
Source: C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe	Code function: 29_2_00007FF70C02C8A0 TlsGetValue,TlsSetValue,?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z,?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z,?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z,?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z,?CreateBool@Value@DirectUI@@SAPEAV12@_N@Z,?AccessibleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ,?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z,?_ZeroRelease@Value@DirectUI@@AEAAXXZ,StrToID,?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z,?GetClassInfoPtr@ModernProgressBar@DirectUI@@SAPEAUIClassInfo@2@XZ,?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ,TlsGetValue,TlsSetValue,	29_2_00007FF70C02C8A0
Source: C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe	Code function: 36_2_00007FF70E3F3578 memset,RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcStringFreeW,LocalAlloc,CreateWellKnownSid,GetLastError,RpcBindingSetAuthInfoExW,LocalFree,RpcBindingFree,	36_2_00007FF70E3F3578
Source: C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe	Code function: 36_2_00007FF70E3F3020 memset,RpcBindingFree,GetAncestor,EnableWindow,CloseHandle,RpcAsyncInitializeHandle,Ndr64AsyncClientCall,EnableWindow,LocalFree,	36_2_00007FF70E3F3020

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	Windows Service1	Exploitation for Privilege Escalation1	Masquerading1	OS Credential Dumping	System Time Discovery11	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Service Execution2	Boot or Logon Initialization Scripts	Access Token Manipulation1	Virtualization/Sandbox Evasion1	LSASS Memory	Security Software Discovery31	Remote Desktop Protocol	Clipboard Data1	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Logon Script (Windows)	Windows Service1	Access Token Manipulation1	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Process Injection313	Process Injection313	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Account Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information3	Cached Domain Credentials	System Owner/User Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Rundll321	DCSync	File and Directory Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing2	Proc Filesystem	System Information Discovery25	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Timestomp1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
PSnPApRPsG.dll	80%	ReversingLabs	Win64.Infostealer.Dridex
PSnPApRPsG.dll	100%	Avira	HEUR/AGEN.1114452
PSnPApRPsG.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\a5Q9CELTE\VERSION.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\br5u0t\WINMM.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\PVSXo\DUI70.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\YaR\MFC42u.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Tp5KLY\XmlLite.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\TQbOBk\DUser.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\a5Q9CELTE\VERSION.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\PVSXo\DUI70.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\72PXeqK\TAPI32.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\nmYaGulOu\UxTheme.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\PVSXo\DUI70.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\HtmF\credui.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\hUhx9Ta\WINSTA.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\a5Q9CELTE\VERSION.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\br5u0t\WINMM.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\PVSXo\DUI70.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\YaR\MFC42u.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Tp5KLY\XmlLite.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\TQbOBk\DUser.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\a5Q9CELTE\VERSION.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\PVSXo\DUI70.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\72PXeqK\TAPI32.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\nmYaGulOu\UxTheme.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\PVSXo\DUI70.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\HtmF\credui.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\hUhx9Ta\WINSTA.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\HtmF\perfmon.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\HtmF\perfmon.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
20.2.RdpSaUacHelper.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.2.tcmsetup.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
33.2.psr.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
5.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
38.2.DevicePairingWizard.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.2.msdt.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
36.2.wlrmdr.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.2.ProximityUxHost.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
40.2.PresentationSettings.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
8.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.2.psr.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.2.bdechangepin.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.loaddll64.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	492695
Start date:	28.09.2021
Start time:	23:00:25
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PSnPApRPsG (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@57/27@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 42.1% (good quality ratio 27.9%) Quality average: 49.4% Quality standard deviation: 42.2%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32 Stop behavior analysis, all processes terminated
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.82.209.183, 20.54.110.249, 173.222.108.226, 173.222.108.210, 40.112.88.60, 80.67.82.211, 80.67.82.235 Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, wu-shim.trafficmanager.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, a1449.dscg2.akamai.net, arc.msn.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing behavior and disassembly information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/492695/sample/PSnPApRPsG.dll

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\72PXeqK\TAPI32.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1527808
Entropy (8bit):	4.693391564888678
Encrypted:	false
SSDEEP:	12288:SVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:PfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	4441DC6E13ED55823A6FE19061C57785
SHA1:	D2EDA84980357BB70998B4393C17C4B5F3EA7763
SHA-256:	4174BFCA405A1249B2FCE8453F648FE1BFF887B35BBB752C3D178B0C442A8A8A
SHA-512:	04651D77D34B35959F5AAEFEC08AAE2391A9F2F468856C481BC07FCD8A2664511DD4A70F07DCCBE564B0001900092866E25D040B68D2587108576F1BBEFB0558
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.(..DN^.........." .........0......p..........@.............................P......@lx}..b..........................................0..V....c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	4.999998588063228
Encrypted:	false
SSDEEP:	192:DIzBdu2Mhf/+G1jQ0pwPYqLmdO0O7RgZiLtzADWO4hxDcUh6UdBndOvfSWG0oW:GMVJjQ0dg0O7yk5ciJcUhLiSWG0oW
MD5:	0DDA495155D552D024593C4B3246C8FA
SHA1:	7501A7AD5DAA41462BEFF9127154BAF261A24A5B
SHA-256:	D3074CBD29678CA612C1F8AA93DE1F5B75108BE8187F0F2A2331BC302AD48CD9
SHA-512:	9159D8AF457591256BA87443E89ECE942DE40B8FF39586116C2026330B8AE9C20F96905547E87D98508951D2B4687069EFD018CC9E4A6C94A6C26D4B587F41B3
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............Z...Z...Z..[...Z..[...Z..[...Z..[...Z...Z...Z..[...Z.:Z...Z..[...ZRich...Z................PE..d....E.H.........."..........,....... .........@..........................................`.......... .......................................9..x....p..P....`..D............... ....5..T............................0...............1...............................text............................... ..`.rdata..&....0......................@..@.data... ....P.......0..............@....pdata..D....`.......2..............@..@.rsrc...P....p.......4..............@..@.reloc.. ............>..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\HtmF\credui.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1523712
Entropy (8bit):	4.673043182665197
Encrypted:	false
SSDEEP:	12288:KVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:XfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	94EEF4660920EB34F50F20810A44AB86
SHA1:	7CD1FF09EA7B63AE4FA9E191EF4653B6BEE24960
SHA-256:	B8E2D3215B26CD75C322EF81C74AFA5F535180F140B440B57FDB0F46F25955F5
SHA-512:	2556ED8B3D9DE1F8F47C4DD4B4AEF58DA34D9DC30E706391EEA68C614374EA72E6BF78F4AFFFF509B417F78BEA9CC623824960A3905540874EF0A927E40295A2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.(..DN^.........." ......... ......p..........@.............................@......@lx}..b..........................................0.......c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\HtmF\perfmon.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	175616
Entropy (8bit):	6.895507339523819
Encrypted:	false
SSDEEP:	3072:uVt2h5auVI9cMHFO+ZyGghtYIo9piswTogiqQKy349:uVMzVIOMHFhyhqIo9s37iTK24
MD5:	BD9ABDEA680B56534CE7627E39270A7C
SHA1:	24FCF3E615F5E7F434244D90AE5C4EB90F7C5EB5
SHA-256:	EB9FF0CDA3E15147BB0FE00984B75C5F7B04644957CCAC135996AC18C1FD3EED
SHA-512:	CEFA87534CB62E705EEE00CE5FA7C73083562A6B97E5D9D0106A3BCB3499A1F7FE997376DB22F73BB4F19DA66E6CE65FE85E2DF1FD06051CC19C006B59082427
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H....f..f..f.c...f.c...f.c...f.c...f..f..f.c...f.c. ..f.c...f.Rich.f.........PE..d.....i6.........."..........$......P..........@.....................................9....`.......... ......................................D........@......0......................p...T...........................`...............`................................text............................... ..`.rdata..:x.......z..................@..@.data........ ......................@....pdata.......0......................@..@.rsrc.......@......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\PVSXo\DUI70.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1806336
Entropy (8bit):	5.1466425775068245
Encrypted:	false
SSDEEP:	12288:2VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1AcX4Yc:rfP7fWsK5z9A+WGAW+V5SB6Ct4bnbNI
MD5:	EB43F254B0FCC1FA10EC0C59130C442A
SHA1:	5002A9D37F594E84379581DA8479C0783A9B1957
SHA-256:	E326F8DA2BCB694C8F56272C5F8741F1722A38D877788CB6C234ECB5BDE23D2E
SHA-512:	552C148AFF9F8224A2DE3133322A3F18014EDE46E0116749167F5642B15D2B4CB3A1DA994925C837AF5453B1F95006693E28E1D963373B4FAE8BFEC09E07F432
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.(..DN^.........." .........p......p..........@....................................@lx}..b..........................................0..dQ...c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65704
Entropy (8bit):	5.834154867756865
Encrypted:	false
SSDEEP:	1536:B14+6gGQ7ubZiQ+KytHIyObsvqr9PxDt8PcPs:QgGIu1iFtHJLu9ZDt8kU
MD5:	4849E997AF1274DD145672A2F9BC0827
SHA1:	D24E9C6079A20D1AED8C1C409C3FC8E1C63628F3
SHA-256:	B43FC043A61BDBCF290929666A62959C8AD2C8C121C7A3F36436D61BBD011C9D
SHA-512:	FB9227F0B758496DE1F1D7CEB3B7A5E847C6846ADD360754CFB900358A71422994C4904333AD51852DC169113ACE4FF3349520C816E7EE796E0FBE6106255AEF
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.s... ... ... .s\ ... .o.!... .o.!... .o.!... .o.!... ... t.. .o.!... .o0 ... .o.!... Rich... ........PE..d....2............"......4...........:.........@.............................@......b................P..................................................xg...............$...0.......y..T............................f...............g..x............................text....3.......4.................. ..`.imrsiv......P...........................rdata..J2...`...4...8..............@..@.data...h............l..............@....pdata...............n..............@..@.rsrc...xg.......h...r..............@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\RjGeORx\DUI70.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1806336
Entropy (8bit):	5.146430269158369
Encrypted:	false
SSDEEP:	24576:BfP7fWsK5z9A+WGAW+V5SB6Ct4bnbN2I:BDW/e+WG0Vo6CtSnZf
MD5:	D2FE5DD6B761D5620B46087FF94F6EC8
SHA1:	6569BA8D06760494A3559B70DA8CB5BC76C8269B
SHA-256:	F11F70DD4CE14021A3F9A298EEEA6BA62824F8FFBB154C9022864563259ACD15
SHA-512:	BF9949C76E1B6F9DD67EF324338412A546C61B6FBF9804169FD63DA4A7C779A8C0E42A0F21830191A299113B569EA857FF2FC52D5E1A5BE48EBEB5C0D76AF19C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.(..DN^.........." .........p......p..........@....................................@lx}..b..........................................0..dQ...c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	369664
Entropy (8bit):	6.503464732962775
Encrypted:	false
SSDEEP:	6144:so87gEZlHVxHEVHHHQVb1kHVqHVqHQQbTuTRTHTfTEHVf2XTQT6TITQT+VyW1727:1H+S+
MD5:	013D00A367D851B0EC869F209337754E
SHA1:	240B731FAA42E170511C1D0676B3ADE76712451B
SHA-256:	3D0BFED2F2A17FA8246634FDA7162A1BE56DDB3080519BCEFEAFD69FBC7F2FE1
SHA-512:	BD55925D3EC097FDD713A6847F69005C7B1007DBFAEAAFD02B0B23567F81C5721B4BFAF6A87DB1E94F4D71D6CC5E23AA31C443FD9030BD2D630489E9E7360662
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........j..9..9..9.8..9.8..9.8..9.8..9..9..9.8..9.8..9.k9..9.8..9Rich..9........................PE..d...l..`.........."......r...4......0t.........@..........................................`.......... ..................................T...4........@..X....0..\|.......................T............................................................................text....q.......r.................. ..`.rdata..v............v..............@..@.data........ ......................@....pdata..\|....0......................@..@.rsrc...X....@......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TQbOBk\DUser.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1527808
Entropy (8bit):	4.678124390083214
Encrypted:	false
SSDEEP:	12288:0VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:xfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	45F2082293D80022AF480E926ADA97DE
SHA1:	1D1849B46676B49A58F8044CD33E96B938D087C9
SHA-256:	5CF647A594E50F7E4C0BF294E76BBCD092C4CEE00AB7A6F90724AA25A05D3249
SHA-512:	01A4A18E7BD9D1572A2ABCB3C82DF9E327BCE9D91BD887FD2EFD52B29AB4F056ED8668EBA324CD91AAD23670019889D785EA94CD3D8651D174DDB19DA0CA6F00
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.(..DN^.........." .........0......p..........@.............................P......@lx}..b..........................................0.......c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\TQbOBk\EaseOfAccessDialog.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	304640
Entropy (8bit):	6.843015704242449
Encrypted:	false
SSDEEP:	6144:E/Odkrq1AlGra6uFz2LJGRg4kLNnei36cw:As5+FCdUc
MD5:	F87F2E5EBF3FFBA39DF1621B5F8689B5
SHA1:	B4E358BF1BE0DF6D341CA1BC949867D94F13EC07
SHA-256:	06780477637707BEA6317AE81D059A4D75B101542ADFA6DC855287EAEDFC822A
SHA-512:	6E8D60C17396260791898A2914422AFFF2921A4C3D924F56C83ED117B683D3F3AEFB15E234600F3B5375A47C0C6A13F6160B0638CA91663D29DC56067EB5E5B7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)..8m..km..km..kd.Hki..k...jn..k...j{..k...j`..k...jv..km..k3..k...jx..k..$kl..k...jl..kRichm..k........PE..d...1.(i.........."............................@....................................L}....`.......... ......................................(0..,........5......................X.......T............................................................................text............................... ..`.rdata..............................@..@.data...0....p.......X..............@....pdata...............b..............@..@.rsrc....5.......6...l..............@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tp5KLY\XmlLite.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1523712
Entropy (8bit):	4.669713032094796
Encrypted:	false
SSDEEP:	12288:QVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:VfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	E1B6631ED63495598724E765533854EC
SHA1:	DEB955764D6C692B34385D043F9251C3900DEF13
SHA-256:	71D8FD1B0D8EFEC04B8E44EE6892F6852EE77AC32D3548DB37D997E895338B0E
SHA-512:	56ACCEF1B329CC5D1380F214135BC887DB3B3AAB95D1F0FD722A4D1DE30469F884878984A6B189A3DD71F56741DE1989544A333B6998DF3FBD701109AFA59992
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.(..DN^.........." ......... ......p..........@.............................@......@lx}..b..........................................0.......c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\Tp5KLY\psr.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	600576
Entropy (8bit):	6.4861677167766665
Encrypted:	false
SSDEEP:	12288:B2mS50ICmAX+ASa8wd9Nkmw6cD8pellpco//EH1:B2mlmeFSa8wd9NStApeCoXEH
MD5:	3B8262EB45E790BF7FA648CEE2CCCB7B
SHA1:	EDDD81D1B3FD2EE99E42A43B25BD74D39BB850BC
SHA-256:	D1225E9FD2834BD2EF84EADAA4126020D20F4A0F50321440190C3896E69BD5D8
SHA-512:	A3709D39372CDB6D9C9E58932144CE8BA437C2134EFC9BCD2531708C1515CBAEA5929C220DF25D76785F7594BC5F8541E6ED5330EA3CA12E87C4DA5A2171C435
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.............x......x......x..........x...x......x......xR.....x......Rich....................PE..d....S............".................`..........@....................................h.....`.......... .......................................7..,...............L...............D.......T........................... ...............X...8....7..@....................text...5........................... ..`.rdata..............................@..@.data....m...`.......H..............@....pdata..L............T..............@..@.didat...............j..............@....rsrc................l..............@..@.reloc..D............&..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\YaR\DevicePairingWizard.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	5.664138088677901
Encrypted:	false
SSDEEP:	1536:D/BmrFjio5/vzDSPwiEKi3xGyibqZ3qOT3:9mp5SwiEKWZiTo3
MD5:	E23643C785D498FF73B5C9D7EA173C3D
SHA1:	56296F1D29FC2DCBFAA1D991C87B10968C6D3882
SHA-256:	40F423488FC0C13DED29109F8CC1C0D2CCE52ECB1BD01939EF774FE31014E0F4
SHA-512:	22E29A06F19E2DA941A707B8DA7115E0F5962617295CC36395A8E9B2A98F0239B6519B4BF4AB1DC671DEF8CD558E8F59F4E50C63130D392D1E085BBF6B710914
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a...h...o......b......r......i......j...a..........c.....j.`......`...Richa...................PE..d...x.1".........."......\...........b.........@.....................................H....`.......... ..............................................................................\|..T...........................`r..............`s..8............................text....[.......\.................. ..`.rdata...-...p.......`..............@..@.data... ...........................@....pdata..............................@..@.rsrc...............................@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\YaR\MFC42u.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1548288
Entropy (8bit):	4.704719914724775
Encrypted:	false
SSDEEP:	12288:sVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ZfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	9A038C371A16C9B3C62D29B74F52FEDF
SHA1:	A842D1B72E1A5549E711BA134F9B2ADED1BBC93A
SHA-256:	CD123ED5259A5A2213E159906F8DB937BCCA1667C0A3469B92576C83452E3372
SHA-512:	67782A30361ADE3F9777D49A89C67250C5DA2FFDC215EB897ED1C2E72545DD2E34C938786FCF6BED2868B67DA8812CA3B6C0A6FAD52EE9E2320D1794E375C388
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.(..DN^.........." ................p..........@....................................@lx}..b..........................................0...l...c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\a5Q9CELTE\VERSION.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1523712
Entropy (8bit):	4.67079382802602
Encrypted:	false
SSDEEP:	12288:XVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:efP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	ED571DF99ACEF5ACC34ABB7B905915D5
SHA1:	484AE4125B91CD8EE87CE9E604D3667DBA97A167
SHA-256:	845EAA492DC7F66D7C1FFC14BA0620BC0E6A324DD151120420AD7B027F5D0B4A
SHA-512:	1FF7C353F05E92478C13060365F14D5335A4C6765158BF969EDCAC1C0BB838622839C28EB2BA814CEB31B628BF5FABAC2579C3E8353821A7BE5DBC4E5F98E67A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.(..DN^.........." ......... ......p..........@.............................@......@lx}..b..........................................0..+....c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\a5Q9CELTE\ie4uinit.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	221184
Entropy (8bit):	6.1390918249618585
Encrypted:	false
SSDEEP:	6144:RgDsww9O7gTBdbI6vxiBEByyrZKLeXOQPIx5mZ:0zlgfIvBjyrZwUJF
MD5:	9DD77F0F421AA9A70383210706ECA529
SHA1:	1EBEFD2674716D6302EC9AE88349CBDE52A18686
SHA-256:	8E8C4A1402E0AF960AB1FF23C8925BBC35B0F015537056CE5C51658519DE41BB
SHA-512:	17875904D790A56A08216732B60E1317F7B916258C903C24313188ECA5D948A6566F558C8F8ECE89BEB18F67B8730F98D7428EC14381C13C212BF8169EC768D5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7Uj.s4..s4..s4...P..p4...P..h4...P..w4...P..Z4..s4..J6...P...4...P..r4...P..r4..Richs4..................PE..d................."......6...0.......8.........@..........................................`.......... ..........................................\|.......`....`...................... ...T....................c..(....b...............c..x.......@....................text....4.......6.................. ..`.rdata.......P.......:..............@..@.data........@....... ..............@....pdata.......`.......(..............@..@.didat..(............B..............@....rsrc...`............D..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	222208
Entropy (8bit):	6.618425906220987
Encrypted:	false
SSDEEP:	3072:dklO/b97taQPr5pT8as3lJwvkAarSvDZpFB+2xmh0QSoKKBlKxyAZEHA:Oo/b1txPlh8I+rUts2xmhfGKraEH
MD5:	76086DD04B6760277A2B897345A0B457
SHA1:	DC65093DB601FE7AA2F4C0C400D18F43DA92DCFA
SHA-256:	BF492302281E3CD4F023FB54E101D8C3BD00FFEAFF75B5D7FE0C1CA43F291A81
SHA-512:	6528C86BA0272274A907F8559DFD79C55D1A6BAF3A4545EF3F6CDC4C790CC9FBDB7A3A8A2E72D0ED39651975DF5967608111448D1351BDC659E8F0F5E8C72442
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.".>.q.>.q.>.q.F~q.>.q.Z.p.>.q.Z.p.>.q.Z.p.>.q.Z.p.>.q.>.q/>.q.Z.p.>.q.Z.q.>.q.Z.p.>.qRich.>.q........PE..d... ..8.........."......J... ...... O.........@.....................................9....`.......... ..........................................................x.......................T............................a...............b...............................text....H.......J.................. ..`.rdata...]...`...^...N..............@..@.data...H...........................@....pdata..x...........................@..@.rsrc...............................@..@.reloc...............b..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\br5u0t\WINMM.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1527808
Entropy (8bit):	4.679438633254575
Encrypted:	false
SSDEEP:	12288:MVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:5fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	1A21CFA5BCFAD80861AB99E593F0B9CD
SHA1:	14083E0AD3D66E58D3BBE6BBCC58502A5454C47F
SHA-256:	5C8D6C9C0B0FF0020E27DF2E223DDB31458563D937054495A53A5E46B32458B6
SHA-512:	614C8565F28FCB52B7A48C15922CF27E34ACCE88BB704D19D499662CED45B82DDD60E3233C1169C8DE18744CF115025E5AB29BA9ACA1C650AA65B0B165AA1C66
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.(..DN^.........." .........0......p..........@.............................P......@lx}..b..........................................0..h....c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29184
Entropy (8bit):	5.483991269470949
Encrypted:	false
SSDEEP:	384:x1i6wkbsVQCy+MmItEV3DAOnKjXxyWzyWpaTeinj7qHk9FyMWagW:x1TwgsmCRMmIcTRnKbQW/kj7uk2U
MD5:	DA88A7B872B1A52F2465D12CFBA4EDAB
SHA1:	8421C2A12DFF33B827E8A6F942C2C87082D933DB
SHA-256:	6A97CF791352C68EFFEFCBE3BB23357A76D93CB51D08543ED993210C56782627
SHA-512:	CA96D8D423235E013B228D05961ED5AA347D25736F8DFC4C7FEB81BFA5A1193D013CD29AA027E1793D6835E52F6557B3491520D56DE7C09F0165F1D5C8FD9ED8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......& ..bA..bA..bA..k9..`A...%..cA...%..`A...%..pA...%..uA..bA...A...%..hA...%p.cA...%..cA..RichbA..........PE..d...?.1V.........."......6...>...... =.........@.....................................f....`.......... ......................................4k.......................................f..T............................U...............V...............................text....4.......6.................. ..`.rdata...'...P...(...:..............@..@.data................b..............@....pdata...............d..............@..@.rsrc................f..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\hUhx9Ta\WINSTA.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1527808
Entropy (8bit):	4.689164819327771
Encrypted:	false
SSDEEP:	12288:9VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:kfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	6153AAE0E62E602E994A951F792A307F
SHA1:	B731C0D74529F0A0DF0CCB445D715ADAECD5642E
SHA-256:	A5CBA571E031F0E3B62F3D115A6B0BC386FCA1527A30B0ED6F92C755F4C77B50
SHA-512:	3CE2FADE0001F3C4CF17440FEBDDAB7E73F305506F879E87E77D0A37697E04C7059D3511A2071710A7153D98823D619CCA2F31B939B37BD90079ABF4A09CB86E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.(..DN^.........." .........0......p..........@.............................P......@lx}..b..........................................0..m....c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\ifnj9zHVv\VERSION.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1523712
Entropy (8bit):	4.670799396744364
Encrypted:	false
SSDEEP:	12288:6VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:nfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	860353B8B3E177786D05F2A2FEAD2FF9
SHA1:	E0D5FA5BEE5DF61560116CE8AACA33AE13391872
SHA-256:	6A58D432E4687914A23E76A9EFD962D6942DC154617F615CEB6FE6EBF0054088
SHA-512:	D11E9A554F5A736F57CE17A1EE13496768CDD686BEA253CCE64072D772A7FE0C636DAC118827F8C74EC1650AF0107FA074B53F984F636BDA5B33455A763BB569
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.(..DN^.........." ......... ......p..........@.............................@......@lx}..b..........................................0..+....c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	600576
Entropy (8bit):	6.4861677167766665
Encrypted:	false
SSDEEP:	12288:B2mS50ICmAX+ASa8wd9Nkmw6cD8pellpco//EH1:B2mlmeFSa8wd9NStApeCoXEH
MD5:	3B8262EB45E790BF7FA648CEE2CCCB7B
SHA1:	EDDD81D1B3FD2EE99E42A43B25BD74D39BB850BC
SHA-256:	D1225E9FD2834BD2EF84EADAA4126020D20F4A0F50321440190C3896E69BD5D8
SHA-512:	A3709D39372CDB6D9C9E58932144CE8BA437C2134EFC9BCD2531708C1515CBAEA5929C220DF25D76785F7594BC5F8541E6ED5330EA3CA12E87C4DA5A2171C435
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.............x......x......x..........x...x......x......xR.....x......Rich....................PE..d....S............".................`..........@....................................h.....`.......... .......................................7..,...............L...............D.......T........................... ...............X...8....7..@....................text...5........................... ..`.rdata..............................@..@.data....m...`.......H..............@....pdata..L............T..............@..@.didat...............j..............@....rsrc................l..............@..@.reloc..D............&..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\nmYaGulOu\UxTheme.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1523712
Entropy (8bit):	4.681960328473459
Encrypted:	false
SSDEEP:	12288:nVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:OfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	7F6034B455EE3B99B1A95AD8A809A85A
SHA1:	4C10BA2334C8AD676A5E1C863040309B0197FF18
SHA-256:	B504AD194233C476E7CDC5E16294C664036BB00F915228568C1716D8274366FD
SHA-512:	4507B6C43262C1C5D6034F610D46BBD8A9E91FBB18E3255778FD8ED876DED7BE97398B35C046C58C517F022E6E31070A261D7BA8586E01F9AB80790598ACA40B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.(..DN^.........." ......... ......p..........@.............................@......@lx}..b..........................................0.......c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1560576
Entropy (8bit):	6.10038070749878
Encrypted:	false
SSDEEP:	24576:tnPfp054tZwxDl6XH4qvIReK1odddGdBnyE0k26kVZnBm:VC4tAqNK7utRB
MD5:	8BE43BAF1F37DA5AB31A53CA1C07EE0C
SHA1:	F2C9EB38775B91C4DE45AA25CDDDB86F5F056BF5
SHA-256:	BD59B4362F8590C5009B28830FF11B339B37FF142FB873204368905A9C843A08
SHA-512:	B30BDD7C3B71D58140F642196D5E44ED4C8B11A35DB65D37414C49F7FE64DD0C63DDEE4A0FDF5E75BB0BEB69FE0AA1D609C252F05D5661E7DCD4B6A4274151C7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..eo..6o..6o..6...7m..6...7q..6...7@..6o..6...6...7\..6...7k..6..X6n..6...7n..6Richo..6................PE..d...4............."......b...r.......].........@...................................._.....`.......... ............................................... ..P........"...................^..T............................................................................text....`.......b.................. ..`.rdata...^.......`...f..............@..@.data...p...........................@....pdata...".......$..................@..@.rsrc...P.... ......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\yC4r\DUI70.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1806336
Entropy (8bit):	5.146677664163729
Encrypted:	false
SSDEEP:	12288:SVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1MX4Yc:PfP7fWsK5z9A+WGAW+V5SB6Ct4bnbMI
MD5:	35FD10B6FCDE5D28D95CDCF5404D3FC9
SHA1:	3882017D7113AD36EDDAEED7D03A7EC5D1E43952
SHA-256:	5AF3534EFB5F306B7F0F0A6BAB9E3BD6CE0A02F569FF983509A0C837B2A672AF
SHA-512:	F532A36385B91B5D02AC1197ED30FD5D2BC496357BB9CC1676621F13D6850B5C104D65CAEF6694BDE745F45DD9225EA25BE1CF9EFDF257FBA2858D18783941A3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.(..DN^.........." .........p......p..........@....................................@lx}..b..........................................0..dQ...c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	264480
Entropy (8bit):	6.478365286411354
Encrypted:	false
SSDEEP:	6144:xSt+s2GFGbqEuzhJONjx9UVuCuHpwqr/vt9r+ULJBaBpcIFz:xStzFGbGhoPgMHpwqrHthUB6IF
MD5:	E7F0E9B3779E54CD271959C600A2A531
SHA1:	8006E2D1AA91798E48D8BFDE1EBF94A2D6BA6C0A
SHA-256:	155CE33E0E145314FE9D8911BE69B8CBBD2AC09B7B6D98363F9BAA277C71954E
SHA-512:	E10C3FD9C5F34260323CEC9E8EEDF2290F40254F0FFDCA582DB57D113B32871793CDFFF03D55941EF5E79FA8141803AB353BA4938357A4555233F2D090045338
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........B..B..B..K.`.&..-..A..-...U..-...K..-..U..B..t..-...]..-...C..-..C..RichB..........PE..d...;.*Q.........."............................@............................. ......&................ ..................................................H.......T....... +..........Pa..T...................p3..(...p2...............3...............................text............................... ..`.imrsiv..................................rdata....... ......................@..@.data...x...........................@....pdata..T...........................@..@.rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\bc49718863ee53e026d805ec372039e9_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	4442
Entropy (8bit):	5.463883728651604
Encrypted:	false
SSDEEP:	48:jpibUB5EI/126dFX1UYvScd0BFc4rjpibUBzoXA346zDExxCVjouPUBsRwA:juo5EILdnUYv+F3uoEkJDcCVTAi
MD5:	BDF7DAB20DD2985C56270F410E71A5F3
SHA1:	3BF6E1C4EEC5CAFB952D52529FA8EF07D81C040C
SHA-256:	9F6CCFE39CDBBD3379EFE2F5B10EA7693EECE1A291EC18BE2121C17C26E5D27F
SHA-512:	9796BA0533E0A821073A139CED69AF5681B58C95C3182A9714B031697F5C4F78F3D2C7A073E4776EB28DB3135E7C98FBF768782312653E0547FD3A901E367D8B
Malicious:	false
Reputation:	unknown
Preview:	........................................user.........................................user.....................RSA1................].......W.6...f..bdy+..>.._WT.,K.e-..p.m...>1....4'......u.f]...u.dJ)....3c.>T....1.5l.m.....B..WJs......ce..........M.7.....................z..O.......A...0C..>GXc......,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ......'g.T.H..9.\|.........d................ ...O.q.y..y.qK..\G.D....x.8.N.......B.yw1.R].z..S.0/...\|.n....3..w..i.W.....M...?U..E.+yhro7.Q...g..n..aX..~{..... ../..=.......%y...w.@...97...pU.Qj..H-:..D.#.,V..\|-.j.H._...1\|.a.[.c..@......a..zo..[.j].c.c2.od..........e$..}.C.>.3.$\|.....%.C.u5.Tb...X..Z^o.....g.I.....A..X.x..J\|.E.K.}...I...E..bs6j.O+. o..nc4.l.Z....[$2..*h..mB.%.....dp....D9..hv..U.q#;.;<..V.6p\|..\|;g4..z,.<LV0...&bWS..A]....D..P..Q.<.)...l..Q.19.\|.B.n'..k>.......-.....2...],....Y(.._7.P.A...X..........v1.f.d..W_.k.F..;.....z.(.M.9p..St.R.s.........I.S...)..I...Qu{j....

Static File Info

General
File type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Entropy (8bit):	5.873565632129989
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	PSnPApRPsG.dll
File size:	1519616
MD5:	ed37656551984cf5c1196d88c282e4aa
SHA1:	1475e0b8fd14a3a13160dc8ab28d228f3027c8b9
SHA256:	4bbd6db4f6bdad3bbcb134c53fb0886197c2880f9e9dd7a630707dbf333623f4
SHA512:	71c2f7bc62fbc229d8b73e76cd216d34215af55f609b5040024d0674cd6cbe6b25f807ba98f0fa1cecca3e990ba34b7641bf0b6d99d200bee6b455e6801d6515
SSDEEP:	12288:gVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1o:FfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|.

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x140041070
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x5E4E44CC [Thu Feb 20 08:35:24 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6668be91e2c948b183827f040944057f

Entrypoint Preview

Instruction
dec eax
xor eax, eax
dec eax
add eax, 5Ah
dec eax
mov dword ptr [00073D82h], ecx
dec eax
lea ecx, dword ptr [FFFFECABh]
dec eax
mov dword ptr [00073D7Ch], edx
dec eax
add eax, ecx
dec esp
mov dword ptr [00073D92h], ecx
dec esp
mov dword ptr [00073DA3h], ebp
dec esp
mov dword ptr [00073D7Ch], eax
dec esp
mov dword ptr [00073D85h], edi
dec esp
mov dword ptr [00073D86h], esi
dec esp
mov dword ptr [00073D8Fh], esp
dec eax
mov ecx, eax
dec eax
sub ecx, 5Ah
dec eax
mov dword ptr [00073D89h], esi
dec eax
test eax, eax
je 00007FB8587C17BFh
dec eax
mov dword ptr [00073D45h], esp
dec eax
mov dword ptr [00073D36h], ebp
dec eax
mov dword ptr [00073D7Fh], ebx
dec eax
mov dword ptr [00073D70h], edi
dec eax
test eax, eax
je 00007FB8587C179Eh
jmp ecx
dec eax
add edi, ecx
dec eax
mov dword ptr [FFFFEC37h], ecx
dec eax
xor ecx, eax
jmp ecx
retn 0008h
ud2
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebx
dec eax
sub esp, 00000080h
mov eax, F957B016h
mov byte ptr [esp+7Fh], 00000037h
mov edx, dword ptr [esp+78h]
inc ecx
mov eax, edx
inc ecx
or eax, 5D262B0Ch
inc esp
mov dword ptr [esp+78h], eax
dec eax
mov dword ptr [eax+eax+00h], 00000000h

Rich Headers

Programming Language:

[LNK] VS2012 UPD4 build 61030
[ASM] VS2013 UPD2 build 30501
[ C ] VS2012 UPD2 build 60315
[C++] VS2013 UPD4 build 31101
[RES] VS2012 UPD3 build 60610
[LNK] VS2017 v15.5.4 build 25834
[ C ] VS2017 v15.5.4 build 25834
[ASM] VS2010 build 30319
[EXP] VS2015 UPD1 build 23506
[IMP] VS2008 SP1 build 30729
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD2 build 60315
[C++] VS2015 UPD1 build 23506
[ C ] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x12d010	0x451b2	.nzhxgg
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa6390	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc0000	0x468	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc1000	0x2324	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x42000	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x40796	0x41000	False	0.776085486779	data	7.73364605679	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x42000	0x64fcb	0x65000	False	0.702262047494	data	7.86510283498	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa7000	0x178b8	0x18000	False	0.0694580078125	data	3.31515306295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0xbf000	0x12c	0x1000	False	0.06005859375	PEX Binary Archive	0.581723022719	IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc0000	0x880	0x1000	False	0.139892578125	data	1.23838501563	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc1000	0x2324	0x3000	False	0.0498046875	data	4.65321444248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.qkm	0xc4000	0x74a	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.cvjb	0xc5000	0x1e66	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tlmkv	0xc7000	0xbde	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.wucsxe	0xc8000	0x45174	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.wnx	0x10e000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.weqy	0x10f000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.yby	0x110000	0x1278	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ormx	0x112000	0xbde	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.dhclu	0x113000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xmiul	0x114000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tlwcxe	0x115000	0x13e	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.get	0x116000	0xbde	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.hzrd	0x117000	0x1124	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.qzu	0x119000	0x736	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.nhglos	0x11a000	0x1af	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.itzo	0x11b000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.nmsaom	0x11c000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rvhi	0x11d000	0x1af	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ucrzce	0x11e000	0x389	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ijc	0x11f000	0xbf6	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ohvs	0x120000	0x13e	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rlvrc	0x121000	0x1ee	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.yjv	0x122000	0xbde	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.clbcyy	0x123000	0x13e	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xcyn	0x124000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.boqx	0x125000	0x389	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rnlia	0x126000	0x389	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ctip	0x127000	0x5a7	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.fkv	0x128000	0x1124	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pczrv	0x12a000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ibglr	0x12b000	0x3fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.uirkq	0x12c000	0x3ba	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.nzhxgg	0x12d000	0x451c2	0x46000	False	0.218607003348	data	5.76576859256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xc00a0	0x370	data	English	United States
RT_MANIFEST	0xc0410	0x56	ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
USER32.dll	LookupIconIdFromDirectoryEx, WaitForInputIdle, GetParent, GetFocus
SETUPAPI.dll	CM_Get_Resource_Conflict_DetailsW
KERNEL32.dll	DeleteCriticalSection, DeleteTimerQueue, TerminateJobObject, GetFileInformationByHandle, GetThreadLocale, GetNamedPipeServerProcessId, GetConsoleFontSize
GDI32.dll	CreateBitmapIndirect, GetPolyFillMode
CRYPT32.dll	CertGetCTLContextProperty
ADVAPI32.dll	AddAccessDeniedObjectAce
SHLWAPI.dll	ChrCmpIW

Exports

Name	Ordinal	Address
??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ	1	0x14001880c
??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ	2	0x140009720
??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ	3	0x14003e65c
??0?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@QEAA@XZ	4	0x140032b54
??0?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@QEAA@XZ	5	0x1400069e4
??0?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@QEAA@XZ	6	0x14000e10c
??0?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@QEAA@XZ	7	0x140008030
??0?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@QEAA@XZ	8	0x140001b7c
??0?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@QEAA@XZ	9	0x1400027d0
??0?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@QEAA@XZ	10	0x140041168
??0?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@QEAA@XZ	11	0x140027df8
??0?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@QEAA@XZ	12	0x140016c88
??0?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@QEAA@XZ	13	0x1400188c0
??0?$SafeArrayAccessor@H@DirectUI@@QEAA@XZ	14	0x14002a644
??0AccessibleButton@DirectUI@@QEAA@$$QEAV01@@Z	15	0x140039f38
??0AccessibleButton@DirectUI@@QEAA@AEBV01@@Z	16	0x14000d77c
??0AccessibleButton@DirectUI@@QEAA@XZ	17	0x14003625c
??0AnimationStrip@DirectUI@@QEAA@AEBV01@@Z	18	0x14001199c
??0AnimationStrip@DirectUI@@QEAA@XZ	19	0x1400311dc
??0AutoButton@DirectUI@@QEAA@$$QEAV01@@Z	20	0x14003d490
??0AutoButton@DirectUI@@QEAA@AEBV01@@Z	21	0x140026764
??0AutoButton@DirectUI@@QEAA@XZ	22	0x14002bdc0
??0AutoLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z	23	0x14001a55c
??0AutoThread@DirectUI@@QEAA@XZ	24	0x14002f04c
??0AutoVariant@DirectUI@@QEAA@XZ	25	0x1400035c8
??0BaseScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	26	0x14000aa98
??0BaseScrollBar@DirectUI@@QEAA@AEBV01@@Z	27	0x140036e78
??0BaseScrollBar@DirectUI@@QEAA@XZ	28	0x140015124
??0BaseScrollViewer@DirectUI@@QEAA@AEBV01@@Z	29	0x140020f3c
??0BaseScrollViewer@DirectUI@@QEAA@XZ	30	0x140029bc4
??0Bind@DirectUI@@QEAA@$$QEAV01@@Z	31	0x14002a09c
??0Bind@DirectUI@@QEAA@AEBV01@@Z	32	0x140040738
??0Bind@DirectUI@@QEAA@XZ	33	0x140013a38
??0BorderLayout@DirectUI@@QEAA@AEBV01@@Z	34	0x140019500
??0BorderLayout@DirectUI@@QEAA@XZ	35	0x140016154
??0Browser@DirectUI@@QEAA@$$QEAV01@@Z	36	0x14000d6d4
??0Browser@DirectUI@@QEAA@AEBV01@@Z	37	0x14001c064
??0Browser@DirectUI@@QEAA@XZ	38	0x140004740
??0BrowserSelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z	39	0x14000ee8c
??0BrowserSelectionProxy@DirectUI@@QEAA@AEBV01@@Z	40	0x140023cc4
??0BrowserSelectionProxy@DirectUI@@QEAA@XZ	41	0x140025f04
??0Button@DirectUI@@QEAA@AEBV01@@Z	42	0x140018bc8
??0Button@DirectUI@@QEAA@XZ	43	0x140033664
??0CCAVI@DirectUI@@QEAA@$$QEAV01@@Z	44	0x140028e3c
??0CCAVI@DirectUI@@QEAA@AEBV01@@Z	45	0x1400030f4
??0CCAVI@DirectUI@@QEAA@XZ	46	0x14003c534
??0CCBase@DirectUI@@QEAA@AEBV01@@Z	47	0x140025df4
??0CCBase@DirectUI@@QEAA@KPEBG@Z	48	0x14003ec90
??0CCBaseCheckRadioButton@DirectUI@@QEAA@$$QEAV01@@Z	49	0x140040418
??0CCBaseCheckRadioButton@DirectUI@@QEAA@AEBV01@@Z	50	0x1400085dc
??0CCBaseCheckRadioButton@DirectUI@@QEAA@K@Z	51	0x14001f2b8
??0CCBaseScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	52	0x14001bf3c
??0CCBaseScrollBar@DirectUI@@QEAA@AEBV01@@Z	53	0x14001b4cc
??0CCBaseScrollBar@DirectUI@@QEAA@K@Z	54	0x14000fd3c
??0CCCheckBox@DirectUI@@QEAA@$$QEAV01@@Z	55	0x140038a78
??0CCCheckBox@DirectUI@@QEAA@AEBV01@@Z	56	0x140025684
??0CCCheckBox@DirectUI@@QEAA@K@Z	57	0x140034c80
??0CCCommandLink@DirectUI@@QEAA@$$QEAV01@@Z	58	0x1400137fc
??0CCCommandLink@DirectUI@@QEAA@AEBV01@@Z	59	0x14001a6e0
??0CCCommandLink@DirectUI@@QEAA@K@Z	60	0x140010150
??0CCHScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	61	0x14001eec8
??0CCHScrollBar@DirectUI@@QEAA@AEBV01@@Z	62	0x14001309c
??0CCHScrollBar@DirectUI@@QEAA@XZ	63	0x140040bec
??0CCListBox@DirectUI@@QEAA@$$QEAV01@@Z	64	0x1400381dc
??0CCListBox@DirectUI@@QEAA@AEBV01@@Z	65	0x140028444
??0CCListBox@DirectUI@@QEAA@XZ	66	0x14000fb74
??0CCListView@DirectUI@@QEAA@$$QEAV01@@Z	67	0x140008368
??0CCListView@DirectUI@@QEAA@AEBV01@@Z	68	0x1400084f4
??0CCListView@DirectUI@@QEAA@XZ	69	0x1400025c4
??0CCProgressBar@DirectUI@@QEAA@$$QEAV01@@Z	70	0x14002ca6c
??0CCProgressBar@DirectUI@@QEAA@AEBV01@@Z	71	0x14002969c
??0CCProgressBar@DirectUI@@QEAA@XZ	72	0x14000ebec
??0CCPushButton@DirectUI@@QEAA@$$QEAV01@@Z	73	0x1400199fc
??0CCPushButton@DirectUI@@QEAA@AEBV01@@Z	74	0x140018198
??0CCPushButton@DirectUI@@QEAA@K@Z	75	0x14000b620
??0CCRadioButton@DirectUI@@QEAA@$$QEAV01@@Z	76	0x140015ae0
??0CCRadioButton@DirectUI@@QEAA@AEBV01@@Z	77	0x14001bbb4
??0CCRadioButton@DirectUI@@QEAA@XZ	78	0x140037080
??0CCSysLink@DirectUI@@QEAA@$$QEAV01@@Z	79	0x140034e30
??0CCSysLink@DirectUI@@QEAA@AEBV01@@Z	80	0x14002f084
??0CCSysLink@DirectUI@@QEAA@XZ	81	0x140005d48
??0CCTrackBar@DirectUI@@QEAA@$$QEAV01@@Z	82	0x14001e190
??0CCTrackBar@DirectUI@@QEAA@AEBV01@@Z	83	0x14003d0f8
??0CCTrackBar@DirectUI@@QEAA@XZ	84	0x14003f348
??0CCTreeView@DirectUI@@QEAA@$$QEAV01@@Z	85	0x140035198
??0CCTreeView@DirectUI@@QEAA@AEBV01@@Z	86	0x140036b34
??0CCTreeView@DirectUI@@QEAA@K@Z	87	0x140023fc8
??0CCVScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	88	0x140004ea0
??0CCVScrollBar@DirectUI@@QEAA@AEBV01@@Z	89	0x14002493c
??0CCVScrollBar@DirectUI@@QEAA@XZ	90	0x14001b408
??0CallstackTracker@DirectUI@@QEAA@XZ	91	0x1400220d0
??0CheckBoxGlyph@DirectUI@@QEAA@AEBV01@@Z	92	0x1400147f4
??0CheckBoxGlyph@DirectUI@@QEAA@XZ	93	0x140003c98
??0ClassInfoBase@DirectUI@@QEAA@AEBV01@@Z	94	0x14002a864
??0ClassInfoBase@DirectUI@@QEAA@XZ	95	0x140022e3c
??0Clipper@DirectUI@@QEAA@$$QEAV01@@Z	96	0x14000e65c
??0Clipper@DirectUI@@QEAA@AEBV01@@Z	97	0x1400166dc
??0Clipper@DirectUI@@QEAA@XZ	98	0x140037d88
??0Combobox@DirectUI@@QEAA@AEBV01@@Z	99	0x14004160c
??0Combobox@DirectUI@@QEAA@XZ	100	0x14001f12c
??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z	101	0x140004a7c
??0DCSurface@DirectUI@@QEAA@AEBV01@@Z	102	0x14001d640
??0DCSurface@DirectUI@@QEAA@PEAUHDC__@@@Z	103	0x140013200
??0DUIFactory@DirectUI@@QEAA@PEAUHWND__@@@Z	104	0x140029cec
??0DUIXmlParser@DirectUI@@QEAA@AEBV01@@Z	105	0x1400354c4
??0DUIXmlParser@DirectUI@@QEAA@XZ	106	0x14000e7fc
??0DialogElement@DirectUI@@QEAA@$$QEAV01@@Z	107	0x140038b68
??0DialogElement@DirectUI@@QEAA@AEBV01@@Z	108	0x14001edd0
??0DialogElement@DirectUI@@QEAA@XZ	109	0x14002ccdc
??0DuiAccessible@DirectUI@@QEAA@XZ	110	0x14003cfc0
??0Edit@DirectUI@@QEAA@AEBV01@@Z	111	0x14001b060
??0Edit@DirectUI@@QEAA@XZ	112	0x1400401b4
??0Element@DirectUI@@QEAA@AEBV01@@Z	113	0x14002b214
??0Element@DirectUI@@QEAA@XZ	114	0x14001d5ac
??0ElementProvider@DirectUI@@QEAA@XZ	115	0x140030200
??0ElementProxy@DirectUI@@IEAA@XZ	116	0x14000322c
??0ElementProxy@DirectUI@@QEAA@$$QEAV01@@Z	117	0x14002dd88
??0ElementProxy@DirectUI@@QEAA@AEBV01@@Z	118	0x140040934
??0ElementWithHWND@DirectUI@@QEAA@$$QEAV01@@Z	119	0x140024a40
??0ElementWithHWND@DirectUI@@QEAA@AEBV01@@Z	120	0x140022dc0
??0ElementWithHWND@DirectUI@@QEAA@XZ	121	0x14002d99c
??0ExpandCollapseProvider@DirectUI@@QEAA@XZ	122	0x14002d034
??0ExpandCollapseProxy@DirectUI@@QEAA@$$QEAV01@@Z	123	0x140015754
??0ExpandCollapseProxy@DirectUI@@QEAA@AEBV01@@Z	124	0x140037bdc
??0ExpandCollapseProxy@DirectUI@@QEAA@XZ	125	0x14001c5e4
??0Expandable@DirectUI@@QEAA@$$QEAV01@@Z	126	0x140004874
??0Expandable@DirectUI@@QEAA@AEBV01@@Z	127	0x14002d5d0
??0Expandable@DirectUI@@QEAA@XZ	128	0x1400301f8
??0Expando@DirectUI@@QEAA@$$QEAV01@@Z	129	0x140041480
??0Expando@DirectUI@@QEAA@AEBV01@@Z	130	0x1400179fc
??0Expando@DirectUI@@QEAA@XZ	131	0x14001310c
??0ExpandoButtonGlyph@DirectUI@@QEAA@AEBV01@@Z	132	0x140001d9c
??0ExpandoButtonGlyph@DirectUI@@QEAA@XZ	133	0x14000632c
??0FillLayout@DirectUI@@QEAA@AEBV01@@Z	134	0x140004b9c
??0FillLayout@DirectUI@@QEAA@XZ	135	0x140039d8c
??0FlowLayout@DirectUI@@QEAA@AEBV01@@Z	136	0x140020b2c
??0FlowLayout@DirectUI@@QEAA@XZ	137	0x14000e63c
??0FontCache@DirectUI@@QEAA@$$QEAV01@@Z	138	0x14001f3dc
??0FontCache@DirectUI@@QEAA@AEBV01@@Z	139	0x1400103c4
??0FontCache@DirectUI@@QEAA@XZ	140	0x14000d4e8
??0FontCheckOut@DirectUI@@QEAA@PEAVElement@1@PEAUHDC__@@@Z	141	0x1400072c8
??0GridItemProvider@DirectUI@@QEAA@XZ	142	0x14001650c
??0GridItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	143	0x1400171f4
??0GridItemProxy@DirectUI@@QEAA@AEBV01@@Z	144	0x14001732c
??0GridItemProxy@DirectUI@@QEAA@XZ	145	0x1400203bc
??0GridLayout@DirectUI@@QEAA@AEBV01@@Z	146	0x14002a1dc
??0GridLayout@DirectUI@@QEAA@XZ	147	0x14001d904
??0GridProvider@DirectUI@@QEAA@XZ	148	0x14003d70c
??0GridProxy@DirectUI@@QEAA@$$QEAV01@@Z	149	0x140009618
??0GridProxy@DirectUI@@QEAA@AEBV01@@Z	150	0x140022954
??0GridProxy@DirectUI@@QEAA@XZ	151	0x14003eae4
??0HWNDElement@DirectUI@@QEAA@AEBV01@@Z	152	0x140012814
??0HWNDElement@DirectUI@@QEAA@XZ	153	0x140034838
??0HWNDElementAccessible@DirectUI@@QEAA@XZ	154	0x1400285c0
??0HWNDElementProvider@DirectUI@@QEAA@XZ	155	0x14002ca70
??0HWNDElementProxy@DirectUI@@IEAA@XZ	156	0x140023ccc
??0HWNDElementProxy@DirectUI@@QEAA@$$QEAV01@@Z	157	0x140018dcc
??0HWNDElementProxy@DirectUI@@QEAA@AEBV01@@Z	158	0x1400101b4
??0HWNDHost@DirectUI@@QEAA@AEBV01@@Z	159	0x140010e84
??0HWNDHost@DirectUI@@QEAA@XZ	160	0x140022438
??0HWNDHostAccessible@DirectUI@@QEAA@XZ	161	0x140017884
??0HWNDHostClientAccessible@DirectUI@@QEAA@XZ	162	0x14001daa4
??0IDataEngine@DirectUI@@QEAA@AEBU01@@Z	163	0x140002be0
??0IDataEngine@DirectUI@@QEAA@XZ	164	0x140006128
??0IDataEntry@DirectUI@@QEAA@AEBU01@@Z	165	0x140016ea4
??0IDataEntry@DirectUI@@QEAA@XZ	166	0x14001bf90
??0IProvider@DirectUI@@QEAA@$$QEAV01@@Z	167	0x140034cac
??0IProvider@DirectUI@@QEAA@AEBV01@@Z	168	0x14001fe0c
??0IProvider@DirectUI@@QEAA@XZ	169	0x14002716c
??0ISBLeak@DirectUI@@QEAA@$$QEAU01@@Z	170	0x1400412e0
??0ISBLeak@DirectUI@@QEAA@AEBU01@@Z	171	0x140038d64
??0ISBLeak@DirectUI@@QEAA@XZ	172	0x14000e8f0
??0IXElementCP@DirectUI@@QEAA@$$QEAV01@@Z	173	0x140039400
??0IXElementCP@DirectUI@@QEAA@AEBV01@@Z	174	0x140006688
??0IXElementCP@DirectUI@@QEAA@XZ	175	0x140031e5c
??0IXProviderCP@DirectUI@@QEAA@$$QEAV01@@Z	176	0x14000f080
??0IXProviderCP@DirectUI@@QEAA@AEBV01@@Z	177	0x14000e01c
??0IXProviderCP@DirectUI@@QEAA@XZ	178	0x1400026e0
??0InvokeHelper@DirectUI@@QEAA@XZ	179	0x14000ebdc
??0InvokeProvider@DirectUI@@QEAA@XZ	180	0x1400267f0
??0InvokeProxy@DirectUI@@QEAA@$$QEAV01@@Z	181	0x140011ab4
??0InvokeProxy@DirectUI@@QEAA@AEBV01@@Z	182	0x14000c374
??0InvokeProxy@DirectUI@@QEAA@XZ	183	0x14000382c
??0ItemList@DirectUI@@QEAA@XZ	184	0x140017284
??0Layout@DirectUI@@QEAA@AEBV01@@Z	185	0x1400022dc
??0Layout@DirectUI@@QEAA@XZ	186	0x140025b38
??0LinkedList@DirectUI@@QEAA@XZ	187	0x14002cca8
??0Macro@DirectUI@@QEAA@$$QEAV01@@Z	188	0x140030210
??0Macro@DirectUI@@QEAA@AEBV01@@Z	189	0x140033a48
??0Macro@DirectUI@@QEAA@XZ	190	0x14000d8cc
??0ModernProgressBar@DirectUI@@QEAA@XZ	191	0x140020a2c
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	192	0x14002e2d8
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	193	0x140030a00
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@XZ	194	0x14002f378
??0ModernProgressRing@DirectUI@@QEAA@XZ	195	0x14001d8ec
??0Movie@DirectUI@@QEAA@AEBV01@@Z	196	0x1400211dc
??0Movie@DirectUI@@QEAA@XZ	197	0x14003e6ac
??0NativeHWNDHost@DirectUI@@QEAA@AEBV01@@Z	198	0x14000afbc
??0NativeHWNDHost@DirectUI@@QEAA@XZ	199	0x140026930
??0Navigator@DirectUI@@QEAA@$$QEAV01@@Z	200	0x14003ac04
??0Navigator@DirectUI@@QEAA@AEBV01@@Z	201	0x140018bec
??0Navigator@DirectUI@@QEAA@XZ	202	0x14001c2e8
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	203	0x140020900
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z	204	0x14003463c
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@XZ	205	0x14003ff04
??0NineGridLayout@DirectUI@@QEAA@AEBV01@@Z	206	0x14000fa04
??0NineGridLayout@DirectUI@@QEAA@XZ	207	0x140023a10
??0PText@DirectUI@@QEAA@AEBV01@@Z	208	0x140040860
??0PText@DirectUI@@QEAA@XZ	209	0x140032da4
??0Page@DirectUI@@QEAA@$$QEAV01@@Z	210	0x1400289cc
??0Page@DirectUI@@QEAA@AEBV01@@Z	211	0x1400145dc
??0Page@DirectUI@@QEAA@XZ	212	0x1400293ac
??0Pages@DirectUI@@QEAA@$$QEAV01@@Z	213	0x140002c14
??0Pages@DirectUI@@QEAA@AEBV01@@Z	214	0x140016d40
??0Pages@DirectUI@@QEAA@XZ	215	0x1400408bc
??0Progress@DirectUI@@QEAA@AEBV01@@Z	216	0x140035a44
??0Progress@DirectUI@@QEAA@XZ	217	0x14000794c
??0ProgressRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	218	0x14002d378
??0ProgressRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	219	0x1400288fc
??0ProgressRangeValueProxy@DirectUI@@QEAA@XZ	220	0x1400386e0
??0ProviderProxy@DirectUI@@IEAA@XZ	221	0x1400067e0
??0ProviderProxy@DirectUI@@QEAA@$$QEAV01@@Z	222	0x140019620
??0ProviderProxy@DirectUI@@QEAA@AEBV01@@Z	223	0x14003e3f0
??0Proxy@DirectUI@@QEAA@AEBV01@@Z	224	0x14001e930
??0Proxy@DirectUI@@QEAA@XZ	225	0x1400194d4
??0PushButton@DirectUI@@QEAA@$$QEAV01@@Z	226	0x140033390
??0PushButton@DirectUI@@QEAA@AEBV01@@Z	227	0x140037ec4
??0PushButton@DirectUI@@QEAA@XZ	228	0x14000a20c
??0RadioButtonGlyph@DirectUI@@QEAA@AEBV01@@Z	229	0x1400190a8
??0RadioButtonGlyph@DirectUI@@QEAA@XZ	230	0x140002494
??0RangeValueProvider@DirectUI@@QEAA@XZ	231	0x1400241d8
??0RangeValueProxy@DirectUI@@IEAA@XZ	232	0x140019a30
??0RangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	233	0x140024f70
??0RangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	234	0x140032fe0
??0RefPointElement@DirectUI@@QEAA@AEBV01@@Z	235	0x1400195d4
??0RefPointElement@DirectUI@@QEAA@XZ	236	0x140007cd0
??0RefcountBase@DirectUI@@QEAA@XZ	237	0x14000d2e4
??0RepeatButton@DirectUI@@QEAA@AEBV01@@Z	238	0x140005684
??0RepeatButton@DirectUI@@QEAA@XZ	239	0x140015334
??0Repeater@DirectUI@@QEAA@$$QEAV01@@Z	240	0x14000846c
??0Repeater@DirectUI@@QEAA@AEBV01@@Z	241	0x1400012c4
??0Repeater@DirectUI@@QEAA@XZ	242	0x1400035a8
??0ResourceModuleHandles@DirectUI@@QEAA@XZ	243	0x14003ba20
??0RichText@DirectUI@@QEAA@XZ	244	0x140017a9c
??0RowLayout@DirectUI@@QEAA@AEBV01@@Z	245	0x140027da4
??0RowLayout@DirectUI@@QEAA@XZ	246	0x140014520
??0ScrollBar@DirectUI@@QEAA@AEBV01@@Z	247	0x14002ba10
??0ScrollBar@DirectUI@@QEAA@XZ	248	0x14001fefc
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	249	0x14003e368
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	250	0x14000188c
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@XZ	251	0x1400305cc
??0ScrollItemProvider@DirectUI@@QEAA@XZ	252	0x140006ed4
??0ScrollItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	253	0x140033544
??0ScrollItemProxy@DirectUI@@QEAA@AEBV01@@Z	254	0x14001e9a8
??0ScrollItemProxy@DirectUI@@QEAA@XZ	255	0x1400080d4
??0ScrollProvider@DirectUI@@QEAA@XZ	256	0x14001bbd8
??0ScrollProxy@DirectUI@@QEAA@$$QEAV01@@Z	257	0x140034330
??0ScrollProxy@DirectUI@@QEAA@AEBV01@@Z	258	0x140007aa4
??0ScrollProxy@DirectUI@@QEAA@XZ	259	0x140025c38
??0ScrollViewer@DirectUI@@QEAA@AEBV01@@Z	260	0x140007b10
??0ScrollViewer@DirectUI@@QEAA@XZ	261	0x140025bd4
??0SelectionItemProvider@DirectUI@@QEAA@XZ	262	0x140030978
??0SelectionItemProxy@DirectUI@@IEAA@XZ	263	0x140020ae0
??0SelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	264	0x1400218dc
??0SelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z	265	0x140013344
??0SelectionProvider@DirectUI@@QEAA@XZ	266	0x1400340c8
??0SelectionProxy@DirectUI@@IEAA@XZ	267	0x14002a2a0
??0SelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z	268	0x140021614
??0SelectionProxy@DirectUI@@QEAA@AEBV01@@Z	269	0x14003253c
??0Selector@DirectUI@@QEAA@AEBV01@@Z	270	0x140040730
??0Selector@DirectUI@@QEAA@XZ	271	0x14001bbb4
??0SelectorNoDefault@DirectUI@@QEAA@$$QEAV01@@Z	272	0x1400168a8
??0SelectorNoDefault@DirectUI@@QEAA@AEBV01@@Z	273	0x140008530
??0SelectorNoDefault@DirectUI@@QEAA@XZ	274	0x140009e90
??0SelectorSelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	275	0x140016fa8
??0SelectorSelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z	276	0x140030e90
??0SelectorSelectionItemProxy@DirectUI@@QEAA@XZ	277	0x1400304ec
??0SelectorSelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z	278	0x14000d558
??0SelectorSelectionProxy@DirectUI@@QEAA@AEBV01@@Z	279	0x140037520
??0SelectorSelectionProxy@DirectUI@@QEAA@XZ	280	0x14000cfbc
??0ShellBorderLayout@DirectUI@@QEAA@AEBV01@@Z	281	0x140036dfc
??0ShellBorderLayout@DirectUI@@QEAA@XZ	282	0x140031598
??0StyleSheet@DirectUI@@QEAA@$$QEAV01@@Z	283	0x140037d6c
??0StyleSheet@DirectUI@@QEAA@AEBV01@@Z	284	0x140018ba4
??0StyleSheet@DirectUI@@QEAA@XZ	285	0x14002d2d4
??0StyledScrollViewer@DirectUI@@QEAA@AEBV01@@Z	286	0x14002fb04
??0StyledScrollViewer@DirectUI@@QEAA@XZ	287	0x140019b0c
??0Surface@DirectUI@@QEAA@AEBV01@@Z	288	0x14003181c
??0Surface@DirectUI@@QEAA@XZ	289	0x14001142c
??0TableItemProvider@DirectUI@@QEAA@XZ	290	0x1400267a4
??0TableItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	291	0x1400189f0
??0TableItemProxy@DirectUI@@QEAA@AEBV01@@Z	292	0x14003e940
??0TableItemProxy@DirectUI@@QEAA@XZ	293	0x14002e09c
??0TableLayout@DirectUI@@QEAA@AEBV01@@Z	294	0x140014244
??0TableLayout@DirectUI@@QEAA@XZ	295	0x1400409ac
??0TableProvider@DirectUI@@QEAA@XZ	296	0x14001d614
??0TableProxy@DirectUI@@QEAA@$$QEAV01@@Z	297	0x14001aeac
??0TableProxy@DirectUI@@QEAA@AEBV01@@Z	298	0x140018218
??0TableProxy@DirectUI@@QEAA@XZ	299	0x140029220
??0TaskPage@DirectUI@@QEAA@AEBV01@@Z	300	0x140029290
??0TaskPage@DirectUI@@QEAA@XZ	301	0x140004bc4
??0TextGraphic@DirectUI@@QEAA@$$QEAV01@@Z	302	0x14000a100
??0TextGraphic@DirectUI@@QEAA@AEBV01@@Z	303	0x14001fc6c
??0TextGraphic@DirectUI@@QEAA@XZ	304	0x14000fd50
??0Thumb@DirectUI@@QEAA@AEBV01@@Z	305	0x140041398
??0Thumb@DirectUI@@QEAA@XZ	306	0x140002a54
??0ToggleProvider@DirectUI@@QEAA@XZ	307	0x1400376f4
??0ToggleProxy@DirectUI@@QEAA@$$QEAV01@@Z	308	0x140030a34
??0ToggleProxy@DirectUI@@QEAA@AEBV01@@Z	309	0x14002fa50
??0ToggleProxy@DirectUI@@QEAA@XZ	310	0x140026840
??0TouchButton@DirectUI@@QEAA@XZ	311	0x1400278f8
??0TouchCheckBox@DirectUI@@QEAA@XZ	312	0x14001d1ac
??0TouchCheckBoxGlyph@DirectUI@@QEAA@XZ	313	0x14002fe60
??0TouchCommandButton@DirectUI@@QEAA@XZ	314	0x14000dacc
??0TouchEdit2@DirectUI@@QEAA@XZ	315	0x140015e2c
??0TouchHWNDElement@DirectUI@@QEAA@XZ	316	0x14000ff0c
??0TouchHyperLink@DirectUI@@QEAA@XZ	317	0x14002f388
??0TouchRepeatButton@DirectUI@@QEAA@XZ	318	0x1400218a4
??0TouchScrollBar@DirectUI@@QEAA@XZ	319	0x14001196c
??0TouchSelect@DirectUI@@QEAA@XZ	320	0x1400209b4
??0TouchSelectItem@DirectUI@@QEAA@XZ	321	0x140030b1c
??0UnknownElement@DirectUI@@QEAA@AEBV01@@Z	322	0x14002c67c
??0UnknownElement@DirectUI@@QEAA@XZ	323	0x140036b1c
??0ValueProvider@DirectUI@@QEAA@XZ	324	0x140004668
??0ValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	325	0x14001a7e0
??0ValueProxy@DirectUI@@QEAA@AEBV01@@Z	326	0x14001c63c
??0ValueProxy@DirectUI@@QEAA@XZ	327	0x14001a668
??0VerticalFlowLayout@DirectUI@@QEAA@AEBV01@@Z	328	0x14003c1b8
??0VerticalFlowLayout@DirectUI@@QEAA@XZ	329	0x14001dd58
??0Viewer@DirectUI@@QEAA@AEBV01@@Z	330	0x14003d608
??0Viewer@DirectUI@@QEAA@XZ	331	0x140003580
??0XBaby@DirectUI@@QEAA@AEBV01@@Z	332	0x1400414c8
??0XBaby@DirectUI@@QEAA@XZ	333	0x140036178
??0XElement@DirectUI@@QEAA@AEBV01@@Z	334	0x140034a64
??0XElement@DirectUI@@QEAA@XZ	335	0x1400209d4
??0XHost@DirectUI@@QEAA@XZ	336	0x140014c10
??0XProvider@DirectUI@@QEAA@AEBV01@@Z	337	0x14000dccc
??0XProvider@DirectUI@@QEAA@XZ	338	0x1400114f0
??0XResourceProvider@DirectUI@@QEAA@$$QEAV01@@Z	339	0x140010fb8
??0XResourceProvider@DirectUI@@QEAA@AEBV01@@Z	340	0x14001d100
??0XResourceProvider@DirectUI@@QEAA@XZ	341	0x14000abe4
??1?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@UEAA@XZ	342	0x14000ab14
??1?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@UEAA@XZ	343	0x14000e670
??1?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@UEAA@XZ	344	0x140029bc0
??1?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@UEAA@XZ	345	0x140024ff0
??1?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@UEAA@XZ	346	0x140012ca0
??1?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@UEAA@XZ	347	0x1400052b8
??1?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@UEAA@XZ	348	0x14002b334
??1?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@UEAA@XZ	349	0x1400396a8
??1?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@UEAA@XZ	350	0x140039a3c
??1?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@UEAA@XZ	351	0x14002e54c
??1?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@UEAA@XZ	352	0x140030540
??1?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@UEAA@XZ	353	0x140005d0c
??1?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@UEAA@XZ	354	0x140018b20
??1?$SafeArrayAccessor@H@DirectUI@@QEAA@XZ	355	0x140019f78
??1AccessibleButton@DirectUI@@UEAA@XZ	356	0x140011408
??1AnimationStrip@DirectUI@@UEAA@XZ	357	0x140022f84
??1AutoButton@DirectUI@@UEAA@XZ	358	0x1400392d4
??1AutoLock@DirectUI@@QEAA@XZ	359	0x14002d860
??1AutoThread@DirectUI@@QEAA@XZ	360	0x14002171c
??1AutoVariant@DirectUI@@QEAA@XZ	361	0x140036d98
??1BaseScrollViewer@DirectUI@@UEAA@XZ	362	0x140005590
??1Bind@DirectUI@@UEAA@XZ	363	0x140006f1c
??1BorderLayout@DirectUI@@UEAA@XZ	364	0x1400085c8
??1Browser@DirectUI@@UEAA@XZ	365	0x1400035a4
??1Button@DirectUI@@UEAA@XZ	366	0x140006c38
??1CCAVI@DirectUI@@UEAA@XZ	367	0x14003181c
??1CCBase@DirectUI@@UEAA@XZ	368	0x140038168
??1CCBaseCheckRadioButton@DirectUI@@UEAA@XZ	369	0x14000b830
??1CCBaseScrollBar@DirectUI@@UEAA@XZ	370	0x140030680
??1CCCheckBox@DirectUI@@UEAA@XZ	371	0x140006bc4
??1CCCommandLink@DirectUI@@UEAA@XZ	372	0x14001d984
??1CCHScrollBar@DirectUI@@UEAA@XZ	373	0x14002d12c
??1CCListBox@DirectUI@@UEAA@XZ	374	0x1400023e8
??1CCListView@DirectUI@@UEAA@XZ	375	0x140007668
??1CCProgressBar@DirectUI@@UEAA@XZ	376	0x140029468
??1CCPushButton@DirectUI@@UEAA@XZ	377	0x1400153a4
??1CCRadioButton@DirectUI@@UEAA@XZ	378	0x140041510
??1CCSysLink@DirectUI@@UEAA@XZ	379	0x14000de0c
??1CCTrackBar@DirectUI@@UEAA@XZ	380	0x14002f32c
??1CCTreeView@DirectUI@@UEAA@XZ	381	0x140006a20
??1CCVScrollBar@DirectUI@@UEAA@XZ	382	0x140022d00
??1CallstackTracker@DirectUI@@QEAA@XZ	383	0x14003e7ac
??1CheckBoxGlyph@DirectUI@@UEAA@XZ	384	0x140005fd4
??1ClassInfoBase@DirectUI@@UEAA@XZ	385	0x140011730
??1Clipper@DirectUI@@UEAA@XZ	386	0x14001c4e4
??1Combobox@DirectUI@@UEAA@XZ	387	0x14001c72c
??1CritSecLock@DirectUI@@QEAA@XZ	388	0x14001c574
??1DCSurface@DirectUI@@UEAA@XZ	389	0x140012464
??1DUIFactory@DirectUI@@QEAA@XZ	390	0x140018c04
??1DUIXmlParser@DirectUI@@UEAA@XZ	391	0x14001ca48
??1DialogElement@DirectUI@@UEAA@XZ	392	0x14001c910
??1DuiAccessible@DirectUI@@UEAA@XZ	393	0x14003c6b4
??1Edit@DirectUI@@UEAA@XZ	394	0x14000e24c
??1Element@DirectUI@@UEAA@XZ	395	0x14001e7b8
??1ElementProvider@DirectUI@@UEAA@XZ	396	0x14001c9c8
??1ElementWithHWND@DirectUI@@UEAA@XZ	397	0x140011de8
??1ExpandCollapseProvider@DirectUI@@UEAA@XZ	398	0x14001ee00
??1Expandable@DirectUI@@UEAA@XZ	399	0x14002cd10
??1Expando@DirectUI@@UEAA@XZ	400	0x14002b4a0
??1ExpandoButtonGlyph@DirectUI@@UEAA@XZ	401	0x140040554
??1FillLayout@DirectUI@@UEAA@XZ	402	0x14003d060
??1FlowLayout@DirectUI@@UEAA@XZ	403	0x14001e7a8
??1FontCheckOut@DirectUI@@QEAA@XZ	404	0x14002d710
??1GridItemProvider@DirectUI@@UEAA@XZ	405	0x140001f9c
??1GridLayout@DirectUI@@UEAA@XZ	406	0x1400353c0
??1GridProvider@DirectUI@@UEAA@XZ	407	0x14002e2ec
??1HWNDElement@DirectUI@@UEAA@XZ	408	0x14002b220
??1HWNDElementAccessible@DirectUI@@UEAA@XZ	409	0x14001b65c
??1HWNDElementProvider@DirectUI@@UEAA@XZ	410	0x14000543c
??1HWNDHost@DirectUI@@UEAA@XZ	411	0x140025a4c
??1HWNDHostAccessible@DirectUI@@UEAA@XZ	412	0x14001f69c
??1HWNDHostClientAccessible@DirectUI@@UEAA@XZ	413	0x140005088
??1IDataEngine@DirectUI@@UEAA@XZ	414	0x14001186c
??1IDataEntry@DirectUI@@UEAA@XZ	415	0x14002b10c
??1InvokeHelper@DirectUI@@UEAA@XZ	416	0x14002df4c
??1InvokeProvider@DirectUI@@UEAA@XZ	417	0x140015f90
??1ItemList@DirectUI@@UEAA@XZ	418	0x140020c7c
??1Layout@DirectUI@@UEAA@XZ	419	0x140029a5c
??1LinkedList@DirectUI@@QEAA@XZ	420	0x140001888
??1Macro@DirectUI@@UEAA@XZ	421	0x140005314
??1ModernProgressBar@DirectUI@@UEAA@XZ	422	0x14000b75c
??1ModernProgressRing@DirectUI@@UEAA@XZ	423	0x140039c38
??1Movie@DirectUI@@UEAA@XZ	424	0x1400374c0
??1NativeHWNDHost@DirectUI@@UEAA@XZ	425	0x14000e678
??1Navigator@DirectUI@@UEAA@XZ	426	0x14002ea28
??1NineGridLayout@DirectUI@@UEAA@XZ	427	0x140023394
??1PText@DirectUI@@UEAA@XZ	428	0x1400247cc
??1Page@DirectUI@@UEAA@XZ	429	0x14002f71c
??1Pages@DirectUI@@UEAA@XZ	430	0x1400282b0
??1Progress@DirectUI@@UEAA@XZ	431	0x14003eebc
??1Proxy@DirectUI@@UEAA@XZ	432	0x14000cebc
??1PushButton@DirectUI@@UEAA@XZ	433	0x14001b804
??1RadioButtonGlyph@DirectUI@@UEAA@XZ	434	0x1400055c8
??1RangeValueProvider@DirectUI@@UEAA@XZ	435	0x140012e84
??1RefPointElement@DirectUI@@UEAA@XZ	436	0x140032e04
??1RefcountBase@DirectUI@@UEAA@XZ	437	0x140005b8c
??1RepeatButton@DirectUI@@UEAA@XZ	438	0x14000b924
??1Repeater@DirectUI@@UEAA@XZ	439	0x140023670
??1ResourceModuleHandles@DirectUI@@QEAA@XZ	440	0x140010d60
??1RichText@DirectUI@@UEAA@XZ	441	0x140031c60
??1RowLayout@DirectUI@@UEAA@XZ	442	0x140038164
??1ScrollBar@DirectUI@@UEAA@XZ	443	0x140009710
??1ScrollItemProvider@DirectUI@@UEAA@XZ	444	0x140007610
??1ScrollProvider@DirectUI@@UEAA@XZ	445	0x1400396bc
??1ScrollViewer@DirectUI@@UEAA@XZ	446	0x14003ce04
??1SelectionItemProvider@DirectUI@@UEAA@XZ	447	0x140039368
??1SelectionProvider@DirectUI@@UEAA@XZ	448	0x140026a9c
??1Selector@DirectUI@@UEAA@XZ	449	0x14000feb4
??1SelectorNoDefault@DirectUI@@UEAA@XZ	450	0x140009d90
??1ShellBorderLayout@DirectUI@@UEAA@XZ	451	0x14003c1f0
??1StyledScrollViewer@DirectUI@@UEAA@XZ	452	0x14003bb1c
??1Surface@DirectUI@@UEAA@XZ	453	0x140013fec
??1TableItemProvider@DirectUI@@UEAA@XZ	454	0x140025428
??1TableLayout@DirectUI@@UEAA@XZ	455	0x1400293f0
??1TableProvider@DirectUI@@UEAA@XZ	456	0x1400195c0
??1TaskPage@DirectUI@@UEAA@XZ	457	0x140036998
??1TextGraphic@DirectUI@@UEAA@XZ	458	0x140032404
??1Thumb@DirectUI@@UEAA@XZ	459	0x140012f68
??1ToggleProvider@DirectUI@@UEAA@XZ	460	0x14002e9d0
??1TouchButton@DirectUI@@UEAA@XZ	461	0x14002aa40
??1TouchCheckBox@DirectUI@@UEAA@XZ	462	0x14002d5ec
??1TouchCheckBoxGlyph@DirectUI@@UEAA@XZ	463	0x1400412ac
??1TouchHWNDElement@DirectUI@@UEAA@XZ	464	0x14002c474
??1TouchHyperLink@DirectUI@@UEAA@XZ	465	0x140010670
??1TouchScrollBar@DirectUI@@UEAA@XZ	466	0x140035734
??1TouchSelect@DirectUI@@UEAA@XZ	467	0x14003c274
??1TouchSelectItem@DirectUI@@UEAA@XZ	468	0x1400041c4
??1UnknownElement@DirectUI@@UEAA@XZ	469	0x14003c3e8
??1ValueProvider@DirectUI@@UEAA@XZ	470	0x14001b418
??1VerticalFlowLayout@DirectUI@@UEAA@XZ	471	0x14001d928
??1Viewer@DirectUI@@UEAA@XZ	472	0x14002b3c4
??1XBaby@DirectUI@@UEAA@XZ	473	0x140022aec
??1XElement@DirectUI@@UEAA@XZ	474	0x140039104
??1XHost@DirectUI@@QEAA@XZ	475	0x14002c5c0
??1XProvider@DirectUI@@UEAA@XZ	476	0x14003c31c
??4?$FunctionDefinition@H@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	477	0x14001035c
??4?$FunctionDefinition@H@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	478	0x140017ed8
??4?$FunctionDefinition@K@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	479	0x14002bd34
??4?$FunctionDefinition@K@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	480	0x140026228
??4?$FunctionDefinition@PEAVValue@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	481	0x14003604c
??4?$FunctionDefinition@PEAVValue@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	482	0x14000fd14
??4?$FunctionDefinition@UScaledRECT@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	483	0x140019da8
??4?$FunctionDefinition@UScaledRECT@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	484	0x140028110
??4?$FunctionDefinition@UScaledSIZE@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	485	0x14001ac00
??4?$FunctionDefinition@UScaledSIZE@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	486	0x140038f94
??4ACCESSIBLEROLE@AccessibleButton@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	487	0x14002ad30
??4ACCESSIBLEROLE@AccessibleButton@DirectUI@@QEAAAEAU012@AEBU012@@Z	488	0x140040070
??4AccessibleButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	489	0x1400370ac
??4AccessibleButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	490	0x140032a50
??4AnimationStrip@DirectUI@@QEAAAEAV01@AEBV01@@Z	491	0x140019cc0
??4AutoButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	492	0x14001ad88
??4AutoButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	493	0x1400039c8
??4AutoLock@DirectUI@@QEAAAEAV01@AEBV01@@Z	494	0x140006394
??4AutoThread@DirectUI@@QEAAAEAV01@AEBV01@@Z	495	0x140033b50
??4AutoVariant@DirectUI@@QEAAAEAV01@AEBV01@@Z	496	0x14002aec4
??4BaseScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	497	0x14002b2ac
??4BaseScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	498	0x140012cbc
??4BaseScrollViewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	499	0x14003c868
??4Bind@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	500	0x140008f3c
??4Bind@DirectUI@@QEAAAEAV01@AEBV01@@Z	501	0x1400389e4
??4BorderLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	502	0x1400241d8
??4Browser@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	503	0x1400201d4
??4Browser@DirectUI@@QEAAAEAV01@AEBV01@@Z	504	0x14001936c
??4BrowserSelectionProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	505	0x140004d5c
??4BrowserSelectionProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	506	0x140007dd0
??4Button@DirectUI@@QEAAAEAV01@AEBV01@@Z	507	0x14003d3a0
??4CCAVI@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	508	0x1400123b0
??4CCAVI@DirectUI@@QEAAAEAV01@AEBV01@@Z	509	0x1400335c4
??4CCBase@DirectUI@@QEAAAEAV01@AEBV01@@Z	510	0x1400354e8
??4CCBaseCheckRadioButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	511	0x1400027cc
??4CCBaseCheckRadioButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	512	0x140006660
??4CCBaseScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	513	0x14003d8ec
??4CCBaseScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	514	0x140023f58
??4CCCheckBox@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	515	0x1400396a0
??4CCCheckBox@DirectUI@@QEAAAEAV01@AEBV01@@Z	516	0x1400199c8
??4CCCommandLink@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	517	0x14000de78
??4CCCommandLink@DirectUI@@QEAAAEAV01@AEBV01@@Z	518	0x140016a88
??4CCHScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	519	0x14000d778
??4CCHScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	520	0x140008fd4
??4CCListBox@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	521	0x14002382c
??4CCListBox@DirectUI@@QEAAAEAV01@AEBV01@@Z	522	0x140006f08
??4CCListView@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	523	0x14000da64
??4CCListView@DirectUI@@QEAAAEAV01@AEBV01@@Z	524	0x140027454
??4CCProgressBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	525	0x14003f158
??4CCProgressBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	526	0x14001db90
??4CCPushButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	527	0x140001db4
??4CCPushButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	528	0x1400113c4
??4CCRadioButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	529	0x1400348dc
??4CCRadioButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	530	0x140005524
??4CCSysLink@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	531	0x14002823c
??4CCSysLink@DirectUI@@QEAAAEAV01@AEBV01@@Z	532	0x140029688
??4CCTrackBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	533	0x140027898
??4CCTrackBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	534	0x14001257c
??4CCTreeView@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	535	0x140022c98
??4CCTreeView@DirectUI@@QEAAAEAV01@AEBV01@@Z	536	0x140005b28
??4CCVScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	537	0x14000fba8
??4CCVScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	538	0x140007400
??4CallstackTracker@DirectUI@@QEAAAEAV01@AEBV01@@Z	539	0x14000a40c
??4CheckBoxGlyph@DirectUI@@QEAAAEAV01@AEBV01@@Z	540	0x14002592c
??4ClassInfoBase@DirectUI@@QEAAAEAV01@AEBV01@@Z	541	0x14002f1f0
??4Clipper@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	542	0x1400292ec
??4Clipper@DirectUI@@QEAAAEAV01@AEBV01@@Z	543	0x140027b20
??4Combobox@DirectUI@@QEAAAEAV01@AEBV01@@Z	544	0x140009eec
??4CritSecLock@DirectUI@@QEAAAEAV01@AEBV01@@Z	545	0x14000f2a4
??4DCSurface@DirectUI@@QEAAAEAV01@AEBV01@@Z	546	0x140013500
??4DUIFactory@DirectUI@@QEAAAEAV01@AEBV01@@Z	547	0x140030724
??4DUIXmlParser@DirectUI@@QEAAAEAV01@AEBV01@@Z	548	0x140001dbc
??4DialogElement@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	549	0x140041324
??4DialogElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	550	0x1400023a4
??4DialogElementCore@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	551	0x1400274b0
??4DialogElementCore@DirectUI@@QEAAAEAV01@AEBV01@@Z	552	0x140002afc
??4DuiNavigate@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	553	0x140002828
??4DuiNavigate@DirectUI@@QEAAAEAV01@AEBV01@@Z	554	0x1400123b0
??4Edit@DirectUI@@QEAAAEAV01@AEBV01@@Z	555	0x140020010
??4Element@DirectUI@@QEAAAEAV01@AEBV01@@Z	556	0x14000bc14
??4ElementProviderManager@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	557	0x140037614
??4ElementProviderManager@DirectUI@@QEAAAEAV01@AEBV01@@Z	558	0x14000d840
??4ElementProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	559	0x14002100c
??4ElementProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	560	0x14001b9ac
??4ElementWithHWND@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	561	0x14002f8e4
??4ElementWithHWND@DirectUI@@QEAAAEAV01@AEBV01@@Z	562	0x140022944
??4EventManager@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	563	0x140022954
??4EventManager@DirectUI@@QEAAAEAV01@AEBV01@@Z	564	0x140008c54
??4ExpandCollapseProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	565	0x14003e388
??4ExpandCollapseProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	566	0x14001c238
??4Expandable@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	567	0x140013434
??4Expandable@DirectUI@@QEAAAEAV01@AEBV01@@Z	568	0x1400272b0
??4Expando@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	569	0x14003ef74
??4Expando@DirectUI@@QEAAAEAV01@AEBV01@@Z	570	0x140002e24
??4ExpandoButtonGlyph@DirectUI@@QEAAAEAV01@AEBV01@@Z	571	0x140019dd4
??4Expression@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	572	0x1400097e8
??4Expression@DirectUI@@QEAAAEAV01@AEBV01@@Z	573	0x14003cd10
??4FillLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	574	0x14002fb80
??4FlowLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	575	0x140002a34
??4FontCache@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	576	0x140024200
??4FontCache@DirectUI@@QEAAAEAV01@AEBV01@@Z	577	0x140017048
??4FontCheckOut@DirectUI@@QEAAAEAV01@AEBV01@@Z	578	0x14000ca04
??4GridItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	579	0x1400264c4
??4GridItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	580	0x140027540
??4GridLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	581	0x140034bd0
??4GridProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	582	0x1400221d4
??4GridProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	583	0x14001754c
??4HWNDElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	584	0x14003af10
??4HWNDElementProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	585	0x1400057d8
??4HWNDElementProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	586	0x14002a054
??4HWNDHost@DirectUI@@QEAAAEAV01@AEBV01@@Z	587	0x1400289dc
??4IDataEngine@DirectUI@@QEAAAEAU01@AEBU01@@Z	588	0x14003c850
??4IDataEntry@DirectUI@@QEAAAEAU01@AEBU01@@Z	589	0x1400314e8
??4IProvider@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	590	0x14001bd80
??4IProvider@DirectUI@@QEAAAEAV01@AEBV01@@Z	591	0x1400052b4
??4ISBLeak@DirectUI@@QEAAAEAU01@$$QEAU01@@Z	592	0x140035f14
??4ISBLeak@DirectUI@@QEAAAEAU01@AEBU01@@Z	593	0x140017900
??4IXElementCP@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	594	0x140014228
??4IXElementCP@DirectUI@@QEAAAEAV01@AEBV01@@Z	595	0x140024fa4
??4IXProviderCP@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	596	0x14001c0dc
??4IXProviderCP@DirectUI@@QEAAAEAV01@AEBV01@@Z	597	0x14002c194
??4InvokeManager@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	598	0x14000d5d0
??4InvokeManager@DirectUI@@QEAAAEAV01@AEBV01@@Z	599	0x1400161e0
??4InvokeProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	600	0x14002075c
??4InvokeProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	601	0x14000cd88
??4Layout@DirectUI@@QEAAAEAV01@AEBV01@@Z	602	0x140040e00
??4LinkedList@DirectUI@@QEAAAEAV01@AEBV01@@Z	603	0x140003310
??4LinkedListNode@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	604	0x14001c0a0
??4LinkedListNode@DirectUI@@QEAAAEAV01@AEBV01@@Z	605	0x140006038
??4Macro@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	606	0x140024130
??4Macro@DirectUI@@QEAAAEAV01@AEBV01@@Z	607	0x140026630
??4ModernProgressBarRangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	608	0x140024e30
??4ModernProgressBarRangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	609	0x1400224c8
??4Movie@DirectUI@@QEAAAEAV01@AEBV01@@Z	610	0x14001dbec
??4NativeHWNDHost@DirectUI@@QEAAAEAV01@AEBV01@@Z	611	0x14000f598
??4NavReference@DirectUI@@QEAAAEAU01@$$QEAU01@@Z	612	0x14002cfb0
??4NavReference@DirectUI@@QEAAAEAU01@AEBU01@@Z	613	0x14000e880
??4NavScoring@DirectUI@@QEAAAEAU01@$$QEAU01@@Z	614	0x14001db94
??4NavScoring@DirectUI@@QEAAAEAU01@AEBU01@@Z	615	0x14001fc40
??4Navigator@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	616	0x1400166f4
??4Navigator@DirectUI@@QEAAAEAV01@AEBV01@@Z	617	0x1400088d0
??4NavigatorSelectionItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	618	0x14002714c
??4NavigatorSelectionItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	619	0x140005e00
??4NineGridLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	620	0x14000af04
??4PText@DirectUI@@QEAAAEAV01@AEBV01@@Z	621	0x140003518
??4PVLAnimation@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	622	0x140031324
??4PVLAnimation@DirectUI@@QEAAAEAV01@AEBV01@@Z	623	0x14000787c
??4Page@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	624	0x14000f828
??4Page@DirectUI@@QEAAAEAV01@AEBV01@@Z	625	0x14002a390
??4Pages@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	626	0x14003f7c8
??4Pages@DirectUI@@QEAAAEAV01@AEBV01@@Z	627	0x140030dc8
??4Progress@DirectUI@@QEAAAEAV01@AEBV01@@Z	628	0x14000f84c
??4ProgressRangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	629	0x14003d47c
??4ProgressRangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	630	0x1400027bc
??4ProviderProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	631	0x14001ea08
??4ProviderProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	632	0x14002a760
??4Proxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	633	0x14004064c
??4PushButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	634	0x14001f7d4
??4PushButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	635	0x1400178f4
??4RadioButtonGlyph@DirectUI@@QEAAAEAV01@AEBV01@@Z	636	0x14000b9e8
??4RangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	637	0x14000af48
??4RangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	638	0x14001360c
??4RefPointElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	639	0x140024378
??4RepeatButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	640	0x14000b994
??4Repeater@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	641	0x14001e76c
??4Repeater@DirectUI@@QEAAAEAV01@AEBV01@@Z	642	0x14001dd1c
??4ResourceModuleHandles@DirectUI@@QEAAAEAV01@AEBV01@@Z	643	0x14003319c
??4RowLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	644	0x14001dc4c
??4Schema@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	645	0x140036ddc
??4Schema@DirectUI@@QEAAAEAV01@AEBV01@@Z	646	0x14003e338
??4ScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	647	0x14002ade0
??4ScrollBarRangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	648	0x14000d1cc
??4ScrollBarRangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	649	0x1400013c4
??4ScrollItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	650	0x140039a34
??4ScrollItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	651	0x140039328
??4ScrollProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	652	0x140022fb0
??4ScrollProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	653	0x14000f7fc
??4ScrollViewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	654	0x14002c790
??4SelectionItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	655	0x140030220
??4SelectionItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	656	0x14001dccc
??4SelectionProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	657	0x140016178
??4SelectionProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	658	0x14001d278
??4Selector@DirectUI@@QEAAAEAV01@AEBV01@@Z	659	0x1400213b0
??4SelectorNoDefault@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	660	0x14001ea68
??4SelectorNoDefault@DirectUI@@QEAAAEAV01@AEBV01@@Z	661	0x140007870
??4SelectorSelectionItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	662	0x140037368
??4SelectorSelectionItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	663	0x14001263c
??4SelectorSelectionProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	664	0x140014d0c
??4SelectorSelectionProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	665	0x14000d320
??4ShellBorderLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	666	0x14003cce0
??4StyleSheet@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	667	0x140014664
??4StyleSheet@DirectUI@@QEAAAEAV01@AEBV01@@Z	668	0x140005664
??4StyledScrollViewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	669	0x1400012fc
??4Surface@DirectUI@@QEAAAEAV01@AEBV01@@Z	670	0x14001f038
??4TableItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	671	0x14002fa54
??4TableItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	672	0x14000d1ec
??4TableLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	673	0x14001b768
??4TableProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	674	0x14000a084
??4TableProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	675	0x140006dc4
??4TaskPage@DirectUI@@QEAAAEAV01@AEBV01@@Z	676	0x140017d34
??4TextGraphic@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	677	0x14002eb90
??4TextGraphic@DirectUI@@QEAAAEAV01@AEBV01@@Z	678	0x14000d708
??4Thumb@DirectUI@@QEAAAEAV01@AEBV01@@Z	679	0x140005d90
??4ToggleProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	680	0x14000c948
??4ToggleProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	681	0x14002b018
??4UnknownElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	682	0x140030730
??4Value@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	683	0x14003b698
??4Value@DirectUI@@QEAAAEAV01@AEBV01@@Z	684	0x140012eac
??4ValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	685	0x140037890
??4ValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	686	0x140026cf4
??4VerticalFlowLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	687	0x140034798
??4Viewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	688	0x14004136c
??4XBaby@DirectUI@@QEAAAEAV01@AEBV01@@Z	689	0x140036a80
??4XElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	690	0x140020ef0
??4XHost@DirectUI@@QEAAAEAV01@AEBV01@@Z	691	0x1400388c0
??4XProvider@DirectUI@@QEAAAEAV01@AEBV01@@Z	692	0x1400205c4
??4XResourceProvider@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	693	0x14002145c
??4XResourceProvider@DirectUI@@QEAAAEAV01@AEBV01@@Z	694	0x140003a14
??B?$SafeArrayAccessor@H@DirectUI@@QEAAPEAHXZ	695	0x140012788
??BTaskPage@DirectUI@@QEAAPEAU_PSP@@XZ	696	0x140010914
??_7?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@6BIProvider@1@@	697	0x140030524
??_7?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@6BRefcountBase@1@@	698	0x140023d5c
??_7?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@6BIProvider@1@@	699	0x14001492c
??_7?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@6BRefcountBase@1@@	700	0x140031078
??_7?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@6BIProvider@1@@	701	0x14002ae98
??_7?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@6BRefcountBase@1@@	702	0x140014954
??_7?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@6BIProvider@1@@	703	0x14001b090
??_7?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@6BRefcountBase@1@@	704	0x1400324c8
??_7?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@6BIProvider@1@@	705	0x140028590
??_7?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@6BRefcountBase@1@@	706	0x14003816c
??_7?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@6BIProvider@1@@	707	0x140021e74
??_7?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@6BRefcountBase@1@@	708	0x140040830
??_7?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@6BIProvider@1@@	709	0x14003e63c
??_7?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@6BRefcountBase@1@@	710	0x140013cd8
??_7?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@6BIProvider@1@@	711	0x1400391d0
??_7?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@6BRefcountBase@1@@	712	0x14002579c
??_7?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@6BIProvider@1@@	713	0x1400060dc
??_7?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@6BRefcountBase@1@@	714	0x140028ce0
??_7?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@6BIProvider@1@@	715	0x140024294
??_7?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@6BRefcountBase@1@@	716	0x1400268d4
??_7?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@6BIProvider@1@@	717	0x140017f7c
??_7?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@6BRefcountBase@1@@	718	0x14003a5ec
??_7?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@6BIProvider@1@@	719	0x1400137d8
??_7?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@6BRefcountBase@1@@	720	0x14002a174
??_7?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@6BIProvider@1@@	721	0x14003c39c
??_7?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@6BRefcountBase@1@@	722	0x1400158d8
??_7AccessibleButton@DirectUI@@6B@	723	0x14003d268
??_7AnimationStrip@DirectUI@@6B@	724	0x14000f71c
??_7AutoButton@DirectUI@@6B@	725	0x14002dd4c
??_7BaseScrollBar@DirectUI@@6B@	726	0x140038a44
??_7BaseScrollViewer@DirectUI@@6BElement@1@@	727	0x14003f654
??_7BaseScrollViewer@DirectUI@@6BIElementListener@1@@	728	0x1400302c8
??_7Bind@DirectUI@@6B@	729	0x14001077c
??_7BorderLayout@DirectUI@@6B@	730	0x140036e64
??_7Browser@DirectUI@@6B@	731	0x14000789c
??_7BrowserSelectionProxy@DirectUI@@6B@	732	0x14003ef98
??_7Button@DirectUI@@6B@	733	0x1400291c0
??_7CCAVI@DirectUI@@6B@	734	0x140001018
??_7CCBase@DirectUI@@6B@	735	0x1400405d8
??_7CCBaseCheckRadioButton@DirectUI@@6B@	736	0x14000bbf0
??_7CCBaseScrollBar@DirectUI@@6BBaseScrollBar@1@@	737	0x140005a98
??_7CCBaseScrollBar@DirectUI@@6BCCBase@1@@	738	0x14001109c
??_7CCCheckBox@DirectUI@@6B@	739	0x1400404d0
??_7CCCommandLink@DirectUI@@6B@	740	0x1400086ac
??_7CCHScrollBar@DirectUI@@6BBaseScrollBar@1@@	741	0x140004fc0
??_7CCHScrollBar@DirectUI@@6BCCBase@1@@	742	0x140007e8c
??_7CCListBox@DirectUI@@6B@	743	0x14001a3e0
??_7CCListView@DirectUI@@6B@	744	0x14000e72c
??_7CCProgressBar@DirectUI@@6B@	745	0x14003041c
??_7CCPushButton@DirectUI@@6B@	746	0x140039e20
??_7CCRadioButton@DirectUI@@6B@	747	0x140004994
??_7CCSysLink@DirectUI@@6B@	748	0x14000f598
??_7CCTrackBar@DirectUI@@6B@	749	0x1400289bc
??_7CCTreeView@DirectUI@@6B@	750	0x140017850
??_7CCVScrollBar@DirectUI@@6BBaseScrollBar@1@@	751	0x140015bdc
??_7CCVScrollBar@DirectUI@@6BCCBase@1@@	752	0x140025fa4
??_7CheckBoxGlyph@DirectUI@@6B@	753	0x14002b138
??_7ClassInfoBase@DirectUI@@6B@	754	0x140004a38
??_7Clipper@DirectUI@@6B@	755	0x14000f0e0
??_7Combobox@DirectUI@@6B@	756	0x1400344cc
??_7DCSurface@DirectUI@@6B@	757	0x140009764
??_7DUIXmlParser@DirectUI@@6B@	758	0x140014a68
??_7DialogElement@DirectUI@@6BHWNDElement@1@@	759	0x1400130b4
??_7DialogElement@DirectUI@@6BIDialogElement@1@@	760	0x14003d02c
??_7DialogElement@DirectUI@@6BIElementListener@1@@	761	0x140027e1c
??_7DuiAccessible@DirectUI@@6BIAccIdentity@@@	762	0x140035254
??_7DuiAccessible@DirectUI@@6BIAccessible@@@	763	0x1400416e0
??_7DuiAccessible@DirectUI@@6BIEnumVARIANT@@@	764	0x14003fde4
??_7DuiAccessible@DirectUI@@6BIOleWindow@@@	765	0x14003ac30
??_7DuiAccessible@DirectUI@@6BIServiceProvider@@@	766	0x14000dd60
??_7Edit@DirectUI@@6B@	767	0x14001cf98
??_7Element@DirectUI@@6B@	768	0x140013d20
??_7ElementProvider@DirectUI@@6BIRawElementProviderAdviseEvents@@@	769	0x14000b1a0
??_7ElementProvider@DirectUI@@6BIRawElementProviderFragment@@@	770	0x140025788
??_7ElementProvider@DirectUI@@6BIRawElementProviderSimple2@@@	771	0x140034378
??_7ElementProvider@DirectUI@@6BRefcountBase@1@@	772	0x140016128
??_7ElementWithHWND@DirectUI@@6B@	773	0x14002bf28
??_7ExpandCollapseProvider@DirectUI@@6B@	774	0x140011318
??_7ExpandCollapseProvider@DirectUI@@6BIProvider@1@@	775	0x14000bd74
??_7ExpandCollapseProvider@DirectUI@@6BRefcountBase@1@@	776	0x14001a7f0
??_7ExpandCollapseProxy@DirectUI@@6B@	777	0x14002c714
??_7Expandable@DirectUI@@6B@	778	0x14001dde8
??_7Expando@DirectUI@@6B@	779	0x14000c05c
??_7ExpandoButtonGlyph@DirectUI@@6B@	780	0x14003de78
??_7FillLayout@DirectUI@@6B@	781	0x140024984
??_7FlowLayout@DirectUI@@6B@	782	0x14003b3fc
??_7FontCache@DirectUI@@6B@	783	0x14003c4c0
??_7GridItemProvider@DirectUI@@6B@	784	0x1400310b8
??_7GridItemProvider@DirectUI@@6BIProvider@1@@	785	0x14001286c
??_7GridItemProvider@DirectUI@@6BRefcountBase@1@@	786	0x14002a874
??_7GridItemProxy@DirectUI@@6B@	787	0x14002e2f4
??_7GridLayout@DirectUI@@6B@	788	0x14003d100
??_7GridProvider@DirectUI@@6B@	789	0x1400156f8
??_7GridProvider@DirectUI@@6BIProvider@1@@	790	0x140018e7c
??_7GridProvider@DirectUI@@6BRefcountBase@1@@	791	0x140006b18
??_7GridProxy@DirectUI@@6B@	792	0x140027db4
??_7HWNDElement@DirectUI@@6B@	793	0x14003f020
??_7HWNDElementAccessible@DirectUI@@6BIAccIdentity@@@	794	0x14001caf4
??_7HWNDElementAccessible@DirectUI@@6BIAccessible@@@	795	0x1400119e0
??_7HWNDElementAccessible@DirectUI@@6BIEnumVARIANT@@@	796	0x140019350
??_7HWNDElementAccessible@DirectUI@@6BIOleWindow@@@	797	0x140012f3c
??_7HWNDElementAccessible@DirectUI@@6BIServiceProvider@@@	798	0x140028c14
??_7HWNDElementProvider@DirectUI@@6B@	799	0x140028bcc
??_7HWNDElementProvider@DirectUI@@6BIRawElementProviderAdviseEvents@@@	800	0x140025104
??_7HWNDElementProvider@DirectUI@@6BIRawElementProviderFragment@@@	801	0x140010610
??_7HWNDElementProvider@DirectUI@@6BIRawElementProviderSimple2@@@	802	0x14002a170
??_7HWNDElementProvider@DirectUI@@6BRefcountBase@1@@	803	0x14001e224
??_7HWNDHost@DirectUI@@6B@	804	0x140025dcc
??_7HWNDHostAccessible@DirectUI@@6BIAccIdentity@@@	805	0x140022a6c
??_7HWNDHostAccessible@DirectUI@@6BIAccessible@@@	806	0x140040b74
??_7HWNDHostAccessible@DirectUI@@6BIEnumVARIANT@@@	807	0x140028900
??_7HWNDHostAccessible@DirectUI@@6BIOleWindow@@@	808	0x14000f6d4
??_7HWNDHostAccessible@DirectUI@@6BIServiceProvider@@@	809	0x140008418
??_7HWNDHostClientAccessible@DirectUI@@6BIAccIdentity@@@	810	0x140040b54
??_7HWNDHostClientAccessible@DirectUI@@6BIAccessible@@@	811	0x14003ccb8
??_7HWNDHostClientAccessible@DirectUI@@6BIEnumVARIANT@@@	812	0x140015b48
??_7HWNDHostClientAccessible@DirectUI@@6BIOleWindow@@@	813	0x14002ee3c
??_7HWNDHostClientAccessible@DirectUI@@6BIServiceProvider@@@	814	0x14003ef58
??_7IDataEngine@DirectUI@@6B@	815	0x140039cf8
??_7IDataEntry@DirectUI@@6B@	816	0x1400155a8
??_7ISBLeak@DirectUI@@6B@	817	0x140020a20
??_7IXElementCP@DirectUI@@6B@	818	0x1400319b8
??_7IXProviderCP@DirectUI@@6B@	819	0x14001e0f0
??_7InvokeHelper@DirectUI@@6B@	820	0x14001ace4
??_7InvokeProvider@DirectUI@@6B@	821	0x140024ad8
??_7InvokeProvider@DirectUI@@6BIProvider@1@@	822	0x140038dac
??_7InvokeProvider@DirectUI@@6BRefcountBase@1@@	823	0x14000fc80
??_7InvokeProxy@DirectUI@@6B@	824	0x140014b30
??_7Layout@DirectUI@@6B@	825	0x140031444
??_7Macro@DirectUI@@6B@	826	0x14000bf94
??_7ModernProgressBarRangeValueProxy@DirectUI@@6B@	827	0x140007384
??_7Movie@DirectUI@@6B@	828	0x140022700
??_7NativeHWNDHost@DirectUI@@6B@	829	0x14002a2c8
??_7Navigator@DirectUI@@6B@	830	0x14000bf14
??_7NavigatorSelectionItemProxy@DirectUI@@6B@	831	0x14000aca4
??_7NineGridLayout@DirectUI@@6B@	832	0x14002ef98
??_7PText@DirectUI@@6B@	833	0x140003904
??_7Page@DirectUI@@6B@	834	0x140040764
??_7Pages@DirectUI@@6B@	835	0x14003f4a0
??_7Progress@DirectUI@@6B@	836	0x140004110
??_7ProgressRangeValueProxy@DirectUI@@6B@	837	0x14000e930
??_7Proxy@DirectUI@@6B@	838	0x14000760c
??_7PushButton@DirectUI@@6B@	839	0x14002d6e0
??_7RadioButtonGlyph@DirectUI@@6B@	840	0x140003ff0
??_7RangeValueProvider@DirectUI@@6B@	841	0x1400403c4
??_7RangeValueProvider@DirectUI@@6BIProvider@1@@	842	0x140016594
??_7RangeValueProvider@DirectUI@@6BRefcountBase@1@@	843	0x14000437c
??_7RangeValueProxy@DirectUI@@6B@	844	0x14003243c
??_7RefPointElement@DirectUI@@6B@	845	0x1400050f8
??_7RefcountBase@DirectUI@@6B@	846	0x14004057c
??_7RepeatButton@DirectUI@@6B@	847	0x14003140c
??_7Repeater@DirectUI@@6B@	848	0x14001e750
??_7RowLayout@DirectUI@@6B@	849	0x140019a68
??_7ScrollBar@DirectUI@@6BBaseScrollBar@1@@	850	0x14002e784
??_7ScrollBar@DirectUI@@6BElement@1@@	851	0x140016694
??_7ScrollBarRangeValueProxy@DirectUI@@6B@	852	0x140021378
??_7ScrollItemProvider@DirectUI@@6B@	853	0x14001bdcc
??_7ScrollItemProvider@DirectUI@@6BIProvider@1@@	854	0x140019490
??_7ScrollItemProvider@DirectUI@@6BRefcountBase@1@@	855	0x1400150cc
??_7ScrollItemProxy@DirectUI@@6B@	856	0x14000b894
??_7ScrollProvider@DirectUI@@6B@	857	0x140030780
??_7ScrollProvider@DirectUI@@6BIProvider@1@@	858	0x14003409c
??_7ScrollProvider@DirectUI@@6BRefcountBase@1@@	859	0x14000b9bc
??_7ScrollProxy@DirectUI@@6B@	860	0x14003ed30
??_7ScrollViewer@DirectUI@@6BElement@1@@	861	0x140017c30
??_7ScrollViewer@DirectUI@@6BIElementListener@1@@	862	0x14002dd70
??_7SelectionItemProvider@DirectUI@@6B@	863	0x1400222d0
??_7SelectionItemProvider@DirectUI@@6BIProvider@1@@	864	0x1400059d8
??_7SelectionItemProvider@DirectUI@@6BRefcountBase@1@@	865	0x140023484
??_7SelectionItemProxy@DirectUI@@6B@	866	0x1400249fc
??_7SelectionProvider@DirectUI@@6B@	867	0x140010ad4
??_7SelectionProvider@DirectUI@@6BIProvider@1@@	868	0x14002a910
??_7SelectionProvider@DirectUI@@6BRefcountBase@1@@	869	0x14000c054
??_7SelectionProxy@DirectUI@@6B@	870	0x140017f94
??_7Selector@DirectUI@@6B@	871	0x140014988
??_7SelectorNoDefault@DirectUI@@6B@	872	0x14000f278
??_7SelectorSelectionItemProxy@DirectUI@@6B@	873	0x14003a9f8
??_7SelectorSelectionProxy@DirectUI@@6B@	874	0x14001cc28
??_7ShellBorderLayout@DirectUI@@6B@	875	0x14001b82c
??_7StyleSheet@DirectUI@@6B@	876	0x14003da18
??_7StyledScrollViewer@DirectUI@@6BElement@1@@	877	0x14000da88
??_7StyledScrollViewer@DirectUI@@6BIElementListener@1@@	878	0x140018614
??_7Surface@DirectUI@@6B@	879	0x14002d748
??_7TableItemProvider@DirectUI@@6B@	880	0x1400032d8
??_7TableItemProvider@DirectUI@@6BIProvider@1@@	881	0x140033d30
??_7TableItemProvider@DirectUI@@6BRefcountBase@1@@	882	0x14001d4e0
??_7TableItemProxy@DirectUI@@6B@	883	0x14002d6f4
??_7TableLayout@DirectUI@@6B@	884	0x140008c30
??_7TableProvider@DirectUI@@6B@	885	0x14002e7ec
??_7TableProvider@DirectUI@@6BIProvider@1@@	886	0x14001f0e0
??_7TableProvider@DirectUI@@6BRefcountBase@1@@	887	0x140030930
??_7TableProxy@DirectUI@@6B@	888	0x14001cdb4
??_7TaskPage@DirectUI@@6BIElementListener@1@@	889	0x1400202d0
??_7TaskPage@DirectUI@@6BIXProviderCP@1@@	890	0x140007708
??_7TextGraphic@DirectUI@@6B@	891	0x14000393c
??_7Thumb@DirectUI@@6B@	892	0x140015428
??_7ToggleProvider@DirectUI@@6B@	893	0x14003e3cc
??_7ToggleProvider@DirectUI@@6BIProvider@1@@	894	0x140022dc4
??_7ToggleProvider@DirectUI@@6BRefcountBase@1@@	895	0x140034ba4
??_7ToggleProxy@DirectUI@@6B@	896	0x140020bc0
??_7UnknownElement@DirectUI@@6B@	897	0x14003b4d4
??_7ValueProvider@DirectUI@@6B@	898	0x14003deb8
??_7ValueProvider@DirectUI@@6BIProvider@1@@	899	0x140040468
??_7ValueProvider@DirectUI@@6BRefcountBase@1@@	900	0x14000a970
??_7ValueProxy@DirectUI@@6B@	901	0x14003588c
??_7VerticalFlowLayout@DirectUI@@6B@	902	0x1400352fc
??_7Viewer@DirectUI@@6B@	903	0x140030c48
??_7XBaby@DirectUI@@6B@	904	0x140040fc0
??_7XBaby@DirectUI@@6BHWNDElement@1@@	905	0x140011e68
??_7XBaby@DirectUI@@6BIDialogElement@1@@	906	0x14002abec
??_7XBaby@DirectUI@@6BIElementListener@1@@	907	0x140020358
??_7XElement@DirectUI@@6BHWNDHost@1@@	908	0x140003b48
??_7XElement@DirectUI@@6BIXElementCP@1@@	909	0x140026fc4
??_7XProvider@DirectUI@@6B@	910	0x140006a5c
??_7XResourceProvider@DirectUI@@6B@	911	0x1400107c8
??_FCCBase@DirectUI@@QEAAXXZ	912	0x14000b600
??_FCCBaseScrollBar@DirectUI@@QEAAXXZ	913	0x14000180c
??_FCCCheckBox@DirectUI@@QEAAXXZ	914	0x1400200c4
??_FCCCommandLink@DirectUI@@QEAAXXZ	915	0x1400227ac
??_FCCPushButton@DirectUI@@QEAAXXZ	916	0x140036e44
??_FCCTreeView@DirectUI@@QEAAXXZ	917	0x140011584
?AbsorbsShortcutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	918	0x14000bfe4
?AccDefActionProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	919	0x140018798
?AccDescProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	920	0x14002260c
?AccHelpProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	921	0x14003d2c8
?AccItemStatusProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	922	0x140006080
?AccItemTypeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	923	0x14001cd60
?AccNameProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	924	0x14002b954
?AccNavigate@DuiAccessible@DirectUI@@SAJPEAVElement@2@JPEAPEAV32@@Z	925	0x14000da00
?AccRoleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	926	0x140035af8
?AccStateProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	927	0x140018584
?AccValueProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	928	0x14002fb8c
?AcceleratorKeyProperty@Schema@DirectUI@@2HA	929	0x14002d180
?Access@?$SafeArrayAccessor@H@DirectUI@@QEAAJPEAUtagSAFEARRAY@@G@Z	930	0x140025dd4
?AccessKeyProperty@Schema@DirectUI@@2HA	931	0x140001bd0
?AccessibleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	932	0x1400148e8
?ActionInitiated@Navigator@DirectUI@@SA?AVUID@@XZ	933	0x1400064f8
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z	934	0x140037c94
?ActivateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z	935	0x140040fe4
?ActivateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z	936	0x140029d54
?ActiveProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	937	0x14002aab0
?ActiveStateChanged@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	938	0x140011560
?ActualReferencePointProp@RefPointElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	939	0x140037198
?Add@BaseScrollViewer@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	940	0x140015998
?Add@Element@DirectUI@@QEAAJPEAV12@@Z	941	0x1400197a8
?Add@Element@DirectUI@@QEAAJPEAV12@P6AHPEBX1@Z@Z	942	0x14001ac48
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z	943	0x140002abc
?Add@ElementProviderManager@DirectUI@@SAJPEAVElementProvider@2@@Z	944	0x140040b9c
?Add@Expando@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	945	0x14001e640
?Add@LinkedList@DirectUI@@QEAAXPEAVLinkedListNode@2@@Z	946	0x14000e628
?Add@Macro@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	947	0x14003a944
?Add@Pages@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	948	0x1400378b0
?Add@TouchEdit2@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	949	0x140034f04
?Add@TouchSelect@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	950	0x140037da0
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z	951	0x140006e04
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ	952	0x140013584
?AddChildren@ScrollViewer@DirectUI@@MEAAJXZ	953	0x14000cf20
?AddChildren@StyledScrollViewer@DirectUI@@MEAAJXZ	954	0x1400369dc
?AddElement@TouchSelect@DirectUI@@QEAAJPEAVElement@2@PEBG@Z	955	0x140039024
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z	956	0x14002ff54
?AddRectangleChange@EventManager@DirectUI@@CAJPEAVElement@2@_N1@Z	957	0x14000c93c
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ	958	0x1400352f8
?AddRef@DuiAccessible@DirectUI@@UEAAKXZ	959	0x140026b30
?AddRef@Element@DirectUI@@QEAAKXZ	960	0x140001258
?AddRef@ElementProvider@DirectUI@@UEAAKXZ	961	0x140037898
?AddRef@ExpandCollapseProvider@DirectUI@@UEAAKXZ	962	0x140016e70
?AddRef@GridItemProvider@DirectUI@@UEAAKXZ	963	0x140015190
?AddRef@GridProvider@DirectUI@@UEAAKXZ	964	0x14002e2ac
?AddRef@HWNDElementProvider@DirectUI@@UEAAKXZ	965	0x1400167ac
?AddRef@InvokeProvider@DirectUI@@UEAAKXZ	966	0x14002398c
?AddRef@RangeValueProvider@DirectUI@@UEAAKXZ	967	0x14001d65c
?AddRef@RefcountBase@DirectUI@@QEAAJXZ	968	0x140008158
?AddRef@ScrollItemProvider@DirectUI@@UEAAKXZ	969	0x140007720
?AddRef@ScrollProvider@DirectUI@@UEAAKXZ	970	0x140019388
?AddRef@SelectionItemProvider@DirectUI@@UEAAKXZ	971	0x14000fe3c
?AddRef@SelectionProvider@DirectUI@@UEAAKXZ	972	0x140030c10
?AddRef@TableItemProvider@DirectUI@@UEAAKXZ	973	0x140040124
?AddRef@TableProvider@DirectUI@@UEAAKXZ	974	0x140026c9c
?AddRef@ToggleProvider@DirectUI@@UEAAKXZ	975	0x140016744
?AddRef@Value@DirectUI@@QEAAXXZ	976	0x140022aac
?AddRef@ValueProvider@DirectUI@@UEAAKXZ	977	0x14001fce8
?AddRef@XProvider@DirectUI@@UEAAKXZ	978	0x140033128
?AddRulesToStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAVStyleSheet@2@PEBGPEAV?$DynamicArray@UXMLParserCond@DirectUI@@$0A@@2@PEAV?$DynamicArray@PEAG$0A@@2@@Z	979	0x140004a10
?AddString@CCListBox@DirectUI@@QEAAHPEBG@Z	980	0x140016478
?AddString@Combobox@DirectUI@@QEAAHPEBG@Z	981	0x14000c270
?AddString@TouchSelect@DirectUI@@QEAAJPEBG@Z	982	0x140022f80
?AddString@TouchSelect@DirectUI@@QEAAJPEBGPEAPEAVElement@2@@Z	983	0x14000af6c
?AddStringWithLabelOverride@TouchSelect@DirectUI@@QEAAJPEBG0PEAPEAVElement@2@@Z	984	0x14001ae00
?AddToSelection@NavigatorSelectionItemProxy@DirectUI@@AEAAJPEAVBrowser@2@@Z	985	0x14001b754
?AddToSelection@SelectionItemProvider@DirectUI@@UEAAJXZ	986	0x14002e8c0
?AddToSelection@SelectorSelectionItemProxy@DirectUI@@AEAAJXZ	987	0x140016830
?AdvanceFrame@AnimationStrip@DirectUI@@IEAAXXZ	988	0x140016d3c
?AdvanceFrame@Movie@DirectUI@@SA?AVUID@@XZ	989	0x140027678
?AdviseEventAdded@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z	990	0x140002258
?AdviseEventAdded@EventManager@DirectUI@@SAJHPEAUtagSAFEARRAY@@@Z	991	0x140015148
?AdviseEventRemoved@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z	992	0x140036c34
?AdviseEventRemoved@EventManager@DirectUI@@SAJHPEAUtagSAFEARRAY@@@Z	993	0x140012418
?AliasedRenderingProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	994	0x14002204c
?AlphaProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	995	0x140012664
?AnimatePopupOnDismissProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	996	0x140039ac4
?AnimateScroll@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	997	0x14000df60
?AnimationChange@Element@DirectUI@@SA?AVUID@@XZ	998	0x1400376b4
?AnimationProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	999	0x14003c2b0
?AnimationStatusChange@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1000	0x1400079b0
?ApplySinkRegion@HWNDHost@DirectUI@@AEAAXPEBUtagRECT@@_N@Z	1001	0x140035974
?Arrow@Expando@DirectUI@@KAGXZ	1002	0x14003a90c
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ	1003	0x14001f6ec
?AsyncContentLoadedEvent@Schema@DirectUI@@2HA	1004	0x14002503c
?Attach@Layout@DirectUI@@UEAAXPEAVElement@2@@Z	1005	0x140027eb0
?AttachCtrlSubclassProc@HWNDHost@DirectUI@@KAXPEAUHWND__@@@Z	1006	0x14000d3fc
?AutoGroupingProp@CCRadioButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1007	0x14000c1d0
?AutoStartProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1008	0x140002654
?AutoStopProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1009	0x14000b32c
?AutomationFocusChangedEvent@Schema@DirectUI@@2HA	1010	0x140029a3c
?AutomationIdProperty@Schema@DirectUI@@2HA	1011	0x140018a50
?AutomationPropertyChangedEvent@Schema@DirectUI@@2HA	1012	0x14002c450
?BackgroundOwnerIDProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	1013	0x14001abb0
?BackgroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1014	0x1400261f4
?BaselineProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1015	0x14003c1e0
?BorderColorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1016	0x1400175a8
?BorderStyleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1017	0x1400020b0
?BorderThicknessProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1018	0x14004163c
?BoundingRectangleProperty@Schema@DirectUI@@2HA	1019	0x14003ffe4
?BroadcastEvent@Element@DirectUI@@QEAAXPEAUEvent@2@@Z	1020	0x14003f6b0
?BufferingProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	1021	0x140023680
?BuildCacheInfo@FlowLayout@DirectUI@@IEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@_N@Z	1022	0x140004574
?BuildCacheInfo@VerticalFlowLayout@DirectUI@@IEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@_N@Z	1023	0x14002f550
?BuildElement@Macro@DirectUI@@MEAAJXZ	1024	0x1400034a4
?BuildElement@Repeater@DirectUI@@MEAAJXZ	1025	0x14003ab20
?ButtonClassAcceptsEnterKeyProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	1026	0x14000d1e4
?ButtonControlType@Schema@DirectUI@@2HA	1027	0x140022c78
?CacheParser@XBaby@DirectUI@@UEAAXPEAVDUIXmlParser@2@@Z	1028	0x14002511c
?CalendarControlType@Schema@DirectUI@@2HA	1029	0x14002fb74
?CanPerformManualVisualSwap@TouchScrollViewer@DirectUI@@QEAA_NXZ	1030	0x140013874
?CanSetFocus@HWNDElement@DirectUI@@UEAA_NXZ	1031	0x14001cff8
?CanSetFocus@XBaby@DirectUI@@UEAA_NXZ	1032	0x1400169dc
?CanSetFocus@XProvider@DirectUI@@UEAAJPEA_N@Z	1033	0x140005c50
?CancelClick@TouchButton@DirectUI@@QEAA_NW4ClickDevice@12@@Z	1034	0x140013ca0
?CancelCurrentDrag@TouchSlider@DirectUI@@QEAAXXZ	1035	0x14003a768
?CaptureCallstackFrames@CallstackTracker@DirectUI@@QEAAHXZ	1036	0x14003b968
?CapturedProp@Button@DirectUI@@SAPEBUPropertyInfo@2@XZ	1037	0x14003fce4
?CapturedProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1038	0x140022b1c
?CaretMoved@TouchEditBase@DirectUI@@SA?AVUID@@XZ	1039	0x14000f1cc
?CheckBoxControlType@Schema@DirectUI@@2HA	1040	0x140023ef4
?CheckScroll@BaseScrollViewer@DirectUI@@AEAAXPEAVBaseScrollBar@2@HHH@Z	1041	0x140039b48
?CheckedStateProp@TouchCheckBox@DirectUI@@SAPEBUPropertyInfo@2@XZ	1042	0x1400406a0
?ChildrenProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1043	0x14002d2a4
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z	1044	0x140015260
?ClassNameProperty@Schema@DirectUI@@2HA	1045	0x140013ee4
?ClassProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1046	0x14002f758
?ClearButtonClicked@TouchEdit2@DirectUI@@SA?AVUID@@XZ	1047	0x140040c88
?ClearCacheDirty@Layout@DirectUI@@IEAAXXZ	1048	0x140014048
?ClearParser@DUIFactory@DirectUI@@AEAAXXZ	1049	0x14003e50c
?Click@Button@DirectUI@@SA?AVUID@@XZ	1050	0x140013040
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ	1051	0x14003ba6c
?ClickDefaultButton@DialogElement@DirectUI@@UEAA_NXZ	1052	0x14002a250
?ClickDefaultButton@DialogElementCore@DirectUI@@QEAA_NXZ	1053	0x14000f478
?ClickDefaultButton@XBaby@DirectUI@@UEAA_NXZ	1054	0x140012d50
?ClickDefaultButton@XProvider@DirectUI@@UEAAHXZ	1055	0x14000b074
?ClickablePointProperty@Schema@DirectUI@@2HA	1056	0x140005860
?Clipper@Expando@DirectUI@@KAGXZ	1057	0x14000e508
?Clone@DuiAccessible@DirectUI@@UEAAJPEAPEAUIEnumVARIANT@@@Z	1058	0x14002785c
?Clone@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAUIEnumVARIANT@@@Z	1059	0x1400040b0
?Close@ElementProviderManager@DirectUI@@SAXXZ	1060	0x14000cce8
?Close@EventManager@DirectUI@@SAXXZ	1061	0x14000135c
?Close@InvokeManager@DirectUI@@SAXXZ	1062	0x14002a860
?ClosePopup@TouchSelect@DirectUI@@QEAAXXZ	1063	0x1400069d8
?CloseThread@InvokeManager@DirectUI@@SAXXZ	1064	0x14000857c
?Collapse@ExpandCollapseProvider@DirectUI@@UEAAJXZ	1065	0x1400135a4
?ColorFontPaletteIndexProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1066	0x140013478
?ComboBoxControlType@Schema@DirectUI@@2HA	1067	0x140039394
?CompositedTextProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1068	0x140037324
?CompositingQualityProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1069	0x140025bbc
?CompositionChange@HWNDElement@DirectUI@@SA?AVUID@@XZ	1070	0x14002daf8
?ConnectProp@Bind@DirectUI@@SAPEBUPropertyInfo@2@XZ	1071	0x140030210
?ConstrainLayoutProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1072	0x14002d0c0
?ContentAlignProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1073	0x140021ce4
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1074	0x1400274a8
?Context@Button@DirectUI@@SA?AVUID@@XZ	1075	0x14002fe0c
?ContextMenuHintShowing@ContextMenuBehavior@DirectUI@@SA?AVUID@@XZ	1076	0x14001a918
?ContextMenuRequested@ContextMenuBehavior@DirectUI@@SA?AVUID@@XZ	1077	0x14000b96c
?ContextMenuRequested@TouchEdit2@DirectUI@@SA?AVUID@@XZ	1078	0x14003a0b0
?ContextSensitiveHelp@DuiAccessible@DirectUI@@UEAAJH@Z	1079	0x14001ea74
?ContextSensitiveHelp@HWNDHostAccessible@DirectUI@@UEAAJH@Z	1080	0x14000fed8
?ControlTypeProperty@Schema@DirectUI@@2HA	1081	0x140014970
?CopySheets@DUIXmlParser@DirectUI@@QEAAJPEAPEAV?$DynamicArray@PEAVValue@DirectUI@@$0A@@2@@Z	1082	0x14001da60
?Count@?$SafeArrayAccessor@H@DirectUI@@QEAAHXZ	1083	0x14003e49c
?Create@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1084	0x1400225e8
?Create@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1085	0x14001c270
?Create@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1086	0x1400351e4
?Create@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1087	0x14001ee7c
?Create@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1088	0x14002dfd4
?Create@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1089	0x140002988
?Create@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1090	0x140021164
?Create@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1091	0x14000781c
?Create@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1092	0x1400377f8
?Create@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1093	0x140015074
?Create@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1094	0x140034418
?Create@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1095	0x14002e128
?Create@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1096	0x14001020c
?Create@AcceleratorBehavior@@SAJPEAPEAUIDuiBehavior@@@Z	1097	0x140007544
?Create@AccessibleButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1098	0x14000a968
?Create@AnimationStrip@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1099	0x140024a08
?Create@AutoButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1100	0x140026dac
?Create@Bind@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1101	0x14002a728
?Create@BorderLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1102	0x14000d6fc
?Create@BorderLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1103	0x14001d3b8
?Create@Browser@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1104	0x14001d028
?Create@Button@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1105	0x140029a00
?Create@Button@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1106	0x14000e318
?Create@CCAVI@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1107	0x14001b5b0
?Create@CCAVI@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1108	0x14003ea84
?Create@CCBase@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1109	0x140006668
?Create@CCBase@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1110	0x14001f4d0
?Create@CCCheckBox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1111	0x140021884
?Create@CCCheckBox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1112	0x140034398
?Create@CCCommandLink@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1113	0x14001f034
?Create@CCCommandLink@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1114	0x1400015b8
?Create@CCHScrollBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1115	0x14003e7d8
?Create@CCHScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1116	0x140035810
?Create@CCListBox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1117	0x14000a794
?Create@CCListBox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1118	0x140038d28
?Create@CCListView@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1119	0x140001640
?Create@CCListView@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1120	0x140020ef8
?Create@CCProgressBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1121	0x14000d2a4
?Create@CCProgressBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1122	0x14001e1e4
?Create@CCPushButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1123	0x14003e11c
?Create@CCPushButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1124	0x140038fd4
?Create@CCRadioButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1125	0x140032b44
?Create@CCRadioButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1126	0x140008374
?Create@CCSysLink@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1127	0x1400307e4
?Create@CCSysLink@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1128	0x140028b18
?Create@CCTrackBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1129	0x14001ab34
?Create@CCTrackBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1130	0x1400146d0
?Create@CCTreeView@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1131	0x14000f5a4
?Create@CCTreeView@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1132	0x1400233dc
?Create@CCVScrollBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1133	0x1400204d8
?Create@CCVScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1134	0x14003e0b8
?Create@CheckBoxGlyph@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1135	0x14002e12c
?Create@CheckBoxGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1136	0x14001eb28
?Create@Clipper@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1137	0x140018524
?Create@Combobox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1138	0x1400089ac
?Create@Combobox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1139	0x14001ab34
?Create@ContextMenuBehavior@DirectUI@@SAJPEAPEAUIDuiBehavior@@@Z	1140	0x140003074
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z	1141	0x140008568
?Create@DialogElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z	1142	0x140011f18
?Create@DuiAccessible@DirectUI@@SAJPEAVElement@2@PEAPEAV12@@Z	1143	0x14002244c
?Create@Edit@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1144	0x14001f928
?Create@Edit@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1145	0x14002cad0
?Create@Element@DirectUI@@SAJIPEAV12@PEAKPEAPEAV12@@Z	1146	0x14003f2c8
?Create@ElementProvider@DirectUI@@SAJPEAVElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z	1147	0x14003e29c
?Create@ElementProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1148	0x14002c31c
?Create@ElementWithHWND@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1149	0x14003e8ac
?Create@ExpandCollapseProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1150	0x140038a84
?Create@Expandable@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1151	0x14001e0bc
?Create@Expando@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1152	0x140034b18
?Create@ExpandoButtonGlyph@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1153	0x140007aec
?Create@ExpandoButtonGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1154	0x140027b14
?Create@FillLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1155	0x140021600
?Create@FillLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1156	0x14003d040
?Create@FlowLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1157	0x14000795c
?Create@FlowLayout@DirectUI@@SAJ_NIIIPEAPEAVLayout@2@@Z	1158	0x1400311c4
?Create@GridItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1159	0x1400110e4
?Create@GridLayout@DirectUI@@SAJHHPEAPEAVLayout@2@@Z	1160	0x14001b704
?Create@GridLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1161	0x14003fa24
?Create@GridProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1162	0x1400048c8
?Create@HWNDElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z	1163	0x14003e070
?Create@HWNDElementAccessible@DirectUI@@SAJPEAVHWNDElement@2@PEAPEAVDuiAccessible@2@@Z	1164	0x1400321e4
?Create@HWNDElementProvider@DirectUI@@SAJPEAVHWNDElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z	1165	0x140009004
?Create@HWNDElementProxy@DirectUI@@SAPEAV12@PEAVHWNDElement@2@@Z	1166	0x140007c28
?Create@HWNDHost@DirectUI@@SAJIIPEAVElement@2@PEAKPEAPEAV32@@Z	1167	0x14001c2d0
?Create@HWNDHost@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1168	0x140038720
?Create@HWNDHostAccessible@DirectUI@@SAJPEAVElement@2@PEAUIAccessible@@PEAPEAVDuiAccessible@2@@Z	1169	0x140024c88
?Create@HWNDHostClientAccessible@DirectUI@@SAJPEAVElement@2@PEAUIAccessible@@PEAPEAVDuiAccessible@2@@Z	1170	0x1400228dc
?Create@InvokeProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1171	0x14003f5fc
?Create@ItemList@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1172	0x140039f08
?Create@Layout@DirectUI@@SAJPEAPEAV12@@Z	1173	0x140030b50
?Create@Macro@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1174	0x140031964
?Create@ModernProgressBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1175	0x140035f9c
?Create@ModernProgressRing@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1176	0x14000edfc
?Create@Movie@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1177	0x140020678
?Create@Movie@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1178	0x140031374
?Create@NativeHWNDHost@DirectUI@@SAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@IPEAPEAV12@@Z	1179	0x14003d444
?Create@NativeHWNDHost@DirectUI@@SAJPEBGPEAUHWND__@@PEAUHICON__@@HHHHHHIPEAPEAV12@@Z	1180	0x1400184ac
?Create@Navigator@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1181	0x14000e2c4
?Create@NineGridLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1182	0x1400039b0
?Create@NineGridLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1183	0x14002f3f8
?Create@PText@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1184	0x14001e960
?Create@Page@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1185	0x140001afc
?Create@Pages@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1186	0x14001a7f4
?Create@Progress@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1187	0x140019fc4
?Create@PushButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1188	0x14003c104
?Create@RadioButtonGlyph@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1189	0x1400352ec
?Create@RadioButtonGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1190	0x140011d00
?Create@RangeValueProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1191	0x140033f70
?Create@RefPointElement@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1192	0x14003f31c
?Create@RefPointElement@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1193	0x14000bbe0
?Create@RepeatButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1194	0x14003d574
?Create@RepeatButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1195	0x14002e204
?Create@Repeater@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1196	0x14001adb8
?Create@RichText@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1197	0x140004558
?Create@RowLayout@DirectUI@@SAJHIIPEAPEAVLayout@2@@Z	1198	0x14000cbb8
?Create@RowLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1199	0x1400400a4
?Create@RowLayout@DirectUI@@SAJIIPEAPEAVLayout@2@@Z	1200	0x140035a30
?Create@ScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1201	0x14001c710
?Create@ScrollBar@DirectUI@@SAJ_NPEAVElement@2@PEAKPEAPEAV32@@Z	1202	0x140030b60
?Create@ScrollItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1203	0x140005d8c
?Create@ScrollProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1204	0x14001da7c
?Create@ScrollViewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1205	0x14003b9f4
?Create@ScrubBehavior@@SAJPEAPEAUIDuiBehavior@@@Z	1206	0x14001a3f4
?Create@SelectionItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1207	0x14002cbd8
?Create@SelectionProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1208	0x1400414a0
?Create@Selector@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1209	0x14001f7b8
?Create@SelectorNoDefault@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1210	0x1400241d0
?Create@SemanticZoomToggle@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1211	0x14000c490
?Create@ShellBorderLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1212	0x1400287dc
?Create@ShellBorderLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1213	0x14003bda4
?Create@StyleSheet@DirectUI@@SAJPEAPEAV12@@Z	1214	0x140032e68
?Create@StyledScrollViewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1215	0x140017984
?Create@TableItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1216	0x14000bf84
?Create@TableLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1217	0x140026674
?Create@TableProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1218	0x140025684
?Create@TextGraphic@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1219	0x140028af8
?Create@Thumb@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1220	0x1400282e0
?Create@Thumb@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1221	0x14003e1e0
?Create@ToggleProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1222	0x14003e6b8
?Create@TouchButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1223	0x14003dd58
?Create@TouchButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1224	0x140025aa0
?Create@TouchCheckBox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1225	0x140028f00
?Create@TouchCheckBox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1226	0x140034694
?Create@TouchCheckBoxGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1227	0x14000f3c0
?Create@TouchCommandButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1228	0x14001ae10
?Create@TouchCommandButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1229	0x140002d48
?Create@TouchEdit2@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1230	0x14001c624
?Create@TouchEditBase@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1231	0x140036d1c
?Create@TouchHWNDElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z	1232	0x1400023e0
?Create@TouchHyperLink@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1233	0x140040730
?Create@TouchHyperLink@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1234	0x14002b06c
?Create@TouchRepeatButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1235	0x14003a124
?Create@TouchRepeatButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1236	0x140005a54
?Create@TouchScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1237	0x140016e30
?Create@TouchScrollViewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1238	0x140020c20
?Create@TouchSelect@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1239	0x140035100
?Create@TouchSelectItem@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1240	0x140024b38
?Create@TouchSlider@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1241	0x140037970
?Create@TouchSwitch@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1242	0x14002a3ac
?Create@UnknownElement@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1243	0x14002bc28
?Create@UnknownElement@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1244	0x140021788
?Create@ValueProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1245	0x140017c7c
?Create@VerticalFlowLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1246	0x140032c48
?Create@VerticalFlowLayout@DirectUI@@SAJ_NIIIPEAPEAVLayout@2@@Z	1247	0x140040180
?Create@Viewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1248	0x140002c04
?Create@XBaby@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1249	0x14002e3e8
?Create@XBaby@DirectUI@@SAJPEAVIXElementCP@2@PEAVXProvider@2@PEAUHWND__@@PEAVElement@2@PEAKPEAPEAV62@@Z	1250	0x1400041d8
?Create@XElement@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1251	0x140018f68
?Create@XElement@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1252	0x140017820
?Create@XHost@DirectUI@@SAJPEAVIXElementCP@2@PEAPEAV12@@Z	1253	0x14003b55c
?Create@XProvider@DirectUI@@SAJPEAVElement@2@PEAVIXProviderCP@2@PEAPEAV12@@Z	1254	0x140023aec
?Create@XResourceProvider@DirectUI@@SAJPEAPEAV12@@Z	1255	0x14001964c
?Create@XResourceProvider@DirectUI@@SAJPEAUHINSTANCE__@@PEBG11PEAPEAV12@@Z	1256	0x140005ab8
?CreateAccNameLabel@HWNDHost@DirectUI@@IEAAPEAUHWND__@@PEAU3@@Z	1257	0x14000c840
?CreateAtom@Value@DirectUI@@SAPEAV12@G@Z	1258	0x140041414
?CreateAtom@Value@DirectUI@@SAPEAV12@PEBG@Z	1259	0x140005014
?CreateBool@Value@DirectUI@@SAPEAV12@_N@Z	1260	0x140034ebc
?CreateButtons@ScrollBar@DirectUI@@MEAAJXZ	1261	0x14000c4f8
?CreateButtons@TouchScrollBar@DirectUI@@UEAAJXZ	1262	0x14001cb10
?CreateCache@RichText@DirectUI@@SAJIPEAPEAUIDUIRichTextCache@@@Z	1263	0x140024f88
?CreateColor@Value@DirectUI@@SAPEAV12@K@Z	1264	0x140025144
?CreateColor@Value@DirectUI@@SAPEAV12@KKE@Z	1265	0x140013fa0
?CreateColor@Value@DirectUI@@SAPEAV12@KKKE@Z	1266	0x14001fdfc
?CreateCursor@Value@DirectUI@@SAPEAV12@PEAUHICON__@@@Z	1267	0x140006084
?CreateCursor@Value@DirectUI@@SAPEAV12@PEBG@Z	1268	0x1400244cc
?CreateDFCFill@Value@DirectUI@@SAPEAV12@II@Z	1269	0x140029a5c
?CreateDTBFill@Value@DirectUI@@SAPEAV12@PEBGHH@Z	1270	0x1400375f8
?CreateDUI@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAPEAUHWND__@@@Z	1271	0x1400066fc
?CreateDUICP@TaskPage@DirectUI@@EEAAJPEAVHWNDElement@2@PEAUHWND__@@1PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z	1272	0x140034bac
?CreateDUICP@XResourceProvider@DirectUI@@UEAAJPEAVHWNDElement@2@PEAUHWND__@@1PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z	1273	0x14000f47c
?CreateDoubleList@Value@DirectUI@@SAPEAV12@PEAV?$DynamicArray@N$0A@@2@@Z	1275	0x14002dc6c
?CreateDoubleList@Value@DirectUI@@SAPEAV12@PEBNH@Z	1276	0x140038680
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z	1277	0x1400021e0
?CreateElementList@Value@DirectUI@@SAPEAV12@PEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@@Z	1278	0x14000bb28
?CreateElementRef@Value@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1279	0x140009598
?CreateElementScaledValue@Value@DirectUI@@SAPEAV12@PEAVElement@2@PEAV12@@Z	1280	0x140031758
?CreateEncodedString@Value@DirectUI@@SAPEAV12@PEBG@Z	1281	0x1400087cc
?CreateExpression@Value@DirectUI@@SAPEAV12@PEAVExpression@2@@Z	1282	0x140010070
?CreateFill@Value@DirectUI@@SAPEAV12@AEBUFill@2@@Z	1283	0x14000e6f8
?CreateFloat@Value@DirectUI@@SAPEAV12@MW4DynamicScaleValue@@@Z	1284	0x140014288
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHBITMAP__@@EI_N11@Z	1285	0x14003ad1c
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHENHMETAFILE__@@0@Z	1286	0x14000a0dc
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHICON__@@_N11@Z	1287	0x140010cf4
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUISharedBitmap@@EI@Z	1288	0x140008fc0
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEBGEIGGPEAUHINSTANCE__@@_N2@Z	1289	0x140014f54
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEBGGGPEAUHINSTANCE__@@_N2@Z	1290	0x140038940
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEBGUScaledSIZE@2@PEAUHINSTANCE__@@_N3@Z	1291	0x140015e78
?CreateHWND@CCBase@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1292	0x14003d378
?CreateHWND@CCBaseScrollBar@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1293	0x14001d39c
?CreateHWND@Combobox@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1294	0x14002db94
?CreateHWND@Edit@DirectUI@@MEAAPEAUHWND__@@PEAU3@@Z	1295	0x140021274
?CreateHWND@Edit@DirectUI@@MEAAPEAUHWND__@@PEAU3@_N@Z	1296	0x140027d6c
?CreateHWND@HWNDHost@DirectUI@@MEAAPEAUHWND__@@PEAU3@@Z	1297	0x14001c63c
?CreateHWND@XElement@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1298	0x1400356ac
?CreateHostWindow@NativeHWNDHost@DirectUI@@UEAAPEAUHWND__@@KPEBG0KHHHHPEAU3@PEAUHMENU__@@PEAUHINSTANCE__@@PEAX@Z	1299	0x140006020
?CreateIconGraphicHelper@Value@DirectUI@@CAPEAV12@PEAUHICON__@@_N11@Z	1300	0x14000cde4
?CreateInstance@CSafeElementProxy@@SAJPEAVElement@DirectUI@@PEAPEAV1@@Z	1301	0x140031da8
?CreateInt@Value@DirectUI@@SAPEAV12@HW4DynamicScaleValue@@@Z	1302	0x14000d720
?CreateLayout@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@P6AJHPEAHPEAPEAVValue@2@@Z@Z	1303	0x14002c188
?CreateLayout@Value@DirectUI@@SAPEAV12@PEAVLayout@2@@Z	1304	0x140030480
?CreateParser@DUIFactory@DirectUI@@QEAAJXZ	1305	0x140037a08
?CreateParser@XProvider@DirectUI@@QEAAJPEAPEAVDUIXmlParser@2@@Z	1306	0x140021398
?CreateParserCP@TaskPage@DirectUI@@EEAAJPEAPEAVDUIXmlParser@2@@Z	1307	0x14001e02c
?CreateParserCP@XResourceProvider@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z	1308	0x14003012c
?CreatePatternProvider@Schema@DirectUI@@SAJW4Pattern@12@PEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1309	0x140023aa4
?CreatePoint@Value@DirectUI@@SAPEAV12@HHW4DynamicScaleValue@@@Z	1310	0x14000c3f0
?CreateRect@Value@DirectUI@@SAPEAV12@HHHHW4DynamicScaleValue@@@Z	1311	0x140011de0
?CreateScaledValue@Value@DirectUI@@SAPEAV12@MPEAV12@@Z	1312	0x140032958
?CreateScrollBars@ScrollViewer@DirectUI@@MEAAJXZ	1313	0x14001b7dc
?CreateScrollBars@StyledScrollViewer@DirectUI@@MEAAJXZ	1314	0x140012230
?CreateSize@Value@DirectUI@@SAPEAV12@HHW4DynamicScaleValue@@@Z	1315	0x140006950
?CreateString@Value@DirectUI@@SAPEAV12@PEBGPEAUHINSTANCE__@@@Z	1316	0x140022a8c
?CreateStringRP@Value@DirectUI@@SAPEAV12@PEBGPEAUHINSTANCE__@@@Z	1317	0x140015fa8
?CreateStyleParser@HWNDElement@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z	1318	0x140002d08
?CreateStyleParser@XBaby@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z	1319	0x14001f9e4
?CreateStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBGPEAPEAVStyleSheet@2@@Z	1320	0x1400256bc
?CreateStyleSheet@Value@DirectUI@@SAPEAV12@PEAVStyleSheet@2@@Z	1321	0x14001ab44
?CreateValueList@Value@DirectUI@@SAPEAV12@PEAV12@@Z	1322	0x140012a28
?CreateValueList@Value@DirectUI@@SAPEAV12@PEAV?$DynamicArray@PEAVValue@DirectUI@@$0A@@2@@Z	1323	0x14001c718
?CreateXBaby@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAUHWND__@@PEAVElement@2@PEAKPEAPEAUIXBaby@2@@Z	1324	0x1400109bc
?CreateXmlReader@DUIXmlParser@DirectUI@@IEAAJPEAPEAUIXmlReader@@@Z	1325	0x14003c2dc
?CreateXmlReaderFromHGLOBAL@DUIXmlParser@DirectUI@@IEAAJPEAXPEAPEAUIXmlReader@@@Z	1326	0x14001e314
?CreateXmlReaderInputWithEncodingName@DUIXmlParser@DirectUI@@IEAAJPEAUIStream@@PEBGPEAPEAUIUnknown@@@Z	1327	0x140010e6c
?CtrlSubclassProc@HWNDHost@DirectUI@@KA_JPEAUHWND__@@I_K_J@Z	1328	0x140032cdc
?CultureProperty@Schema@DirectUI@@2HA	1329	0x1400181f4
?CursorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1330	0x1400411b8
?CustomControlType@Schema@DirectUI@@2HA	1331	0x1400125bc
?CustomDragDropScalingHint@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1332	0x140010304
?CustomProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1333	0x140034e90
?CustomReflowHint@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1334	0x1400263ec
?CustomTapHint@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1335	0x14003aa98
?Cut@TouchEditBase@DirectUI@@SA?AVUID@@XZ	1336	0x14001f1dc
?DCompDeviceRebuilt@Element@DirectUI@@SA?AVUID@@XZ	1337	0x14001e43c
?DPIProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1338	0x14001cc80
?DUICreatePropertySheetPage@TaskPage@DirectUI@@QEAAJPEAUHINSTANCE__@@@Z	1339	0x140024e5c
?DataGridControlType@Schema@DirectUI@@2HA	1340	0x14002bfd4
?DataItemControlType@Schema@DirectUI@@2HA	1341	0x14001aa14
?DefaultAction@Button@DirectUI@@UEAAJXZ	1342	0x140002b50
?DefaultAction@CCBase@DirectUI@@UEAAJXZ	1343	0x140026490
?DefaultAction@CCPushButton@DirectUI@@UEAAJXZ	1344	0x140030de8
?DefaultAction@Element@DirectUI@@UEAAJXZ	1345	0x14003e430
?DefaultAction@SemanticZoomToggle@DirectUI@@UEAAJXZ	1346	0x140034f14
?DefaultAction@TouchButton@DirectUI@@UEAAJXZ	1347	0x14003a334
?DefaultAction@TouchRepeatButton@DirectUI@@UEAAJXZ	1348	0x14003f4f4
?DefaultButtonTrackingProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	1349	0x140032a78
?DelayActivateTooltip@HWNDElement@DirectUI@@QEAAXXZ	1350	0x140011510
?DeleteString@CCListBox@DirectUI@@QEAAHH@Z	1351	0x14003bce0
?DesiredSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1352	0x140014448
?Destroy@ClassInfoBase@DirectUI@@UEAAXXZ	1353	0x140001630
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ	1354	0x14003ce10
?Destroy@Element@DirectUI@@QEAAJ_N@Z	1355	0x14001e1d4
?Destroy@Expression@DirectUI@@QEAAXXZ	1356	0x14003920c
?Destroy@Layout@DirectUI@@QEAAXXZ	1357	0x14003e538
?Destroy@NativeHWNDHost@DirectUI@@QEAAXXZ	1358	0x140019878
?Destroy@XHost@DirectUI@@QEAAXXZ	1359	0x1400319bc
?DestroyAll@Element@DirectUI@@QEAAJ_N@Z	1360	0x14003814c
?DestroyCP@TaskPage@DirectUI@@EEAAXXZ	1361	0x140004c20
?DestroyCP@XResourceProvider@DirectUI@@UEAAXXZ	1362	0x1400014d8
?DestroyListener@EventManager@DirectUI@@SAXPEAVElement@2@@Z	1363	0x140002da8
?DestroyMsg@NativeHWNDHost@DirectUI@@SAIXZ	1364	0x14002647c
?DestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ	1365	0x14000ace0
?DestroyWindow@XHost@DirectUI@@QEAAXXZ	1366	0x14000c2d0
?Detach@CSafeElementProxy@@QEAAXXZ	1367	0x140014c68
?Detach@Element@DirectUI@@QEAAXPEAVDeferCycle@2@@Z	1368	0x14001672c
?Detach@HWNDHost@DirectUI@@QEAAXXZ	1369	0x1400409c8
?Detach@Layout@DirectUI@@UEAAXPEAVElement@2@@Z	1370	0x14003cb50
?DetachParser@DUIFactory@DirectUI@@QEAAPEAVDUIXmlParser@2@XZ	1371	0x14001da58
?DeterminateProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	1372	0x140009d80
?DirectionProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1373	0x140040ba0
?DirtyProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	1374	0x14003dea4
?DisableAccTextExtendProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1375	0x14000da78
?DisableMouseInRectCheckProp@TouchRepeatButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1376	0x140025da8
?DisableSelectionHandlesOnEmptyContent@TouchEdit2@DirectUI@@QEAAXXZ	1377	0x140014628
?Disconnect@DuiAccessible@DirectUI@@UEAAJXZ	1378	0x14000382c
?Disconnect@HWNDElementAccessible@DirectUI@@UEAAJXZ	1379	0x140036b74
?Disconnect@HWNDHostAccessible@DirectUI@@UEAAJXZ	1380	0x140038cd8
?DismissIHMAsync@TouchHWNDElement@DirectUI@@QEAAJXZ	1381	0x14003b320
?DllsLoaded@CallstackTracker@DirectUI@@CAHXZ	1382	0x14003ef9c
?DoInvoke@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@IEAAJHZZ	1383	0x14002fcfc
?DoInvoke@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@IEAAJHZZ	1384	0x140020554
?DoInvoke@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@IEAAJHZZ	1385	0x140015338
?DoInvoke@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@IEAAJHZZ	1386	0x1400309d0
?DoInvoke@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@IEAAJHZZ	1387	0x14003b334
?DoInvoke@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@IEAAJHZZ	1388	0x14000e34c
?DoInvoke@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@IEAAJHZZ	1389	0x14002681c
?DoInvoke@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@IEAAJHZZ	1390	0x1400413a8
?DoInvoke@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@IEAAJHZZ	1391	0x14001ca74
?DoInvoke@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@IEAAJHZZ	1392	0x14004015c
?DoInvoke@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@IEAAJHZZ	1393	0x14002111c
?DoInvoke@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@IEAAJHZZ	1394	0x14002369c
?DoInvoke@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@IEAAJHZZ	1395	0x14003916c
?DoInvoke@ElementProvider@DirectUI@@IEAAJHZZ	1396	0x14001999c
?DoInvoke@InvokeHelper@DirectUI@@QEAAJHPEAVElementProvider@2@P6APEAVProviderProxy@2@PEAVElement@2@@ZPEAD@Z	1397	0x140003520
?DoInvokeArgs@ElementProvider@DirectUI@@QEAAJHP6APEAVProviderProxy@2@PEAVElement@2@@ZPEAD@Z	1398	0x14004112c
?DoLayout@BorderLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1399	0x14001f304
?DoLayout@FillLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1400	0x140039734
?DoLayout@FlowLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1401	0x140002e9c
?DoLayout@GridLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1402	0x140037580
?DoLayout@Layout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1403	0x140015718
?DoLayout@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1404	0x1400411b4
?DoLayout@RowLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1405	0x140036e4c
?DoLayout@TableLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1406	0x140026364
?DoLayout@VerticalFlowLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1407	0x1400030a4
?DoMethod@BrowserSelectionProxy@DirectUI@@UEAAJHPEAD@Z	1408	0x14001f86c
?DoMethod@ElementProxy@DirectUI@@UEAAJHPEAD@Z	1409	0x14001d450
?DoMethod@ExpandCollapseProxy@DirectUI@@UEAAJHPEAD@Z	1410	0x140016338
?DoMethod@GridItemProxy@DirectUI@@UEAAJHPEAD@Z	1411	0x1400129b8
?DoMethod@GridProxy@DirectUI@@UEAAJHPEAD@Z	1412	0x1400279ac
?DoMethod@HWNDElementProxy@DirectUI@@UEAAJHPEAD@Z	1413	0x14000a434
?DoMethod@InvokeProxy@DirectUI@@UEAAJHPEAD@Z	1414	0x140002724
?DoMethod@ModernProgressBarRangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1415	0x140008250
?DoMethod@NavigatorSelectionItemProxy@DirectUI@@UEAAJHPEAD@Z	1416	0x140031a30
?DoMethod@ProgressRangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1417	0x14000c390
?DoMethod@RangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1418	0x14002a8b8
?DoMethod@ScrollBarRangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1419	0x140007e40
?DoMethod@ScrollItemProxy@DirectUI@@UEAAJHPEAD@Z	1420	0x14000d368
?DoMethod@ScrollProxy@DirectUI@@UEAAJHPEAD@Z	1421	0x140017da8
?DoMethod@SelectionItemProxy@DirectUI@@UEAAJHPEAD@Z	1422	0x1400134ac
?DoMethod@SelectionProxy@DirectUI@@UEAAJHPEAD@Z	1423	0x14002af04
?DoMethod@SelectorSelectionItemProxy@DirectUI@@UEAAJHPEAD@Z	1424	0x140020a30
?DoMethod@SelectorSelectionProxy@DirectUI@@UEAAJHPEAD@Z	1425	0x140036f28
?DoMethod@TableItemProxy@DirectUI@@UEAAJHPEAD@Z	1426	0x14003a790
?DoMethod@TableProxy@DirectUI@@UEAAJHPEAD@Z	1427	0x14001d5c0
?DoMethod@ToggleProxy@DirectUI@@UEAAJHPEAD@Z	1428	0x14000b85c
?DoMethod@ValueProxy@DirectUI@@UEAAJHPEAD@Z	1429	0x1400346f8
?DockPattern@Schema@DirectUI@@2HA	1430	0x14000c88c
?DocumentControlType@Schema@DirectUI@@2HA	1431	0x140015f7c
?DoubleBuffered@Element@DirectUI@@QEAAX_N@Z	1432	0x14002ec94
?Drag@Thumb@DirectUI@@SA?AVUID@@XZ	1433	0x1400224e4
?DragDragCancelEvent@Schema@DirectUI@@2HA	1434	0x1400155f4
?DragDragCompleteEvent@Schema@DirectUI@@2HA	1435	0x140002fa4
?DragDragStartEvent@Schema@DirectUI@@2HA	1436	0x1400290cc
?DragPattern@Schema@DirectUI@@2HA	1437	0x140014920
?Drag_DropEffect_Property@Schema@DirectUI@@2HA	1438	0x140028674
?Drag_DropEffects_Property@Schema@DirectUI@@2HA	1439	0x140038bdc
?Drag_IsGrabbed_Property@Schema@DirectUI@@2HA	1440	0x14002eb08
?DrawOutlinesProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1441	0x14001aa24
?DumpDuiProperties@@YAXPEAVElement@DirectUI@@@Z	1443	0x140020f18
?DumpDuiTree@@YAXPEAVElement@DirectUI@@H@Z	1444	0x14002a324
?EdgeHighlightColorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1445	0x14000f008
?EdgeHighlightThicknessProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1446	0x140030040
?EditControlType@Schema@DirectUI@@2HA	1447	0x14000e7d8
?ElementFromPoint@HWNDElement@DirectUI@@QEAAPEAVElement@2@PEAUtagPOINT@@@Z	1448	0x1400358c8
?ElementFromPoint@HWNDElementProxy@DirectUI@@IEAAJNNPEAPEAUIRawElementProviderFragment@@@Z	1449	0x140020b18
?ElementMovesOnIHMNotifyProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	1450	0x14003c624
?ElementProviderFromPoint@HWNDElementProvider@DirectUI@@UEAAJNNPEAPEAUIRawElementProviderFragment@@@Z	1451	0x140020160
?EnableDesignMode@DUIXmlParser@DirectUI@@QEAAXXZ	1452	0x14001eb78
?EnableUiaEvents@Element@DirectUI@@QEAAX_N@Z	1453	0x14002a9a8
?EnabledProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1454	0x14002e76c
?End@BaseScrollBar@DirectUI@@UEAAXXZ	1455	0x140014ee8
?EndDefer@Element@DirectUI@@QEAAXK@Z	1456	0x1400366b0
?EndDefer@EventManager@DirectUI@@SAJPEAVElement@2@@Z	1457	0x1400044a0
?EnforceSizeProp@PushButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1458	0x14003a958
?EnsureVisible@Element@DirectUI@@QEAA_NI@Z	1459	0x140033f84
?EnsureVisible@Element@DirectUI@@QEAA_NXZ	1460	0x14001d6c8
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z	1461	0x14003bd64
?EnsureVisible@Viewer@DirectUI@@UEAA_NHHHH@Z	1462	0x14002997c
?Enter@Edit@DirectUI@@SA?AVUID@@XZ	1463	0x14000e300
?Enter@TouchEditBase@DirectUI@@SA?AVUID@@XZ	1464	0x1400348a4
?Entered@Browser@DirectUI@@SA?AVUID@@XZ	1465	0x14003cfbc
?EnumCallstackFrames@CallstackTracker@DirectUI@@QEAAHP6AXPEBD0KK@Z@Z	1466	0x1400412e4
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z	1467	0x140035ebc
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z	1468	0x14000a0c0
?EraseFeedback@TouchSlider@DirectUI@@QEAAXXZ	1469	0x14002f730
?EstimateContentSize@CCPushButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1470	0x14003d23c
?EventFromEventId@Schema@DirectUI@@SA?AW4Event@12@H@Z	1471	0x14001eb38
?EventListener@EventManager@DirectUI@@SAJPEAVElement@2@PEAUEvent@2@@Z	1472	0x14002d708
?ExecuteManualSwapDeferredZoomToRect@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	1473	0x140008504
?Expand@ExpandCollapseProvider@DirectUI@@UEAAJXZ	1474	0x14001a8a0
?ExpandCollapsePattern@Schema@DirectUI@@2HA	1475	0x14003a8f8
?ExpandCollapse_ExpandCollapseState_Property@Schema@DirectUI@@2HA	1476	0x14002a5e4
?ExpandProp@Macro@DirectUI@@SAPEBUPropertyInfo@2@XZ	1477	0x140024460
?ExpandedProp@Expandable@DirectUI@@SAPEBUPropertyInfo@2@XZ	1478	0x140002474
?ExtentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1479	0x14000aafc
?FWantAnyEvent@EventManager@DirectUI@@SA_NPEAVElement@2@@Z	1480	0x1400091c8
?FillSymbolInfo@CallstackTracker@DirectUI@@AEAAXPEAUSTACK_SYMBOL_INFO@12@_K@Z	1481	0x14003bbfc
?FilterOnPasteProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	1482	0x1400105d0
?FinalizeCurrentIMEComposition@TouchEdit2@DirectUI@@UEAAJXZ	1483	0x14003680c
?FinalizeCurrentIMEComposition@TouchEditBase@DirectUI@@UEAAJXZ	1484	0x14000bfb8
?Find@ElementProviderManager@DirectUI@@SAPEAVElementProvider@2@PEAVElement@2@@Z	1485	0x140027ab0
?FindAccessibleRole@AccessibleButton@DirectUI@@CAPEBUACCESSIBLEROLE@12@H@Z	1486	0x14002b544
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z	1487	0x140011f58
?FindDescendentWorker@Element@DirectUI@@AEAAPEAV12@G@Z	1488	0x140007c20
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UEAAHGH@Z	1489	0x14001c018
?FindInvokeHelper@InvokeManager@DirectUI@@CAPEAVInvokeHelper@2@PEAI@Z	1490	0x1400228a8
?FindProviderCallback@ElementProviderManager@DirectUI@@CA_NPEAVElementProvider@2@PEAX@Z	1491	0x14001311c
?FindRefPoint@RefPointElement@DirectUI@@SAPEAVElement@2@PEAV32@PEAUtagPOINT@@@Z	1492	0x140037c48
?FindShortcut@HWNDElement@DirectUI@@SA_NGPEAVElement@2@PEAPEAV32@PEAH2H@Z	1493	0x1400233d4
?FindShortcutRecursive@HWNDElement@DirectUI@@KA_NGPEAVElement@2@PEAPEAV32@PEAH2H@Z	1494	0x140040968
?FireAnimationChangeEvent@BaseScrollViewer@DirectUI@@IEAAX_N@Z	1495	0x14001bb8c
?FireClickEvent@TouchButton@DirectUI@@UEAAXIIW4ClickDevice@12@PEAUtagPOINT@@@Z	1496	0x140016e60
?FireClickEvent@TouchRepeatButton@DirectUI@@UEAAXIIW4ClickDevice@TouchButton@2@PEAUtagPOINT@@@Z	1497	0x14002b050
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z	1498	0x14000cb14
?FireEventOnMouseOrPointerRelease@TouchSlider@DirectUI@@QEAAXXZ	1499	0x140007528
?FireHostEvent@PushButton@DirectUI@@AEAAXPEAVElement@2@_N@Z	1500	0x140031478
?FireNavigate@Browser@DirectUI@@AEAAHG@Z	1501	0x14000b3e8
?FireNavigationEvent@Navigator@DirectUI@@AEAAXXZ	1502	0x14000eb98
?FireRightClickEvent@TouchButton@DirectUI@@UEAAXIPEAUtagPOINT@@@Z	1503	0x140010ce8
?FireRightClickEvent@TouchRepeatButton@DirectUI@@UEAAXIPEAUtagPOINT@@@Z	1504	0x14003626c
?FireStructureChangedEvent@EventManager@DirectUI@@SAJPEAVElement@2@W4StructureChangeType@@@Z	1505	0x14003d28c
?FlagsProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	1506	0x140002d58
?FlushWorkingSet@HWNDElement@DirectUI@@QEAAXXZ	1507	0x140010a60
?FontColorRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1508	0x1400300f4
?FontFaceProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1509	0x140038ac0
?FontProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1510	0x140023f8c
?FontQualityProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1511	0x1400211f8
?FontSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1512	0x1400412f4
?FontSizeRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1513	0x14002d0d8
?FontStyleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1514	0x14002dea0
?FontWeightProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1515	0x14002bd98
?FontWeightRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1516	0x14003f784
?ForceEditTextToLTRProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	1517	0x14002fdc8
?ForceThemeChange@XBaby@DirectUI@@UEAAX_K_J@Z	1518	0x140022bf4
?ForceThemeChange@XProvider@DirectUI@@UEAAJ_K_J@Z	1519	0x140021984
?ForegroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1520	0x1400081d4
?Forward@Movie@DirectUI@@QEAAXXZ	1521	0x14001ef00
?ForwardingWindowMessage@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	1522	0x14003c464
?FrameDurationProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	1523	0x14003cb50
?FrameIndexProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	1524	0x140008108
?FrameWidthProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	1525	0x140028a70
?FrameworkId@Schema@DirectUI@@2HA	1526	0x140010ff0
?FreeComCtl32@TaskPage@DirectUI@@AEAAXXZ	1527	0x140002520
?FreeProvider@XElement@DirectUI@@QEAAXXZ	1528	0x14003cac8
?GetAbsorbsShortcut@Element@DirectUI@@QEAA_NXZ	1529	0x14000a458
?GetAccDefAction@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1530	0x14001e680
?GetAccDesc@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1531	0x140033930
?GetAccHelp@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1532	0x1400171f0
?GetAccItemStatus@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1533	0x14002c840
?GetAccItemType@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1534	0x1400044cc
?GetAccName@DuiAccessible@DirectUI@@IEAAJUtagVARIANT@@HPEAPEAG@Z	1535	0x140012bc0
?GetAccName@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1536	0x140036410
?GetAccNameAsDisplayed@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1537	0x140036c34
?GetAccNameFromContent@DuiAccessible@DirectUI@@IEAAJPEAPEAG@Z	1538	0x14002a250
?GetAccRole@Element@DirectUI@@QEAAHXZ	1539	0x14004098c
?GetAccState@Element@DirectUI@@QEAAHXZ	1540	0x1400224b0
?GetAccValue@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1541	0x140032e7c
?GetAccessible@Element@DirectUI@@QEAA_NXZ	1542	0x14000c9c0
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1543	0x140010504
?GetAccessibleImpl@HWNDElement@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1544	0x14001ecb8
?GetAccessibleImpl@HWNDHost@DirectUI@@AEAAJPEAPEAUIAccessible@@_N@Z	1545	0x14001a330
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1546	0x14002a3fc
?GetAccessibleImpl@TouchEdit2@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1547	0x14001a824
?GetAccessibleParent@DuiAccessible@DirectUI@@SAPEAVElement@2@PEAV32@@Z	1548	0x14003b2ec
?GetActive@Element@DirectUI@@QEAAHXZ	1549	0x140003e38
?GetActiveState@TouchScrollBar@DirectUI@@QEAA?AW4ActiveState@2@XZ	1550	0x14003b210
?GetActualReferencePoint@RefPointElement@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z	1551	0x140004a34
?GetAdjacent@BorderLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1552	0x14000fd0c
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z	1553	0x140020d3c
?GetAdjacent@FillLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1554	0x14000c820
?GetAdjacent@FlowLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1555	0x140039c84
?GetAdjacent@GridLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1556	0x14000d884
?GetAdjacent@ItemList@DirectUI@@UEAAPEAVElement@2@PEAV32@HPEBUNavReference@2@K@Z	1557	0x140025270
?GetAdjacent@Layout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1558	0x14003d490
?GetAdjacent@NineGridLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1559	0x140030494
?GetAdjacent@RowLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1560	0x140003714
?GetAdjacent@Selector@DirectUI@@UEAAPEAVElement@2@PEAV32@HPEBUNavReference@2@K@Z	1561	0x1400107e8
?GetAdjacent@ShellBorderLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1562	0x140022824
?GetAdjacent@TableLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1563	0x140031658
?GetAdjacent@VerticalFlowLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1564	0x14002f2e4
?GetAdjacent@XBaby@DirectUI@@UEAAPEAVElement@2@PEAV32@HPEBUNavReference@2@K@Z	1565	0x140005498
?GetAllowArrowOut@TouchScrollViewer@DirectUI@@QEAA_NXZ	1566	0x140019148
?GetAlpha@Element@DirectUI@@QEAAHXZ	1567	0x14001458c
?GetAnimatePopupOnDismiss@TouchSelect@DirectUI@@QEAA_NXZ	1568	0x140040f30
?GetAnimation@Element@DirectUI@@QEAAHXZ	1569	0x14002e3b4
?GetAtom@Value@DirectUI@@QEAAGXZ	1570	0x14001c1f4
?GetAtomZero@Value@DirectUI@@SAPEAV12@XZ	1571	0x14000c7a8
?GetAutoGrouping@CCRadioButton@DirectUI@@QEAA_NXZ	1572	0x140040490
?GetAutoStart@Movie@DirectUI@@QEAA_NXZ	1573	0x140006224
?GetAutoStop@Movie@DirectUI@@QEAA_NXZ	1574	0x14001f81c
?GetAutomationId@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@@Z	1575	0x140002214
?GetBackgroundColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1576	0x14000df3c
?GetBackgroundOwner@HWNDHost@DirectUI@@IEAAPEAVElement@2@XZ	1577	0x1400134e4
?GetBackgroundOwnerID@HWNDHost@DirectUI@@QEAAGXZ	1578	0x140026c98
?GetBackgroundStdColor@Element@DirectUI@@QEAAHXZ	1579	0x140038dc0
?GetBool@EventManager@DirectUI@@CAJPEAUtagVARIANT@@PEAVValue@2@@Z	1580	0x14000c604
?GetBool@Value@DirectUI@@QEAA_NXZ	1581	0x14001bdcc
?GetBoolFalse@Value@DirectUI@@SAPEAV12@XZ	1582	0x140005e78
?GetBoolTrue@Value@DirectUI@@SAPEAV12@XZ	1583	0x140014098
?GetBorderColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1584	0x140022f40
?GetBorderStdColor@Element@DirectUI@@QEAAHXZ	1585	0x140024f44
?GetBorderStyle@Element@DirectUI@@QEAAHXZ	1586	0x14002cd5c
?GetBorderThickness@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1587	0x14002b2e4
?GetBoundingRect@ElementProxy@DirectUI@@IEAAJPEAUUiaRect@@@Z	1588	0x14000ac78
?GetBrowser@Navigator@DirectUI@@QEAAPEAVBrowser@2@XZ	1589	0x140035154
?GetBuffering@TouchSlider@DirectUI@@QEAAHXZ	1590	0x140018fe4
?GetButtonClassAcceptsEnterKey@DialogElement@DirectUI@@UEAA_NXZ	1591	0x140030fc0
?GetButtonColor@CCPushButton@DirectUI@@UEAA_NPEAUHDC__@@PEAPEAUHBRUSH__@@@Z	1592	0x140032a40
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z	1593	0x1400016dc
?GetCaptured@Button@DirectUI@@QEAA_NXZ	1594	0x140006e38
?GetCaptured@TouchButton@DirectUI@@QEAA_NXZ	1595	0x140002788
?GetCellInfo@TableLayout@DirectUI@@QEAAPEAUCellInfo@2@H@Z	1596	0x14001f9a0
?GetCheckedState@TouchCheckBox@DirectUI@@QEAA?AW4CheckedStateFlags@2@XZ	1597	0x14003464c
?GetChildFromLayoutIndex@Layout@DirectUI@@QEAAPEAVElement@2@PEAV32@HPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@@Z	1598	0x140023ae0
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ	1599	0x140008850
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z	1600	0x1400020d4
?GetClass@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1601	0x140029db8
?GetClassInfoPtr@AccessibleButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1602	0x140008e94
?GetClassInfoPtr@AnimationStrip@DirectUI@@SAPEAUIClassInfo@2@XZ	1603	0x140017d20
?GetClassInfoPtr@AutoButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1604	0x140005db0
?GetClassInfoPtr@BaseScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1605	0x140018478
?GetClassInfoPtr@Bind@DirectUI@@SAPEAUIClassInfo@2@XZ	1606	0x14001b510
?GetClassInfoPtr@Browser@DirectUI@@SAPEAUIClassInfo@2@XZ	1607	0x14001ff8c
?GetClassInfoPtr@Button@DirectUI@@SAPEAUIClassInfo@2@XZ	1608	0x140030aa4
?GetClassInfoPtr@CCAVI@DirectUI@@SAPEAUIClassInfo@2@XZ	1609	0x1400168c4
?GetClassInfoPtr@CCBase@DirectUI@@SAPEAUIClassInfo@2@XZ	1610	0x14000f144
?GetClassInfoPtr@CCBaseCheckRadioButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1611	0x14002c140
?GetClassInfoPtr@CCBaseScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1612	0x140035a08
?GetClassInfoPtr@CCCheckBox@DirectUI@@SAPEAUIClassInfo@2@XZ	1613	0x140034d10
?GetClassInfoPtr@CCCommandLink@DirectUI@@SAPEAUIClassInfo@2@XZ	1614	0x140024350
?GetClassInfoPtr@CCHScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1615	0x14002dab0
?GetClassInfoPtr@CCListBox@DirectUI@@SAPEAUIClassInfo@2@XZ	1616	0x140012290
?GetClassInfoPtr@CCListView@DirectUI@@SAPEAUIClassInfo@2@XZ	1617	0x1400213e0
?GetClassInfoPtr@CCProgressBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1618	0x14001c9dc
?GetClassInfoPtr@CCPushButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1619	0x140032e2c
?GetClassInfoPtr@CCRadioButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1620	0x140037b44
?GetClassInfoPtr@CCSysLink@DirectUI@@SAPEAUIClassInfo@2@XZ	1621	0x14000b304
?GetClassInfoPtr@CCTrackBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1622	0x140027b00
?GetClassInfoPtr@CCTreeView@DirectUI@@SAPEAUIClassInfo@2@XZ	1623	0x140035fd8
?GetClassInfoPtr@CCVScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1624	0x1400250c8
?GetClassInfoPtr@CheckBoxGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1625	0x14003398c
?GetClassInfoPtr@Clipper@DirectUI@@SAPEAUIClassInfo@2@XZ	1626	0x14001d190
?GetClassInfoPtr@Combobox@DirectUI@@SAPEAUIClassInfo@2@XZ	1627	0x14000ae00
?GetClassInfoPtr@DialogElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1628	0x140007a40
?GetClassInfoPtr@Edit@DirectUI@@SAPEAUIClassInfo@2@XZ	1629	0x14002585c
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ	1630	0x14001be50
?GetClassInfoPtr@ElementWithHWND@DirectUI@@SAPEAUIClassInfo@2@XZ	1631	0x14000ab74
?GetClassInfoPtr@Expandable@DirectUI@@SAPEAUIClassInfo@2@XZ	1632	0x1400366bc
?GetClassInfoPtr@Expando@DirectUI@@SAPEAUIClassInfo@2@XZ	1633	0x14001b964
?GetClassInfoPtr@ExpandoButtonGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1634	0x140005e00
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1635	0x140005e78
?GetClassInfoPtr@HWNDHost@DirectUI@@SAPEAUIClassInfo@2@XZ	1636	0x140017d08
?GetClassInfoPtr@ItemList@DirectUI@@SAPEAUIClassInfo@2@XZ	1637	0x140027c04
?GetClassInfoPtr@Macro@DirectUI@@SAPEAUIClassInfo@2@XZ	1638	0x14002c1c8
?GetClassInfoPtr@ModernProgressBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1639	0x140037424
?GetClassInfoPtr@ModernProgressRing@DirectUI@@SAPEAUIClassInfo@2@XZ	1640	0x140008a44
?GetClassInfoPtr@Movie@DirectUI@@SAPEAUIClassInfo@2@XZ	1641	0x14000ce50
?GetClassInfoPtr@Navigator@DirectUI@@SAPEAUIClassInfo@2@XZ	1642	0x14002967c
?GetClassInfoPtr@PText@DirectUI@@SAPEAUIClassInfo@2@XZ	1643	0x140020de8
?GetClassInfoPtr@Page@DirectUI@@SAPEAUIClassInfo@2@XZ	1644	0x140014ef4
?GetClassInfoPtr@Pages@DirectUI@@SAPEAUIClassInfo@2@XZ	1645	0x140015e54
?GetClassInfoPtr@Progress@DirectUI@@SAPEAUIClassInfo@2@XZ	1646	0x140040160
?GetClassInfoPtr@PushButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1647	0x14003fc70
?GetClassInfoPtr@RadioButtonGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1648	0x14003a568
?GetClassInfoPtr@RefPointElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1649	0x140026de8
?GetClassInfoPtr@RepeatButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1650	0x140007cac
?GetClassInfoPtr@Repeater@DirectUI@@SAPEAUIClassInfo@2@XZ	1651	0x140008ec0
?GetClassInfoPtr@RichText@DirectUI@@SAPEAUIClassInfo@2@XZ	1652	0x140029f34
?GetClassInfoPtr@ScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1653	0x140009bcc
?GetClassInfoPtr@ScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1654	0x140017d64
?GetClassInfoPtr@Selector@DirectUI@@SAPEAUIClassInfo@2@XZ	1655	0x14003b9dc
?GetClassInfoPtr@SelectorNoDefault@DirectUI@@SAPEAUIClassInfo@2@XZ	1656	0x14002f980
?GetClassInfoPtr@SemanticZoomToggle@DirectUI@@SAPEAUIClassInfo@2@XZ	1657	0x140027bd4
?GetClassInfoPtr@StyledScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1658	0x140017a60
?GetClassInfoPtr@TextGraphic@DirectUI@@SAPEAUIClassInfo@2@XZ	1659	0x14001a814
?GetClassInfoPtr@Thumb@DirectUI@@SAPEAUIClassInfo@2@XZ	1660	0x14000ebbc
?GetClassInfoPtr@TouchButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1661	0x14000a8b0
?GetClassInfoPtr@TouchCheckBox@DirectUI@@SAPEAUIClassInfo@2@XZ	1662	0x140009714
?GetClassInfoPtr@TouchCheckBoxGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1663	0x140030784
?GetClassInfoPtr@TouchCommandButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1664	0x14000379c
?GetClassInfoPtr@TouchEdit2@DirectUI@@SAPEAUIClassInfo@2@XZ	1665	0x14003bc3c
?GetClassInfoPtr@TouchEditBase@DirectUI@@SAPEAUIClassInfo@2@XZ	1666	0x140019be4
?GetClassInfoPtr@TouchHWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1667	0x14002f62c
?GetClassInfoPtr@TouchHyperLink@DirectUI@@SAPEAUIClassInfo@2@XZ	1668	0x14002db78
?GetClassInfoPtr@TouchRepeatButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1669	0x140013fc0
?GetClassInfoPtr@TouchScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1670	0x140031118
?GetClassInfoPtr@TouchScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1671	0x140014b3c
?GetClassInfoPtr@TouchSelect@DirectUI@@SAPEAUIClassInfo@2@XZ	1672	0x140011fa0
?GetClassInfoPtr@TouchSelectItem@DirectUI@@SAPEAUIClassInfo@2@XZ	1673	0x140006504
?GetClassInfoPtr@TouchSlider@DirectUI@@SAPEAUIClassInfo@2@XZ	1674	0x14002ca74
?GetClassInfoPtr@TouchSwitch@DirectUI@@SAPEAUIClassInfo@2@XZ	1675	0x140020034
?GetClassInfoPtr@UnknownElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1676	0x14001ff4c
?GetClassInfoPtr@Viewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1677	0x140030088
?GetClassInfoPtr@XBaby@DirectUI@@SAPEAUIClassInfo@2@XZ	1678	0x14000e480
?GetClassInfoPtr@XElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1679	0x14002d344
?GetClassInfoW@AccessibleButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1680	0x140031e5c
?GetClassInfoW@AnimationStrip@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1681	0x140023da8
?GetClassInfoW@AutoButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1682	0x14001c014
?GetClassInfoW@BaseScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1683	0x140032a50
?GetClassInfoW@Bind@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1684	0x140008770
?GetClassInfoW@Browser@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1685	0x14002f504
?GetClassInfoW@Button@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1686	0x140016118
?GetClassInfoW@CCAVI@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1687	0x14000cfe4
?GetClassInfoW@CCBase@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1688	0x14002c0b8
?GetClassInfoW@CCBaseCheckRadioButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1689	0x140019790
?GetClassInfoW@CCBaseScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1690	0x14000d998
?GetClassInfoW@CCCheckBox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1691	0x140019e48
?GetClassInfoW@CCCommandLink@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1692	0x14000e96c
?GetClassInfoW@CCHScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1693	0x140025e60
?GetClassInfoW@CCListBox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1694	0x140008570
?GetClassInfoW@CCListView@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1695	0x14001f1f4
?GetClassInfoW@CCProgressBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1696	0x140028848
?GetClassInfoW@CCPushButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1697	0x1400122a0
?GetClassInfoW@CCRadioButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1698	0x140015b4c
?GetClassInfoW@CCSysLink@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1699	0x14000c698
?GetClassInfoW@CCTrackBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1700	0x140023aa4
?GetClassInfoW@CCTreeView@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1701	0x1400336e4
?GetClassInfoW@CCVScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1702	0x14003eec8
?GetClassInfoW@CheckBoxGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1703	0x140023930
?GetClassInfoW@Clipper@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1704	0x140016adc
?GetClassInfoW@Combobox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1705	0x14002c2f4
?GetClassInfoW@DialogElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1706	0x14001bb60
?GetClassInfoW@Edit@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1707	0x1400308f0
?GetClassInfoW@Element@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1708	0x14002892c
?GetClassInfoW@ElementWithHWND@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1709	0x14003f224
?GetClassInfoW@Expandable@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1710	0x140036814
?GetClassInfoW@Expando@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1711	0x14003d130
?GetClassInfoW@ExpandoButtonGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1712	0x140034f58
?GetClassInfoW@HWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1713	0x1400311a8
?GetClassInfoW@HWNDHost@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1714	0x140032fdc
?GetClassInfoW@ItemList@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1715	0x140036c3c
?GetClassInfoW@Macro@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1716	0x14002ba50
?GetClassInfoW@ModernProgressBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1717	0x140030218
?GetClassInfoW@ModernProgressRing@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1718	0x14004152c
?GetClassInfoW@Movie@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1719	0x140029d28
?GetClassInfoW@Navigator@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1720	0x14001b390
?GetClassInfoW@PText@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1721	0x140008ee0
?GetClassInfoW@Page@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1722	0x14003c184
?GetClassInfoW@Pages@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1723	0x14000d41c
?GetClassInfoW@Progress@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1724	0x14002adec
?GetClassInfoW@PushButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1725	0x1400048c0
?GetClassInfoW@RadioButtonGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1726	0x140007fec
?GetClassInfoW@RefPointElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1727	0x140021d40
?GetClassInfoW@RepeatButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1728	0x14001c424
?GetClassInfoW@Repeater@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1729	0x140024fcc
?GetClassInfoW@RichText@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1730	0x14001ffe0
?GetClassInfoW@ScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1731	0x140009d04
?GetClassInfoW@ScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1732	0x140002520
?GetClassInfoW@Selector@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1733	0x140018720
?GetClassInfoW@SelectorNoDefault@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1734	0x14000368c
?GetClassInfoW@SemanticZoomToggle@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1735	0x140029acc
?GetClassInfoW@StyledScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1736	0x140015bbc
?GetClassInfoW@TextGraphic@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1737	0x140015704
?GetClassInfoW@Thumb@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1738	0x14001f594
?GetClassInfoW@TouchButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1739	0x140033228
?GetClassInfoW@TouchCheckBox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1740	0x140019214
?GetClassInfoW@TouchCheckBoxGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1741	0x14000bb9c
?GetClassInfoW@TouchCommandButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1742	0x14000b53c
?GetClassInfoW@TouchEdit2@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1743	0x140041608
?GetClassInfoW@TouchEditBase@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1744	0x1400189b8
?GetClassInfoW@TouchHWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1745	0x140002fb8
?GetClassInfoW@TouchHyperLink@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1746	0x14000a3e0
?GetClassInfoW@TouchRepeatButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1747	0x140017930
?GetClassInfoW@TouchScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1748	0x14003b980
?GetClassInfoW@TouchScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1749	0x14001354c
?GetClassInfoW@TouchSelect@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1750	0x140031b1c
?GetClassInfoW@TouchSelectItem@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1751	0x140007c90
?GetClassInfoW@TouchSlider@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1752	0x140020938
?GetClassInfoW@TouchSwitch@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1753	0x140027a80
?GetClassInfoW@UnknownElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1754	0x14002c7d4
?GetClassInfoW@Viewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1755	0x14001256c
?GetClassInfoW@XBaby@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1756	0x140002258
?GetClassInfoW@XElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1757	0x14000324c
?GetClickDevice@TouchButton@DirectUI@@QEAA?AW4ClickDevice@12@XZ	1758	0x14002c620
?GetClickablePoint@Element@DirectUI@@QEAA_NPEAUtagPOINT@@@Z	1759	0x140025ecc
?GetClientAccessibleImpl@HWNDHost@DirectUI@@QEAAJPEAPEAUIAccessible@@@Z	1760	0x140030960
?GetColorFromProperty@DirectUI@@YAJPEAVElement@1@PEBUPropertyInfo@1@HPEAK@Z	1761	0x140014744
?GetColorFromValue@DirectUI@@YAJPEAVElement@1@PEAVValue@1@PEAK@Z	1762	0x140014eac
?GetColorTrans@Value@DirectUI@@SAPEAV12@XZ	1763	0x140028d40
?GetColorize@Element@DirectUI@@QEAAHXZ	1764	0x1400209ec
?GetColumn@GridItemProxy@DirectUI@@AEAAJPEAH@Z	1765	0x140012cf0
?GetColumnCount@GridProxy@DirectUI@@AEAAJPEAH@Z	1766	0x14003d83c
?GetColumnHeaderItems@TableItemProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	1767	0x14003f334
?GetColumnHeaders@TableProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	1768	0x140025c5c
?GetCommonDrawTextFlags@Element@DirectUI@@AEAAIH@Z	1769	0x140014490
?GetCompositingQuality@Movie@DirectUI@@QEAAHXZ	1770	0x14002e1cc
?GetConnect@Bind@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1771	0x14002b3e8
?GetContainingGrid@GridItemProxy@DirectUI@@AEAAJPEAPEAUIRawElementProviderSimple@@@Z	1772	0x1400317d8
?GetContent@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@PEAUIAccessible@@@Z	1773	0x140023da8
?GetContentAlign@Element@DirectUI@@QEAAHXZ	1774	0x1400105e0
?GetContentCrossfadeOpacity@TouchScrollViewer@DirectUI@@QEAAMXZ	1775	0x140017658
?GetContentDesiredSize@XBaby@DirectUI@@UEAA?AUtagSIZE@@HH@Z	1776	0x140029d4c
?GetContentSize@CCBase@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1777	0x14001dd00
?GetContentSize@CCBaseCheckRadioButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1778	0x14002b34c
?GetContentSize@CCCommandLink@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1779	0x140034acc
?GetContentSize@CCHScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1780	0x14001e1c4
?GetContentSize@CCListBox@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1781	0x140038ba0
?GetContentSize@CCListView@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1782	0x14000db60
?GetContentSize@CCPushButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1783	0x140031e1c
?GetContentSize@CCSysLink@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1784	0x1400130b0
?GetContentSize@CCTreeView@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1785	0x14002bb00
?GetContentSize@CCVScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1786	0x14003e100
?GetContentSize@Combobox@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1787	0x14002ad78
?GetContentSize@Edit@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1788	0x140027e84
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1789	0x14001979c
?GetContentSize@Progress@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1790	0x14001dddc
?GetContentSize@PushButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1791	0x140007d28
?GetContentSize@RichText@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1792	0x14001badc
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1793	0x1400044f0
?GetContentStringAsDisplayed@Edit@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1794	0x14000b61c
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1795	0x140025da4
?GetContentStringAsDisplayed@TextGraphic@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1796	0x140012a78
?GetContentStringAsDisplayed@TouchEditBase@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1797	0x140025038
?GetControlType@ElementProxy@DirectUI@@IEAAXPEAUtagVARIANT@@PEAUIAccessible@@@Z	1798	0x14001db90
?GetControllerFor@TouchEditBase@DirectUI@@UEAAJPEAPEAUIUnknown@@@Z	1799	0x14000ffd4
?GetCount@CCListBox@DirectUI@@QEAAHXZ	1800	0x14000d3c0
?GetCount@Pages@DirectUI@@QEAAIXZ	1801	0x140006818
?GetCreationFlags@XElement@DirectUI@@UEAAIXZ	1802	0x1400391c4
?GetCurrentCols@GridLayout@DirectUI@@IEAAIH@Z	1803	0x14003de6c
?GetCurrentCols@GridLayout@DirectUI@@IEAAIPEAVElement@2@@Z	1804	0x14000ea80
?GetCurrentPage@Browser@DirectUI@@QEAAPEAVElement@2@XZ	1805	0x140027504
?GetCurrentPageID@Browser@DirectUI@@QEAAGXZ	1806	0x140037bbc
?GetCurrentRows@GridLayout@DirectUI@@IEAAIH@Z	1807	0x1400165d4
?GetCurrentRows@GridLayout@DirectUI@@IEAAIPEAVElement@2@@Z	1808	0x14001f020
?GetCursor@Value@DirectUI@@QEAAPEAUCursor@2@XZ	1809	0x140018aec
?GetCursorNull@Value@DirectUI@@SAPEAV12@XZ	1810	0x140017ed8
?GetDPI@Element@DirectUI@@QEAAHXZ	1811	0x1400225d4
?GetDataEntry@Macro@DirectUI@@QEAAPEAUIDataEntry@2@XZ	1812	0x14001ea24
?GetDblListEmpty@Value@DirectUI@@SAPEAV12@XZ	1813	0x140040ef8
?GetDefaultButton@DialogElement@DirectUI@@UEAAPEAVElement@2@XZ	1814	0x14003920c
?GetDefaultButton@DialogElementCore@DirectUI@@QEAAPEAVElement@2@XZ	1815	0x140010680
?GetDefaultButtonTracking@DialogElement@DirectUI@@UEAA_NXZ	1816	0x140013440
?GetDefaultButtonTracking@XBaby@DirectUI@@UEAA_NXZ	1817	0x14001b3c8
?GetDeferObject@Element@DirectUI@@QEAAPEAVDeferCycle@2@XZ	1818	0x14000dba0
?GetDesiredSize@Element@DirectUI@@QEAAPEBUtagSIZE@@XZ	1819	0x14000642c
?GetDesiredSize@XProvider@DirectUI@@UEAAJHHPEAUtagSIZE@@@Z	1820	0x140022c1c
?GetDirection@Element@DirectUI@@QEAAHXZ	1821	0x1400040c4
?GetDirty@Edit@DirectUI@@QEAA_NXZ	1822	0x14003b1cc
?GetDisableMouseInRectCheck@TouchRepeatButton@DirectUI@@QEAA_NXZ	1823	0x14000f4d4
?GetDispatchFromElement@DuiAccessible@DirectUI@@IEAAJPEAVElement@2@PEAPEAUIDispatch@@@Z	1824	0x14003fc04
?GetDisplayNode@Element@DirectUI@@QEAAPEAUHGADGET__@@XZ	1825	0x1400142b0
?GetDoubleList@Value@DirectUI@@QEAAPEAV?$DynamicArray@N$0A@@2@XZ	1826	0x1400134e8
?GetDrawOutlines@Movie@DirectUI@@QEAA_NXZ	1827	0x140032c30
?GetEdgeHighlightColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1828	0x14000fb40
?GetEdgeHighlightThickness@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1829	0x14001c9fc
?GetElListNull@Value@DirectUI@@SAPEAV12@XZ	1830	0x140003204
?GetElement@CCBaseScrollBar@DirectUI@@UEAAPEAVElement@2@XZ	1831	0x14002a608
?GetElement@ElementProvider@DirectUI@@UEAAPEDVElement@2@XZ	1832	0x14003c668
?GetElement@NativeHWNDHost@DirectUI@@QEAAPEAVElement@2@XZ	1833	0x14000e900
?GetElement@ScrollBar@DirectUI@@UEAAPEAVElement@2@XZ	1834	0x1400296b8
?GetElement@TaskPage@DirectUI@@IEAAPEAVElement@2@XZ	1835	0x1400214ec
?GetElement@Value@DirectUI@@QEAAPEAVElement@2@XZ	1836	0x14003bc74
?GetElement@XHost@DirectUI@@QEAAPEAVElement@2@XZ	1837	0x14003a8b8
?GetElementKey@ElementProvider@DirectUI@@QEAAPEBVElement@2@XZ	1838	0x14001a050
?GetElementList@Value@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@XZ	1839	0x14001fe50
?GetElementMovesOnIHMNotify@TouchEditBase@DirectUI@@QEAA_NXZ	1840	0x140004f2c
?GetElementNull@Value@DirectUI@@SAPEAV12@XZ	1841	0x14002355c
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z	1842	0x14003f080
?GetElementProviderImpl@TouchSelect@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z	1843	0x14000bf74
?GetElementProviderImpl@XBaby@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z	1844	0x1400171a4
?GetElementScaleFactor@Element@DirectUI@@QEAAMXZ	1845	0x140017cec
?GetElementScaledFloat@Value@DirectUI@@QEAAMPEAVElement@2@@Z	1846	0x14000cce8
?GetElementScaledInt@Value@DirectUI@@QEAAHPEAVElement@2@@Z	1847	0x140010bac
?GetElementScaledPoint@Value@DirectUI@@QEAAXPEAVElement@2@PEAUtagPOINT@@@Z	1848	0x14003c554
?GetElementScaledRect@Value@DirectUI@@QEAAXPEAVElement@2@PEAUtagRECT@@@Z	1849	0x140011ef0
?GetElementScaledSize@Value@DirectUI@@QEAAXPEAVElement@2@PEAUtagSIZE@@@Z	1850	0x14000fd64
?GetEmbeddedFragmentRoots@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	1851	0x140027070
?GetEnabled@Element@DirectUI@@QEAA_NXZ	1852	0x1400363b4
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z	1853	0x14001b488
?GetEncodedContentStringLength@Element@DirectUI@@QEAA_KXZ	1854	0x14001b378
?GetEncodedString@Value@DirectUI@@QEAAJPEAG_K@Z	1855	0x140035168
?GetEncodedStringLength@Value@DirectUI@@QEAA_KXZ	1856	0x14001eab0
?GetEnforceSize@PushButton@DirectUI@@QEAA_NXZ	1857	0x140029740
?GetExpand@Macro@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1858	0x140029a90
?GetExpandCollapseState@EventManager@DirectUI@@CAXPEAUtagVARIANT@@@Z	1859	0x14003cbd8
?GetExpanded@Expandable@DirectUI@@QEAA_NXZ	1860	0x14002d60c
?GetExprNull@Value@DirectUI@@SAPEAV12@XZ	1861	0x14000d734
?GetExpression@Value@DirectUI@@QEAAPEAVExpression@2@XZ	1862	0x140006d18
?GetExtent@Element@DirectUI@@QEAAPEBUtagSIZE@@PEAPEAVValue@2@@Z	1863	0x140012ca4
?GetFactory@RichText@DirectUI@@QEAAPEAUIDWriteFactory@@XZ	1864	0x14000c3c8
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ	1865	0x14000741c
?GetFill@Value@DirectUI@@QEAAPEBUFill@2@XZ	1866	0x140001f18
?GetFillpartElement@TouchSlider@DirectUI@@QEAAPEAVElement@2@XZ	1867	0x140019e60
?GetFilterOnPaste@TouchEditBase@DirectUI@@QEAA_NXZ	1868	0x14000efe0
?GetFlags@TouchHWNDElement@DirectUI@@QEAA?AW4TouchHWNDElementFlags@2@XZ	1869	0x1400211a4
?GetFloat@Value@DirectUI@@QEAAMXZ	1870	0x140018a38
?GetFloatOne@Value@DirectUI@@SAPEAV12@XZ	1871	0x1400256cc
?GetFloatZero@Value@DirectUI@@SAPEAV12@XZ	1872	0x14000fe64
?GetFocus@HWNDElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderFragment@@@Z	1873	0x14003d5bc
?GetFocus@HWNDElementProxy@DirectUI@@IEAAJPEAPEAUIRawElementProviderFragment@@@Z	1874	0x14003d638
?GetFocusableElement@XBaby@DirectUI@@UEAAPEAVElement@2@XZ	1875	0x1400033e0
?GetFocusedHWNDElement@HWNDElement@DirectUI@@SAPEAV12@XZ	1876	0x140001910
?GetFont@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1877	0x140013920
?GetFont@HWNDHost@DirectUI@@IEAAPEAUHFONT__@@XZ	1878	0x140008fb4
?GetFontFace@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1879	0x14002fd04
?GetFontQuality@Element@DirectUI@@QEAAHXZ	1880	0x14002c268
?GetFontSize@Element@DirectUI@@QEAAHXZ	1881	0x14000f7ac
?GetFontStyle@Element@DirectUI@@QEAAHXZ	1882	0x14003b39c
?GetFontWeight@Element@DirectUI@@QEAAHXZ	1883	0x14000ed34
?GetForceEditTextToLTR@TouchEditBase@DirectUI@@QEAA_NXZ	1884	0x14000832c
?GetForegroundColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1885	0x140040654
?GetForegroundColorRef@RichText@DirectUI@@UEAAJPEAK@Z	1886	0x14001a93c
?GetForegroundColorRef@TouchButton@DirectUI@@UEAAJPEAK@Z	1887	0x140036e48
?GetForegroundStdColor@Element@DirectUI@@QEAAHXZ	1888	0x14003626c
?GetFragmentRoot@ElementProxy@DirectUI@@IEAAJPEAPEAUIRawElementProviderFragmentRoot@@@Z	1889	0x140040f18
?GetFrameDuration@AnimationStrip@DirectUI@@QEAAHXZ	1890	0x140036e2c
?GetFrameIndex@AnimationStrip@DirectUI@@QEAAHXZ	1891	0x14000cbe4
?GetFrameWidth@AnimationStrip@DirectUI@@QEAAHXZ	1892	0x1400140cc
?GetGetSheetCallback@DUIXmlParser@DirectUI@@QEAAP6APEAVValue@2@PEBGPEAX@ZXZ	1893	0x14003d628
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ	1894	0x140003538
?GetGraphic@Value@DirectUI@@QEAAPEAUGraphic@2@XZ	1895	0x140005a7c
?GetHDC@DCSurface@DirectUI@@QEAAPEAUHDC__@@XZ	1896	0x140027374
?GetHInstance@DUIXmlParser@DirectUI@@QEAAPEAUHINSTANCE__@@XZ	1897	0x140022870
?GetHScroll@ScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	1898	0x140014624
?GetHScroll@StyledScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	1899	0x140006ed8
?GetHScrollbar@TouchScrollViewer@DirectUI@@QEAAJPEAPEAVElement@2@@Z	1900	0x140020810
?GetHWND@HWNDElement@DirectUI@@UEAAPEAUHWND__@@XZ	1901	0x14000feb8
?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ	1902	0x14003bfe4
?GetHWND@NativeHWNDHost@DirectUI@@QEAAPEAUHWND__@@XZ	1903	0x1400344e8
?GetHWND@XHost@DirectUI@@QEAAPEAUHWND__@@XZ	1904	0x14001ec00
?GetHWNDParent@HWNDHost@DirectUI@@QEAAPEAUHWND__@@XZ	1905	0x14002bf44
?GetHandle@ResourceModuleHandles@DirectUI@@QEAAJPEBGPEAPEAUHINSTANCE__@@@Z	1906	0x14001661c
?GetHandleEnter@TouchButton@DirectUI@@QEAA_NXZ	1907	0x14002822c
?GetHandleEnterKey@DialogElement@DirectUI@@UEAA_NXZ	1908	0x1400221ac
?GetHandleGlobalEnter@TouchButton@DirectUI@@QEAA_NXZ	1909	0x14002bdd0
?GetHasShield@CCPushButton@DirectUI@@QEAA_NXZ	1910	0x140039910
?GetHeight@Element@DirectUI@@QEAAHXZ	1911	0x140007158
?GetHighDPI@Element@DirectUI@@QEAA_NXZ	1912	0x14003fd4c
?GetHostedElementID@XBaby@DirectUI@@UEAAJPEAG@Z	1913	0x140010594
?GetHostedElementID@XProvider@DirectUI@@UEAAJPEAG@Z	1914	0x14000b084
?GetHwnd@ElementProxy@DirectUI@@IEAAJPEAPEAUHWND__@@@Z	1915	0x14003eed4
?GetID@Element@DirectUI@@QEAAGXZ	1916	0x140039c94
?GetIDsOfNames@DuiAccessible@DirectUI@@UEAAJAEBU_GUID@@PEAPEAGIKPEAJ@Z	1917	0x14002dab8
?GetIHMRect@TouchHWNDElement@DirectUI@@QEAAJPEAUtagRECT@@@Z	1918	0x140040b2c
?GetIHMState@TouchHWNDElement@DirectUI@@QEAA?AW4IHMState@2@XZ	1919	0x14003d7d4
?GetIMEComposing@TouchEditBase@DirectUI@@QEAA_NXZ	1920	0x140033e24
?GetIdentityString@DuiAccessible@DirectUI@@UEAAJKPEAPEAEPEAK@Z	1921	0x14003ada0
?GetIdentityString@HWNDHostAccessible@DirectUI@@UEAAJKPEAPEAEPEAK@Z	1922	0x140014c3c
?GetIgnoredKeyCombos@TouchEditBase@DirectUI@@QEAA?AW4TouchEditFilteredKeyComboFlags@2@XZ	1923	0x140007ed0
?GetImage@Value@DirectUI@@QEAAPEAX_NM@Z	1924	0x14003ae18
?GetImmediateChild@Element@DirectUI@@QEAAPEAV12@PEAV12@@Z	1925	0x140020cb8
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z	1926	0x140012cd4
?GetImmersiveFocusRectOffsets@TouchButton@DirectUI@@UEAAXPEAUtagRECT@@@Z	1927	0x140002e50
?GetImmersiveFocusRectOffsets@TouchCheckBox@DirectUI@@UEAAXPEAUtagRECT@@@Z	1928	0x140021a94
?GetImmersiveFocusRectOffsets@TouchHyperLink@DirectUI@@UEAAXPEAUtagRECT@@@Z	1929	0x140006768
?GetIndex@Element@DirectUI@@QEAAHXZ	1930	0x1400111b0
?GetInertiaEndpointVisibleRect@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@@Z	1931	0x140010c74
?GetInertiaEndpointZoomLevel@TouchScrollViewer@DirectUI@@QEAAMM@Z	1932	0x1400377f4
?GetInnerBorderThickness@TouchEdit2@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1933	0x140019e7c
?GetInnerHWND@XElement@DirectUI@@QEAAPEAUHWND__@@XZ	1934	0x1400156d8
?GetInputScope@TouchEdit2@DirectUI@@QEAA?AW4__MIDL___MIDL_itf_inputscope_0000_0000_0001@@XZ	1935	0x1400329d4
?GetInt@EventManager@DirectUI@@CAJPEAUtagVARIANT@@PEAVValue@2@@Z	1936	0x1400084a0
?GetInt@Value@DirectUI@@QEAAHXZ	1937	0x1400347d4
?GetIntMinusOne@Value@DirectUI@@SAPEAV12@XZ	1938	0x14003d8ac
?GetIntZero@Value@DirectUI@@SAPEAV12@XZ	1939	0x14003a13c
?GetIntegrateIMECandidateList@TouchEditBase@DirectUI@@QEAA_NXZ	1940	0x140026d98
?GetInteractionMode@TouchScrollViewer@DirectUI@@QEAAHXZ	1941	0x14002d01c
?GetInterpolationMode@Movie@DirectUI@@QEAAHXZ	1942	0x140025ac8
?GetInvokeHelper@InvokeManager@DirectUI@@SAJPEAPEAVInvokeHelper@2@@Z	1943	0x14002cd8c
?GetIsContinuous@TouchSlider@DirectUI@@QEAA_NXZ	1944	0x14002a074
?GetIsPressed@TouchSlider@DirectUI@@QEAA_NXZ	1945	0x1400401f4
?GetIsReadOnly@ValueProxy@DirectUI@@AEAAJPEAH@Z	1946	0x140028cc4
?GetIsSelected@NavigatorSelectionItemProxy@DirectUI@@AEAAJPEAVBrowser@2@PEAH@Z	1947	0x14003c03c
?GetIsSelectionRequired@BrowserSelectionProxy@DirectUI@@AEAAJPEAH@Z	1948	0x14001e9dc
?GetIsSelectionRequired@SelectorSelectionProxy@DirectUI@@AEAAJPEAH@Z	1949	0x14001a3e4
?GetIsShowOnOffFeedback@TouchSlider@DirectUI@@QEAA_NXZ	1950	0x140013ee0
?GetIsVertical@TouchSlider@DirectUI@@QEAA_NXZ	1951	0x14003b7e8
?GetItem@GridProvider@DirectUI@@UEAAJHHPEAPEAUIRawElementProviderSimple@@@Z	1952	0x14002e290
?GetItem@GridProxy@DirectUI@@AEAAJIIPEAPEAUIRawElementProviderSimple@@@Z	1953	0x14003d474
?GetItemCount@TouchSelect@DirectUI@@QEAAKXZ	1954	0x140024dd0
?GetItemData@TouchSelect@DirectUI@@QEAAJHPEAPEAUIUnknown@@@Z	1955	0x14002f3c8
?GetItemData@TouchSelectItem@DirectUI@@QEAAJPEAPEAUIUnknown@@@Z	1956	0x140039bc4
?GetItemHeightInPopup@TouchSelect@DirectUI@@QEAAHXZ	1957	0x140032830
?GetItemState@CCTreeView@DirectUI@@QEAAIQEAU_TREEITEM@@@Z	1958	0x140022d18
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ	1959	0x140011208
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ	1960	0x14001d4bc
?GetKeyFocusedElement@DialogElement@DirectUI@@UEAAPEAVElement@2@XZ	1961	0x1400342f0
?GetKeyFocusedElement@HWNDElement@DirectUI@@SAPEAVElement@2@XZ	1962	0x14003149c
?GetKeyWithin@Element@DirectUI@@QEAA_NXZ	1963	0x14000d268
?GetKeyWithinChild@Element@DirectUI@@QEAAPEAV12@XZ	1964	0x14000f69c
?GetKeyboardNavigationCapture@TouchEditBase@DirectUI@@QEAA?AW4TouchEditKeyboardNavigationCapture@2@XZ	1965	0x14001ce44
?GetLabel@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@@Z	1966	0x140021238
?GetLayout@Element@DirectUI@@QEAAPEAVLayout@2@PEAPEAVValue@2@@Z	1967	0x140002d20
?GetLayout@Value@DirectUI@@QEAAPEAVLayout@2@XZ	1968	0x14002daf0
?GetLayoutChildCount@Layout@DirectUI@@QEAAIPEAVElement@2@@Z	1969	0x14002a588
?GetLayoutIndexFromChild@Layout@DirectUI@@QEAAHPEAVElement@2@0@Z	1970	0x14000cf44
?GetLayoutNull@Value@DirectUI@@SAPEAV12@XZ	1971	0x140016008
?GetLayoutPos@Element@DirectUI@@QEAAHXZ	1972	0x140008e00
?GetLightDismissIHM@TouchHWNDElement@DirectUI@@QEAA_NXZ	1973	0x140016ec4
?GetLine@CCBaseScrollBar@DirectUI@@UEAAHXZ	1974	0x14000e300
?GetLine@FlowLayout@DirectUI@@QEAAHPEAVElement@2@0@Z	1975	0x140027260
?GetLine@ScrollBar@DirectUI@@UEAAHXZ	1976	0x14000a78c
?GetLine@VerticalFlowLayout@DirectUI@@QEAAHPEAVElement@2@0@Z	1977	0x140038ad4
?GetLineCount@RichText@DirectUI@@QEAAKXZ	1978	0x14002ca38
?GetLineSize@CCTrackBar@DirectUI@@QEAAHXZ	1979	0x1400374e0
?GetLinkIndicatorsToContent@TouchScrollViewer@DirectUI@@QEAA_NXZ	1980	0x140032560
?GetLocation@Element@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z	1981	0x140033138
?GetManipulationCompositor@TouchScrollViewer@DirectUI@@QEAAPEAUIDirectManipulationCompositor@@XZ	1982	0x140009e40
?GetManipulationHorizontalAlignment@TouchScrollViewer@DirectUI@@QEAAHXZ	1983	0x14002a4e4
?GetManipulationManager@TouchScrollViewer@DirectUI@@QEAAPEAUIDirectManipulationManager@@XZ	1984	0x14003de08
?GetManipulationVerticalAlignment@TouchScrollViewer@DirectUI@@QEAAHXZ	1985	0x14000a3d4
?GetManipulationViewport@TouchScrollViewer@DirectUI@@QEAAPEAUIDirectManipulationViewport@@_N@Z	1986	0x140016094
?GetMargin@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1987	0x140006bd8
?GetMaxLength@Edit@DirectUI@@QEAAHXZ	1988	0x140014150
?GetMaxLength@TouchEditBase@DirectUI@@QEAAHXZ	1989	0x14003ba78
?GetMaximum@CCBaseScrollBar@DirectUI@@UEAAHXZ	1990	0x14001d7f4
?GetMaximum@ModernProgressBar@DirectUI@@QEAAHXZ	1991	0x140020398
?GetMaximum@Progress@DirectUI@@QEAAHXZ	1992	0x140006450
?GetMaximum@ScrollBar@DirectUI@@UEAAHXZ	1993	0x14002cec0
?GetMetering@TouchSlider@DirectUI@@QEAAHXZ	1994	0x14002bfa8
?GetMinSize@Element@DirectUI@@QEAAPEBUtagSIZE@@PEAPEAVValue@2@@Z	1995	0x14000c7a8
?GetMinimum@CCBaseScrollBar@DirectUI@@UEAAHXZ	1996	0x1400108e8
?GetMinimum@ModernProgressBar@DirectUI@@QEAAHXZ	1997	0x140026e10
?GetMinimum@Progress@DirectUI@@QEAAHXZ	1998	0x14001d414
?GetMinimum@ScrollBar@DirectUI@@UEAAHXZ	1999	0x14001ad30
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ	2000	0x140023d4c
?GetModuleBase@CallstackTracker@DirectUI@@AEAA_KPEAX_K@Z	2001	0x1400236c4
?GetMouseFocused@Element@DirectUI@@QEAA_NXZ	2002	0x140024ee8
?GetMouseWithin@Element@DirectUI@@QEAA_NXZ	2003	0x140017c3c
?GetMouseWithinChild@Element@DirectUI@@QEAAPEAV12@XZ	2004	0x140035a10
?GetMouseWithinHorizontalScrollRegion@TouchScrollViewer@DirectUI@@QEAA_NXZ	2005	0x1400072f4
?GetMoveCaretToEndOnSyncContent@TouchEditBase@DirectUI@@QEAA_NXZ	2006	0x14000e5f8
?GetMultiline@Edit@DirectUI@@QEAA_NXZ	2007	0x14001b03c
?GetMultiline@TouchEditBase@DirectUI@@QEAA_NXZ	2008	0x140026268
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ	2009	0x140018418
?GetNote@CCCommandLink@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2010	0x14003bf28
?GetNotificationSinkHWND@XElement@DirectUI@@UEAAPEAUHWND__@@XZ	2011	0x14002ab7c
?GetNull@Value@DirectUI@@SAPEAV12@XZ	2012	0x14000da2c
?GetOffText@TouchSwitch@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2013	0x140030554
?GetOnText@TouchSwitch@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2014	0x140035a74
?GetOptimizeMove@HWNDHost@DirectUI@@QEAA_NXZ	2015	0x14000f5ec
?GetOrder@ScrollBar@DirectUI@@QEAAHXZ	2016	0x14002c994
?GetOverhang@Element@DirectUI@@QEAA_NXZ	2017	0x14002aaf4
?GetOverrideButtonBackground@CCPushButton@DirectUI@@QEAA_NXZ	2018	0x14000bda4
?GetOverrideScaleFactor@DUIXmlParser@DirectUI@@QEBA_NPEAM@Z	2019	0x1400179b0
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ	2020	0x14000b4a8
?GetPVLAnimationState@Element@DirectUI@@QEAAHXZ	2021	0x1400209c4
?GetPadding@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	2022	0x140007c14
?GetPage@CCBaseScrollBar@DirectUI@@UEAAHXZ	2023	0x140008460
?GetPage@Pages@DirectUI@@QEAAPEAVElement@2@I@Z	2024	0x14003213c
?GetPage@Pages@DirectUI@@QEAAPEAVElement@2@PEBG@Z	2025	0x1400373cc
?GetPage@ScrollBar@DirectUI@@UEAAHXZ	2026	0x1400407dc
?GetPageInc@BaseScrollBar@DirectUI@@QEAAHXZ	2027	0x14003cc38
?GetPageRCID@TaskPage@DirectUI@@MEAAIXZ	2028	0x140010e2c
?GetPageResID@TaskPage@DirectUI@@MEAAPEBGXZ	2029	0x14003424c
?GetPages@Browser@DirectUI@@QEAAPEAVPages@2@XZ	2030	0x140037c08
?GetParent@Element@DirectUI@@QEAAPEAV12@XZ	2031	0x14001fa70
?GetParentHWND@TaskPage@DirectUI@@QEAAPEAUHWND__@@XZ	2032	0x140018758
?GetParser@DUIFactory@DirectUI@@QEAAPEAVDUIXmlParser@2@XZ	2033	0x1400103f4
?GetParserCommon@DUIXmlParser@DirectUI@@IEAAJPEAPEAV12@@Z	2034	0x14002c238
?GetPasswordCharacter@Edit@DirectUI@@QEAAHXZ	2035	0x14002d3a4
?GetPasswordCharacter@TouchEditBase@DirectUI@@QEAAHXZ	2036	0x14001cd04
?GetPasswordRevealMode@TouchEdit2@DirectUI@@QEAA?AW4TouchEditPasswordRevealMode@2@XZ	2037	0x14001519c
?GetPath@Movie@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2038	0x140041540
?GetPatternProvider@ElementProvider@DirectUI@@UEAAJHPEAPEAUIUnknown@@@Z	2039	0x14003dde0
?GetPinning@BaseScrollViewer@DirectUI@@QEAAHXZ	2040	0x140036db0
?GetPixelOffsetMode@Movie@DirectUI@@QEAAHXZ	2041	0x14002f0c0
?GetPlay@AnimationStrip@DirectUI@@QEAA_NXZ	2042	0x140022968
?GetPlayAllFramesMode@Movie@DirectUI@@QEAA_NXZ	2043	0x140014228
?GetPoint@Value@DirectUI@@QEAAPEBUtagPOINT@@XZ	2044	0x140012540
?GetPointZero@Value@DirectUI@@SAPEAV12@XZ	2045	0x14003f27c
?GetPopupBounds@TouchSelect@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	2046	0x14002b138
?GetPosition@CCBaseScrollBar@DirectUI@@UEAAHXZ	2047	0x140004abc
?GetPosition@ModernProgressBar@DirectUI@@QEAAHXZ	2048	0x140010ce8
?GetPosition@Progress@DirectUI@@QEAAHXZ	2049	0x14002dd10
?GetPosition@ScrollBar@DirectUI@@UEAAHXZ	2050	0x1400081a8
?GetPredictedVisibleRect@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@@Z	2051	0x140014b68
?GetPreserveAlphaChannel@Element@DirectUI@@QEBA_NXZ	2052	0x14002afa8
?GetPressed@Button@DirectUI@@QEAA_NXZ	2053	0x14002b844
?GetPressed@TouchButton@DirectUI@@QEAA_NXZ	2054	0x140027af0
?GetPreventFormatChangeUpdatingModifiedState@TouchEditBase@DirectUI@@QEAA_NXZ	2055	0x14001feb8
?GetProcs@Schema@DirectUI@@CAJXZ	2056	0x14001f124
?GetPromptText@TouchEdit2@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2057	0x14001df04
?GetPromptWithCaret@TouchEdit2@DirectUI@@QEAA_NXZ	2058	0x1400225dc
?GetPropValPairInfo@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUIClassInfo@2@PEBG2PEAPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	2059	0x14001a36c
?GetPropValPairInfo@DUIXmlParser@DirectUI@@IEAAJULINEINFO@2@PEAUIClassInfo@2@PEBG2PEAPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	2060	0x14003e014
?GetProperty@Bind@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2061	0x14002d9a0
?GetProperty@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@H@Z	2062	0x140024088
?GetPropertyValue@ElementProvider@DirectUI@@UEAAJHPEAUtagVARIANT@@@Z	2063	0x14002876c
?GetProportional@CCBaseScrollBar@DirectUI@@UEAA_NXZ	2064	0x14001d92c
?GetProportional@ScrollBar@DirectUI@@UEAA_NXZ	2065	0x140005b7c
?GetProvider@XElement@DirectUI@@QEAAPEAUIXProvider@2@XZ	2066	0x140033d20
?GetProviderOptions@ElementProxy@DirectUI@@IEAAJPEAW4ProviderOptions@@@Z	2067	0x140041788
?GetProxyCreator@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2068	0x14002f9c4
?GetProxyCreator@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2069	0x14002863c
?GetProxyCreator@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2070	0x140038d0c
?GetProxyCreator@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2071	0x14003d4a8
?GetProxyCreator@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2072	0x140024008
?GetProxyCreator@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2073	0x14001b3e4
?GetProxyCreator@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2074	0x14000a078
?GetProxyCreator@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2075	0x140032324
?GetProxyCreator@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2076	0x140029b94
?GetProxyCreator@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2077	0x140015ea8
?GetProxyCreator@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2078	0x140041614
?GetProxyCreator@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2079	0x14002aeb4
?GetProxyCreator@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2080	0x140025020
?GetProxyCreator@ElementProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2081	0x14001432c
?GetProxyCreator@ExpandCollapseProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2082	0x1400170cc
?GetProxyCreator@GridItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2083	0x14001b9ac
?GetProxyCreator@GridProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2084	0x1400342f0
?GetProxyCreator@HWNDElementProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2085	0x1400351f0
?GetProxyCreator@InvokeProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2086	0x1400038bc
?GetProxyCreator@RangeValueProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2087	0x14002d6e8
?GetProxyCreator@ScrollItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2088	0x14001e6ec
?GetProxyCreator@ScrollProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2089	0x14000f98c
?GetProxyCreator@SelectionItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2090	0x14001950c
?GetProxyCreator@SelectionProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2091	0x140011fa4
?GetProxyCreator@TableItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2092	0x14000f880
?GetProxyCreator@TableProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2093	0x140035e04
?GetProxyCreator@ToggleProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2094	0x14002e878
?GetProxyCreator@ValueProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2095	0x140033ebc
?GetRangeMax@CCTrackBar@DirectUI@@QEAAHXZ	2096	0x140016bec
?GetRangeMax@TouchSlider@DirectUI@@QEAAHXZ	2097	0x140030f14
?GetRangeMin@CCTrackBar@DirectUI@@QEAAHXZ	2098	0x14002e980
?GetRangeMin@TouchSlider@DirectUI@@QEAAHXZ	2099	0x140008178
?GetRawValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z	2100	0x140027340
?GetReadOnly@TouchEditBase@DirectUI@@QEAA_NXZ	2101	0x14002bd48
?GetRect@Value@DirectUI@@QEAAPEBUtagRECT@@XZ	2102	0x140030c58
?GetRectZero@Value@DirectUI@@SAPEAV12@XZ	2103	0x14000a720
?GetRefCount@Value@DirectUI@@QEBAHXZ	2104	0x14002d61c
?GetReferencePoint@RefPointElement@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z	2105	0x14003e704
?GetRegisteredDefaultButton@DialogElement@DirectUI@@UEAAPEAVElement@2@XZ	2106	0x14001f068
?GetRenderBorderThickness@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2107	0x1400105cc
?GetRenderEdgeHighlightThickness@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2108	0x140031514
?GetRenderMargin@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2109	0x14002246c
?GetRenderMinSize@Element@DirectUI@@QEAAXPEAUtagSIZE@@@Z	2110	0x140008fb4
?GetRenderPadding@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2111	0x14000cfa0
?GetRepeat@Movie@DirectUI@@QEAA_NXZ	2112	0x14002bb8c
?GetResourceHInstance@DUIXmlParser@DirectUI@@QEAAPEAUHINSTANCE__@@XZ	2113	0x140021888
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ	2114	0x140040b10
?GetRoot@XProvider@DirectUI@@IEAAPEAVElement@2@XZ	2115	0x14004165c
?GetRootRelativeBounds@Element@DirectUI@@QEAAJPEAUtagRECT@@@Z	2116	0x140027128
?GetRow@GridItemProxy@DirectUI@@AEAAJPEAH@Z	2117	0x14002472c
?GetRowCount@GridProxy@DirectUI@@AEAAJPEAH@Z	2118	0x1400258ac
?GetRowHeaderItems@TableItemProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2119	0x140004734
?GetRowHeaders@TableProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2120	0x14000ab70
?GetRuntimeId@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2121	0x140016df0
?GetRuntimeId@ElementProxy@DirectUI@@IEAAJPEAPEAUtagSAFEARRAY@@@Z	2122	0x140010398
?GetScaledFloat@Value@DirectUI@@QEAAMM@Z	2123	0x14000cdc0
?GetScaledInt@Value@DirectUI@@QEAAHM@Z	2124	0x14002de70
?GetScaledInt@Value@DirectUI@@QEAAPEBUScaledInt@2@XZ	2125	0x140033ba0
?GetScaledPoint@Value@DirectUI@@QEAAXMPEAUtagPOINT@@@Z	2126	0x14003b3d8
?GetScaledRect@Value@DirectUI@@QEAAXMPEAUtagRECT@@@Z	2127	0x1400295fc
?GetScaledSize@Value@DirectUI@@QEAAXMPEAUtagSIZE@@@Z	2128	0x14002d328
?GetScrollBar@ScrollProxy@DirectUI@@AEAAPEAVBaseScrollBar@2@_N@Z	2129	0x140026a28
?GetScrollBarHelper@ScrollProxy@DirectUI@@AEAAPEAVBaseScrollBar@2@PEAVElement@2@_N@Z	2130	0x14003a8a0
?GetScrollPadding@TouchScrollViewer@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	2131	0x140038090
?GetScrollPercent@ScrollProxy@DirectUI@@AEAAJ_NPEAN@Z	2132	0x14001d51c
?GetScrollable@ScrollProxy@DirectUI@@AEAAJ_NPEAH@Z	2133	0x140030044
?GetSelected@Element@DirectUI@@QEAA_NXZ	2134	0x140040b90
?GetSelection@BrowserSelectionProxy@DirectUI@@AEAAJPEAPEAUtagSAFEARRAY@@@Z	2135	0x140025890
?GetSelection@Combobox@DirectUI@@QEAAHXZ	2136	0x14000ab74
?GetSelection@SelectionProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2137	0x1400254ec
?GetSelection@Selector@DirectUI@@QEAAPEAVElement@2@XZ	2138	0x14000ad74
?GetSelection@TouchEdit2@DirectUI@@QEAAJPEAJ0@Z	2139	0x1400222c8
?GetSelection@TouchSelect@DirectUI@@QEAAPEAVElement@2@XZ	2140	0x140030c78
?GetSelectionBackgroundColor@TouchEditBase@DirectUI@@QEAAPEAVValue@2@XZ	2141	0x14002415c
?GetSelectionContainer@SelectorSelectionItemProxy@DirectUI@@AEAAJPEAPEAUIRawElementProviderSimple@@@Z	2142	0x1400326a8
?GetSelectionForegroundColor@TouchEditBase@DirectUI@@QEAAPEAVValue@2@XZ	2143	0x140022758
?GetSelectionIndex@TouchSelect@DirectUI@@QEAAHXZ	2144	0x140040834
?GetShadowIntensity@Element@DirectUI@@QEAAHXZ	2145	0x14001488c
?GetSheet@DUIXmlParser@DirectUI@@QEAAJPEBGPEAPEAVValue@2@@Z	2146	0x140030b00
?GetSheet@Element@DirectUI@@QEAAPEAVStyleSheet@2@XZ	2147	0x14003b620
?GetSheetContext@DUIXmlParser@DirectUI@@QEAAPEAXXZ	2148	0x140040900
?GetSheetNull@Value@DirectUI@@SAPEAV12@XZ	2149	0x140030778
?GetShortcut@Element@DirectUI@@QEAAHXZ	2150	0x14004126c
?GetShortcutChar@Element@DirectUI@@QEAAGXZ	2151	0x1400080a8
?GetShortcutChar@RichText@DirectUI@@QEAAGXZ	2152	0x14003df54
?GetShowClearButtonMinWidth@TouchEdit2@DirectUI@@QEAAHXZ	2153	0x14001bb08
?GetShowKeyFocus@TouchButton@DirectUI@@QEAA_NXZ	2154	0x14000e170
?GetShowTick@TouchSlider@DirectUI@@QEAA_NXZ	2155	0x14003f3dc
?GetSinkRect@HWNDHost@DirectUI@@AEAAXPEBUtagRECT@@PEAU3@@Z	2156	0x14003acf4
?GetSize@Value@DirectUI@@QEAAPEBUtagSIZE@@XZ	2157	0x140029538
?GetSizeZero@Value@DirectUI@@SAPEAV12@XZ	2158	0x1400239bc
?GetSmoothingMode@Movie@DirectUI@@QEAAHXZ	2159	0x14000ae50
?GetSnapIntervalX@TouchScrollViewer@DirectUI@@QEAAMXZ	2160	0x14001262c
?GetSnapIntervalY@TouchScrollViewer@DirectUI@@QEAAMXZ	2161	0x1400220e8
?GetSnapMode@TouchScrollViewer@DirectUI@@QEAAHXZ	2162	0x1400166c0
?GetSnapOffsetX@TouchScrollViewer@DirectUI@@QEAAMXZ	2163	0x14003526c
?GetSnapOffsetY@TouchScrollViewer@DirectUI@@QEAAMXZ	2164	0x14003c1c4
?GetSnapPointCollectionX@TouchScrollViewer@DirectUI@@QEAAPEAV?$DynamicArray@N$0A@@2@PEAPEAVValue@2@@Z	2165	0x140024b8c
?GetSnapPointCollectionY@TouchScrollViewer@DirectUI@@QEAAPEAV?$DynamicArray@N$0A@@2@PEAPEAVValue@2@@Z	2166	0x14000a6ec
?GetState@ModernProgressBar@DirectUI@@QEAAHXZ	2167	0x140020748
?GetStaticColor@HWNDHost@DirectUI@@IEAA_NPEAUHDC__@@PEAPEAUHBRUSH__@@@Z	2168	0x140005010
?GetStepCount@TouchSlider@DirectUI@@QEAAHXZ	2169	0x14002ec44
?GetString@EventManager@DirectUI@@CAJPEAUtagVARIANT@@PEAVValue@2@@Z	2170	0x140040028
?GetString@Value@DirectUI@@QEAAPEBGXZ	2171	0x140037180
?GetStringDynamicScaling@Value@DirectUI@@QEAAPEBGXZ	2172	0x14002a21c
?GetStringNull@Value@DirectUI@@SAPEAV12@XZ	2173	0x14001b6e4
?GetStringRPNull@Value@DirectUI@@SAPEAV12@XZ	2174	0x140040d2c
?GetStyle@CCTreeView@DirectUI@@QEAAKXZ	2175	0x140003424
?GetStyleSheet@Value@DirectUI@@QEAAPEAVStyleSheet@2@XZ	2176	0x14003a518
?GetSubContent@TouchCommandButton@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2177	0x14001c4a8
?GetSuppressClearButton@TouchEdit2@DirectUI@@QEAA_NXZ	2178	0x140016d98
?GetSurfaceType@Surface@DirectUI@@SA?AW4EType@12@I@Z	2179	0x140021dac
?GetSurfaceType@Surface@DirectUI@@SAIW4EType@12@@Z	2180	0x1400313f4
?GetSyncContentWhileIMEComposing@TouchEditBase@DirectUI@@QEAA_NXZ	2181	0x1400323cc
?GetTargetPage@Navigator@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2182	0x140010034
?GetTextContentOverride@TouchSelectItem@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2183	0x140031c74
?GetTextDocument@TouchEdit2@DirectUI@@UEAAJPEAPEAUITextDocument@@@Z	2184	0x140025a3c
?GetTextDocument@TouchEditBase@DirectUI@@UEAAJPEAPEAUITextDocument@@@Z	2185	0x140039c94
?GetTextGlowSize@Element@DirectUI@@QEAAHXZ	2186	0x140008a30
?GetTextHeight@Edit@DirectUI@@AEAAIXZ	2187	0x140030934
?GetTextHost@TouchEdit2@DirectUI@@QEAAJPEAPEAVITextHost@@@Z	2188	0x14003a1a8
?GetTextMode@TouchEditBase@DirectUI@@QEAA?AW4TouchEditTextMode@2@XZ	2189	0x140023e70
?GetTextSelection@TouchEdit2@DirectUI@@QEAAJPEAPEAUITextSelection@@@Z	2190	0x14003b65c
?GetTextServices@TouchEdit2@DirectUI@@UEAAJPEAPEAVITextServices@@@Z	2191	0x140038140
?GetTextServices@TouchEditBase@DirectUI@@UEAAJPEAPEAVITextServices@@@Z	2192	0x14000eb3c
?GetTheme@Element@DirectUI@@AEAAJPEBGPEAPEAX@Z	2193	0x140013f78
?GetThemeChanged@HWNDHost@DirectUI@@IEAAHXZ	2194	0x140026b24
?GetThemedBorder@Edit@DirectUI@@QEAA_NXZ	2195	0x14001b504
?GetThumb@TouchScrollBar@DirectUI@@QEAAPEAVElement@2@XZ	2196	0x1400114e0
?GetThumbElement@TouchSlider@DirectUI@@QEAAPEAVButton@2@XZ	2197	0x140038f18
?GetThumbPosition@CCTrackBar@DirectUI@@QEAAHXZ	2198	0x1400125b4
?GetThumbValue@TouchSlider@DirectUI@@QEAAHXZ	2199	0x14001da30
?GetTickCount@TouchSlider@DirectUI@@QEAAHXZ	2200	0x1400169b8
?GetTitleText@TouchSwitch@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2201	0x14001e1b8
?GetToggleOnClick@TouchCheckBox@DirectUI@@QEAA_NXZ	2202	0x14001bf8c
?GetToggleState@EventManager@DirectUI@@CAXPEAUtagVARIANT@@@Z	2203	0x1400259d0
?GetToggleState@ToggleProxy@DirectUI@@AEAAJPEAW4ToggleState@@@Z	2204	0x140018d00
?GetToggleValue@TouchSwitch@DirectUI@@QEAAHXZ	2205	0x1400277b4
?GetTooltip@Element@DirectUI@@QEAA_NXZ	2206	0x140032794
?GetTooltipMaxWidth@Element@DirectUI@@QEAAHXZ	2207	0x14000ce78
?GetTooltipMaximumLineCount@TouchHWNDElement@DirectUI@@QEAAHXZ	2208	0x140004f6c
?GetTopLevel@Element@DirectUI@@QEAAPEAV12@XZ	2209	0x14000c174
?GetTrackElement@TouchSlider@DirectUI@@QEAAPEAVElement@2@XZ	2210	0x14003d400
?GetTracking@CCBaseScrollBar@DirectUI@@QEAA_NXZ	2211	0x14003ab58
?GetTranslatedTileRects@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@PEAII@Z	2212	0x140038da0
?GetTransparent@HWNDHost@DirectUI@@QEAA_NXZ	2213	0x140030a94
?GetTreatRightMouseButtonAsLeft@TouchButton@DirectUI@@QEAA_NXZ	2214	0x14003202c
?GetTreeAlphaLevel@Element@DirectUI@@QEAAMXZ	2215	0x14000840c
?GetTrimmedLineCount@RichText@DirectUI@@QEAAKXZ	2216	0x14001f318
?GetType@DCSurface@DirectUI@@UEBA?AW4EType@Surface@2@XZ	2217	0x140009a54
?GetType@Value@DirectUI@@QEBAHXZ	2218	0x14002dcd8
?GetTypeInfo@DuiAccessible@DirectUI@@UEAAJIKPEAPEAUITypeInfo@@@Z	2219	0x14001f198
?GetTypeInfoCount@DuiAccessible@DirectUI@@UEAAJPEAI@Z	2220	0x14001ca20
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	2221	0x140034d34
?GetUIState@HWNDElement@DirectUI@@QEAAGXZ	2222	0x140029494
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ	2223	0x14000fd44
?GetUiaFocusDelegate@TouchEdit2@DirectUI@@UEAAPEAVElement@2@XZ	2224	0x140010374
?GetUnavailable@Value@DirectUI@@SAPEAV12@XZ	2225	0x140005ef8
?GetUnset@Value@DirectUI@@SAPEAV12@XZ	2226	0x140021154
?GetVScroll@ScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	2227	0x140008bdc
?GetVScroll@StyledScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	2228	0x14003dbc8
?GetVScrollbar@TouchScrollViewer@DirectUI@@QEAAJPEAPEAVElement@2@@Z	2229	0x140038fa4
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@P6APEBUPropertyInfo@2@XZHPEAUUpdateCache@2@@Z	2230	0x14001cab8
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z	2231	0x140024940
?GetValue@ValueProxy@DirectUI@@AEAAJPEAPEAG@Z	2232	0x14001ebcc
?GetValueList@Value@DirectUI@@QEAAPEAV?$DynamicArray@PEAVValue@DirectUI@@$0A@@2@XZ	2233	0x14002f4dc
?GetValueParser@DUIXmlParser@DirectUI@@IEAAJPEAPEAVValueParser@ParserTools@2@@Z	2234	0x140008638
?GetVertical@ScrollBar@DirectUI@@QEAA_NXZ	2235	0x140012644
?GetViewSize@ScrollProxy@DirectUI@@AEAAJ_NPEAN@Z	2236	0x14001720c
?GetViewer@ScrollProxy@DirectUI@@AEAAJPEAPEAVViewer@2@@Z	2237	0x14003e308
?GetVisible@Element@DirectUI@@QEAA_NXZ	2238	0x14003f920
?GetVisibleRect@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@@Z	2239	0x140022380
?GetVisited@TouchHyperLink@DirectUI@@QEAA_NXZ	2240	0x140027e98
?GetVisualState@TouchSlider@DirectUI@@QEAAHXZ	2241	0x140016740
?GetWantTabs@Edit@DirectUI@@QEAA_NXZ	2242	0x1400031b4
?GetWidth@Element@DirectUI@@QEAAHXZ	2243	0x140008d88
?GetWinStyle@CCBase@DirectUI@@QEAAHXZ	2244	0x1400228e4
?GetWindow@DuiAccessible@DirectUI@@UEAAJPEAPEAUHWND__@@@Z	2245	0x14003c4b4
?GetWindow@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAUHWND__@@@Z	2246	0x14001c914
?GetWindowAccessGradientColor@TouchHWNDElement@DirectUI@@QEAAPEAVValue@2@XZ	2247	0x14001ba14
?GetWindowActive@Element@DirectUI@@QEAA_NXZ	2248	0x14000620c
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UEAAXPEAPEBGPEAI@Z	2249	0x14001f470
?GetWrapKeyboardNavigate@HWNDElement@DirectUI@@QEAA_NXZ	2250	0x14002ac48
?GetX@Element@DirectUI@@QEAAHXZ	2251	0x14001a988
?GetXBabyElement@XBaby@DirectUI@@UEAAPEAVHWNDElement@2@XZ	2252	0x14003b750
?GetXBarVisibility@BaseScrollViewer@DirectUI@@QEAAHXZ	2253	0x140020cbc
?GetXOffset@BaseScrollViewer@DirectUI@@QEAAHXZ	2254	0x140026224
?GetXOffset@Viewer@DirectUI@@QEAAHXZ	2255	0x14000b740
?GetXScrollHeight@BaseScrollViewer@DirectUI@@QEAAHXZ	2256	0x14002fbf8
?GetXScrollable@BaseScrollViewer@DirectUI@@QEAA_NXZ	2257	0x14002ed0c
?GetXScrollable@Viewer@DirectUI@@QEAA_NXZ	2258	0x140009950
?GetXmlLiteDll@DUIXmlParser@DirectUI@@KAJPEAPEAUHINSTANCE__@@@Z	2259	0x14001005c
?GetY@Element@DirectUI@@QEAAHXZ	2260	0x14001fa5c
?GetYBarVisibility@BaseScrollViewer@DirectUI@@QEAAHXZ	2261	0x140017104
?GetYOffset@BaseScrollViewer@DirectUI@@QEAAHXZ	2262	0x14003a32c
?GetYOffset@Viewer@DirectUI@@QEAAHXZ	2263	0x14002f414
?GetYScrollWidth@BaseScrollViewer@DirectUI@@QEAAHXZ	2264	0x140002db4
?GetYScrollable@BaseScrollViewer@DirectUI@@QEAA_NXZ	2265	0x14000cfc4
?GetYScrollable@Viewer@DirectUI@@QEAA_NXZ	2266	0x14003c518
?GetZoomMaximum@TouchScrollViewer@DirectUI@@QEAAMXZ	2267	0x14002cc80
?GetZoomMinimum@TouchScrollViewer@DirectUI@@QEAAMXZ	2268	0x140022974
?GridItemPattern@Schema@DirectUI@@2HA	2269	0x14001d7b0
?GridItem_ColumnSpan_Property@Schema@DirectUI@@2HA	2270	0x14003eca0
?GridItem_Column_Property@Schema@DirectUI@@2HA	2271	0x14001ad00
?GridItem_Parent_Property@Schema@DirectUI@@2HA	2272	0x1400336e0
?GridItem_RowSpan_Property@Schema@DirectUI@@2HA	2273	0x140023e8c
?GridItem_Row_Property@Schema@DirectUI@@2HA	2274	0x14001ead8
?GridPattern@Schema@DirectUI@@2HA	2275	0x14002b754
?Grid_ColumnCount_Property@Schema@DirectUI@@2HA	2276	0x1400062bc
?Grid_RowCount_Property@Schema@DirectUI@@2HA	2277	0x14002d380
?GroupControlType@Schema@DirectUI@@2HA	2278	0x140014784
?HandleAccChange@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2279	0x1400107f8
?HandleAccDesc@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2280	0x14000731c
?HandleAccPatternChange@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@IIHPEAUtagVARIANT@@2P6AX2@Z@Z	2281	0x14002968c
?HandleAccRoleEvent@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@PEAVValue@2@1@Z	2282	0x14001b3fc
?HandleAccStateChange@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@IIHPEAUtagVARIANT@@1_N@Z	2283	0x140012224
?HandleBoolProp@EventManager@DirectUI@@CAJPEAVElement@2@P6A_N0@ZPEAUIRawElementProviderSimple@@HPEAVValue@2@3@Z	2284	0x14003c460
?HandleChildrenEvent@EventManager@DirectUI@@CAJPEAVElement@2@PEAVValue@2@1@Z	2285	0x140034484
?HandleEnterKeyProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	2286	0x140025c34
?HandleEnterProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2287	0x1400083dc
?HandleGlobalEnterProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2288	0x14000661c
?HandleRangeValue@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2289	0x1400185bc
?HandleScrollPos@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2290	0x140026990
?HandleSelectedChange@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@PEAVValue@2@@Z	2291	0x140006b38
?HandleStringProp@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@HPEAVValue@2@1@Z	2292	0x140028e6c
?HandleToggleValue@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2293	0x14002a950
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ	2294	0x140007120
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z	2295	0x140013638
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z	2296	0x14000898c
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2297	0x140030d58
?HandleVisibilityChange@EventManager@DirectUI@@CAJPEAVElement@2@I@Z	2298	0x140013da4
?HasAnimation@Element@DirectUI@@QEAA_NXZ	2299	0x14001b4b4
?HasBorder@Element@DirectUI@@QEAA_NXZ	2300	0x14002e390
?HasChildren@Element@DirectUI@@QEAA_NXZ	2301	0x14001408c
?HasContent@Element@DirectUI@@QEAA_NXZ	2302	0x1400035cc
?HasEdgeHighlight@Element@DirectUI@@QEAA_NXZ	2303	0x14003e010
?HasKeyboardFocusProperty@Schema@DirectUI@@2HA	2304	0x140012a58
?HasLayout@Element@DirectUI@@QEAA_NXZ	2305	0x14002ac30
?HasMargin@Element@DirectUI@@QEAA_NXZ	2306	0x140013a34
?HasPVLAnimationState@Element@DirectUI@@QEAA_NI@Z	2307	0x140022b64
?HasPadding@Element@DirectUI@@QEAA_NXZ	2308	0x1400216dc
?HasSelection@TouchEdit2@DirectUI@@QEAA_NXZ	2309	0x140031314
?HasShieldProp@CCPushButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2310	0x14000c188
?HaveWin32Focus@HWNDHost@DirectUI@@AEAA_NXZ	2311	0x14003306c
?HeaderControlType@Schema@DirectUI@@2HA	2312	0x1400283b8
?HeaderItemControlType@Schema@DirectUI@@2HA	2313	0x140018528
?HeightProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2314	0x14000c7a0
?HelpTextProperty@Schema@DirectUI@@2HA	2315	0x14002c0cc
?HideTouchTooltip@TouchHWNDElement@DirectUI@@QEAAJXZ	2316	0x14003fb34
?HideWindow@NativeHWNDHost@DirectUI@@QEAAXXZ	2317	0x140034d54
?HideWindow@XHost@DirectUI@@QEAAXXZ	2318	0x140024fe4
?HighDPIProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2319	0x14003c064
?Home@BaseScrollBar@DirectUI@@UEAAXXZ	2320	0x1400164d8
?Host@NativeHWNDHost@DirectUI@@QEAAXPEAVElement@2@@Z	2321	0x14002a87c
?Host@XHost@DirectUI@@QEAAXPEAVElement@2@@Z	2322	0x14003e760
?Hosted@PushButton@DirectUI@@SA?AVUID@@XZ	2323	0x140012588
?HyperlinkControlType@Schema@DirectUI@@2HA	2324	0x14003d0c4
?IDProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2325	0x140029154
?IHMNotify@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	2326	0x140032ef4
?IMEComposingProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2327	0x14003af08
?INITIALSTACKSKIP@CallstackTracker@DirectUI@@0HB	2328	0x14001026c
?IgnoredKeyCombosProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2329	0x14002efe4
?ImageControlType@Schema@DirectUI@@2HA	2330	0x14003a1e4
?ImmersiveColorSchemeChange@HWNDElement@DirectUI@@SA?AVUID@@XZ	2331	0x1400303e8
?Init@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2332	0x14002ee50
?Init@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2333	0x140027e10
?Init@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2334	0x14002c3bc
?Init@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2335	0x14002487c
?Init@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2336	0x14004143c
?Init@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2337	0x1400411ec
?Init@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2338	0x140014774
?Init@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2339	0x140030f98
?Init@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2340	0x140022d58
?Init@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2341	0x140018ab0
?Init@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2342	0x140015e20
?Init@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2343	0x140006418
?Init@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2344	0x140013c88
?Init@AutoThread@DirectUI@@QEAAJXZ	2345	0x140002ffc
?Init@BrowserSelectionProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2346	0x14001f280
?Init@CallstackTracker@DirectUI@@SAHXZ	2347	0x14001d5ec
?Init@ElementProvider@DirectUI@@MEAAJPEAVElement@2@PEAVInvokeHelper@2@@Z	2348	0x14002846c
?Init@ElementProviderManager@DirectUI@@SAJXZ	2349	0x14001d704
?Init@ElementProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2350	0x1400026d0
?Init@EventManager@DirectUI@@SAJXZ	2351	0x140004a74
?Init@ExpandCollapseProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2352	0x14001f8cc
?Init@GridItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2353	0x140022850
?Init@GridProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2354	0x140015dc0
?Init@HWNDElementProvider@DirectUI@@MEAAJPEAVHWNDElement@2@PEAVInvokeHelper@2@@Z	2355	0x140041250
?Init@HWNDElementProxy@DirectUI@@UEAAXPEAVHWNDElement@2@@Z	2356	0x14000e1a8
?Init@InvokeHelper@DirectUI@@QEAAHK@Z	2357	0x14001d6a8
?Init@InvokeManager@DirectUI@@SAJXZ	2358	0x14002a37c
?Init@InvokeProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2359	0x140028028
?Init@ModernProgressBarRangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2360	0x140021650
?Init@NavReference@DirectUI@@QEAAXPEAVElement@2@PEAUtagRECT@@@Z	2361	0x140003984
?Init@NavScoring@DirectUI@@QEAAXPEAVElement@2@HPEBUNavReference@2@@Z	2362	0x1400038a8
?Init@NavigatorSelectionItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2363	0x140019018
?Init@ProgressRangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2364	0x140022580
?Init@ProviderProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2365	0x140016644
?Init@RangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2366	0x140013854
?Init@Schema@DirectUI@@SAJXZ	2367	0x140017cd0
?Init@ScrollBarRangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2368	0x14002758c
?Init@ScrollItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2369	0x1400368ac
?Init@ScrollProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2370	0x140002058
?Init@SelectionItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2371	0x140018b88
?Init@SelectionProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2372	0x140002fbc
?Init@SelectorSelectionItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2373	0x14002d928
?Init@SelectorSelectionProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2374	0x14003cad4
?Init@TableItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2375	0x140032b90
?Init@TableProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2376	0x14002331c
?Init@ToggleProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2377	0x140011ad0
?Init@ValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2378	0x140031430
?InitOnceCallback@CallstackTracker@DirectUI@@CAHPEAT_RTL_RUN_ONCE@@PEAXPEAPEAX@Z	2379	0x14002a1c8
?InitProcess@FontCache@DirectUI@@SAJXZ	2380	0x140002a40
?InitPropSheetPage@TaskPage@DirectUI@@MEAAXPEAU_PROPSHEETPAGEW@@@Z	2381	0x1400337ac
?InitThread@FontCache@DirectUI@@SAJXZ	2382	0x140026568
?Initialize@AccessibleButton@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2383	0x14003205c
?Initialize@AnimationStrip@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2384	0x140027084
?Initialize@AutoButton@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2385	0x1400314e4
?Initialize@BaseScrollViewer@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2386	0x14003037c
?Initialize@Bind@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2387	0x140026aa0
?Initialize@BorderLayout@DirectUI@@QEAAXXZ	2388	0x14001d6a8
?Initialize@Browser@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2389	0x14000a5ec
?Initialize@Button@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2390	0x14002b5d0
?Initialize@CCBase@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2391	0x14001239c
?Initialize@CCBaseScrollBar@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2392	0x14002eb4c
?Initialize@CCListView@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2393	0x140013f44
?Initialize@CCProgressBar@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2394	0x1400324bc
?Initialize@CSafeElementProxy@@IEAAJPEAVElement@DirectUI@@@Z	2395	0x14003fed8
?Initialize@CheckBoxGlyph@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2396	0x140025434
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z	2397	0x14001b19c
?Initialize@Clipper@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2398	0x14000b4e8
?Initialize@Combobox@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2399	0x14003a960
?Initialize@DUIXmlParser@DirectUI@@IEAAJXZ	2400	0x140001bf4
?Initialize@DialogElementCore@DirectUI@@QEAAXPEAUIDialogElement@2@PEAUIElementListener@2@@Z	2401	0x14001c728
?Initialize@DuiAccessible@DirectUI@@QEAAXPEAVElement@2@@Z	2402	0x140006c5c
?Initialize@Edit@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2403	0x140033fa4
?Initialize@Element@DirectUI@@QEAAJIPEAV12@PEAK@Z	2404	0x14002af88
?Initialize@Expando@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2405	0x140022bb8
?Initialize@ExpandoButtonGlyph@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2406	0x1400230c4
?Initialize@FillLayout@DirectUI@@QEAAXXZ	2407	0x14000c91c
?Initialize@FlowLayout@DirectUI@@QEAAX_NIII@Z	2408	0x14001f9b8
?Initialize@GridLayout@DirectUI@@QEAAXHH@Z	2409	0x14003a1b8
?Initialize@HWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z	2410	0x14003abd4
?Initialize@HWNDElementAccessible@DirectUI@@QEAAJPEAVHWNDElement@2@@Z	2411	0x14003aee4
?Initialize@HWNDHost@DirectUI@@QEAAJIIPEAVElement@2@PEAK@Z	2412	0x140011470
?Initialize@HWNDHostAccessible@DirectUI@@QEAAJPEAVElement@2@PEAUIAccessible@@@Z	2413	0x14000436c
?Initialize@Layout@DirectUI@@QEAAXXZ	2414	0x14000fed8
?Initialize@Macro@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2415	0x14000beb4
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@I@Z	2416	0x1400147c4
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBGPEAUHWND__@@PEAUHICON__@@HHHHHHI@Z	2417	0x1400172c8
?Initialize@Navigator@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2418	0x140003900
?Initialize@NineGridLayout@DirectUI@@QEAAXXZ	2419	0x140031cb0
?Initialize@PText@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2420	0x14003f0a0
?Initialize@Page@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2421	0x140005984
?Initialize@Pages@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2422	0x1400052e8
?Initialize@Progress@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2423	0x140005470
?Initialize@RadioButtonGlyph@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2424	0x140023c60
?Initialize@RefPointElement@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2425	0x140008f6c
?Initialize@RepeatButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2426	0x14002ccbc
?Initialize@Repeater@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2427	0x14002af14
?Initialize@RichText@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2428	0x140040aec
?Initialize@RowLayout@DirectUI@@QEAAJHII@Z	2429	0x1400174ac
?Initialize@ScrollBar@DirectUI@@QEAAJ_NPEAVElement@2@PEAK@Z	2430	0x14001e988
?Initialize@Selector@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2431	0x14000d368
?Initialize@SelectorNoDefault@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2432	0x14000db5c
?Initialize@SemanticZoomToggle@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2433	0x1400255c4
?Initialize@TableLayout@DirectUI@@QEAAXHHHPEAH@Z	2434	0x140013764
?Initialize@TextGraphic@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2435	0x140003374
?Initialize@Thumb@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2436	0x140007120
?Initialize@TouchButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2437	0x14001742c
?Initialize@TouchCheckBox@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2438	0x140015cd0
?Initialize@TouchCheckBoxGlyph@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2439	0x140014c38
?Initialize@TouchCommandButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2440	0x14001b7e8
?Initialize@TouchEdit2@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2441	0x1400241c0
?Initialize@TouchHWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z	2442	0x1400361c8
?Initialize@TouchRepeatButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2443	0x14003dbfc
?Initialize@TouchScrollBar@DirectUI@@QEAAJ_NPEAVElement@2@PEAK@Z	2444	0x1400029d0
?Initialize@TouchSelect@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2445	0x1400338c8
?Initialize@TouchSlider@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2446	0x14003a460
?Initialize@TouchSwitch@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2447	0x14003c3f8
?Initialize@UnknownElement@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2448	0x14000cfe0
?Initialize@VerticalFlowLayout@DirectUI@@QEAAX_NIII@Z	2449	0x14000e250
?Initialize@Viewer@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2450	0x140021e1c
?Initialize@XBaby@DirectUI@@IEAAJPEAVIXElementCP@2@PEAVXProvider@2@PEAUHWND__@@PEAVElement@2@PEAK@Z	2451	0x1400176cc
?Initialize@XElement@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2452	0x1400014b8
?Initialize@XHost@DirectUI@@QEAAJPEAVIXElementCP@2@@Z	2453	0x140040cd4
?Initialize@XProvider@DirectUI@@QEAAJPEAVElement@2@PEAVIXProviderCP@2@@Z	2454	0x1400142b4
?Initialize@XResourceProvider@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG11@Z	2455	0x14001eca8
?InitializeDllInfo@CallstackTracker@DirectUI@@CAHXZ	2456	0x140009084
?InitializeParserFromXmlReader@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUHINSTANCE__@@1@Z	2457	0x14003e3b4
?InitializeSymbols@CallstackTracker@DirectUI@@CAHXZ	2458	0x1400087f8
?InnerBorderThicknessProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	2459	0x14002ff10
?Insert@Element@DirectUI@@QEAAJPEAV12@I@Z	2460	0x140033308
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z	2461	0x14000c860
?Insert@TouchCheckBox@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2462	0x14003e8d4
?Insert@TouchCheckBoxGlyph@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2463	0x1400289c8
?Insert@TouchCommandButton@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2464	0x140037314
?Insert@TouchEditBase@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2465	0x14000aa68
?Insert@TouchSelect@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2466	0x14000f4e4
?InsertItem@CCTreeView@DirectUI@@QEAAPEAU_TREEITEM@@PEAGIQEAU3@1@Z	2467	0x140001dc8
?InsertItem@CCTreeView@DirectUI@@QEAAPEAU_TREEITEM@@PEBUtagTVINSERTSTRUCTW@@@Z	2468	0x140037db8
?IntegrateIMECandidateListProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2469	0x140020588
?InteractionEnd@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	2470	0x1400197fc
?InteractionStart@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	2471	0x140002380
?InternalCreate@TableLayout@DirectUI@@SAJHHHPEAHPEAPEAVLayout@2@@Z	2472	0x14003aa60
?InterpolationModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	2473	0x140013698
?Invoke@DuiAccessible@DirectUI@@UEAAJJAEBU_GUID@@KGPEAUtagDISPPARAMS@@PEAUtagVARIANT@@PEAUtagEXCEPINFO@@PEAI@Z	2474	0x140004550
?Invoke@InvokeProvider@DirectUI@@UEAAJXZ	2475	0x140036bb4
?Invoke@Proxy@DirectUI@@IEAAXIPEAX@Z	2476	0x14000fe38
?InvokeAnimation@Element@DirectUI@@QEAAXHI@Z	2477	0x140017bd4
?InvokeAnimation@Element@DirectUI@@QEAAXIIMM_N@Z	2478	0x140040780
?InvokeInvokedEvent@Schema@DirectUI@@2HA	2479	0x140018984
?InvokePattern@Schema@DirectUI@@2HA	2480	0x1400292e4
?IsActivityOccuring@ModernProgressBar@DirectUI@@QEAA_NXZ	2481	0x14001b750
?IsActivityOccuring@ModernProgressRing@DirectUI@@QEAA_NXZ	2482	0x14000ae38
?IsAddLayeredRef@ModernProgressBar@DirectUI@@QEAA_NXZ	2483	0x14003a7c0
?IsAddLayeredRef@ModernProgressRing@DirectUI@@QEAA_NXZ	2484	0x14000b738
?IsAutoHeight@ModernProgressBar@DirectUI@@QEAA_NXZ	2485	0x1400396d4
?IsBehaviorLayout@Element@DirectUI@@QEBA_NXZ	2486	0x1400065fc
?IsButtonEnabledAndVisible@DialogElementCore@DirectUI@@KA_NPEAVElement@2@@Z	2487	0x140031dd4
?IsCacheDirty@Layout@DirectUI@@IEAA_NXZ	2488	0x140040c0c
?IsCompositedText@Element@DirectUI@@QEAA_NXZ	2489	0x140028418
?IsContentElementProperty@Schema@DirectUI@@2HA	2490	0x14000997c
?IsContentProtected@Edit@DirectUI@@UEAA_NXZ	2491	0x140027898
?IsContentProtected@Element@DirectUI@@UEAA_NXZ	2492	0x140016b24
?IsContentProtected@TouchEditBase@DirectUI@@UEAA_NXZ	2493	0x1400131c4
?IsContinuousProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2494	0x14002f89c
?IsControlElementProperty@Schema@DirectUI@@2HA	2495	0x14002f118
?IsCorrectImageHlpVersion@CallstackTracker@DirectUI@@CAHXZ	2496	0x14000dc50
?IsCrossfadeInProgress@TouchScrollViewer@DirectUI@@QEAA_NXZ	2497	0x140032b44
?IsDefaultCAlign@Element@DirectUI@@QEAA_NXZ	2498	0x14002c800
?IsDefaultCursor@Element@DirectUI@@QEAA_NXZ	2499	0x140027170
?IsDescendent@Element@DirectUI@@QEAA_NPEAV12@@Z	2500	0x14003e5e8
?IsDescendent@XElement@DirectUI@@QEAA_NPEAVElement@2@@Z	2501	0x14000907c
?IsDescendent@XProvider@DirectUI@@UEAAJPEAVElement@2@PEA_N@Z	2502	0x1400334d8
?IsDestroyed@Element@DirectUI@@QEAA_NXZ	2503	0x14003adf0
?IsDeterminate@ModernProgressBar@DirectUI@@QEAA_NXZ	2504	0x140001a70
?IsDynamicScaled@Value@DirectUI@@QEAA_NXZ	2505	0x14001cb1c
?IsDynamicScaling@DUIXmlParser@DirectUI@@QEAA_NXZ	2506	0x1400339f4
?IsEnabledProperty@Schema@DirectUI@@2HA	2507	0x14001f5e4
?IsEqual@Value@DirectUI@@QEAA_NPEAV12@@Z	2508	0x140035d48
?IsFirstElement@HWNDElement@DirectUI@@QEAA_NPEAVElement@2@@Z	2509	0x140033d64
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ	2510	0x140007af8
?IsHosted@Element@DirectUI@@QEAA_NXZ	2511	0x140020000
?IsIndependentAnimations@ModernProgressBar@DirectUI@@QEAA_NXZ	2512	0x14002c52c
?IsKeyboardFocusableProperty@Schema@DirectUI@@2HA	2513	0x14000d230
?IsLastElement@HWNDElement@DirectUI@@QEAA_NPEAVElement@2@@Z	2514	0x14002b10c
?IsMSAAEnabled@HWNDElement@DirectUI@@UEAA_NXZ	2515	0x140037174
?IsMSAAEnabled@TouchHWNDElement@DirectUI@@UEAA_NXZ	2516	0x14001a1d8
?IsManualVisualSwapInProgress@TouchScrollViewer@DirectUI@@QEAA_NXZ	2517	0x14001d0d4
?IsMoveDeferred@HWNDHost@DirectUI@@IEAA_NXZ	2518	0x14000c818
?IsOffscreen@Schema@DirectUI@@2HA	2519	0x140036ce0
?IsPasswordProperty@Schema@DirectUI@@2HA	2520	0x140020c80
?IsPatternSupported@ElementProxy@DirectUI@@IEAAJW4Pattern@Schema@2@PEA_N@Z	2521	0x14003c82c
?IsPatternSupported@ExpandCollapseProxy@DirectUI@@SA_NPEAVElement@2@@Z	2522	0x14000ef50
?IsPatternSupported@GridItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2523	0x1400032f4
?IsPatternSupported@GridProxy@DirectUI@@SA_NPEAVElement@2@@Z	2524	0x140008dc8
?IsPatternSupported@InvokeProxy@DirectUI@@SA_NPEAVElement@2@@Z	2525	0x14003eeec
?IsPatternSupported@RangeValueProxy@DirectUI@@SA_NPEAVElement@2@@Z	2526	0x14001bee0
?IsPatternSupported@ScrollItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2527	0x140020418
?IsPatternSupported@ScrollProxy@DirectUI@@SA_NPEAVElement@2@@Z	2528	0x1400048f4
?IsPatternSupported@SelectionItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2529	0x14002f668
?IsPatternSupported@SelectionProxy@DirectUI@@SA_NPEAVElement@2@@Z	2530	0x14003d3b8
?IsPatternSupported@TableItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2531	0x1400073f4
?IsPatternSupported@TableProxy@DirectUI@@SA_NPEAVElement@2@@Z	2532	0x14001f934
?IsPatternSupported@ToggleProxy@DirectUI@@SA_NPEAVElement@2@@Z	2533	0x140026760
?IsPatternSupported@ValueProxy@DirectUI@@SA_NPEAVElement@2@@Z	2534	0x140035ad8
?IsPeripheral@Schema@DirectUI@@2HA	2535	0x14000e260
?IsPinned@BaseScrollBar@DirectUI@@QEAA_NXZ	2536	0x140017654
?IsPointValid@Element@DirectUI@@AEAA_NNN@Z	2537	0x140015d3c
?IsPopupOpen@TouchSelect@DirectUI@@QEAA_NXZ	2538	0x140024254
?IsPressedProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2539	0x14001cfa4
?IsRTL@Element@DirectUI@@QEAA_NXZ	2540	0x14003d768
?IsRTLReading@Element@DirectUI@@UEAA_NXZ	2541	0x140019028
?IsRegisteredForAnimationStatusChanges@TouchHWNDElement@DirectUI@@QEAA_NXZ	2542	0x14002c1c0
?IsReorderable@ItemList@DirectUI@@QEAA_NXZ	2543	0x140022c34
?IsRoot@Element@DirectUI@@QEAAHXZ	2544	0x140017300
?IsScrollable@BaseScrollBar@DirectUI@@QEAA_NXZ	2545	0x140002ec8
?IsSelfLayout@Element@DirectUI@@QEAA_NXZ	2546	0x140019698
?IsShowOnOffFeedbackProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2547	0x1400129b8
?IsSmoothFillAnimation@ModernProgressBar@DirectUI@@QEAA_NXZ	2548	0x140001c9c
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z	2549	0x140034628
?IsThemeClassName@DUIXmlParser@DirectUI@@KA_NPEBUExprNode@ParserTools@2@@Z	2550	0x140022458
?IsThumbActive@TouchScrollBar@DirectUI@@QEAA_NXZ	2551	0x140010bcc
?IsTileMember@TouchScrollViewer@DirectUI@@QEAA_NIPEAVElement@2@@Z	2552	0x14001cdb8
?IsValidAccessor@Element@DirectUI@@QEAA_NPEBUPropertyInfo@2@H_N@Z	2553	0x140001588
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z	2554	0x140031d98
?IsValidValue@Element@DirectUI@@SA_NPEBUPropertyInfo@2@PEAVValue@2@@Z	2555	0x14000cbac
?IsVerticalProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2556	0x140035c60
?IsWordWrap@Element@DirectUI@@QEAA_NXZ	2557	0x14001e900
?ItemContainerPattern@Schema@DirectUI@@2HA	2558	0x140015850
?ItemHeightInPopupProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	2559	0x14000ed88
?ItemStatusProperty@Schema@DirectUI@@2HA	2560	0x140025abc
?ItemTypeProperty@Schema@DirectUI@@2HA	2561	0x140001894
?KeyFocusedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2562	0x14003b0ac
?KeyWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2563	0x14001c9d8
?KeyboardNavigate@Element@DirectUI@@SA?AVUID@@XZ	2564	0x14001b068
?KeyboardNavigationCaptureProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2565	0x1400052a8
?LabeledByProperty@Schema@DirectUI@@2HA	2566	0x14000e4d4
?LastDSConstProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2567	0x14000cd90
?LayoutInvalidatedEvent@Schema@DirectUI@@2HA	2568	0x140018598
?LayoutPosProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2569	0x14003b658
?LayoutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2570	0x14001b968
?Leaving@Browser@DirectUI@@SA?AVUID@@XZ	2571	0x140036be0
?LightDismissIHMProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	2572	0x14001c22c
?LineDown@BaseScrollBar@DirectUI@@UEAAXI@Z	2573	0x140016f40
?LineDown@TouchScrollBar@DirectUI@@UEAAXI@Z	2574	0x1400393b0
?LineProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2575	0x14002f880
?LineProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2576	0x140015498
?LineSizeProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2577	0x14000f6c4
?LineSpacingProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2578	0x140036bd8
?LineUp@BaseScrollBar@DirectUI@@UEAAXI@Z	2579	0x14000459c
?LineUp@TouchScrollBar@DirectUI@@UEAAXI@Z	2580	0x14003e3f0
?ListControlType@Schema@DirectUI@@2HA	2581	0x140040e80
?ListItemControlType@Schema@DirectUI@@2HA	2582	0x14001867c
?LoadComCtl32@TaskPage@DirectUI@@AEAAJXZ	2583	0x14001d5bc
?LoadCommonControlExports@AnimationStrip@DirectUI@@AEAAJXZ	2584	0x14003e2c8
?LoadFromBuffer@DUIFactory@DirectUI@@QEAAJPEBG_K0PEAVElement@2@PEAKPEAPEAV32@@Z	2585	0x1400194d8
?LoadFromFile@DUIFactory@DirectUI@@QEAAJPEBG0PEAVElement@2@PEAKPEAPEAV32@@Z	2586	0x14003c870
?LoadFromPath@Movie@DirectUI@@QEAAJPEBG@Z	2587	0x14002e638
?LoadFromResource@DUIFactory@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG1PEAVElement@2@PEAKPEAPEAV42@1@Z	2588	0x140016f58
?LoadFromResource@Movie@DirectUI@@QEAAJPEAUHINSTANCE__@@H@Z	2589	0x14000fbcc
?LoadImagesIntoAnimationStrip@AnimationStrip@DirectUI@@IEAAJXZ	2590	0x14000c6a8
?LoadPage@TaskPage@DirectUI@@AEAAJPEAPEAVElement@2@PEAV32@PEAPEAVDUIXmlParser@2@@Z	2591	0x14000c508
?LoadPage@TaskPage@DirectUI@@MEAAJPEAVHWNDElement@2@PEAUHINSTANCE__@@PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z	2592	0x14001e6d8
?LoadParser@TaskPage@DirectUI@@MEAAJPEAPEAVDUIXmlParser@2@@Z	2593	0x14000e1dc
?LocaleProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2594	0x14000a090
?LocalizedControlTypeProperty@Schema@DirectUI@@2HA	2595	0x14001a6e8
?Locate@RefPointElement@DirectUI@@SAPEAV12@PEAVElement@2@@Z	2596	0x140017514
?LocationProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2597	0x14002b194
?LookupAccessibleRole@Schema@DirectUI@@SAHHPEA_N@Z	2598	0x140009438
?LookupControlInfos@Schema@DirectUI@@CAJXZ	2599	0x14002830c
?LookupElement@DUIXmlParser@DirectUI@@QEAAJPEAUIXmlReader@@PEBGPEAUHINSTANCE__@@PEAPEAUIClassInfo@2@@Z	2600	0x14003762c
?LookupElement@DUIXmlParser@DirectUI@@QEAAJULINEINFO@2@PEBGPEAUHINSTANCE__@@PEAPEAUIClassInfo@2@@Z	2601	0x1400097a4
?LookupEventInfos@Schema@DirectUI@@CAJXZ	2602	0x140006808
?LookupPatternInfos@Schema@DirectUI@@CAJXZ	2603	0x140035c9c
?LookupPropertyInfos@Schema@DirectUI@@CAJXZ	2604	0x1400269b4
?ManipulationCompleted@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2605	0x14002e62c
?ManipulationDelta@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2606	0x1400277dc
?ManipulationHorizontalAlignmentProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	2607	0x140025e2c
?ManipulationStarted@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2608	0x14000442c
?ManipulationStarting@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2609	0x140033214
?ManipulationVerticalAlignmentProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	2610	0x1400049d8
?ManualStoryboardVerify@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2611	0x14001fcd0
?MapContentVisuals@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2612	0x14002861c
?MapElementPoint@Element@DirectUI@@QEAAXPEAV12@PEBUtagPOINT@@PEAU3@@Z	2613	0x140017db0
?MapPropertyEnumValue@DUIXmlParser@DirectUI@@IEAAJPEBUEnumMap@2@PEBGPEAH@Z	2614	0x140027970
?MapPropertyNameToPropertyInfo@DUIXmlParser@DirectUI@@IEAAJULINEINFO@2@PEAUIClassInfo@2@PEBGPEAPEBUPropertyInfo@2@@Z	2615	0x140035f68
?MapRunsToClustersProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2616	0x14003151c
?MarginProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2617	0x1400193b8
?MarkHosted@Element@DirectUI@@IEAAXXZ	2618	0x1400073e8
?MarkNeedsDSUpdate@Element@DirectUI@@QEAAXXZ	2619	0x140009f78
?MarkSelfLayout@Element@DirectUI@@IEAAXXZ	2620	0x140018524
?MaxLengthProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	2621	0x14003a6c8
?MaxLengthProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2622	0x140036830
?MaximumProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2623	0x14001ff28
?MaximumProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2624	0x14003d320
?MaximumProp@Progress@DirectUI@@SAPEBUPropertyInfo@2@XZ	2625	0x140035350
?MaximumProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2626	0x14001879c
?MenuBarControlType@Schema@DirectUI@@2HA	2627	0x140007aa8
?MenuClosedEvent@Schema@DirectUI@@2HA	2628	0x140031810
?MenuControlType@Schema@DirectUI@@2HA	2629	0x140020264
?MenuItemControlType@Schema@DirectUI@@2HA	2630	0x140017810
?MenuOpenedEvent@Schema@DirectUI@@2HA	2631	0x14000db34
?MessageCallback@Edit@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2632	0x14002602c
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2633	0x14001016c
?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2634	0x14000d738
?MessageCallback@TouchHWNDElement@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2635	0x14002eb50
?MeteringProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2636	0x140031d3c
?MinSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2637	0x14003d980
?MinimumProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2638	0x14000d4ac
?MinimumProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2639	0x1400312cc
?MinimumProp@Progress@DirectUI@@SAPEBUPropertyInfo@2@XZ	2640	0x14003b598
?MinimumProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2641	0x14001ca38
?MonitorPowerSettingsChange@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	2642	0x140007b98
?MouseFocusedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2643	0x140013b3c
?MouseOrPointerReleased@TouchSlider@DirectUI@@SA?AVUID@@XZ	2644	0x14002f460
?MouseWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2645	0x140004a30
?MoveCaretToEndOnSyncContentProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2646	0x140004fd0
?MultilineProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	2647	0x14003fed8
?MultilineProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2648	0x140010db4
?MultipleClick@TouchButton@DirectUI@@SA?AVUID@@XZ	2649	0x140033140
?MultipleViewPattern@Schema@DirectUI@@2HA	2650	0x140024a50
?NameProperty@Schema@DirectUI@@2HA	2651	0x14001f08c
?Navigate@DuiNavigate@DirectUI@@SAPEAVElement@2@PEAV32@PEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@H@Z	2652	0x140025598
?Navigate@ElementProvider@DirectUI@@UEAAJW4NavigateDirection@@PEAPEAUIRawElementProviderFragment@@@Z	2653	0x140002248
?Navigate@ElementProxy@DirectUI@@IEAAJW4NavigateDirection@@PEAPEAUIRawElementProviderFragment@@@Z	2654	0x14003b07c
?Navigate@XProvider@DirectUI@@UEAAJHPEA_N@Z	2655	0x14003b760
?NeedsDSUpdate@Element@DirectUI@@QEAA_NXZ	2656	0x14003ca2c
?NewChildElementsAdded@TouchScrollViewer@DirectUI@@QEAAXXZ	2657	0x14001c828
?NewNativeWindowHandleProperty@Schema@DirectUI@@2HA	2658	0x140003fd4
?Next@DuiAccessible@DirectUI@@UEAAJKPEAUtagVARIANT@@PEAK@Z	2659	0x14001011c
?Next@HWNDHostAccessible@DirectUI@@UEAAJKPEAUtagVARIANT@@PEAK@Z	2660	0x1400225a4
?NoteProp@CCCommandLink@DirectUI@@SAPEBUPropertyInfo@2@XZ	2661	0x14000d498
?NotifyComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2662	0x14003859c
?NotifyImplicit@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2663	0x14003de94
?NotifyStart@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2664	0x140004cc8
?NotifyStoryboardComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2665	0x1400294c0
?NullControlType@Schema@DirectUI@@2HA	2666	0x14001a9e8
?OffTextProp@TouchSwitch@DirectUI@@SAPEBUPropertyInfo@2@XZ	2667	0x140031764
?OnAction@AnimationStrip@DirectUI@@IEAAXPEAUGMA_ACTIONINFO@@@Z	2668	0x1400375cc
?OnAdd@BorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2669	0x140040a80
?OnAdd@Layout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2670	0x140041634
?OnAdd@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2671	0x1400089e4
?OnAdd@ShellBorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2672	0x14000189c
?OnAdjustWindowSize@Combobox@DirectUI@@UEAAHHHI@Z	2673	0x1400279c0
?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z	2674	0x14001352c
?OnChildLostFocus@DialogElement@DirectUI@@UEAA_NPEAVElement@2@@Z	2675	0x1400211a4
?OnChildLostFocus@DialogElementCore@DirectUI@@QEAA_NPEAVElement@2@@Z	2676	0x14001bfc8
?OnChildLostFocus@XBaby@DirectUI@@UEAA_NPEAVElement@2@@Z	2677	0x140016b88
?OnChildReceivedFocus@DialogElement@DirectUI@@UEAA_NPEAVElement@2@@Z	2678	0x1400298b8
?OnChildReceivedFocus@DialogElementCore@DirectUI@@QEAA_NPEAVElement@2@@Z	2679	0x140023258
?OnChildReceivedFocus@XBaby@DirectUI@@UEAA_NPEAVElement@2@@Z	2680	0x1400063c4
?OnCompositionChanged@HWNDElement@DirectUI@@UEAAXXZ	2681	0x140006500
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2682	0x14003bff4
?OnCustomDraw@CCBase@DirectUI@@UEAA_NPEAUtagNMCUSTOMDRAWINFO@@PEA_J@Z	2683	0x140019014
?OnDefaultButtonTrackingChanged@DialogElementCore@DirectUI@@QEAAXPEAVValue@2@@Z	2684	0x1400292e8
?OnDestroy@AnimationStrip@DirectUI@@MEAAXXZ	2685	0x14001e300
?OnDestroy@DialogElement@DirectUI@@UEAAXXZ	2686	0x1400404b4
?OnDestroy@DialogElementCore@DirectUI@@QEAAXXZ	2687	0x14002819c
?OnDestroy@Element@DirectUI@@UEAAXXZ	2688	0x14000aabc
?OnDestroy@HWNDElement@DirectUI@@UEAAXXZ	2689	0x14000aa7c
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ	2690	0x1400328f4
?OnDestroy@ModernProgressBar@DirectUI@@MEAAXXZ	2691	0x140017ac0
?OnDestroy@ModernProgressRing@DirectUI@@MEAAXXZ	2692	0x140004874
?OnDestroy@Movie@DirectUI@@UEAAXXZ	2693	0x14002d4fc
?OnDestroy@TouchHWNDElement@DirectUI@@UEAAXXZ	2694	0x14001a6b0
?OnEvent@AutoButton@DirectUI@@UEAAXPEAUEvent@2@@Z	2695	0x1400178cc
?OnEvent@BaseScrollViewer@DirectUI@@UEAAXPEAUEvent@2@@Z	2696	0x1400115c8
?OnEvent@Browser@DirectUI@@UEAAXPEAUEvent@2@@Z	2697	0x14000d3c4
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z	2698	0x140029d14
?OnEvent@Expando@DirectUI@@UEAAXPEAUEvent@2@@Z	2699	0x14000f77c
?OnEvent@HWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z	2700	0x14003b894
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z	2701	0x140025d1c
?OnEvent@Movie@DirectUI@@UEAAXPEAUEvent@2@@Z	2702	0x140032768
?OnEvent@Navigator@DirectUI@@UEAAXPEAUEvent@2@@Z	2703	0x140004be4
?OnEvent@RichText@DirectUI@@UEAAXPEAUEvent@2@@Z	2704	0x14002c9e4
?OnEvent@ScrollBar@DirectUI@@UEAAXPEAUEvent@2@@Z	2705	0x1400147d0
?OnEvent@Selector@DirectUI@@UEAAXPEAUEvent@2@@Z	2706	0x1400204e8
?OnEvent@SelectorNoDefault@DirectUI@@UEAAXPEAUEvent@2@@Z	2707	0x1400226e4
?OnEvent@TouchButton@DirectUI@@UEAAXPEAUEvent@2@@Z	2708	0x1400025f8
?OnEvent@TouchCheckBox@DirectUI@@UEAAXPEAUEvent@2@@Z	2709	0x14001cd78
?OnEvent@TouchEdit2@DirectUI@@UEAAXPEAUEvent@2@@Z	2710	0x14002f364
?OnEvent@TouchHWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z	2711	0x1400037fc
?OnEvent@TouchScrollBar@DirectUI@@UEAAXPEAUEvent@2@@Z	2712	0x14002c310
?OnEvent@TouchSelect@DirectUI@@UEAAXPEAUEvent@2@@Z	2713	0x140012da0
?OnEvent@Viewer@DirectUI@@UEAAXPEAUEvent@2@@Z	2714	0x140040360
?OnEvent@XBaby@DirectUI@@UEAAXPEAUEvent@2@@Z	2715	0x140022a4c
?OnEvent@XElement@DirectUI@@UEAAXPEAUEvent@2@@Z	2716	0x140037344
?OnGetDlgCode@DialogElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z	2717	0x1400105a8
?OnGetDlgCode@DialogElementCore@DirectUI@@QEAAXPEAUtagMSG@@PEA_J@Z	2718	0x140017688
?OnGetDlgCode@HWNDElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z	2719	0x140004294
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z	2720	0x14003ca64
?OnGroupChanged@HWNDElement@DirectUI@@UEAAXH_N@Z	2721	0x14003f6ec
?OnHosted@Combobox@DirectUI@@UEAAXPEAVElement@2@@Z	2722	0x140015a58
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z	2723	0x1400285b8
?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z	2724	0x14000b9a0
?OnHosted@ModernProgressBar@DirectUI@@MEAAXPEAVElement@2@@Z	2725	0x140018ee4
?OnHosted@ModernProgressRing@DirectUI@@MEAAXPEAVElement@2@@Z	2726	0x140038b60
?OnHosted@Movie@DirectUI@@UEAAXPEAVElement@2@@Z	2727	0x14001f004
?OnHosted@PushButton@DirectUI@@UEAAXPEAVElement@2@@Z	2728	0x140009f90
?OnHosted@RichText@DirectUI@@UEAAXPEAVElement@2@@Z	2729	0x14001abd4
?OnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z	2730	0x1400313f0
?OnHosted@TouchEdit2@DirectUI@@UEAAXPEAVElement@2@@Z	2731	0x140029148
?OnHosted@TouchScrollBar@DirectUI@@UEAAXPEAVElement@2@@Z	2732	0x14000ebbc
?OnHosted@TouchSelect@DirectUI@@UEAAXPEAVElement@2@@Z	2733	0x140012028
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UEAAXXZ	2734	0x1400221b8
?OnInput@BaseScrollViewer@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2735	0x1400415f0
?OnInput@Button@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2736	0x14003737c
?OnInput@CCBase@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2737	0x140041318
?OnInput@CCCheckBox@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2738	0x14002656c
?OnInput@CCProgressBar@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2739	0x140005804
?OnInput@CCPushButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2740	0x140023f94
?OnInput@CCRadioButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2741	0x140012f78
?OnInput@CCSysLink@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2742	0x14002c058
?OnInput@Combobox@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2743	0x14003f224
?OnInput@DialogElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2744	0x140024f3c
?OnInput@DialogElementCore@DirectUI@@QEAAXPEAUInputEvent@2@@Z	2745	0x1400372a0
?OnInput@Edit@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2746	0x14001c50c
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2747	0x140001c50
?OnInput@HWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2748	0x140033bb4
?OnInput@HWNDHost@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2749	0x14001e6cc
?OnInput@RepeatButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2750	0x140018150
?OnInput@Selector@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2751	0x140025650
?OnInput@Thumb@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2752	0x14003cd4c
?OnInput@TouchButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2753	0x140017158
?OnInput@TouchEdit2@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2754	0x140026e08
?OnInput@TouchHWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2755	0x1400246e8
?OnInput@TouchScrollBar@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2756	0x14002a518
?OnInput@TouchSelect@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2757	0x14002dfa8
?OnInput@Viewer@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2758	0x14001dda0
?OnInput@XElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2759	0x14003a40c
?OnInvoke@InvokeHelper@DirectUI@@AEAAXPEAUInvokeArgs@12@@Z	2760	0x140037bd0
?OnInvoke@Proxy@DirectUI@@MEAAXIPEAX@Z	2761	0x14003a7f4
?OnKeyFocusMoved@DialogElement@DirectUI@@UEAAXPEAVElement@2@0@Z	2762	0x140033e44
?OnKeyFocusMoved@DialogElementCore@DirectUI@@QEAAXPEAVElement@2@0@Z	2763	0x14002db78
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z	2764	0x1400130ec
?OnKeyFocusMoved@Selector@DirectUI@@UEAAXPEAVElement@2@0@Z	2765	0x14002c508
?OnKeyFocusMoved@SelectorNoDefault@DirectUI@@UEAAXPEAVElement@2@0@Z	2766	0x14001ba44
?OnKeyFocusMoved@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@0@Z	2767	0x1400301fc
?OnKillActive@TaskPage@DirectUI@@MEAA_JXZ	2768	0x140004fc0
?OnLayoutPosChanged@BorderLayout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2769	0x140029f18
?OnLayoutPosChanged@Layout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2770	0x14002eec4
?OnLayoutPosChanged@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2771	0x140009ee4
?OnLayoutPosChanged@ShellBorderLayout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2772	0x140030ba4
?OnListenedEvent@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEAUEvent@2@@Z	2773	0x1400188ac
?OnListenedEvent@DialogElement@DirectUI@@UEAAXPEAVElement@2@PEAUEvent@2@@Z	2774	0x140001978
?OnListenedEvent@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEAUEvent@2@@Z	2775	0x14003ebd4
?OnListenedInput@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEAUInputEvent@2@@Z	2776	0x1400280ac
?OnListenedInput@DialogElement@DirectUI@@UEAAXPEAVElement@2@PEAUInputEvent@2@@Z	2777	0x140034b58
?OnListenedInput@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEAUInputEvent@2@@Z	2778	0x140007378
?OnListenedPropertyChanged@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2779	0x14000465c
?OnListenedPropertyChanged@DialogElement@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2780	0x14002b9bc
?OnListenedPropertyChanged@ScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2781	0x140032a4c
?OnListenedPropertyChanged@StyledScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2782	0x140017600
?OnListenedPropertyChanged@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2783	0x140016120
?OnListenedPropertyChanged@TouchEdit2@DirectUI@@EEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2784	0x14001c2a8
?OnListenedPropertyChanging@BaseScrollViewer@DirectUI@@UEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2785	0x14003748c
?OnListenedPropertyChanging@DialogElement@DirectUI@@UEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2786	0x14001920c
?OnListenedPropertyChanging@TaskPage@DirectUI@@MEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2787	0x140013fbc
?OnListenerAttach@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@@Z	2788	0x140023c0c
?OnListenerAttach@DialogElement@DirectUI@@UEAAXPEAVElement@2@@Z	2789	0x140012b50
?OnListenerAttach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z	2790	0x140026a84
?OnListenerDetach@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@@Z	2791	0x140008564
?OnListenerDetach@DialogElement@DirectUI@@UEAAXPEAVElement@2@@Z	2792	0x1400408f0
?OnListenerDetach@DialogElementCore@DirectUI@@QEAAXPEAVElement@2@@Z	2793	0x14000f3a0
?OnListenerDetach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z	2794	0x14003de50
?OnListenerDetach@TouchEdit2@DirectUI@@EEAAXPEAVElement@2@@Z	2795	0x14003f604
?OnLostDialogFocus@Button@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2796	0x14002f71c
?OnLostDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2797	0x14003f5b0
?OnLostDialogFocus@CCBaseCheckRadioButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2798	0x140034edc
?OnLostDialogFocus@CCPushButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2799	0x140008524
?OnLostDialogFocus@CCSysLink@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2800	0x14003bd30
?OnLostDialogFocus@CheckBoxGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2801	0x1400211f0
?OnLostDialogFocus@ExpandoButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2802	0x14001b5e4
?OnLostDialogFocus@RadioButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2803	0x14003e3bc
?OnMaximumChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2804	0x14003c71c
?OnMessage@CCBaseScrollBar@DirectUI@@UEAA_NI_K_JPEA_J@Z	2805	0x140020f48
?OnMessage@CCPushButton@DirectUI@@UEAA_NI_K_JPEA_J@Z	2806	0x140012c54
?OnMessage@CCTrackBar@DirectUI@@UEAA_NI_K_JPEA_J@Z	2807	0x1400349a0
?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2808	0x140033738
?OnMessage@NativeHWNDHost@DirectUI@@UEAAJI_K_JPEA_J@Z	2809	0x140017b50
?OnMessage@TaskPage@DirectUI@@MEAA_NI_K_JPEA_J@Z	2810	0x14003972c
?OnMessage@XElement@DirectUI@@UEAA_NI_K_JPEA_J@Z	2811	0x140005bcc
?OnMinimumChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2812	0x140006f50
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z	2813	0x140038adc
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z	2814	0x14001e66c
?OnNoChildWithShortcutFound@XBaby@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z	2815	0x140004f50
?OnNotify@CCBase@DirectUI@@UEAA_NI_K_JPEA_J@Z	2816	0x14002eff0
?OnNotify@CCCheckBox@DirectUI@@UEAA_NI_K_JPEA_J@Z	2817	0x140004d24
?OnNotify@CCPushButton@DirectUI@@UEAA_NI_K_JPEA_J@Z	2818	0x14001eab0
?OnNotify@CCRadioButton@DirectUI@@UEAA_NI_K_JPEA_J@Z	2819	0x14003a8a8
?OnNotify@CCTreeView@DirectUI@@UEAA_NI_K_JPEA_J@Z	2820	0x14002496c
?OnNotify@Combobox@DirectUI@@UEAA_NI_K_JPEA_J@Z	2821	0x1400167f4
?OnNotify@Edit@DirectUI@@UEAA_NI_K_JPEA_J@Z	2822	0x1400316b4
?OnNotify@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2823	0x140018e0c
?OnPageChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2824	0x14001e60c
?OnPageChanging@BaseScrollBar@DirectUI@@QEAA_NPEAVValue@2@@Z	2825	0x1400230a4
?OnPositionChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2826	0x140006914
?OnPositionChanging@BaseScrollBar@DirectUI@@QEAA_NPEAVValue@2@@Z	2827	0x140028e3c
?OnPropertyChanged@AccessibleButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2828	0x14000b420
?OnPropertyChanged@AnimationStrip@DirectUI@@MEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2829	0x140034e58
?OnPropertyChanged@BaseScrollViewer@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2830	0x14000f53c
?OnPropertyChanged@Browser@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2831	0x140012188
?OnPropertyChanged@Button@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2832	0x140014c6c
?OnPropertyChanged@CCBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2833	0x140020c80
?OnPropertyChanged@CCBaseCheckRadioButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2834	0x14001be78
?OnPropertyChanged@CCBaseScrollBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2835	0x14000ef4c
?OnPropertyChanged@CCCommandLink@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2836	0x14003a4f0
?OnPropertyChanged@CCPushButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2837	0x1400061d8
?OnPropertyChanged@CCTrackBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2838	0x14001bea0
?OnPropertyChanged@Combobox@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2839	0x1400181d8
?OnPropertyChanged@DialogElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2840	0x140004118
?OnPropertyChanged@Edit@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2841	0x140030fd4
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z	2842	0x140023e04
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2843	0x140029208
?OnPropertyChanged@Expando@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2844	0x14000b704
?OnPropertyChanged@HWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2845	0x14002a934
?OnPropertyChanged@HWNDHost@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2846	0x14001955c
?OnPropertyChanged@ItemList@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2847	0x140012270
?OnPropertyChanged@Macro@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2848	0x14000ebf4
?OnPropertyChanged@ModernProgressBar@DirectUI@@MEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2849	0x14003ddf4
?OnPropertyChanged@ModernProgressRing@DirectUI@@MEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2850	0x140002d78
?OnPropertyChanged@RefPointElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2851	0x140012f28
?OnPropertyChanged@RichText@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2852	0x14000e76c
?OnPropertyChanged@ScrollBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2853	0x14003a7e8
?OnPropertyChanged@ScrollViewer@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2854	0x140001dec
?OnPropertyChanged@Selector@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2855	0x1400381dc
?OnPropertyChanged@TextGraphic@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2856	0x140024d48
?OnPropertyChanged@TouchButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2857	0x14001b1bc
?OnPropertyChanged@TouchCheckBox@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2858	0x140012eb8
?OnPropertyChanged@TouchCommandButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2859	0x14001d414
?OnPropertyChanged@TouchEdit2@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2860	0x14003d448
?OnPropertyChanged@TouchEditBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2861	0x140028fcc
?OnPropertyChanged@TouchHWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2862	0x14000946c
?OnPropertyChanged@TouchHyperLink@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2863	0x14002a950
?OnPropertyChanged@TouchRepeatButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2864	0x14001ce24
?OnPropertyChanged@TouchScrollBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2865	0x140028878
?OnPropertyChanged@TouchSelect@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2866	0x14002e030
?OnPropertyChanged@Viewer@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2867	0x14002fd48
?OnPropertyChanging@BaseScrollViewer@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2868	0x14003ea54
?OnPropertyChanging@CCBaseScrollBar@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2869	0x14001bf48
?OnPropertyChanging@CCTrackBar@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2870	0x1400331c0
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z	2871	0x140036228
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2872	0x140029a0c
?OnPropertyChanging@PText@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2873	0x14003efa8
?OnPropertyChanging@ScrollBar@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2874	0x140017aac
?OnPropertyChanging@TextGraphic@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2875	0x14001e4d0
?OnPropertyChanging@TouchCheckBox@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2876	0x14002c024
?OnPropertyChanging@TouchCheckBoxGlyph@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2877	0x140017760
?OnPropertyChanging@TouchCommandButton@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2878	0x1400310f4
?OnPropertyChanging@TouchEdit2@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2879	0x1400111c8
?OnPropertyChanging@TouchEditBase@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2880	0x14001ef34
?OnPropertyChanging@TouchSelect@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2881	0x14000429c
?OnPropertyChanging@Viewer@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2882	0x140006958
?OnQueryCancel@TaskPage@DirectUI@@MEAA_JXZ	2883	0x14003dd04
?OnQueryInitialFocus@TaskPage@DirectUI@@MEAAPEAVElement@2@XZ	2884	0x140019e90
?OnReceivedDialogFocus@Button@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2885	0x140006294
?OnReceivedDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2886	0x1400078e0
?OnReceivedDialogFocus@CCBaseCheckRadioButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2887	0x14001122c
?OnReceivedDialogFocus@CCPushButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2888	0x14002ed10
?OnReceivedDialogFocus@CCSysLink@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2889	0x14003f018
?OnReceivedDialogFocus@CheckBoxGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2890	0x140008884
?OnReceivedDialogFocus@ExpandoButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2891	0x14001680c
?OnReceivedDialogFocus@RadioButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2892	0x14001529c
?OnRegisteredDefaultButtonChanged@DialogElementCore@DirectUI@@QEAAXPEAVValue@2@0@Z	2893	0x140037f3c
?OnRemove@BorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2894	0x1400097c4
?OnRemove@Layout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2895	0x140022868
?OnRemove@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2896	0x140029ac4
?OnRemove@ShellBorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2897	0x140006cd0
?OnReset@TaskPage@DirectUI@@MEAA_JXZ	2898	0x14003098c
?OnSelectedPropertyChanged@CCCommandLink@DirectUI@@UEAAXXZ	2899	0x140015b10
?OnSelectedPropertyChanged@CCPushButton@DirectUI@@UEAAXXZ	2900	0x14003a218
?OnSetActive@TaskPage@DirectUI@@MEAA_JXZ	2901	0x14000b358
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2902	0x140040bb8
?OnSinkThemeChanged@XElement@DirectUI@@UEAA_NI_K_JPEA_J@Z	2903	0x140034e8c
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z	2904	0x14000a80c
?OnSysChar@XElement@DirectUI@@UEAA_NG@Z	2905	0x14001cc20
?OnTextProp@TouchSwitch@DirectUI@@SAPEBUPropertyInfo@2@XZ	2906	0x140004234
?OnThemeChanged@HWNDElement@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z	2907	0x14001a9b8
?OnThemeChanged@XBaby@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z	2908	0x140033ebc
?OnToolTip@EventManager@DirectUI@@SAJPEAVElement@2@K@Z	2909	0x14001e5e8
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z	2910	0x140035660
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z	2911	0x1400097ec
?OnUnHosted@ModernProgressBar@DirectUI@@MEAAXPEAVElement@2@@Z	2912	0x14003e544
?OnUnHosted@ModernProgressRing@DirectUI@@MEAAXPEAVElement@2@@Z	2913	0x14003c1f8
?OnUnHosted@PushButton@DirectUI@@UEAAXPEAVElement@2@@Z	2914	0x14000ccc0
?OnUnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z	2915	0x1400120a8
?OnUnHosted@TouchSelect@DirectUI@@UEAAXPEAVElement@2@@Z	2916	0x14001f2a0
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z	2917	0x14003cd2c
?OnWizBack@TaskPage@DirectUI@@MEAA_JXZ	2918	0x140033860
?OnWizFinish@TaskPage@DirectUI@@MEAA_JXZ	2919	0x1400285ac
?OnWizNext@TaskPage@DirectUI@@MEAA_JXZ	2920	0x14003dad8
?OnWmSettingChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z	2921	0x140014740
?OnWmThemeChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z	2922	0x140020998
?OnWmThemeChanged@XBaby@DirectUI@@UEAAX_K_J@Z	2923	0x14002443c
?OnWndMsg@TaskPage@DirectUI@@AEAAHI_K_JPEA_J@Z	2924	0x140006560
?OpenAnimation@CCAVI@DirectUI@@AEAAXPEAUHWND__@@@Z	2925	0x14001ea44
?OpenPopup@TouchSelect@DirectUI@@QEAAJXZ	2926	0x14003e6f8
?OptimizeMoveProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	2927	0x14002a10c
?OrderProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2928	0x140032458
?Orientation@Schema@DirectUI@@2HA	2929	0x14003fdc8
?OverhangOffsetProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2930	0x140038624
?OverhangProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2931	0x140026424
?OverrideButtonBackgroundProp@CCPushButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2932	0x140017a64
?OverrideZoomThreshold@TouchScrollViewer@DirectUI@@QEAAJMMH@Z	2933	0x140015c48
?PaddingProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2934	0x1400132c8
?PageDown@BaseScrollBar@DirectUI@@UEAAXI@Z	2935	0x1400378f4
?PageDown@TouchScrollBar@DirectUI@@UEAAXI@Z	2936	0x14001e820
?PageProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2937	0x14001871c
?PageProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2938	0x1400304c0
?PageUp@BaseScrollBar@DirectUI@@UEAAXI@Z	2939	0x14000a5d8
?PageUp@TouchScrollBar@DirectUI@@UEAAXI@Z	2940	0x14000ec24
?Paint@AnimationStrip@DirectUI@@MEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2941	0x140011c24
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2942	0x14002549c
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2943	0x1400287a4
?Paint@ModernProgressBar@DirectUI@@MEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2944	0x140032610
?Paint@ModernProgressRing@DirectUI@@MEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2945	0x14001d730
?Paint@Movie@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2946	0x140013e84
?Paint@Progress@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2947	0x14002cbc0
?Paint@RichText@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2948	0x140013424
?Paint@TouchCheckBox@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2949	0x1400112dc
?Paint@TouchCheckBoxGlyph@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2950	0x14001230c
?Paint@TouchCommandButton@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2951	0x1400054e8
?Paint@TouchEdit2@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2952	0x1400050c8
?PaintBackground@Element@DirectUI@@QEAAXPEAUHDC__@@PEAVValue@2@AEBUtagRECT@@222@Z	2953	0x14002b718
?PaintBorder@Element@DirectUI@@QEAAXPEAUHDC__@@PEAVValue@2@PEAUtagRECT@@AEBU5@@Z	2954	0x14001f2fc
?PaintContent@Element@DirectUI@@QEAAXPEAUHDC__@@PEBUtagRECT@@@Z	2955	0x140040260
?PaintEdgeHighlight@Element@DirectUI@@QEAAXPEAUHDC__@@AEBUtagRECT@@1@Z	2956	0x140037d54
?PaintFocusRect@Element@DirectUI@@QEAAXPEAUHDC__@@PEBUtagRECT@@1@Z	2957	0x14002e350
?PaintStringContent@Element@DirectUI@@QEAAXPEAUHDC__@@PEBUtagRECT@@PEAVValue@2@H@Z	2958	0x1400050ec
?PaneControlType@Schema@DirectUI@@2HA	2959	0x140002d4c
?ParentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2960	0x140034d40
?ParseARGBColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAKPEA_N@Z	2961	0x14000d4c8
?ParseArgs@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEATParsedArg@12@IPEBD@Z	2962	0x1400336e0
?ParseAtomValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2963	0x140017320
?ParseBehavior@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@@Z	2964	0x140019fc4
?ParseBehaviorArgValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2965	0x14001227c
?ParseBoolValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2966	0x1400238a8
?ParseColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAK@Z	2967	0x14002b418
?ParseDFCFill@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2968	0x140004c8c
?ParseDTBFill@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2969	0x14000d0bc
?ParseDoubleListValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2970	0x140041788
?ParseFillValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2971	0x140003cb0
?ParseFloat@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAMPEA_N@Z	2972	0x14000bf6c
?ParseFloatValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2973	0x14002600c
?ParseFunction@DUIXmlParser@DirectUI@@IEAAJPEBGPEBUExprNode@ParserTools@2@PEATParsedArg@12@IPEBD@Z	2974	0x140014f5c
?ParseGTCColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAKPEA_N@Z	2975	0x140035864
?ParseGTFStr@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2976	0x14000344c
?ParseGTMarRect@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledRECT@2@PEA_N@Z	2977	0x14000fe48
?ParseGTMetInt@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAHPEA_N@Z	2978	0x140033a34
?ParseGTPartSize@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledSIZE@2@PEA_N@Z	2979	0x140006008
?ParseGradientFill@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2980	0x140030c90
?ParseGraphicGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2981	0x14002f8a8
?ParseGraphicHelper@DUIXmlParser@DirectUI@@IEAAJ_NPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2982	0x14002d444
?ParseGraphicValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2983	0x1400030dc
?ParseIconGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2984	0x140035f9c
?ParseImageGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2985	0x14003fb4c
?ParseIntValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2986	0x140031eb8
?ParseLayoutValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@@Z	2987	0x14002ffa8
?ParseLibrary@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAUHINSTANCE__@@@Z	2988	0x14002e2d4
?ParseLiteral@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEBG@Z	2989	0x140035398
?ParseLiteralColor@DUIXmlParser@DirectUI@@IEAAJPEBGPEAK@Z	2990	0x1400315c0
?ParseLiteralColorInt@DUIXmlParser@DirectUI@@IEAAJPEBGPEAH@Z	2991	0x140007a28
?ParseLiteralNumber@DUIXmlParser@DirectUI@@IEAAJPEBGPEAHPEA_N@Z	2992	0x1400241cc
?ParseMagnitude@DUIXmlParser@DirectUI@@IEAAJPEBGPEAHPEA_N@Z	2993	0x1400066fc
?ParseMagnitudeFloat@DUIXmlParser@DirectUI@@IEAAJPEBGPEAMPEA_N@Z	2994	0x140037750
?ParseNumber@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAHPEA_N@Z	2995	0x140011598
?ParsePointValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2996	0x1400073c4
?ParseQuotedString@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEBG@Z	2997	0x140031810
?ParseRGBColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAKPEA_N@Z	2998	0x14001dc30
?ParseRect@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledRECT@2@@Z	2999	0x14000e1a4
?ParseRectRect@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledRECT@2@PEA_N@Z	3000	0x14000a864
?ParseRectValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3001	0x1400256cc
?ParseResStr@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	3002	0x140014440
?ParseResid@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEBG@Z	3003	0x140029c04
?ParseSGraphicGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	3004	0x14003a6c8
?ParseSGraphicHelper@DUIXmlParser@DirectUI@@IEAAJ_NPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3005	0x140009394
?ParseSize@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledSIZE@2@@Z	3006	0x140030150
?ParseSizeSize@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledSIZE@2@PEA_N@Z	3007	0x140030e0c
?ParseSizeValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3008	0x140003704
?ParseStringValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3009	0x140025fe0
?ParseStyleSheets@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	3010	0x14000f2e0
?ParseSysMetricInt@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAHPEA_N@Z	3011	0x1400133d8
?ParseSysMetricStr@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	3012	0x1400276cc
?ParseTheme@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@_NPEAPEAX@Z	3013	0x140009674
?PasswordCharacterProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	3014	0x140007ae4
?PasswordCharacterProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3015	0x14001e1ac
?PasswordRevealModeProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3016	0x14000911c
?Paste@TouchEditBase@DirectUI@@SA?AVUID@@XZ	3017	0x140034d68
?PasteText@TouchEdit2@DirectUI@@QEAAJPEBG@Z	3018	0x14002511c
?PathProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3019	0x140020a94
?PatternFromPatternId@Schema@DirectUI@@SA?AW4Pattern@12@H@Z	3020	0x14002b59c
?Pause@Movie@DirectUI@@QEAAXXZ	3021	0x1400386ec
?PfnIsSupportedFromPattern@Schema@DirectUI@@SAP6A_NPEAVElement@2@@ZW4Pattern@12@@Z	3022	0x1400200cc
?PinningProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3023	0x140010b58
?PixelOffsetModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3024	0x14001496c
?Play@CCAVI@DirectUI@@QEAAXPEAUHWND__@@@Z	3025	0x14002bf3c
?Play@Movie@DirectUI@@QEAAXXZ	3026	0x14001f7e8
?PlayAllFramesModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3027	0x140018708
?PlayProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	3028	0x14002b388
?PopupBoundsProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	3029	0x14000cbc0
?PopupChange@TouchSelect@DirectUI@@SA?AVUID@@XZ	3030	0x14000e0f0
?PosInLayoutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3031	0x14000631c
?PositionProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3032	0x1400391b0
?PositionProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3033	0x14000a70c
?PositionProp@Progress@DirectUI@@SAPEBUPropertyInfo@2@XZ	3034	0x14003c394
?PositionProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3035	0x140008aa8
?PostCreate@CCAVI@DirectUI@@MEAAXPEAUHWND__@@@Z	3036	0x1400139c4
?PostCreate@CCBase@DirectUI@@MEAAXPEAUHWND__@@@Z	3037	0x14000ea88
?PostCreate@CCBaseCheckRadioButton@DirectUI@@MEAAXPEAUHWND__@@@Z	3038	0x14001bd48
?PostCreate@CCCommandLink@DirectUI@@MEAAXPEAUHWND__@@@Z	3039	0x14002905c
?PostCreate@CCTrackBar@DirectUI@@MEAAXPEAUHWND__@@@Z	3040	0x14002fa78
?PrepareManualSwapDeferredZoomToRect@TouchScrollViewer@DirectUI@@QEAAJPEBUtagRECT@@PEBM1PEAM2M@Z	3041	0x140003158
?PressedProp@Button@DirectUI@@SAPEBUPropertyInfo@2@XZ	3042	0x140010d20
?PressedProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3043	0x140001098
?PreventFormatChangeUpdatingModifiedStateProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3044	0x140021c2c
?PrintRTLControl@HWNDHost@DirectUI@@IEAAXPEAUHDC__@@0AEBUtagRECT@@@Z	3045	0x14003d098
?ProcessIdProperty@Schema@DirectUI@@2HA	3046	0x14002fef4
?ProcessingKeyboardNavigation@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3047	0x14001b61c
?ProgressBarControlType@Schema@DirectUI@@2HA	3048	0x14001cca0
?PromptTextProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3049	0x14002f63c
?PromptWithCaretProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3050	0x140031fc4
?PropSheet_SendMessage@TaskPage@DirectUI@@IEAA_JI_K_J@Z	3051	0x14000dd18
?PropertyChangedCore@Edit@DirectUI@@AEAAXPEBUPropertyInfo@2@HPEAVValue@2@PEAUHWND__@@@Z	3052	0x14002c3c0
?PropertyChangingListener@EventManager@DirectUI@@SAJPEAVElement@2@PEBUPropertyInfo@2@PEA_N@Z	3053	0x14002f680
?PropertyListener@EventManager@DirectUI@@SAJPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	3054	0x14003aec8
?PropertyProp@Bind@DirectUI@@SAPEBUPropertyInfo@2@XZ	3055	0x140029c64
?ProportionalProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3056	0x14003103c
?QueryInterface@DuiAccessible@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3057	0x140027cc4
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3058	0x14001c6c0
?QueryInterface@ElementProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3059	0x14001633c
?QueryInterface@ExpandCollapseProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3060	0x1400380c8
?QueryInterface@GridItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3061	0x1400019b4
?QueryInterface@GridProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3062	0x140023ca8
?QueryInterface@HWNDElementProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3063	0x14002b2b4
?QueryInterface@HWNDHostAccessible@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3064	0x14001c924
?QueryInterface@InvokeProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3065	0x14002c5f0
?QueryInterface@RangeValueProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3066	0x14001a400
?QueryInterface@ScrollItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3067	0x14000644c
?QueryInterface@ScrollProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3068	0x14001f674
?QueryInterface@SelectionItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3069	0x14002d3a4
?QueryInterface@SelectionProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3070	0x140033b04
?QueryInterface@TableItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3071	0x140035830
?QueryInterface@TableProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3072	0x14000e388
?QueryInterface@ToggleProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3073	0x140037d08
?QueryInterface@ValueProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3074	0x14002e41c
?QueryInterface@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3075	0x140007a2c
?QueryService@DuiAccessible@DirectUI@@UEAAJAEBU_GUID@@0PEAPEAX@Z	3076	0x140038b54
?QueryService@HWNDHostAccessible@DirectUI@@UEAAJAEBU_GUID@@0PEAPEAX@Z	3077	0x1400163e0
?QuerySysMetric@DUIXmlParser@DirectUI@@IEAAHHPEA_N@Z	3078	0x140028b4c
?QuerySysMetricStr@DUIXmlParser@DirectUI@@IEAAPEBGHPEAGI@Z	3079	0x140023524
?QueueDefaultAction@Element@DirectUI@@QEAAJXZ	3080	0x14000d580
?RadioButtonControlType@Schema@DirectUI@@2HA	3081	0x140006ffc
?RaiseChildRemovedEvent@EventManager@DirectUI@@CAJAEBUElementRuntimeId@2@PEAVElement@2@@Z	3082	0x14002963c
?RaiseGeometryEventWorker@EventManager@DirectUI@@CAJPEAURectangleChange@2@_N111@Z	3083	0x14003efa4
?RaiseGeometryEvents@EventManager@DirectUI@@CAJXZ	3084	0x140026f00
?RaiseStructureChangedEvent@EventManager@DirectUI@@CAJPEAVElement@2@W4StructureChangeType@@@Z	3085	0x140028c7c
?RaiseStructureEvents@EventManager@DirectUI@@CAJXZ	3086	0x140017260
?RaiseVisibilityEvents@EventManager@DirectUI@@CAJXZ	3087	0x140041110
?RangeMaxProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3088	0x140017a0c
?RangeMinProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3089	0x1400151f4
?RangeValuePattern@Schema@DirectUI@@2HA	3090	0x140006270
?RangeValue_IsReadOnly_Property@Schema@DirectUI@@2HA	3091	0x140005524
?RangeValue_LargeChange_Property@Schema@DirectUI@@2HA	3092	0x140021714
?RangeValue_Maximum_Property@Schema@DirectUI@@2HA	3093	0x140034dec
?RangeValue_Minimum_Property@Schema@DirectUI@@2HA	3094	0x1400055a8
?RangeValue_SmallChange_Property@Schema@DirectUI@@2HA	3095	0x140010ef4
?RangeValue_Value_Property@Schema@DirectUI@@2HA	3096	0x14001ea78
?RawActionProc@AnimationStrip@DirectUI@@KAXPEAUGMA_ACTIONINFO@@@Z	3097	0x14002484c
?RawActionProc@Movie@DirectUI@@SAXPEAUGMA_ACTIONINFO@@@Z	3098	0x1400043c8
?ReadOnlyProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3099	0x140031804
?Recalc@AccessibleButton@DirectUI@@QEAAXXZ	3100	0x1400032f8
?ReferencePointProp@RefPointElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3101	0x14003da64
?ReflowStyle@PVLAnimation@DirectUI@@SA?AVUID@@XZ	3102	0x14002923c
?RefreshContent@TouchEdit2@DirectUI@@UEAAJXZ	3103	0x140029164
?RefreshContent@TouchEditBase@DirectUI@@UEAAJXZ	3104	0x14002d65c
?Register@AccessibleButton@DirectUI@@SAJXZ	3105	0x140036bb8
?Register@AnimationStrip@DirectUI@@SAJXZ	3106	0x1400274d4
?Register@AutoButton@DirectUI@@SAJXZ	3107	0x14002c340
?Register@BaseScrollViewer@DirectUI@@SAJXZ	3108	0x14000ec98
?Register@Bind@DirectUI@@SAJXZ	3109	0x14002cd40
?Register@Browser@DirectUI@@SAJXZ	3110	0x14002daa4
?Register@Button@DirectUI@@SAJXZ	3111	0x140001c68
?Register@CCAVI@DirectUI@@SAJXZ	3112	0x14003bd64
?Register@CCBase@DirectUI@@SAJXZ	3113	0x140041058
?Register@CCBaseCheckRadioButton@DirectUI@@SAJXZ	3114	0x140028ea0
?Register@CCBaseScrollBar@DirectUI@@SAJXZ	3115	0x1400323ac
?Register@CCCheckBox@DirectUI@@SAJXZ	3116	0x14003229c
?Register@CCCommandLink@DirectUI@@SAJXZ	3117	0x14001025c
?Register@CCHScrollBar@DirectUI@@SAJXZ	3118	0x14002c708
?Register@CCListBox@DirectUI@@SAJXZ	3119	0x140025e0c
?Register@CCListView@DirectUI@@SAJXZ	3120	0x14003654c
?Register@CCProgressBar@DirectUI@@SAJXZ	3121	0x140037c28
?Register@CCPushButton@DirectUI@@SAJXZ	3122	0x140017ed0
?Register@CCRadioButton@DirectUI@@SAJXZ	3123	0x140009c1c
?Register@CCSysLink@DirectUI@@SAJXZ	3124	0x14003cd88
?Register@CCTrackBar@DirectUI@@SAJXZ	3125	0x1400384f4
?Register@CCTreeView@DirectUI@@SAJXZ	3126	0x140008858
?Register@CCVScrollBar@DirectUI@@SAJXZ	3127	0x14003eb48
?Register@CheckBoxGlyph@DirectUI@@SAJXZ	3128	0x140040b20
?Register@ClassInfoBase@DirectUI@@QEAAJXZ	3129	0x14002ed14
?Register@Clipper@DirectUI@@SAJXZ	3130	0x14002324c
?Register@Combobox@DirectUI@@SAJXZ	3131	0x140001cb8
?Register@DialogElement@DirectUI@@SAJXZ	3132	0x140029c3c
?Register@Edit@DirectUI@@SAJXZ	3133	0x14003155c
?Register@Element@DirectUI@@SAJXZ	3134	0x140038020
?Register@ElementWithHWND@DirectUI@@SAJXZ	3135	0x1400056fc
?Register@Expandable@DirectUI@@SAJXZ	3136	0x140009424
?Register@Expando@DirectUI@@SAJXZ	3137	0x14003ef44
?Register@ExpandoButtonGlyph@DirectUI@@SAJXZ	3138	0x140033138
?Register@HWNDElement@DirectUI@@SAJXZ	3139	0x14003abc8
?Register@HWNDHost@DirectUI@@SAJXZ	3140	0x140034724
?Register@ItemList@DirectUI@@SAJXZ	3141	0x140029b1c
?Register@Macro@DirectUI@@SAJXZ	3142	0x14001814c
?Register@ModernProgressBar@DirectUI@@SAJXZ	3143	0x14003f328
?Register@ModernProgressRing@DirectUI@@SAJXZ	3144	0x140004cf8
?Register@Movie@DirectUI@@SAJXZ	3145	0x1400281d4
?Register@Navigator@DirectUI@@SAJXZ	3146	0x14002db30
?Register@PText@DirectUI@@SAJXZ	3147	0x14001fe94
?Register@Page@DirectUI@@SAJXZ	3148	0x14001c45c
?Register@Pages@DirectUI@@SAJXZ	3149	0x140001c84
?Register@Progress@DirectUI@@SAJXZ	3150	0x14000bba0
?Register@PushButton@DirectUI@@SAJXZ	3151	0x140014764
?Register@RadioButtonGlyph@DirectUI@@SAJXZ	3152	0x14002cc44
?Register@RefPointElement@DirectUI@@SAJXZ	3153	0x140031520
?Register@RepeatButton@DirectUI@@SAJXZ	3154	0x1400183e0
?Register@Repeater@DirectUI@@SAJXZ	3155	0x14001a100
?Register@RichText@DirectUI@@SAJXZ	3156	0x140004f58
?Register@ScrollBar@DirectUI@@SAJXZ	3157	0x14000e254
?Register@ScrollViewer@DirectUI@@SAJXZ	3158	0x140022ee8
?Register@Selector@DirectUI@@SAJXZ	3159	0x140039924
?Register@SelectorNoDefault@DirectUI@@SAJXZ	3160	0x140024ff0
?Register@SemanticZoomToggle@DirectUI@@SAJXZ	3161	0x140022de8
?Register@StyledScrollViewer@DirectUI@@SAJXZ	3162	0x140029984
?Register@TextGraphic@DirectUI@@SAJXZ	3163	0x140033cf0
?Register@Thumb@DirectUI@@SAJXZ	3164	0x140019f44
?Register@TouchButton@DirectUI@@SAJXZ	3165	0x14002e958
?Register@TouchCheckBox@DirectUI@@SAJXZ	3166	0x14003b5e0
?Register@TouchCheckBoxGlyph@DirectUI@@SAJXZ	3167	0x14001a86c
?Register@TouchCommandButton@DirectUI@@SAJXZ	3168	0x1400397d0
?Register@TouchEdit2@DirectUI@@SAJXZ	3169	0x14003bc5c
?Register@TouchEditBase@DirectUI@@SAJXZ	3170	0x14000b0c8
?Register@TouchHWNDElement@DirectUI@@SAJXZ	3171	0x140024a68
?Register@TouchHyperLink@DirectUI@@SAJXZ	3172	0x140012840
?Register@TouchRepeatButton@DirectUI@@SAJXZ	3173	0x14000bc40
?Register@TouchScrollBar@DirectUI@@SAJXZ	3174	0x14002b03c
?Register@TouchSelect@DirectUI@@SAJXZ	3175	0x14003af44
?Register@TouchSelectItem@DirectUI@@SAJXZ	3176	0x14001bb34
?Register@TouchSlider@DirectUI@@SAJXZ	3177	0x140008f9c
?Register@TouchSwitch@DirectUI@@SAJXZ	3178	0x14002ccc4
?Register@UnknownElement@DirectUI@@SAJXZ	3179	0x14003dee8
?Register@Viewer@DirectUI@@SAJXZ	3180	0x140029d00
?Register@XBaby@DirectUI@@SAJXZ	3181	0x14002cf54
?Register@XElement@DirectUI@@SAJXZ	3182	0x140017444
?RegisterForAnimationStatusChanges@TouchHWNDElement@DirectUI@@QEAAXXZ	3183	0x140037f98
?RegisterForIHMChanges@TouchHWNDElement@DirectUI@@QEAAJXZ	3184	0x140013c4c
?RegisterForMonitorPowerChanges@TouchHWNDElement@DirectUI@@QEAAJXZ	3185	0x140028f40
?RegisteredDefaultButtonProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3186	0x14002dc98
?Release@ClassInfoBase@DirectUI@@UEAAHXZ	3187	0x14000d048
?Release@DuiAccessible@DirectUI@@UEAAKXZ	3188	0x14001c924
?Release@Element@DirectUI@@QEAAKXZ	3189	0x14001351c
?Release@ElementProvider@DirectUI@@UEAAKXZ	3190	0x140039cd0
?Release@ExpandCollapseProvider@DirectUI@@UEAAKXZ	3191	0x14001cf9c
?Release@GridItemProvider@DirectUI@@UEAAKXZ	3192	0x140023120
?Release@GridProvider@DirectUI@@UEAAKXZ	3193	0x140024c9c
?Release@HWNDElementProvider@DirectUI@@UEAAKXZ	3194	0x14001b4c0
?Release@InvokeProvider@DirectUI@@UEAAKXZ	3195	0x140038604
?Release@RangeValueProvider@DirectUI@@UEAAKXZ	3196	0x140023558
?Release@RefcountBase@DirectUI@@QEAAJXZ	3197	0x14002f040
?Release@ScrollItemProvider@DirectUI@@UEAAKXZ	3198	0x140023b40
?Release@ScrollProvider@DirectUI@@UEAAKXZ	3199	0x14003d564
?Release@SelectionItemProvider@DirectUI@@UEAAKXZ	3200	0x140008460
?Release@SelectionProvider@DirectUI@@UEAAKXZ	3201	0x14002ea74
?Release@TableItemProvider@DirectUI@@UEAAKXZ	3202	0x14003ffd4
?Release@TableProvider@DirectUI@@UEAAKXZ	3203	0x14000cd74
?Release@ToggleProvider@DirectUI@@UEAAKXZ	3204	0x14001fe64
?Release@Value@DirectUI@@QEAAXXZ	3205	0x1400100f4
?Release@ValueProvider@DirectUI@@UEAAKXZ	3206	0x1400395c0
?Release@XProvider@DirectUI@@UEAAKXZ	3207	0x14002f8e8
?ReleaseSnapshot@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3208	0x1400057b8
?ReloadIcon@Value@DirectUI@@CAPEAUHICON__@@PEAUGraphic@2@M@Z	3209	0x140023e10
?Remove@Element@DirectUI@@QEAAJPEAV12@@Z	3210	0x140034fb0
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z	3211	0x140013b00
?Remove@ElementProviderManager@DirectUI@@SAXPEAVElementProvider@2@@Z	3212	0x140008e60
?Remove@LinkedList@DirectUI@@QEAAXPEAVLinkedListNode@2@@Z	3213	0x140012b74
?RemoveAll@Element@DirectUI@@QEAAJXZ	3214	0x14001adb4
?RemoveAll@TouchSelect@DirectUI@@QEAAXXZ	3215	0x14002fa90
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z	3216	0x1400357b4
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ	3217	0x14001a97c
?RemoveFromSelection@SelectionItemProvider@DirectUI@@UEAAJXZ	3218	0x140030614
?RemoveItem@TouchSelect@DirectUI@@QEAAJH@Z	3219	0x140016ea4
?RemoveListener@Element@DirectUI@@QEAAXPEAUIElementListener@2@@Z	3220	0x14001f504
?RemoveLocalValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZ@Z	3221	0x140012bb4
?RemoveLocalValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@@Z	3222	0x140005ad0
?RemoveRichDuiTooltip@TouchSlider@DirectUI@@QEAAXXZ	3223	0x140026b2c
?RemoveShortcutFromName@Element@DirectUI@@AEAAPEAGPEBG@Z	3224	0x14001fee0
?RemoveTail@LinkedList@DirectUI@@QEAAPEAVLinkedListNode@2@XZ	3225	0x140040e9c
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z	3226	0x14001ae04
?RemoveTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3227	0x14002865c
?RemoveTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3228	0x14003d2e4
?RepeatClick@TouchRepeatButton@DirectUI@@SA?AVUID@@XZ	3229	0x140039024
?RepeatProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3230	0x14003d85c
?Reset@DuiAccessible@DirectUI@@UEAAJXZ	3231	0x1400160cc
?Reset@HWNDHostAccessible@DirectUI@@UEAAJXZ	3232	0x140009fbc
?ResetInputState@TouchScrollViewer@DirectUI@@QEAAJXZ	3233	0x14003cf10
?ResetManipulations@TouchScrollViewer@DirectUI@@QEAAJXZ	3234	0x14002a7b0
?ResolveBindings@Macro@DirectUI@@IEAAXXZ	3235	0x140037e08
?RestoreFocus@NativeHWNDHost@DirectUI@@QEAAHXZ	3236	0x14001edcc
?Resume@Movie@DirectUI@@QEAAXXZ	3237	0x140006ee4
?ReturnValueParser@DUIXmlParser@DirectUI@@IEAAXPEAVValueParser@ParserTools@2@@Z	3238	0x14001054c
?Rewind@Movie@DirectUI@@QEAAXXZ	3239	0x14000c8f0
?RichTooltipShowing@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3240	0x14000b050
?RightClick@TouchButton@DirectUI@@SA?AVUID@@XZ	3241	0x140029dc8
?RuntimeIdProperty@Schema@DirectUI@@2HA	3242	0x14001eb3c
?STACKDEPTH@CallstackTracker@DirectUI@@0HB	3243	0x14002f288
?SaveFocus@NativeHWNDHost@DirectUI@@QEAAXXZ	3244	0x140039580
?ScaleChanged@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3245	0x14000ef74
?ScaleFactorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3246	0x14001d734
?Scroll@BaseScrollBar@DirectUI@@SA?AVUID@@XZ	3247	0x140016194
?Scroll@ScrollProvider@DirectUI@@UEAAJW4ScrollAmount@@0@Z	3248	0x1400294ec
?Scroll@ScrollProxy@DirectUI@@AEAAJW4ScrollAmount@@0@Z	3249	0x140037460
?ScrollBarControlType@Schema@DirectUI@@2HA	3250	0x14002e5d8
?ScrollIntoView@ScrollItemProvider@DirectUI@@UEAAJXZ	3251	0x140040bb0
?ScrollItemPattern@Schema@DirectUI@@2HA	3252	0x1400317f8
?ScrollLine@ScrollProxy@DirectUI@@AEAAJ_N0@Z	3253	0x14002700c
?ScrollPaddingProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3254	0x14003fec4
?ScrollPage@ScrollProxy@DirectUI@@AEAAJ_N0@Z	3255	0x14003205c
?ScrollPattern@Schema@DirectUI@@2HA	3256	0x14001fc10
?ScrollToHorizontalPosition@ScrollProxy@DirectUI@@AEAAJH_N@Z	3257	0x140028ce4
?ScrollToVerticalPosition@ScrollProxy@DirectUI@@AEAAJH_N@Z	3258	0x140029a14
?Scroll_HorizontalScrollPercent_Property@Schema@DirectUI@@2HA	3259	0x1400325bc
?Scroll_HorizontalViewSize_Property@Schema@DirectUI@@2HA	3260	0x140017074
?Scroll_HorizontallyScrollable_Property@Schema@DirectUI@@2HA	3261	0x140029b98
?Scroll_VerticalScrollPercent_Property@Schema@DirectUI@@2HA	3262	0x14002d410
?Scroll_VerticalViewSize_Property@Schema@DirectUI@@2HA	3263	0x140028e3c
?Scroll_VerticallyScrollable_Property@Schema@DirectUI@@2HA	3264	0x14002b5a8
?Select@SelectionItemProvider@DirectUI@@UEAAJXZ	3265	0x1400162dc
?Select@SelectorSelectionItemProxy@DirectUI@@AEAAJXZ	3266	0x14002eb90
?SelectAll@TouchEdit2@DirectUI@@QEAAJXZ	3267	0x14002b448
?SelectNone@TouchEdit2@DirectUI@@QEAAJXZ	3268	0x140014700
?SelectedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3269	0x140004f24
?SelectionBackgroundColorProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3270	0x140041538
?SelectionChange@Combobox@DirectUI@@SA?AVUID@@XZ	3271	0x140006b78
?SelectionChange@Selector@DirectUI@@SA?AVUID@@XZ	3272	0x14001ecb8
?SelectionChange@TouchSelect@DirectUI@@SA?AVUID@@XZ	3273	0x140019a2c
?SelectionForegroundColorProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3274	0x1400404dc
?SelectionInvalidatedEvent@Schema@DirectUI@@2HA	3275	0x140037614
?SelectionItemElementAddedToSelectionEvent@Schema@DirectUI@@2HA	3276	0x140003534
?SelectionItemElementRemovedFromSelectionEvent@Schema@DirectUI@@2HA	3277	0x14001e5d0
?SelectionItemElementSelectedEvent@Schema@DirectUI@@2HA	3278	0x140009d90
?SelectionItemPattern@Schema@DirectUI@@2HA	3279	0x14001df2c
?SelectionItem_IsSelected_Property@Schema@DirectUI@@2HA	3280	0x14001cd38
?SelectionItem_SelectionContainer_Property@Schema@DirectUI@@2HA	3281	0x14001a3c0
?SelectionPattern@Schema@DirectUI@@2HA	3282	0x140019c4c
?SelectionProp@Combobox@DirectUI@@SAPEBUPropertyInfo@2@XZ	3283	0x140026128
?SelectionProp@Selector@DirectUI@@SAPEBUPropertyInfo@2@XZ	3284	0x14000bd74
?SelectionProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	3285	0x140033720
?Selection_CanSelectMultiple_Property@Schema@DirectUI@@2HA	3286	0x14001c6e0
?Selection_IsSelectionRequired_Property@Schema@DirectUI@@2HA	3287	0x1400145d8
?Selection_Selection_Property@Schema@DirectUI@@2HA	3288	0x140005270
?SemanticChange@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3289	0x140037dc8
?SemanticZoomControlType@Schema@DirectUI@@2HA	3290	0x1400311a8
?SendParseError@DUIXmlParser@DirectUI@@IEAAXPEBG0HHJ@Z	3291	0x140011984
?SendParseError@DUIXmlParser@DirectUI@@IEAAXPEBG0PEAUIXmlReader@@J@Z	3292	0x14000b6ac
?SeparatorControlType@Schema@DirectUI@@2HA	3293	0x1400210e0
?SetAbsorbsShortcut@Element@DirectUI@@QEAAJ_N@Z	3294	0x140006fe4
?SetAccDefAction@Element@DirectUI@@QEAAJPEBG@Z	3295	0x14003fa84
?SetAccDesc@Element@DirectUI@@QEAAJPEBG@Z	3296	0x14000b4b0
?SetAccHelp@Element@DirectUI@@QEAAJPEBG@Z	3297	0x140003504
?SetAccItemStatus@Element@DirectUI@@QEAAJPEBG@Z	3298	0x140016304
?SetAccItemType@Element@DirectUI@@QEAAJPEBG@Z	3299	0x140034aa8
?SetAccName@Element@DirectUI@@QEAAJPEBG@Z	3300	0x140032600
?SetAccRole@Element@DirectUI@@QEAAJH@Z	3301	0x14001c120
?SetAccState@Element@DirectUI@@QEAAJH@Z	3302	0x140014768
?SetAccValue@Element@DirectUI@@QEAAJPEBG@Z	3303	0x14001bf00
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z	3304	0x140023de4
?SetActive@Element@DirectUI@@QEAAJH@Z	3305	0x14000e6f0
?SetActiveState@TouchScrollBar@DirectUI@@QEAAXW4ActiveState@2@_N@Z	3306	0x14002acc8
?SetActivityOccuring@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3307	0x14002c580
?SetActivityOccuring@ModernProgressRing@DirectUI@@QEAAJ_N@Z	3308	0x140014ff0
?SetAddLayeredRef@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3309	0x14002cba8
?SetAddLayeredRef@ModernProgressRing@DirectUI@@QEAAJ_N@Z	3310	0x14000f994
?SetAliasedRendering@RichText@DirectUI@@QEAAJ_N@Z	3311	0x140030b08
?SetAllowArrowOut@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3312	0x140034abc
?SetAlpha@Element@DirectUI@@QEAAJH@Z	3313	0x14000fa8c
?SetAnimatePopupOnDismiss@TouchSelect@DirectUI@@QEAAJ_N@Z	3314	0x140015970
?SetAnimation@Element@DirectUI@@QEAAJH@Z	3315	0x14002c6f8
?SetAutoGrouping@CCRadioButton@DirectUI@@QEAAJ_N@Z	3316	0x140035a5c
?SetAutoHeight@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3317	0x14000da44
?SetAutoStart@Movie@DirectUI@@QEAAJ_N@Z	3318	0x1400083ac
?SetAutoStop@Movie@DirectUI@@QEAAJ_N@Z	3319	0x140040df4
?SetBackgroundColor@Element@DirectUI@@QEAAJAEBUFill@2@@Z	3320	0x140013f4c
?SetBackgroundColor@Element@DirectUI@@QEAAJK@Z	3321	0x140038278
?SetBackgroundColor@Element@DirectUI@@QEAAJKKE@Z	3322	0x1400282e4
?SetBackgroundColor@Element@DirectUI@@QEAAJKKKE@Z	3323	0x14001cbe4
?SetBackgroundColor@Element@DirectUI@@QEAAJPEBGHH@Z	3324	0x140007788
?SetBackgroundOwnerID@HWNDHost@DirectUI@@QEAAJPEBG@Z	3325	0x140007604
?SetBackgroundStdColor@Element@DirectUI@@QEAAJH@Z	3326	0x140016ea8
?SetBaseline@RichText@DirectUI@@QEAAJH@Z	3327	0x1400083ac
?SetBorderColor@Element@DirectUI@@QEAAJK@Z	3328	0x140026114
?SetBorderGradientColor@Element@DirectUI@@QEAAJKKE@Z	3329	0x14002956c
?SetBorderStdColor@Element@DirectUI@@QEAAJH@Z	3330	0x140015b48
?SetBorderStyle@Element@DirectUI@@QEAAJH@Z	3331	0x1400177ac
?SetBorderThickness@Element@DirectUI@@QEAAJHHHH@Z	3332	0x140025060
?SetBuffering@TouchSlider@DirectUI@@QEAAJH@Z	3333	0x14003884c
?SetButtonClassAcceptsEnterKey@DialogElement@DirectUI@@QEAAJ_N@Z	3334	0x140037774
?SetButtonClassAcceptsEnterKey@XBaby@DirectUI@@UEAAJ_N@Z	3335	0x140022e20
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UEAAJ_N@Z	3336	0x14001988c
?SetCache@RichText@DirectUI@@QEAAXKPEAUIDUIRichTextCache@@@Z	3337	0x14003a108
?SetCacheDirty@Layout@DirectUI@@IEAAXXZ	3338	0x14001c9d0
?SetCaptured@Button@DirectUI@@QEAAJ_N@Z	3339	0x14001fcb8
?SetCaptured@TouchButton@DirectUI@@QEAAJ_N@Z	3340	0x140020708
?SetCaretPosition@TouchEdit2@DirectUI@@QEAAJJ@Z	3341	0x14000853c
?SetCheckedState@TouchCheckBox@DirectUI@@QEAAJW4CheckedStateFlags@2@@Z	3342	0x14001f06c
?SetClass@Element@DirectUI@@QEAAJPEBG@Z	3343	0x14001fc1c
?SetClassInfoPtr@AccessibleButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3344	0x140039218
?SetClassInfoPtr@AnimationStrip@DirectUI@@SAXPEAUIClassInfo@2@@Z	3345	0x140001ed0
?SetClassInfoPtr@AutoButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3346	0x14000b6f4
?SetClassInfoPtr@BaseScrollViewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3347	0x140007a90
?SetClassInfoPtr@Bind@DirectUI@@SAXPEAUIClassInfo@2@@Z	3348	0x14003e80c
?SetClassInfoPtr@Browser@DirectUI@@SAXPEAUIClassInfo@2@@Z	3349	0x14001c5f8
?SetClassInfoPtr@Button@DirectUI@@SAXPEAUIClassInfo@2@@Z	3350	0x140006610
?SetClassInfoPtr@CCAVI@DirectUI@@SAXPEAUIClassInfo@2@@Z	3351	0x140008420
?SetClassInfoPtr@CCBase@DirectUI@@SAXPEAUIClassInfo@2@@Z	3352	0x140008820
?SetClassInfoPtr@CCBaseCheckRadioButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3353	0x140027460
?SetClassInfoPtr@CCBaseScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3354	0x14001fdb4
?SetClassInfoPtr@CCCheckBox@DirectUI@@SAXPEAUIClassInfo@2@@Z	3355	0x140021b70
?SetClassInfoPtr@CCCommandLink@DirectUI@@SAXPEAUIClassInfo@2@@Z	3356	0x14002d094
?SetClassInfoPtr@CCHScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3357	0x14001d9a4
?SetClassInfoPtr@CCListBox@DirectUI@@SAXPEAUIClassInfo@2@@Z	3358	0x140010e0c
?SetClassInfoPtr@CCListView@DirectUI@@SAXPEAUIClassInfo@2@@Z	3359	0x140026668
?SetClassInfoPtr@CCProgressBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3360	0x14002a7bc
?SetClassInfoPtr@CCPushButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3361	0x140008940
?SetClassInfoPtr@CCRadioButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3362	0x14001a484
?SetClassInfoPtr@CCSysLink@DirectUI@@SAXPEAUIClassInfo@2@@Z	3363	0x140026b64
?SetClassInfoPtr@CCTrackBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3364	0x140036bcc
?SetClassInfoPtr@CCTreeView@DirectUI@@SAXPEAUIClassInfo@2@@Z	3365	0x140021b9c
?SetClassInfoPtr@CCVScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3366	0x140033bdc
?SetClassInfoPtr@CheckBoxGlyph@DirectUI@@SAXPEAUIClassInfo@2@@Z	3367	0x1400244ec
?SetClassInfoPtr@Clipper@DirectUI@@SAXPEAUIClassInfo@2@@Z	3368	0x14002ed04
?SetClassInfoPtr@Combobox@DirectUI@@SAXPEAUIClassInfo@2@@Z	3369	0x14001da40
?SetClassInfoPtr@DialogElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3370	0x14000a3c8
?SetClassInfoPtr@Edit@DirectUI@@SAXPEAUIClassInfo@2@@Z	3371	0x14002d228
?SetClassInfoPtr@Element@DirectUI@@SAXPEAUIClassInfo@2@@Z	3372	0x140041258
?SetClassInfoPtr@ElementWithHWND@DirectUI@@SAXPEAUIClassInfo@2@@Z	3373	0x14001c2c0
?SetClassInfoPtr@Expandable@DirectUI@@SAXPEAUIClassInfo@2@@Z	3374	0x1400333c4
?SetClassInfoPtr@Expando@DirectUI@@SAXPEAUIClassInfo@2@@Z	3375	0x140013774
?SetClassInfoPtr@ExpandoButtonGlyph@DirectUI@@SAXPEAUIClassInfo@2@@Z	3376	0x14003bc1c
?SetClassInfoPtr@HWNDElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3377	0x140016280
?SetClassInfoPtr@HWNDHost@DirectUI@@SAXPEAUIClassInfo@2@@Z	3378	0x140022174
?SetClassInfoPtr@Macro@DirectUI@@SAXPEAUIClassInfo@2@@Z	3379	0x140024408
?SetClassInfoPtr@Movie@DirectUI@@SAXPEAUIClassInfo@2@@Z	3380	0x14002d984
?SetClassInfoPtr@Navigator@DirectUI@@SAXPEAUIClassInfo@2@@Z	3381	0x140039380
?SetClassInfoPtr@PText@DirectUI@@SAXPEAUIClassInfo@2@@Z	3382	0x140009844
?SetClassInfoPtr@Page@DirectUI@@SAXPEAUIClassInfo@2@@Z	3383	0x140014f50
?SetClassInfoPtr@Pages@DirectUI@@SAXPEAUIClassInfo@2@@Z	3384	0x14003eb44
?SetClassInfoPtr@Progress@DirectUI@@SAXPEAUIClassInfo@2@@Z	3385	0x14001fb0c
?SetClassInfoPtr@PushButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3386	0x14003f15c
?SetClassInfoPtr@RadioButtonGlyph@DirectUI@@SAXPEAUIClassInfo@2@@Z	3387	0x140025398
?SetClassInfoPtr@RefPointElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3388	0x140017aa0
?SetClassInfoPtr@RepeatButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3389	0x140020f3c
?SetClassInfoPtr@Repeater@DirectUI@@SAXPEAUIClassInfo@2@@Z	3390	0x1400204ac
?SetClassInfoPtr@ScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3391	0x14002edd8
?SetClassInfoPtr@ScrollViewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3392	0x140035148
?SetClassInfoPtr@Selector@DirectUI@@SAXPEAUIClassInfo@2@@Z	3393	0x1400378a0
?SetClassInfoPtr@SelectorNoDefault@DirectUI@@SAXPEAUIClassInfo@2@@Z	3394	0x1400085ac
?SetClassInfoPtr@StyledScrollViewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3395	0x140024eec
?SetClassInfoPtr@TextGraphic@DirectUI@@SAXPEAUIClassInfo@2@@Z	3396	0x14001b1b4
?SetClassInfoPtr@Thumb@DirectUI@@SAXPEAUIClassInfo@2@@Z	3397	0x14000376c
?SetClassInfoPtr@UnknownElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3398	0x140013a6c
?SetClassInfoPtr@Viewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3399	0x1400242c0
?SetClassInfoPtr@XBaby@DirectUI@@SAXPEAUIClassInfo@2@@Z	3400	0x1400172b4
?SetClassInfoPtr@XElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3401	0x140009ea4
?SetClient@BorderLayout@DirectUI@@AEAAXPEAVElement@2@@Z	3402	0x140002b98
?SetColorFontPaletteIndex@RichText@DirectUI@@QEAAJH@Z	3403	0x1400324b4
?SetCompositedText@Element@DirectUI@@QEAAJ_N@Z	3404	0x140031198
?SetCompositingQuality@Movie@DirectUI@@QEAAJH@Z	3405	0x1400125dc
?SetConnect@Bind@DirectUI@@QEAAJPEBG@Z	3406	0x140016928
?SetConstrainLayout@RichText@DirectUI@@QEAAJH@Z	3407	0x14000f830
?SetContact@TouchScrollViewer@DirectUI@@QEAAJI_N@Z	3408	0x14000d6e8
?SetContactNeeded@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3409	0x14003bd98
?SetContactNotify@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3410	0x14001d1c8
?SetContentAlign@Element@DirectUI@@QEAAJH@Z	3411	0x140019a34
?SetContentGraphic@Element@DirectUI@@QEAAJPEBGEI@Z	3412	0x140025118
?SetContentGraphic@Element@DirectUI@@QEAAJPEBGGG@Z	3413	0x14003e0cc
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z	3414	0x14003a64c
?SetCursor@Element@DirectUI@@QEAAJPEBG@Z	3415	0x1400396c0
?SetCursorHandle@Element@DirectUI@@QEAAJPEAUHICON__@@@Z	3416	0x14001e014
?SetDWriteFontCollection@RichText@DirectUI@@QEAAXPEAUIDWriteFontCollection@@@Z	3417	0x14001450c
?SetDWriteTextLayout@RichText@DirectUI@@QEAAXPEAUIDWriteTextLayout@@@Z	3418	0x14002180c
?SetDataEngine@Repeater@DirectUI@@QEAAXPEAUIDataEngine@2@@Z	3419	0x140007240
?SetDataEntry@Macro@DirectUI@@QEAAXPEAUIDataEntry@2@PEAVElement@2@@Z	3420	0x1400397e4
?SetDataEntry@PText@DirectUI@@QEAAXPEAUIDataEntry@2@@Z	3421	0x140002934
?SetDefaultButtonTracking@DialogElement@DirectUI@@UEAAJ_N@Z	3422	0x140029a3c
?SetDefaultButtonTracking@XBaby@DirectUI@@UEAAJ_N@Z	3423	0x140022c48
?SetDefaultButtonTracking@XProvider@DirectUI@@UEAAJ_N@Z	3424	0x14000cbb0
?SetDefaultFocusID@NativeHWNDHost@DirectUI@@QEAAXPEBG@Z	3425	0x14003f434
?SetDefaultGraphicType@Macro@DirectUI@@QEAAXE_N@Z	3426	0x1400299c0
?SetDefaultHInstance@DUIXmlParser@DirectUI@@QEAAXPEAUHINSTANCE__@@@Z	3427	0x140001fc0
?SetDefaultState@CCPushButton@DirectUI@@IEAAXKK@Z	3428	0x14001d2b8
?SetDelegateEventHandler@TouchScrollViewer@DirectUI@@QEAAJPEAUIUnknown@@@Z	3429	0x14002dab0
?SetDeterminate@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3430	0x14002f298
?SetDirection@Element@DirectUI@@QEAAJH@Z	3431	0x1400414e0
?SetDirty@Edit@DirectUI@@QEAAJ_N@Z	3432	0x140024678
?SetDisableAccTextExtend@RichText@DirectUI@@QEAAJ_N@Z	3433	0x14000de00
?SetDisableMouseInRectCheck@TouchRepeatButton@DirectUI@@QEAAJ_N@Z	3434	0x14001f178
?SetDisableOffscreenCaching@TouchScrollViewer@DirectUI@@QEAAX_N@Z	3435	0x140012724
?SetDrawOutlines@Movie@DirectUI@@QEAAJ_N@Z	3436	0x140016cd8
?SetDynamicScaling@DUIXmlParser@DirectUI@@QEAAXW4DynamicScaleParsing@2@@Z	3437	0x140026c08
?SetEdgeHighlightColor@Element@DirectUI@@QEAAJK@Z	3438	0x1400075cc
?SetEdgeHighlightThickness@Element@DirectUI@@QEAAJHHHH@Z	3439	0x140007db8
?SetElementMovesOnIHMNotify@TouchEditBase@DirectUI@@QEAAJ_N@Z	3440	0x140021120
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z	3441	0x140032fa4
?SetEncodedContentString@Element@DirectUI@@QEAAJPEBG@Z	3442	0x14000b9c0
?SetEnforceSize@PushButton@DirectUI@@QEAAJ_N@Z	3443	0x14003f654
?SetEnsureVisibleUseLayoutCoordinates@Viewer@DirectUI@@QEAAX_N@Z	3444	0x14003333c
?SetError@DUIFactory@DirectUI@@QEAAXPEBGZZ	3445	0x14000c7b8
?SetExpand@Macro@DirectUI@@QEAAJPEBG@Z	3446	0x140040618
?SetExpanded@Expandable@DirectUI@@QEAAJ_N@Z	3447	0x1400129fc
?SetFilterOnPaste@TouchEditBase@DirectUI@@QEAAJ_N@Z	3448	0x140027058
?SetFireContinuousSliderEvent@TouchSlider@DirectUI@@QEAAX_N@Z	3449	0x14001d9cc
?SetFlags@TouchHWNDElement@DirectUI@@QEAAJW4TouchHWNDElementFlags@2@0@Z	3450	0x140013684
?SetFocus@ElementProvider@DirectUI@@UEAAJXZ	3451	0x140027418
?SetFocus@HWNDElement@DirectUI@@QEAAX_N@Z	3452	0x140024d6c
?SetFocus@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z	3453	0x14003f88c
?SetFont@Element@DirectUI@@QEAAJPEBG@Z	3454	0x140020758
?SetFontColorRuns@RichText@DirectUI@@QEAAJPEBG@Z	3455	0x14000466c
?SetFontFace@Element@DirectUI@@QEAAJPEBG@Z	3456	0x14001d540
?SetFontQuality@Element@DirectUI@@QEAAJH@Z	3457	0x14001d290
?SetFontSize@Element@DirectUI@@QEAAJH@Z	3458	0x140023068
?SetFontSizeRuns@RichText@DirectUI@@QEAAJPEBG@Z	3459	0x140032db0
?SetFontStyle@Element@DirectUI@@QEAAJH@Z	3460	0x14001a458
?SetFontWeight@Element@DirectUI@@QEAAJH@Z	3461	0x140024dbc
?SetFontWeightRuns@RichText@DirectUI@@QEAAJPEBG@Z	3462	0x14000f6c0
?SetForceEditTextToLTR@TouchEditBase@DirectUI@@QEAAJ_N@Z	3463	0x14002a36c
?SetForegroundColor@Element@DirectUI@@QEAAJK@Z	3464	0x14003a530
?SetForegroundColor@Element@DirectUI@@QEAAJKKE@Z	3465	0x1400270cc
?SetForegroundColor@Element@DirectUI@@QEAAJKKKE@Z	3466	0x1400231a0
?SetForegroundStdColor@Element@DirectUI@@QEAAJH@Z	3467	0x1400083b4
?SetFrameDuration@AnimationStrip@DirectUI@@QEAAJH@Z	3468	0x140032d30
?SetFrameIndex@AnimationStrip@DirectUI@@QEAAJH@Z	3469	0x140036868
?SetFrameWidth@AnimationStrip@DirectUI@@QEAAJH@Z	3470	0x14003acb8
?SetGetSheetCallback@DUIXmlParser@DirectUI@@QEAAXP6APEAVValue@2@PEBGPEAX@Z1@Z	3471	0x14000f934
?SetGraphicType@Repeater@DirectUI@@QEAAXE@Z	3472	0x14003e5c0
?SetHandleEnter@TouchButton@DirectUI@@QEAAJ_N@Z	3473	0x14002baa4
?SetHandleEnterKey@DialogElement@DirectUI@@QEAAJ_N@Z	3474	0x140009218
?SetHandleEnterKey@XBaby@DirectUI@@UEAAJ_N@Z	3475	0x14000c568
?SetHandleEnterKey@XProvider@DirectUI@@IEAAX_N@Z	3476	0x140033d50
?SetHandleGlobalEnter@TouchButton@DirectUI@@QEAAJ_N@Z	3477	0x140015474
?SetHeight@Element@DirectUI@@QEAAJH@Z	3478	0x140013458
?SetID@Element@DirectUI@@QEAAJPEBG@Z	3479	0x1400332b0
?SetIMEComposing@TouchEditBase@DirectUI@@QEAAJ_N@Z	3480	0x140027dac
?SetIgnoredKeyCombos@TouchEditBase@DirectUI@@QEAAJW4TouchEditFilteredKeyComboFlags@2@0@Z	3481	0x1400139ec
?SetIndependentAnimations@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3482	0x140027514
?SetInnerBorderThickness@TouchEdit2@DirectUI@@QEAAJHHHH@Z	3483	0x1400192dc
?SetInputScope@TouchEdit2@DirectUI@@QEAAJW4__MIDL___MIDL_itf_inputscope_0000_0000_0001@@@Z	3484	0x140029218
?SetIntegrateIMECandidateList@TouchEditBase@DirectUI@@QEAAJ_N@Z	3485	0x14003e900
?SetInteractionMode@TouchScrollViewer@DirectUI@@QEAAJH@Z	3486	0x14004068c
?SetInterpolationMode@Movie@DirectUI@@QEAAJH@Z	3487	0x140032880
?SetIsContinuous@TouchSlider@DirectUI@@QEAAJ_N@Z	3488	0x14000f900
?SetIsPressed@TouchSlider@DirectUI@@QEAAJ_N@Z	3489	0x14003ef14
?SetIsShowOnOffFeedback@TouchSlider@DirectUI@@QEAAJ_N@Z	3490	0x1400043b4
?SetIsVertical@TouchSlider@DirectUI@@QEAAJ_N@Z	3491	0x140016f34
?SetItemData@TouchSelect@DirectUI@@QEAAJHPEAUIUnknown@@@Z	3492	0x140021554
?SetItemData@TouchSelectItem@DirectUI@@QEAAJPEAUIUnknown@@@Z	3493	0x14002ac08
?SetItemHeightInPopup@TouchSelect@DirectUI@@QEAAJH@Z	3494	0x14001fbfc
?SetItemState@CCTreeView@DirectUI@@QEAAXPEAU_TREEITEM@@I@Z	3495	0x14002e608
?SetKeyFocus@Element@DirectUI@@UEAAXXZ	3496	0x140024c64
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ	3497	0x14001e4e0
?SetKeyFocus@TouchEditBase@DirectUI@@UEAAXXZ	3498	0x140022508
?SetKeyFocus@XBaby@DirectUI@@UEAAXXZ	3499	0x14000147c
?SetKeyFocus@XElement@DirectUI@@UEAAXXZ	3500	0x140025848
?SetKeyboardNavigationCapture@TouchEditBase@DirectUI@@QEAAJW4TouchEditKeyboardNavigationCapture@2@@Z	3501	0x140001e9c
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z	3502	0x140036be4
?SetLayoutCompletionNotify@Element@DirectUI@@QEAAX_N@Z	3503	0x140023bdc
?SetLayoutPointerToNull@Value@DirectUI@@QEAAXXZ	3504	0x140014738
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z	3505	0x14003a754
?SetLightDismissIHM@TouchHWNDElement@DirectUI@@QEAAJ_N@Z	3506	0x14002d070
?SetLine@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3507	0x1400079c4
?SetLine@ScrollBar@DirectUI@@UEAAJH@Z	3508	0x140040444
?SetLineSize@CCTrackBar@DirectUI@@QEAAJH@Z	3509	0x14001e8b0
?SetLineSpacing@RichText@DirectUI@@QEAAJH@Z	3510	0x14001ce4c
?SetLinkIndicatorsToContent@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3511	0x14000bf88
?SetLocale@RichText@DirectUI@@QEAAJPEBG@Z	3512	0x14002f5ec
?SetManipulationHorizontalAlignment@TouchScrollViewer@DirectUI@@QEAAJH@Z	3513	0x140023a98
?SetManipulationVerticalAlignment@TouchScrollViewer@DirectUI@@QEAAJH@Z	3514	0x14001ec60
?SetMapRunsToClusters@RichText@DirectUI@@QEAAJ_N@Z	3515	0x140010648
?SetMargin@Element@DirectUI@@QEAAJHHHH@Z	3516	0x140012d04
?SetMaxLength@Edit@DirectUI@@QEAAJH@Z	3517	0x14002ff44
?SetMaxLength@TouchEditBase@DirectUI@@QEAAJH@Z	3518	0x140014a2c
?SetMaxLineCount@RichText@DirectUI@@QEAAXI@Z	3519	0x14001a888
?SetMaximum@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3520	0x14002de38
?SetMaximum@ModernProgressBar@DirectUI@@QEAAJH@Z	3521	0x14000be54
?SetMaximum@Progress@DirectUI@@QEAAJH@Z	3522	0x1400125dc
?SetMaximum@ScrollBar@DirectUI@@UEAAJH@Z	3523	0x140018e6c
?SetMetering@TouchSlider@DirectUI@@QEAAJH@Z	3524	0x14003a814
?SetMinSize@Element@DirectUI@@QEAAJHH@Z	3525	0x140018f68
?SetMinimum@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3526	0x1400377c0
?SetMinimum@ModernProgressBar@DirectUI@@QEAAJH@Z	3527	0x140026240
?SetMinimum@Progress@DirectUI@@QEAAJH@Z	3528	0x140036604
?SetMinimum@ScrollBar@DirectUI@@UEAAJH@Z	3529	0x14000e944
?SetMoveCaretToEndOnSyncContent@TouchEditBase@DirectUI@@QEAAJ_N@Z	3530	0x14000b1b8
?SetMultiline@Edit@DirectUI@@QEAAJ_N@Z	3531	0x140029380
?SetMultiline@TouchEditBase@DirectUI@@QEAAJ_N@Z	3532	0x14001c4e8
?SetNoBrowseOnFirstAdd@Pages@DirectUI@@QEAAXXZ	3533	0x14000e73c
?SetNote@CCCommandLink@DirectUI@@QEAAJPEBG@Z	3534	0x14003d354
?SetNotifyHandler@CCBase@DirectUI@@QEAAXP6AHI_K_JPEA_JPEAX@Z3@Z	3535	0x1400063c0
?SetOffText@TouchSwitch@DirectUI@@QEAAJPEBG@Z	3536	0x140006dac
?SetOnOffText@TouchSwitch@DirectUI@@QEAAXPEBG0@Z	3537	0x14001c5f0
?SetOnText@TouchSwitch@DirectUI@@QEAAJPEBG@Z	3538	0x140014e24
?SetOptimizeMove@HWNDHost@DirectUI@@QEAAJ_N@Z	3539	0x140035610
?SetOrder@ScrollBar@DirectUI@@QEAAJH@Z	3540	0x14002d400
?SetOverhang@Element@DirectUI@@QEAAJ_N@Z	3541	0x140019100
?SetOverhangOffset@RichText@DirectUI@@QEAAJH@Z	3542	0x140032778
?SetOverrideButtonBackground@CCPushButton@DirectUI@@QEAAJ_N@Z	3543	0x140015220
?SetOverrideScaleFactor@DUIXmlParser@DirectUI@@QEAAXM@Z	3544	0x140010e78
?SetOverrideScaleFactor@Element@DirectUI@@QEAAXM@Z	3545	0x140011910
?SetPVLAnimationState@Element@DirectUI@@QEAAXH@Z	3546	0x140015368
?SetPadding@Element@DirectUI@@QEAAJHHHH@Z	3547	0x14000b148
?SetPage@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3548	0x14003d8f4
?SetPage@ScrollBar@DirectUI@@UEAAJH@Z	3549	0x140015888
?SetParameter@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAX@Z	3550	0x140028000
?SetParentSizeControl@HWNDElement@DirectUI@@QEAAX_N@Z	3551	0x14001888c
?SetParseErrorCallback@DUIXmlParser@DirectUI@@QEAAXP6AXPEBG0HPEAX@Z1@Z	3552	0x14001fe18
?SetParseState@DUIXmlParser@DirectUI@@AEAAXW4_DUI_PARSE_STATE@2@@Z	3553	0x14003614c
?SetParser@Macro@DirectUI@@QEAAXPEAVDUIXmlParser@2@@Z	3554	0x14000d918
?SetPasswordCharacter@Edit@DirectUI@@QEAAJH@Z	3555	0x14001c5d4
?SetPasswordCharacter@TouchEditBase@DirectUI@@QEAAJH@Z	3556	0x140025818
?SetPasswordRevealMode@TouchEdit2@DirectUI@@QEAAJW4TouchEditPasswordRevealMode@2@@Z	3557	0x1400038a0
?SetPath@Movie@DirectUI@@QEAAJPEBG@Z	3558	0x1400280c8
?SetPercent@ScrollProxy@DirectUI@@AEAAJPEAVBaseScrollBar@2@N@Z	3559	0x140032f70
?SetPinned@BaseScrollBar@DirectUI@@QEAAX_N@Z	3560	0x140032094
?SetPinning@BaseScrollViewer@DirectUI@@QEAAJH@Z	3561	0x140011a7c
?SetPixelOffsetMode@Movie@DirectUI@@QEAAJH@Z	3562	0x1400105f4
?SetPlay@AnimationStrip@DirectUI@@QEAAJ_N@Z	3563	0x14002b4c8
?SetPlayAllFramesMode@Movie@DirectUI@@QEAAJ_N@Z	3564	0x1400228c4
?SetPopupBounds@TouchSelect@DirectUI@@QEAAJHHHH@Z	3565	0x140002414
?SetPosition@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3566	0x140040734
?SetPosition@ModernProgressBar@DirectUI@@QEAAJH@Z	3567	0x1400281d8
?SetPosition@Progress@DirectUI@@QEAAJH@Z	3568	0x14003dd60
?SetPosition@ScrollBar@DirectUI@@UEAAJH@Z	3569	0x140020ee0
?SetPreprocessedXML@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z	3570	0x140037808
?SetPreserveAlphaChannel@Element@DirectUI@@QEAAX_N@Z	3571	0x140028b94
?SetPressed@Button@DirectUI@@QEAAJ_N@Z	3572	0x140007098
?SetPressed@TouchButton@DirectUI@@QEAAJ_N@Z	3573	0x140022f74
?SetPreventFormatChangeUpdatingModifiedState@TouchEditBase@DirectUI@@QEAAJ_N@Z	3574	0x14000ba2c
?SetPromptText@TouchEdit2@DirectUI@@QEAAJPEBG@Z	3575	0x140038f68
?SetPromptWithCaret@TouchEdit2@DirectUI@@QEAAJ_N@Z	3576	0x14003ac58
?SetProperty@Bind@DirectUI@@QEAAJPEBG@Z	3577	0x14002d9b8
?SetProportional@ScrollBar@DirectUI@@QEAAJ_N@Z	3578	0x14000c85c
?SetProvider@XElement@DirectUI@@QEAAJPEAUIUnknown@@@Z	3579	0x14003de00
?SetRangeMax@CCTrackBar@DirectUI@@QEAAJH@Z	3580	0x140017b74
?SetRangeMax@TouchSlider@DirectUI@@QEAAXH@Z	3581	0x140009658
?SetRangeMin@CCTrackBar@DirectUI@@QEAAJH@Z	3582	0x14003c9e8
?SetRangeMin@TouchSlider@DirectUI@@QEAAXH@Z	3583	0x14002cdf8
?SetRangeMinAndRangeMax@TouchSlider@DirectUI@@QEAAXHH@Z	3584	0x14003ae14
?SetReadOnly@TouchEditBase@DirectUI@@QEAAJ_N@Z	3585	0x14001351c
?SetReferencePoint@RefPointElement@DirectUI@@QEAAJHH@Z	3586	0x140029b30
?SetRegisteredDefaultButton@DialogElement@DirectUI@@QEAAJPEAVElement@2@@Z	3587	0x14003a0e0
?SetRegisteredDefaultButton@XBaby@DirectUI@@UEAAJPEAVElement@2@@Z	3588	0x14003ca38
?SetRegisteredDefaultButton@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z	3589	0x140025f80
?SetRegisteredDefaultButtonSelectedState@DialogElementCore@DirectUI@@IEAAX_N@Z	3590	0x140036f60
?SetRelPixHeight@Element@DirectUI@@QEAAJH@Z	3591	0x14000848c
?SetRelPixMargin@Element@DirectUI@@QEAAJHHHH@Z	3592	0x14002ded0
?SetRelPixPadding@Element@DirectUI@@QEAAJHHHH@Z	3593	0x14003d618
?SetRelPixWidth@Element@DirectUI@@QEAAJH@Z	3594	0x14000746c
?SetReorderable@ItemList@DirectUI@@QEAAJ_N@Z	3595	0x14002c570
?SetRepeat@Movie@DirectUI@@QEAAJ_N@Z	3596	0x14003cba8
?SetRespectLanguageDirection@TouchSlider@DirectUI@@QEAAX_N@Z	3597	0x140019444
?SetRespondToMouseScroll@TouchSlider@DirectUI@@QEAAX_N@Z	3598	0x14003e790
?SetRootWindowForTheming@DUIXmlParser@DirectUI@@QEAAXPEAUHWND__@@@Z	3599	0x14003d81c
?SetScaleFactor@DUIXmlParser@DirectUI@@QEAAXM@Z	3600	0x14001de3c
?SetScreenCenter@HWNDElement@DirectUI@@QEAAX_N@Z	3601	0x140033190
?SetScrollControlHost@TouchScrollViewer@DirectUI@@QEAAJPEAVElement@2@@Z	3602	0x14004136c
?SetScrollPadding@TouchScrollViewer@DirectUI@@QEAAJHHHH@Z	3603	0x140009b34
?SetScrollPercent@ScrollProvider@DirectUI@@UEAAJNN@Z	3604	0x14003f1f8
?SetScrollPercent@ScrollProxy@DirectUI@@AEAAJNN@Z	3605	0x14002bd98
?SetSelected@Element@DirectUI@@QEAAJ_N@Z	3606	0x140028e68
?SetSelection@Combobox@DirectUI@@QEAAJH@Z	3607	0x140020bc0
?SetSelection@Selector@DirectUI@@UEAAJPEAVElement@2@@Z	3608	0x140037098
?SetSelection@SelectorNoDefault@DirectUI@@UEAAJPEAVElement@2@@Z	3609	0x14003b558
?SetSelection@TouchEdit2@DirectUI@@QEAAJJJ@Z	3610	0x140023b88
?SetSelection@TouchSelect@DirectUI@@QEAAJPEAVElement@2@@Z	3611	0x140010bf0
?SetSelectionBackgroundColor@TouchEditBase@DirectUI@@QEAAJPEAVValue@2@@Z	3612	0x14001dcb0
?SetSelectionForegroundColor@TouchEditBase@DirectUI@@QEAAJPEAVValue@2@@Z	3613	0x1400113a0
?SetSelectionIndex@TouchSelect@DirectUI@@QEAAJH@Z	3614	0x14001c044
?SetShadowIntensity@Element@DirectUI@@QEAAJH@Z	3615	0x140034668
?SetSheet@Element@DirectUI@@QEAAJPEAVStyleSheet@2@@Z	3616	0x140025f28
?SetShortcut@Element@DirectUI@@QEAAJH@Z	3617	0x14003a6fc
?SetShowClearButtonMinWidth@TouchEdit2@DirectUI@@QEAAJH@Z	3618	0x140037798
?SetShowKeyFocus@TouchButton@DirectUI@@QEAAJ_N@Z	3619	0x14003bae8
?SetShowTick@TouchSlider@DirectUI@@QEAAJ_N@Z	3620	0x1400341b4
?SetSmoothFillAnimation@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3621	0x140005d90
?SetSmoothingMode@Movie@DirectUI@@QEAAJH@Z	3622	0x14002487c
?SetSnapIntervalX@TouchScrollViewer@DirectUI@@QEAAJM@Z	3623	0x140029c50
?SetSnapIntervalY@TouchScrollViewer@DirectUI@@QEAAJM@Z	3624	0x140039324
?SetSnapMode@TouchScrollViewer@DirectUI@@QEAAJH@Z	3625	0x14003f1b4
?SetSnapOffsetX@TouchScrollViewer@DirectUI@@QEAAJM@Z	3626	0x140022c64
?SetSnapOffsetY@TouchScrollViewer@DirectUI@@QEAAJM@Z	3627	0x140002414
?SetSnapPointCollectionX@TouchScrollViewer@DirectUI@@QEAAJPEAV?$DynamicArray@N$0A@@2@@Z	3628	0x14002d42c
?SetSnapPointCollectionX@TouchScrollViewer@DirectUI@@QEAAJPEBNH@Z	3629	0x140041204
?SetSnapPointCollectionY@TouchScrollViewer@DirectUI@@QEAAJPEAV?$DynamicArray@N$0A@@2@@Z	3630	0x14001770c
?SetSnapPointCollectionY@TouchScrollViewer@DirectUI@@QEAAJPEBNH@Z	3631	0x140034b48
?SetState@ModernProgressBar@DirectUI@@QEAAJH@Z	3632	0x140016f70
?SetStdCursor@Element@DirectUI@@QEAAJH@Z	3633	0x140020038
?SetStepCount@TouchSlider@DirectUI@@QEAAXH@Z	3634	0x140018600
?SetStopThumbBehavior@RepeatButton@DirectUI@@QEAAXXZ	3635	0x14000b838
?SetString@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@P8Element@2@EAAPEBGPEAPEAVValue@2@@Z@Z	3636	0x140013a48
?SetStyle@CCTreeView@DirectUI@@QEAAKK@Z	3637	0x140021e34
?SetSubContent@TouchCommandButton@DirectUI@@QEAAJPEBG@Z	3638	0x140030044
?SetSuppressClearButton@TouchEdit2@DirectUI@@QEAAJ_N@Z	3639	0x14003ef10
?SetSuppressSetContact@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3640	0x1400306ac
?SetSyncContentWhileIMEComposing@TouchEditBase@DirectUI@@QEAAJ_N@Z	3641	0x14003aa5c
?SetTargetPage@Navigator@DirectUI@@QEAAJPEBG@Z	3642	0x1400218f8
?SetTextContentOverride@TouchSelectItem@DirectUI@@QEAAJPEBG@Z	3643	0x14003d354
?SetTextGlowSize@Element@DirectUI@@QEAAJH@Z	3644	0x140008a6c
?SetTextMode@TouchEditBase@DirectUI@@QEAAJW4TouchEditTextMode@2@@Z	3645	0x1400349f0
?SetThemeChanged@HWNDHost@DirectUI@@IEAAJH@Z	3646	0x14001f2d8
?SetThemedBorder@Edit@DirectUI@@QEAAJ_N@Z	3647	0x140022220
?SetThumbPosition@CCTrackBar@DirectUI@@QEAAJH@Z	3648	0x140033590
?SetThumbValue@TouchSlider@DirectUI@@QEAAXH_N0@Z	3649	0x140032a74
?SetThumbValue@TouchSlider@DirectUI@@QEAAXH_N@Z	3650	0x140016034
?SetTickCount@TouchSlider@DirectUI@@QEAAJH@Z	3651	0x14003533c
?SetTitleText@TouchSwitch@DirectUI@@QEAAJPEBG@Z	3652	0x14002fc48
?SetToHost@XBaby@DirectUI@@UEAAJPEAVElement@2@@Z	3653	0x14001db74
?SetToggleOnClick@TouchCheckBox@DirectUI@@QEAAJ_N@Z	3654	0x140014160
?SetToggleSwitchText@TouchSwitch@DirectUI@@QEAAXPEBG@Z	3655	0x14003a508
?SetToggleValue@TouchSwitch@DirectUI@@QEAAXH@Z	3656	0x1400347b8
?SetToggleValue@TouchSwitch@DirectUI@@QEAAXH_N0@Z	3657	0x1400097f0
?SetToggleValue@TouchSwitch@DirectUI@@QEAAXH_N@Z	3658	0x14004076c
?SetTooltip@Element@DirectUI@@QEAAJ_N@Z	3659	0x140027dd8
?SetTooltipMaxWidth@Element@DirectUI@@QEAAJH@Z	3660	0x14002daf0
?SetTooltipMaximumLineCount@TouchHWNDElement@DirectUI@@QEAAJH@Z	3661	0x14002fe94
?SetTooltipText@TouchSlider@DirectUI@@QEAAXPEBG@Z	3662	0x14001b718
?SetTracking@CCBaseScrollBar@DirectUI@@QEAAJ_N@Z	3663	0x140024070
?SetTransparent@HWNDHost@DirectUI@@QEAAJ_N@Z	3664	0x140029b20
?SetTreatRightMouseButtonAsLeft@TouchButton@DirectUI@@QEAAJ_N@Z	3665	0x14001dbfc
?SetTypography@RichText@DirectUI@@QEAAJPEBG@Z	3666	0x140010dc0
?SetTypographyRuns@RichText@DirectUI@@QEAAJPEBG@Z	3667	0x14001bc5c
?SetUnavailableIcon@DUIXmlParser@DirectUI@@QEAAXPEAUHICON__@@@Z	3668	0x14001b9d0
?SetUnknownAttrCallback@DUIXmlParser@DirectUI@@QEAAXP6A_NPEBGPEAX@Z1@Z	3669	0x140014d0c
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z	3670	0x14002e4cc
?SetValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@HPEAVValue@2@@Z	3671	0x140018edc
?SetValue@RangeValueProvider@DirectUI@@UEAAJN@Z	3672	0x1400343f8
?SetValue@ValueProvider@DirectUI@@UEAAJPEBG@Z	3673	0x140021b58
?SetValue@ValueProxy@DirectUI@@AEAAJPEBG@Z	3674	0x14001a728
?SetVertical@ScrollBar@DirectUI@@QEAAJ_N@Z	3675	0x140011d50
?SetVerticalScript@RichText@DirectUI@@QEAAJ_N@Z	3676	0x140027310
?SetVirtualizeElements@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3677	0x140010fe0
?SetVisible@Element@DirectUI@@QEAAJ_N@Z	3678	0x14000580c
?SetVisited@TouchHyperLink@DirectUI@@QEAAJ_N@Z	3679	0x140017a5c
?SetWantTabs@Edit@DirectUI@@QEAAJ_N@Z	3680	0x140039f88
?SetWidth@Element@DirectUI@@QEAAJH@Z	3681	0x140021f0c
?SetWinStyle@CCBase@DirectUI@@QEAAJH@Z	3682	0x14000d71c
?SetWindowAccessGradientColor@TouchHWNDElement@DirectUI@@QEAAJPEAVValue@2@@Z	3683	0x14001d07c
?SetWindowActive@Element@DirectUI@@QEAAJ_N@Z	3684	0x14002f2bc
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z	3685	0x140011f34
?SetWrapKeyboardNavigate@HWNDElement@DirectUI@@QEAAJ_N@Z	3686	0x14003f0c0
?SetX@Element@DirectUI@@QEAAJH@Z	3687	0x140023b80
?SetXBarVisibility@BaseScrollViewer@DirectUI@@QEAAJH@Z	3688	0x14002b588
?SetXML@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z	3689	0x14000f8c8
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z	3690	0x140014700
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEBGPEAUHINSTANCE__@@1@Z	3691	0x140034a80
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJPEBG0PEAUHINSTANCE__@@1@Z	3692	0x14001a9ec
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z	3693	0x1400025d8
?SetXMLFromResourceWithTheme@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@00@Z	3694	0x1400145a8
?SetXOffset@BaseScrollViewer@DirectUI@@QEAAJH@Z	3695	0x140002b44
?SetXOffset@Viewer@DirectUI@@QEAAJH@Z	3696	0x140032b4c
?SetXScrollable@BaseScrollViewer@DirectUI@@QEAAJ_N@Z	3697	0x14003fc8c
?SetXScrollable@Viewer@DirectUI@@QEAAJ_N@Z	3698	0x14000637c
?SetY@Element@DirectUI@@QEAAJH@Z	3699	0x140038858
?SetYBarVisibility@BaseScrollViewer@DirectUI@@QEAAJH@Z	3700	0x14002e1dc
?SetYOffset@BaseScrollViewer@DirectUI@@QEAAJH@Z	3701	0x14000ab48
?SetYOffset@Viewer@DirectUI@@QEAAJH@Z	3702	0x140024158
?SetYScrollable@BaseScrollViewer@DirectUI@@QEAAJ_N@Z	3703	0x14003fe7c
?SetYScrollable@Viewer@DirectUI@@QEAAJ_N@Z	3704	0x140002820
?SetZoomMaximum@TouchScrollViewer@DirectUI@@QEAAJM@Z	3705	0x1400380e4
?SetZoomMinimum@TouchScrollViewer@DirectUI@@QEAAJM@Z	3706	0x140005e84
?ShadowIntensityProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3707	0x14001d1b8
?SheetProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3708	0x140006fcc
?ShiftChild@Element@DirectUI@@QEAAJII@Z	3709	0x14000b1a4
?ShortcutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3710	0x140004824
?ShouldUseDesktopPerMonitorScaling@HWNDElement@DirectUI@@QEAA_NXZ	3711	0x14003ec2c
?ShouldUsePerMonitorScaling@TouchHWNDElement@DirectUI@@QEAA_NXZ	3712	0x14003a878
?ShowAccel@HWNDElement@DirectUI@@QEAA_NXZ	3713	0x14002c40c
?ShowClearButtonMinWidthProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3714	0x140040aac
?ShowContextMenu@ElementProvider@DirectUI@@UEAAJXZ	3715	0x14002fcfc
?ShowFocus@HWNDElement@DirectUI@@QEAA_NXZ	3716	0x1400192a8
?ShowKeyFocusProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3717	0x140040b90
?ShowRichTooltip@TouchHWNDElement@DirectUI@@QEAAJW4TOUCHTOOLTIP_INPUT@@W4TOUCHTOOLTIP_OPTION_FLAGS@@PEAVElement@2@@Z	3718	0x140030fc4
?ShowTickProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3719	0x140001c28
?ShowTooltipOnRightForLTRBuild@TouchSlider@DirectUI@@QEAAXXZ	3720	0x140008618
?ShowUIState@HWNDElement@DirectUI@@QEAAX_N0@Z	3721	0x14000b170
?ShowWindow@NativeHWNDHost@DirectUI@@QEAAXH@Z	3722	0x14001a2c4
?ShowWindow@XHost@DirectUI@@QEAAXH@Z	3723	0x14001329c
?SideGraphicProp@TextGraphic@DirectUI@@SAPEBUPropertyInfo@2@XZ	3724	0x14003ebb4
?SizeInLayoutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3725	0x140026554
?SizeZero@FlowLayout@DirectUI@@KA?AUtagSIZE@@XZ	3726	0x1400060ac
?SizeZero@VerticalFlowLayout@DirectUI@@KA?AUtagSIZE@@XZ	3727	0x140007b40
?Skip@DuiAccessible@DirectUI@@UEAAJK@Z	3728	0x140031a14
?Skip@HWNDHostAccessible@DirectUI@@UEAAJK@Z	3729	0x140016ce0
?SliderControlType@Schema@DirectUI@@2HA	3730	0x14002b540
?SliderUpdated@TouchSlider@DirectUI@@SA?AVUID@@XZ	3731	0x14002254c
?SmoothingModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3732	0x140007a58
?SnapIntervalXProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3733	0x140035364
?SnapIntervalYProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3734	0x140004538
?SnapModeProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3735	0x1400010e4
?SnapOffsetXProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3736	0x14001f7e8
?SnapOffsetYProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3737	0x14001ed5c
?SnapPointCollectionXProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3738	0x140041450
?SnapPointCollectionYProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3739	0x140029f8c
?SnapshotTransformElement@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3740	0x14001caf4
?SortChildren@Element@DirectUI@@QEAAJP6AHPEBX0@Z@Z	3741	0x140037e64
?SpinnerControlType@Schema@DirectUI@@2HA	3742	0x140011be4
?SplitButtonControlType@Schema@DirectUI@@2HA	3743	0x140031dc8
?Start@AnimationStrip@DirectUI@@AEAAJXZ	3744	0x14003e984
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z	3745	0x1400353f0
?StartNavigate@Browser@DirectUI@@SA?AVUID@@XZ	3746	0x14001a970
?StartRichTooltipTimer@TouchHWNDElement@DirectUI@@QEAAJW4TOUCHTOOLTIP_INPUT@@@Z	3747	0x140032ef8
?StateProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3748	0x14002257c
?StaticWndProc@HWNDElement@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z	3749	0x14002b428
?StaticXHostSubclassProc@TaskPage@DirectUI@@CA_JPEAUHWND__@@I_K_J@Z	3750	0x14002f524
?StaticXmlParserError@TaskPage@DirectUI@@CAXPEBG0HPEAX@Z	3751	0x140034444
?StatusBarControlType@Schema@DirectUI@@2HA	3752	0x140009ef0
?Stop@AnimationStrip@DirectUI@@AEAAXXZ	3753	0x14001ff64
?Stop@CCAVI@DirectUI@@QEAAXXZ	3754	0x140036aa0
?StopAnimation@Element@DirectUI@@QEAAXI@Z	3755	0x140028630
?StopUsingCache@RichText@DirectUI@@QEAAXXZ	3756	0x14000fd00
?StrDupW@Value@DirectUI@@CAJPEBGPEAPEAG@Z	3757	0x14003b67c
?StructureChangedEvent@Schema@DirectUI@@2HA	3758	0x14002e5b8
?SubContentProp@TouchCommandButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3759	0x140026a04
?SuppressClearButtonProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3760	0x1400185b4
?SupressRightButtonDrag@Thumb@DirectUI@@QEAAX_N@Z	3761	0x14001712c
?SyncBackground@HWNDHost@DirectUI@@IEAAXXZ	3762	0x140002abc
?SyncCallback@Proxy@DirectUI@@SAJPEAUHGADGET__@@PEAXPEAUEventMsg@@@Z	3763	0x1400383bc
?SyncColorsAndFonts@HWNDHost@DirectUI@@AEAAXXZ	3764	0x140008500
?SyncContentWhileIMEComposingProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3765	0x140011280
?SyncDestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ	3766	0x14003cf84
?SyncDirection@HWNDHost@DirectUI@@IEAAXXZ	3767	0x140021c88
?SyncElementAlphaFromForegroundAlpha@DirectUI@@YAXPEAVElement@1@@Z	3768	0x1400303a0
?SyncFont@HWNDHost@DirectUI@@IEAAXXZ	3769	0x140015dd8
?SyncForeground@HWNDHost@DirectUI@@IEAAXXZ	3770	0x14001a564
?SyncNoteAndGlyph@CCCommandLink@DirectUI@@IEAAXPEAUHWND__@@@Z	3771	0x1400383ac
?SyncParent@HWNDHost@DirectUI@@IEAAXXZ	3772	0x140026254
?SyncRect@HWNDHost@DirectUI@@IEAAXI_N@Z	3773	0x140029a98
?SyncScrollBar@CCBaseScrollBar@DirectUI@@QEAAXXZ	3774	0x1400296d4
?SyncStyle@HWNDHost@DirectUI@@IEAAXXZ	3775	0x140040404
?SyncText@HWNDHost@DirectUI@@IEAAXXZ	3776	0x140019be0
?SyncVisible@HWNDHost@DirectUI@@IEAAXXZ	3777	0x140027ac4
?SystemAlertEvent@Schema@DirectUI@@2HA	3778	0x14001bc64
?TabControlType@Schema@DirectUI@@2HA	3779	0x140005a7c
?TabItemControlType@Schema@DirectUI@@2HA	3780	0x140024f50
?TableControlType@Schema@DirectUI@@2HA	3781	0x140028c2c
?TableItemPattern@Schema@DirectUI@@2HA	3782	0x14001e3d4
?TableItem_ColumnHeaderItems_Property@Schema@DirectUI@@2HA	3783	0x140014868
?TableItem_RowHeaderItems_Property@Schema@DirectUI@@2HA	3784	0x140017744
?TablePattern@Schema@DirectUI@@2HA	3785	0x140022400
?Table_ColumnHeaders_Property@Schema@DirectUI@@2HA	3786	0x140008214
?Table_RowHeaders_Property@Schema@DirectUI@@2HA	3787	0x140017970
?Table_RowOrColumnMajor_Property@Schema@DirectUI@@2HA	3788	0x14000b660
?TargetPageProp@Navigator@DirectUI@@SAPEBUPropertyInfo@2@XZ	3789	0x14000b7c8
?TelemetrySetDescription@TouchScrollViewer@DirectUI@@QEAAJPEBG@Z	3790	0x1400174c0
?TestDeferObject@Element@DirectUI@@QEAAPEAVDeferCycle@2@XZ	3791	0x14002b870
?TextContentOverrideProp@TouchSelectItem@DirectUI@@SAPEBUPropertyInfo@2@XZ	3792	0x14002f350
?TextControlType@Schema@DirectUI@@2HA	3793	0x140011fc0
?TextGlowSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3794	0x14003ba64
?TextModeProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3795	0x14000b99c
?TextPattern@Schema@DirectUI@@2HA	3796	0x14001c968
?TextTextSelectionChangedEvent@Schema@DirectUI@@2HA	3797	0x140001efc
?TextTooltipShowing@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3798	0x14001e1c8
?ThemeChange@HWNDElement@DirectUI@@SA?AVUID@@XZ	3799	0x14001dee8
?ThemeChangedProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	3800	0x1400162a4
?ThemedBorderProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	3801	0x14001d570
?ThumbControlType@Schema@DirectUI@@2HA	3802	0x14003f3d0
?ThumbPositionProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3803	0x1400388bc
?ThumbPositionProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3804	0x1400391e0
?TickCountProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3805	0x14003daec
?TitleBarControlType@Schema@DirectUI@@2HA	3806	0x14001674c
?TitleTextProp@TouchSwitch@DirectUI@@SAPEBUPropertyInfo@2@XZ	3807	0x140022e38
?ToString@Value@DirectUI@@QEBAPEAGPEAGI@Z	3808	0x1400068b4
?Toggle@AutoButton@DirectUI@@SA?AVUID@@XZ	3809	0x14001564c
?Toggle@SemanticZoomToggle@DirectUI@@SA?AVUID@@XZ	3810	0x14003084c
?Toggle@ToggleProvider@DirectUI@@UEAAJXZ	3811	0x140028340
?ToggleOnClickProp@TouchCheckBox@DirectUI@@SAPEBUPropertyInfo@2@XZ	3812	0x14001c6ec
?TogglePattern@Schema@DirectUI@@2HA	3813	0x140019104
?ToggleUIState@HWNDElement@DirectUI@@QEAAX_N0@Z	3814	0x140017ebc
?Toggle_ToggleState_Property@Schema@DirectUI@@2HA	3815	0x14000cc40
?ToolBarControlType@Schema@DirectUI@@2HA	3816	0x14000698c
?ToolTipClosedEvent@Schema@DirectUI@@2HA	3817	0x14000b1e4
?ToolTipControlType@Schema@DirectUI@@2HA	3818	0x14003e208
?ToolTipOpenedEvent@Schema@DirectUI@@2HA	3819	0x140040728
?TooltipMaxWidthProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3820	0x140028854
?TooltipMaximumLineCountProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3821	0x140035de8
?TooltipProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3822	0x140013750
?TooltipTimerStarting@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3823	0x1400388dc
?TossElement@ElementProvider@DirectUI@@UEAAXXZ	3824	0x140002a70
?TossPatternProvider@ElementProvider@DirectUI@@QEAAXW4Pattern@Schema@2@@Z	3825	0x140006ef0
?TrackScore@NavScoring@DirectUI@@QEAAHPEAVElement@2@0@Z	3826	0x1400105e4
?TrackingProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3827	0x14000583c
?TransformPattern@Schema@DirectUI@@2HA	3828	0x1400362e4
?TranslateThumbPositionToThumbValue@TouchSlider@DirectUI@@QEAAHH@Z	3829	0x140003920
?TransparentProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	3830	0x1400214d4
?TreatRightMouseButtonAsLeftProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3831	0x14000ec88
?TreeControlType@Schema@DirectUI@@2HA	3832	0x140016d28
?TreeItemControlType@Schema@DirectUI@@2HA	3833	0x14000bc7c
?TriggeredAnimationComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ	3834	0x140016cf0
?Try@NavScoring@DirectUI@@QEAAHPEAVElement@2@HPEBUNavReference@2@K@Z	3835	0x140013a2c
?TryLinePattern@Element@DirectUI@@AEAA_NPEAUtagPOINT@@AEBUtagRECT@@@Z	3836	0x140038d34
?TryPattern@Element@DirectUI@@AEAA_NNNPEAUtagPOINT@@AEBUtagRECT@@@Z	3837	0x140009918
?TrySparsePattern@Element@DirectUI@@AEAA_NPEAUtagPOINT@@AEBUtagRECT@@@Z	3838	0x1400237a4
?TypographyProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	3839	0x14003110c
?TypographyRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	3840	0x140023760
?UiaEvents@Element@DirectUI@@QEAA_NXZ	3841	0x140020da0
?UiaHostProviderFromHwnd@Schema@DirectUI@@2P6AJPEAUHWND__@@PEAPEAUIRawElementProviderSimple@@@ZEA	3842	0x140001874
?UiaLookupId@Schema@DirectUI@@2P6AHW4AutomationIdentifierType@@PEBU_GUID@@@ZEA	3843	0x14002a660
?UiaRaiseAutomationEvent@Schema@DirectUI@@2P6AJPEAUIRawElementProviderSimple@@H@ZEA	3844	0x14002b33c
?UiaRaiseAutomationPropertyChangedEvent@Schema@DirectUI@@2P6AJPEAUIRawElementProviderSimple@@HUtagVARIANT@@1@ZEA	3845	0x14003e864
?UiaRaiseStructureChangedEvent@Schema@DirectUI@@2P6AJPEAUIRawElementProviderSimple@@W4StructureChangeType@@PEAHH@ZEA	3846	0x140028fb8
?UiaReturnRawElementProvider@Schema@DirectUI@@2P6A_JPEAUHWND__@@_K_JPEAUIRawElementProviderSimple@@@ZEA	3847	0x140029684
?UnRegister@Element@DirectUI@@SAJPEAPEAUIClassInfo@2@@Z	3848	0x140011628
?UnhandledSyschar@XElement@DirectUI@@SA?AVUID@@XZ	3849	0x140032864
?Uninit@CallstackTracker@DirectUI@@SAXXZ	3850	0x140014cb4
?Uninit@InvokeHelper@DirectUI@@QEAAXXZ	3851	0x140028964
?UninitProcess@FontCache@DirectUI@@SAXXZ	3852	0x14000a534
?UninitThread@FontCache@DirectUI@@SAXXZ	3853	0x140036018
?UnloadCommonControlExports@AnimationStrip@DirectUI@@AEAAXXZ	3854	0x14001ed10
?Unlock@CritSecLock@DirectUI@@QEAAXXZ	3855	0x140011ce4
?UnregisterForAnimationStatusChanges@TouchHWNDElement@DirectUI@@QEAAXXZ	3856	0x14002fd00
?UnregisterForIHMChanges@TouchHWNDElement@DirectUI@@QEAAXXZ	3857	0x1400095d4
?UnregisterForMonitorPowerChanges@TouchHWNDElement@DirectUI@@QEAAJXZ	3858	0x140032968
?UnvirtualizePosition@HWNDHost@DirectUI@@AEAAXXZ	3859	0x140018220
?UpdateChildFocus@DialogElementCore@DirectUI@@QEAAXPEAVElement@2@0@Z	3860	0x1400150ec
?UpdateChildren@Expando@DirectUI@@IEAAXPEAVValue@2@@Z	3861	0x140031f34
?UpdateContentSize@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3862	0x140025bdc
?UpdateDesiredSize@BorderLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3863	0x140019814
?UpdateDesiredSize@FillLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3864	0x14003c510
?UpdateDesiredSize@FlowLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3865	0x140040cd4
?UpdateDesiredSize@GridLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3866	0x140025fd0
?UpdateDesiredSize@Layout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3867	0x1400301f0
?UpdateDesiredSize@NineGridLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3868	0x140017974
?UpdateDesiredSize@RowLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3869	0x140038e74
?UpdateDesiredSize@TableLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3870	0x14001be34
?UpdateDesiredSize@VerticalFlowLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3871	0x14002afa8
?UpdateElement@TouchSelect@DirectUI@@QEAAJHPEAVElement@2@PEBG@Z	3872	0x14001539c
?UpdateLayout@Element@DirectUI@@QEAAXXZ	3873	0x1400221d4
?UpdateLayoutRect@Layout@DirectUI@@SAXPEAVElement@2@HH0HHHH@Z	3874	0x14002cf4c
?UpdateSheets@DUIXmlParser@DirectUI@@QEAAJPEAVElement@2@@Z	3875	0x140018024
?UpdateString@TouchSelect@DirectUI@@QEAAJHPEBG@Z	3876	0x140015f10
?UpdateStyleSheets@HWNDElement@DirectUI@@IEAAXXZ	3877	0x140025470
?UpdateToggleState@SemanticZoomToggle@DirectUI@@QEAAXW4SemanticZoomToggleState@@_N@Z	3878	0x140008228
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z	3879	0x14003fcd8
?UpdateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3880	0x140016b2c
?UpdateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3881	0x140029c9c
?UpdateView@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3882	0x140035368
?UseFixedTooltipOffset@TouchSlider@DirectUI@@QEAAXXZ	3883	0x140005d90
?UsePerMonitorScaling@TouchHWNDElement@DirectUI@@QEAAXPEAUHMONITOR__@@@Z	3884	0x1400367f4
?UserTextChanged@TouchEditBase@DirectUI@@SA?AVUID@@XZ	3885	0x140002594
?UserTextUpdateNoChange@TouchEditBase@DirectUI@@SA?AVUID@@XZ	3886	0x1400364c0
?UsesDesktopPerMonitorScalingProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3887	0x14001e75c
?ValuePattern@Schema@DirectUI@@2HA	3888	0x1400137b0
?Value_IsReadOnly_Property@Schema@DirectUI@@2HA	3889	0x14003d238
?Value_Value_Property@Schema@DirectUI@@2HA	3890	0x14001b29c
?VerifyParentage@HWNDHost@DirectUI@@IEAAHXZ	3891	0x14003bc6c
?VerticalProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3892	0x140018d54
?VerticalScriptProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	3893	0x140029fe0
?VirtualizedItemPattern@Schema@DirectUI@@2HA	3894	0x14003e9b4
?VisibleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3895	0x140016eac
?VisitedProp@TouchHyperLink@DirectUI@@SAPEBUPropertyInfo@2@XZ	3896	0x1400350d0
?VisualStateProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3897	0x140028074
?WantEvent@EventManager@DirectUI@@CA_NW4Event@Schema@2@H@Z	3898	0x14001bb90
?WantEvent@EventManager@DirectUI@@SA_NW4Event@Schema@2@@Z	3899	0x140027848
?WantPropertyEvent@EventManager@DirectUI@@SA_NH@Z	3900	0x14000a05c
?WantTabsProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	3901	0x1400217b8
?WidthProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3902	0x140031430
?WinStyleProp@CCBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3903	0x14000ae2c
?WindowAccessGradientColorProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3904	0x1400385d8
?WindowActiveProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3905	0x140022978
?WindowControlType@Schema@DirectUI@@2HA	3906	0x140035478
?WindowDpiChanged@HWNDElement@DirectUI@@SA?AVUID@@XZ	3907	0x140041294
?WindowPattern@Schema@DirectUI@@2HA	3908	0x14001531c
?WindowWindowClosedEvent@Schema@DirectUI@@2HA	3909	0x1400327a0
?WindowWindowOpenedEvent@Schema@DirectUI@@2HA	3910	0x14001099c
?WndProc@HWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z	3911	0x14002b29c
?WndProc@NativeHWNDHost@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z	3912	0x14001f474
?WndProc@TouchHWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z	3913	0x140012184
?WndProc@XHost@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z	3914	0x140009bc0
?WrapKeyboardNavigateProp@HWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3915	0x1400188a8
?XBarVisibilityProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3916	0x14002ccf8
?XOffsetProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3917	0x14003605c
?XOffsetProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3918	0x140011410
?XProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3919	0x140018cc8
?XScrollableProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3920	0x14001c200
?XScrollableProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3921	0x14001a67c
?YBarVisibilityProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3922	0x1400389ac
?YOffsetProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3923	0x14001f9a0
?YOffsetProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3924	0x14001afd4
?YProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3925	0x14000eda8
?YScrollableProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3926	0x1400325e4
?YScrollableProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3927	0x140037720
?ZoomToRect@TouchScrollViewer@DirectUI@@QEAAJPEBUtagRECT@@_N@Z	3928	0x14002cb94
?ZoomToRectManualVisualSwap@TouchScrollViewer@DirectUI@@QEAAJMMMMPEBHMMM_N@Z	3929	0x140009f48
?_AddDependency@Element@DirectUI@@SAXPEAV12@PEBUPropertyInfo@2@HPEAUDepRecs@2@PEAVDeferCycle@2@PEAJ@Z	3930	0x140021f34
?_BitAccurateFillRect@Macro@DirectUI@@KAXPEAUHDC__@@HHHHEEEEK@Z	3931	0x14001a300
?_BroadcastEventWorker@Element@DirectUI@@AEAAXPEAUEvent@2@@Z	3932	0x140006018
?_BuildChildren@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAVElement@2@@Z	3933	0x14002fd04
?_BuildElement@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAVElement@2@PEAPEAV42@@Z	3934	0x14001b35c
?_BuildFromBinary@DUIXmlParser@DirectUI@@IEAAJPEAVElement@2@0PEBGPEAKPEAPEAV32@@Z	3935	0x14002c59c
?_BuildStyles@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	3936	0x14002b118
?_CachedValueIsEqual@Element@DirectUI@@AEAAHPEBUPropertyInfo@2@PEAV12@@Z	3937	0x14000ef74
?_CalcTabOrder@ShellBorderLayout@DirectUI@@AEAAJPEAVElement@2@@Z	3938	0x14003ef70
?_ClearNeedsLayout@Element@DirectUI@@QEAAXXZ	3939	0x14003e8bc
?_ClearTooltipState@TouchHWNDElement@DirectUI@@IEAAXXZ	3940	0x14003ce14
?_CreateAndSetLayout@DirectUI@@YAJPEAVElement@1@P6AJHPEAHPEAPEAVValue@1@@ZH1@Z	3941	0x140021a04
?_CreateValue@DUIXmlParser@DirectUI@@IEAAJPEBGPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	3942	0x140032d30
?_CtrlWndProc@HWNDHost@DirectUI@@CAHPEAXPEAUHWND__@@I_K_JPEA_J@Z	3943	0x140006d88
?_DeleteCtrlWnd@HWNDHost@DirectUI@@AEAAXXZ	3944	0x14003664c
?_DestroyTables@DUIXmlParser@DirectUI@@QEAAXXZ	3945	0x14003a2b4
?_DestroyTooltip@TouchHWNDElement@DirectUI@@IEAAXXZ	3946	0x14001ce40
?_DisplayNodeCallback@Element@DirectUI@@SAJPEAUHGADGET__@@PEAXPEAUEventMsg@@@Z	3947	0x14002626c
?_EndOptimizedLayoutQ@Element@DirectUI@@QEAAXXZ	3948	0x1400227a8
?_EnterOnCurrentThread@DUIXmlParser@DirectUI@@IEAAJXZ	3949	0x14002db18
?_Fill@Element@DirectUI@@IEAAXPEAUHDC__@@KHHHH_N@Z	3950	0x1400206d4
?_FireWindowDpiChangeEvent@HWNDElement@DirectUI@@IEAAXXZ	3951	0x1400292b4
?_FlushDS@Element@DirectUI@@AEAAXPEAVDeferCycle@2@@Z	3952	0x1400243e8
?_FlushLayout@Element@DirectUI@@KAXPEAV12@PEAVDeferCycle@2@@Z	3953	0x14003f380
?_GetBitmapSize@Macro@DirectUI@@KA_NPEAUHBITMAP__@@PEAUtagSIZE@@@Z	3954	0x140019fa0
?_GetBuriedSheetDependencies@Element@DirectUI@@AEAAXPEBUPropertyInfo@2@PEAV12@PEAUDepRecs@2@PEAVDeferCycle@2@PEAJ@Z	3955	0x14002ef5c
?_GetChangesUpdatePass@Element@DirectUI@@QEAAHXZ	3956	0x14000c7a8
?_GetClassForElement@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAPEAUIClassInfo@2@@Z	3957	0x1400280ec
?_GetClassForElementByName@DUIXmlParser@DirectUI@@IEAAJPEBGPEAPEAUIClassInfo@2@@Z	3958	0x1400301b4
?_GetComputedValue@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@PEAUUpdateCache@2@@Z	3959	0x140036994
?_GetContent@Viewer@DirectUI@@AEAAPEAVElement@2@XZ	3960	0x14003ca88
?_GetDependencies@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@HPEAUDepRecs@2@HPEAVValue@2@PEAVDeferCycle@2@@Z	3961	0x140016150
?_GetLineInfo@DUIXmlParser@DirectUI@@IEAA?AULINEINFO@2@PEAUIXmlReader@@@Z	3962	0x14000576c
?_GetLocalValue@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@@Z	3963	0x14002c424
?_GetLocalValueFromVM@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@@Z	3964	0x140005194
?_GetNeedsLayout@Element@DirectUI@@QEAAIXZ	3965	0x140009fa0
?_GetPerMonitorScaleFactorForDesktopWindow@HWNDElement@DirectUI@@IEAAHPEAUHWND__@@@Z	3966	0x140033834
?_GetPropertyForAttribute@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUIClassInfo@2@PEAPEBUPropertyInfo@2@@Z	3967	0x1400294ac
?_GetSpecifiedValue@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@PEAUUpdateCache@2@@Z	3968	0x140034a3c
?_GetSpecifiedValueIgnoreCache@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@@Z	3969	0x14000fb64
?_GetValueForStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEAUIClassInfo@2@PEBG1PEAPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	3970	0x140026a9c
?_HandleImmersiveColorSchemeChange@HWNDElement@DirectUI@@IEAAXXZ	3971	0x14000beb8
?_InheritProperties@Element@DirectUI@@AEAAXXZ	3972	0x1400060f0
?_InitializeTables@DUIXmlParser@DirectUI@@QEAAJXZ	3973	0x140031bd4
?_InternalEnsureVisible@Viewer@DirectUI@@AEAA_NHHHH@Z	3974	0x140005614
?_InvalidateCachedDSConstraints@Element@DirectUI@@KAXPEAV12@@Z	3975	0x1400135e0
?_IsSemanticZoomControl@ElementProxy@DirectUI@@AEAA_NH@Z	3976	0x14003dbe0
?_IsWindowHostUsingDoNotStealFocusFlag@ElementProxy@DirectUI@@AEAA_NXZ	3977	0x140038008
?_LeaveOnCurrentThread@DUIXmlParser@DirectUI@@IEAAXXZ	3978	0x14001cfa4
?_LoadImage32BitsPerPixel@Macro@DirectUI@@KAPEAVValue@2@PEBG@Z	3979	0x140029634
?_MarkElementForDS@Element@DirectUI@@SAHPEAV12@@Z	3980	0x140027158
?_MarkElementForLayout@Element@DirectUI@@SAHPEAV12@I@Z	3981	0x14002c308
?_OnFontPropChanged@Element@DirectUI@@IEAAXPEAVValue@2@@Z	3982	0x140034f34
?_OnGetInfoTip@CCTreeView@DirectUI@@MEAAJPEBUtagNMTVGETINFOTIPW@@@Z	3983	0x140006120
?_OnItemChanged@CCTreeView@DirectUI@@MEAAJPEBUtagTVITEMCHANGE@@@Z	3984	0x1400030a0
?_OnUIStateChanged@HWNDElement@DirectUI@@MEAAXGG@Z	3985	0x14001c2fc
?_OnUIStateChanged@TouchHWNDElement@DirectUI@@MEAAXGG@Z	3986	0x140025c2c
?_ParseBehavior@DUIXmlParser@DirectUI@@IEAAJPEAVElement@2@PEBG@Z	3987	0x14000a25c
?_ParseLayout@DUIXmlParser@DirectUI@@IEAAJPEBGPEAPEAVValue@2@@Z	3988	0x140033834
?_ParseValue@DUIXmlParser@DirectUI@@IEAAJPEBUPropertyInfo@2@PEBGPEAPEAVValue@2@@Z	3989	0x140007970
?_PostEvent@Element@DirectUI@@AEAAXPEAUEvent@2@H@Z	3990	0x1400374f0
?_PostSourceChange@Element@DirectUI@@AEAAJXZ	3991	0x14001a168
?_PreSourceChange@Element@DirectUI@@AEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@1@Z	3992	0x14000d5bc
?_PreSourceChange@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@HPEAVValue@2@1@Z	3993	0x140005a90
?_RecordElementBehaviors@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBG@Z	3994	0x140034fd4
?_RecordElementLayout@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBG@Z	3995	0x140017430
?_RecordElementStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEBG_N@Z	3996	0x140034f24
?_RecordElementTrees@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	3997	0x1400380a8
?_RecordElementWithChildren@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@_NPEAPEAG@Z	3998	0x140022f2c
?_RecordInstantiateElement@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAPEAG@Z	3999	0x14001a6bc
?_RecordSetElementProperties@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	4000	0x14000a6cc
?_RecordSetValue@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBG1@Z	4001	0x140022f7c
?_RemoveLocalValue@Element@DirectUI@@IEAAJP6APEBUPropertyInfo@2@XZ_N@Z	4002	0x140014280
?_RemoveLocalValue@Element@DirectUI@@IEAAJPEBUPropertyInfo@2@_N@Z	4003	0x14001fc34
?_RepeatButtonActionCallback@RepeatButton@DirectUI@@CAXPEAUGMA_ACTIONINFO@@@Z	4004	0x14002c864
?_Reset@ShellBorderLayout@DirectUI@@AEAAXXZ	4005	0x14003814c
?_ResolveStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEBGPEAPEAVValue@2@PEAI@Z	4006	0x140010ef8
?_ScalePointsToPixels@DUIXmlParser@DirectUI@@AEBAHH@Z	4007	0x14000a6e4
?_ScalePointsToPixels@DUIXmlParser@DirectUI@@AEBAMM@Z	4008	0x1400358c4
?_ScaleRelativePixels@DUIXmlParser@DirectUI@@AEBAHH@Z	4009	0x1400383c8
?_ScaleRelativePixels@DUIXmlParser@DirectUI@@AEBAMM@Z	4010	0x14003d20c
?_SelfLayoutDoLayout@Clipper@DirectUI@@UEAAXHH@Z	4011	0x1400076c4
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z	4012	0x140031334
?_SelfLayoutDoLayout@ScrollBar@DirectUI@@UEAAXHH@Z	4013	0x140015f24
?_SelfLayoutDoLayout@TouchScrollBar@DirectUI@@UEAAXHH@Z	4014	0x14001ff10
?_SelfLayoutDoLayout@Viewer@DirectUI@@UEAAXHH@Z	4015	0x14003fafc
?_SelfLayoutUpdateDesiredSize@Clipper@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4016	0x140007054
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4017	0x14002ea54
?_SelfLayoutUpdateDesiredSize@ScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4018	0x140027cf0
?_SelfLayoutUpdateDesiredSize@TouchScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4019	0x140008884
?_SelfLayoutUpdateDesiredSize@Viewer@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4020	0x1400140ec
?_SetBinaryXml@DUIXmlParser@DirectUI@@IEAAJPEBE_KPEAUHINSTANCE__@@@Z	4021	0x1400041c4
?_SetGroupChanges@Element@DirectUI@@SA_NPEAV12@HPEAVDeferCycle@2@@Z	4022	0x14000c8c0
?_SetNeedsLayout@Element@DirectUI@@QEAAHI@Z	4023	0x1400181f4
?_SetProperties@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUIClassInfo@2@PEAVElement@2@@Z	4024	0x14002680c
?_SetRelPixRect@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@HHHH@Z	4025	0x14001acbc
?_SetRelPixValue@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@H@Z	4026	0x140039fd4
?_SetValue@Element@DirectUI@@IEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@_N@Z	4027	0x140017e90
?_SetValue@Element@DirectUI@@IEAAJPEBUPropertyInfo@2@HPEAVValue@2@_N@Z	4028	0x14000f480
?_SetXMLFromResource@DUIXmlParser@DirectUI@@IEAAJPEBG0PEAUHINSTANCE__@@11@Z	4029	0x140041420
?_SetupParserState@DUIXmlParser@DirectUI@@IEAAJPEAUHINSTANCE__@@0@Z	4030	0x140041710
?_SinkWndProc@HWNDHost@DirectUI@@CAHPEAXPEAUHWND__@@I_K_JPEA_J@Z	4031	0x14003c7c4
?_StartOptimizedLayoutQ@Element@DirectUI@@QEAAXXZ	4032	0x140027c90
?_SyncBackground@Element@DirectUI@@AEAAXXZ	4033	0x14002c780
?_SyncRedrawStyle@Element@DirectUI@@AEAAXXZ	4034	0x140035120
?_SyncVisible@Element@DirectUI@@AEAAXXZ	4035	0x1400082f0
?_TransferGroupFlags@Element@DirectUI@@SAXPEAV12@H@Z	4036	0x140016c50
?_UpdateDesiredSize@Element@DirectUI@@QEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4037	0x14001c208
?_UpdateDesktopScaleFactor@HWNDElement@DirectUI@@AEAAHXZ	4038	0x1400226ec
?_UpdateLayoutPosition@Element@DirectUI@@QEAAXHH@Z	4039	0x140008adc
?_UpdateLayoutSize@Element@DirectUI@@QEAAXHH@Z	4040	0x140011da4
?_UpdatePropertyInCache@Element@DirectUI@@AEAAXPEBUPropertyInfo@2@@Z	4041	0x14000bc44
?_UpdateTileList@NineGridLayout@DirectUI@@AEAAXHPEAVElement@2@@Z	4042	0x14002057c
?_UsesUIAProxies@ElementProxy@DirectUI@@IEAAHXZ	4043	0x1400359d8
?_VoidPCNotifyTree@Element@DirectUI@@CAXHPEAVDeferCycle@2@@Z	4044	0x140006fe0
?_WndProc@InvokeHelper@DirectUI@@CAHPEAXPEAUHWND__@@I_K_JPEA_J@Z	4045	0x140014e80
?_ZeroRelease@Value@DirectUI@@AEAAXXZ	4046	0x1400073a8
?_atmArrow@Expando@DirectUI@@0GA	4047	0x14001d4a8
?_atmClipper@Expando@DirectUI@@0GA	4048	0x140001308
?_roleMapping@Schema@DirectUI@@0QBURoleMap@12@B	4049	0x1400088a4
?accDoDefaultAction@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@@Z	4050	0x1400018e0
?accDoDefaultAction@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@@Z	4051	0x1400306c0
?accHitTest@DuiAccessible@DirectUI@@UEAAJJJPEAUtagVARIANT@@@Z	4052	0x140037fec
?accHitTest@HWNDHostAccessible@DirectUI@@UEAAJJJPEAUtagVARIANT@@@Z	4053	0x14001b484
?accLocation@DuiAccessible@DirectUI@@UEAAJPEAJ000UtagVARIANT@@@Z	4054	0x1400146a0
?accLocation@HWNDHostAccessible@DirectUI@@UEAAJPEAJ000UtagVARIANT@@@Z	4055	0x14003e36c
?accNavigate@DuiAccessible@DirectUI@@UEAAJJUtagVARIANT@@PEAU3@@Z	4056	0x140026ac0
?accNavigate@HWNDHostAccessible@DirectUI@@UEAAJJUtagVARIANT@@PEAU3@@Z	4057	0x14002a874
?accNavigate@HWNDHostClientAccessible@DirectUI@@UEAAJJUtagVARIANT@@PEAU3@@Z	4058	0x140024910
?accSelect@DuiAccessible@DirectUI@@UEAAJJUtagVARIANT@@@Z	4059	0x140035ba4
?accSelect@HWNDHostAccessible@DirectUI@@UEAAJJUtagVARIANT@@@Z	4060	0x14000b630
?advanceFrameActionStart@Movie@DirectUI@@AEAAXXZ	4061	0x14001a418
?advanceFrameActionStop@Movie@DirectUI@@AEAAXXZ	4062	0x140003084
?cChangeBulk@EventManager@DirectUI@@0HB	4063	0x140006110
?c_RefCountBitOffset@Value@DirectUI@@0HB	4064	0x1400172e4
?c_RefCountMask@Value@DirectUI@@0JB	4065	0x140030750
?c_SingleRefCount@Value@DirectUI@@0JB	4066	0x14002c658
?c_rgar@AccessibleButton@DirectUI@@0QBUACCESSIBLEROLE@12@B	4067	0x14001d338
?doAction@Movie@DirectUI@@QEAAXPEAUGMA_ACTIONINFO@@@Z	4068	0x140028dd8
?g_cRefCount@ResourceModuleHandles@DirectUI@@0JC	4069	0x140028f08
?g_controlInfoTable@Schema@DirectUI@@0QBUControlInfo@12@B	4070	0x1400234cc
?g_cs@ElementProviderManager@DirectUI@@2U_RTL_CRITICAL_SECTION@@A	4071	0x14000b30c
?g_cs@EventManager@DirectUI@@0U_RTL_CRITICAL_SECTION@@A	4072	0x140003f20
?g_cs@InvokeManager@DirectUI@@0U_RTL_CRITICAL_SECTION@@A	4073	0x14001ad40
?g_dwElSlot@DirectUI@@3KA	4074	0x14002e9f4
?g_eventInfoTable@Schema@DirectUI@@0QBUEventInfo@12@B	4075	0x140024270
?g_eventMapping@Schema@DirectUI@@0QBUEventMap@12@B	4076	0x140014428
?g_eventRegisteredMap@EventManager@DirectUI@@0PAIA	4077	0x14001ca7c
?g_fInited@Schema@DirectUI@@0_NA	4078	0x14002e194
?g_fWantAnyEvent@EventManager@DirectUI@@0_NA	4079	0x1400124f4
?g_pArrayInvokeHelper@InvokeManager@DirectUI@@0PEAV?$UiaArray@PEAVInvokeHelper@DirectUI@@@2@EA	4080	0x140018da4
?g_pArrayPprv@ElementProviderManager@DirectUI@@0PEAV?$UiaArray@PEAVElementProvider@DirectUI@@@2@EA	4081	0x140004974
?g_pArrayPropertyEvent@EventManager@DirectUI@@0PEAV?$UiaArray@H@2@EA	4082	0x14003e5fc
?g_patternInfoTable@Schema@DirectUI@@0QBUPatternInfo@12@B	4083	0x140038c6c
?g_patternMapping@Schema@DirectUI@@0QBUPatternMap@12@B	4084	0x140011e78
?g_propertyInfoTable@Schema@DirectUI@@0QBUPropertyInfo@12@B	4085	0x140007010
?g_rgMouseMap@HWNDHost@DirectUI@@0QAY02$$CBIA	4086	0x140031c3c
?get_BoundingRectangle@ElementProvider@DirectUI@@UEAAJPEAUUiaRect@@@Z	4087	0x1400217d0
?get_CanSelectMultiple@SelectionProvider@DirectUI@@UEAAJPEAH@Z	4088	0x140010994
?get_Column@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4089	0x14003adf8
?get_ColumnCount@GridProvider@DirectUI@@UEAAJPEAH@Z	4090	0x140034f84
?get_ColumnSpan@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4091	0x14003e724
?get_ContainingGrid@GridItemProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z	4092	0x1400340ac
?get_ExpandCollapseState@ExpandCollapseProvider@DirectUI@@UEAAJPEAW4ExpandCollapseState@@@Z	4093	0x1400052a4
?get_FragmentRoot@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderFragmentRoot@@@Z	4094	0x14003d474
?get_HorizontalScrollPercent@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4095	0x140002654
?get_HorizontalViewSize@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4096	0x14003a2b0
?get_HorizontallyScrollable@ScrollProvider@DirectUI@@UEAAJPEAH@Z	4097	0x140035900
?get_HostRawElementProvider@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z	4098	0x14003dbd0
?get_IsReadOnly@RangeValueProvider@DirectUI@@UEAAJPEAH@Z	4099	0x140021518
?get_IsReadOnly@ValueProvider@DirectUI@@UEAAJPEAH@Z	4100	0x14000fdb8
?get_IsSelected@SelectionItemProvider@DirectUI@@UEAAJPEAH@Z	4101	0x14000590c
?get_IsSelectionRequired@SelectionProvider@DirectUI@@UEAAJPEAH@Z	4102	0x14001b5f0
?get_LargeChange@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4103	0x140011794
?get_Maximum@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4104	0x140040810
?get_Minimum@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4105	0x14002ce98
?get_ProviderOptions@ElementProvider@DirectUI@@UEAAJPEAW4ProviderOptions@@@Z	4106	0x1400045d4
?get_Row@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4107	0x14001b0b8
?get_RowCount@GridProvider@DirectUI@@UEAAJPEAH@Z	4108	0x14000d114
?get_RowOrColumnMajor@TableProvider@DirectUI@@UEAAJPEAW4RowOrColumnMajor@@@Z	4109	0x140024cfc
?get_RowSpan@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4110	0x14001c960
?get_SelectionContainer@SelectionItemProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z	4111	0x140006ac0
?get_SmallChange@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4112	0x14000c29c
?get_ToggleState@ToggleProvider@DirectUI@@UEAAJPEAW4ToggleState@@@Z	4113	0x1400221dc
?get_Value@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4114	0x14003a7ec
?get_Value@ValueProvider@DirectUI@@UEAAJPEAPEAG@Z	4115	0x14002c338
?get_VerticalScrollPercent@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4116	0x1400378d0
?get_VerticalViewSize@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4117	0x14001f780
?get_VerticallyScrollable@ScrollProvider@DirectUI@@UEAAJPEAH@Z	4118	0x14002bee4
?get_accChild@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAUIDispatch@@@Z	4119	0x140012980
?get_accChild@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAUIDispatch@@@Z	4120	0x140037660
?get_accChildCount@DuiAccessible@DirectUI@@UEAAJPEAJ@Z	4121	0x14000b90c
?get_accChildCount@HWNDHostAccessible@DirectUI@@UEAAJPEAJ@Z	4122	0x140041734
?get_accDefaultAction@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4123	0x14001793c
?get_accDefaultAction@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4124	0x1400283e4
?get_accDescription@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4125	0x14001de4c
?get_accDescription@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4126	0x14001e1f8
?get_accFocus@DuiAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4127	0x140018a4c
?get_accFocus@HWNDHostAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4128	0x1400215bc
?get_accHelp@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4129	0x1400058a8
?get_accHelp@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4130	0x1400175f4
?get_accHelpTopic@DuiAccessible@DirectUI@@UEAAJPEAPEAGUtagVARIANT@@PEAJ@Z	4131	0x14000a95c
?get_accHelpTopic@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAGUtagVARIANT@@PEAJ@Z	4132	0x14003af1c
?get_accKeyboardShortcut@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4133	0x14000e6dc
?get_accKeyboardShortcut@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4134	0x140017d38
?get_accName@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4135	0x1400408a4
?get_accName@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4136	0x140012c5c
?get_accParent@DuiAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4137	0x14003b32c
?get_accParent@HWNDElementAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4138	0x14000233c
?get_accParent@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4139	0x14001b934
?get_accParent@HWNDHostClientAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4140	0x140032f64
?get_accRole@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4141	0x140031a70
?get_accRole@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4142	0x140024760
?get_accRole@HWNDHostClientAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4143	0x14000c190
?get_accSelection@DuiAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4144	0x14004075c
?get_accSelection@HWNDHostAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4145	0x140007824
?get_accState@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4146	0x1400157dc
?get_accState@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4147	0x140025814
?get_accValue@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4148	0x140004058
?get_accValue@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4149	0x140007c98
?put_accName@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4150	0x140029c34
?put_accName@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4151	0x1400288e0
?put_accValue@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4152	0x14003be88
?put_accValue@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4153	0x1400150ac
?s_HandleDUIEventMessage@Element@DirectUI@@CA_NPEAV12@PEAUEventMsg@@@Z	4154	0x140033828
?s_ImageHlpFuncList@CallstackTracker@DirectUI@@0PAUIMGHLPFN_LOAD@12@A	4155	0x1400362c8
?s_SyncCallback@CSafeElementProxy@@SAJPEAUHGADGET__@@PEAXPEAUEventMsg@@@Z	4156	0x140012508
?s_XMLParseError@DUIFactory@DirectUI@@CAXPEBG0HPEAX@Z	4157	0x14001c534
?s_fdClr@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@K@12@B	4158	0x1400031e4
?s_fdFill@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@PEAVValue@DirectUI@@@12@B	4159	0x14001d80c
?s_fdGraphic@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@PEAVValue@DirectUI@@@12@B	4160	0x1400180b4
?s_fdInt@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@H@12@B	4161	0x14000f7d0
?s_fdRect@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@UScaledRECT@DirectUI@@@12@B	4162	0x140010020
?s_fdSize@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@UScaledSIZE@DirectUI@@@12@B	4163	0x140031418
?s_fdString@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@PEAVValue@DirectUI@@@12@B	4164	0x1400351f0
?s_hProcess@CallstackTracker@DirectUI@@0PEAXEA	4165	0x140023cdc
?s_hinstImageHlp@CallstackTracker@DirectUI@@0PEAUHINSTANCE__@@EA	4166	0x14001a2f0
?s_hinstNtDll@CallstackTracker@DirectUI@@0PEAUHINSTANCE__@@EA	4167	0x14002f5e8
?s_initonceInit@CallstackTracker@DirectUI@@0T_RTL_RUN_ONCE@@A	4168	0x14002d9e8
?s_pClassInfo@AccessibleButton@DirectUI@@0PEAUIClassInfo@2@EA	4169	0x140022594
?s_pClassInfo@AnimationStrip@DirectUI@@0PEAUIClassInfo@2@EA	4170	0x140005e5c
?s_pClassInfo@AutoButton@DirectUI@@0PEAUIClassInfo@2@EA	4171	0x14000a714
?s_pClassInfo@BaseScrollViewer@DirectUI@@0PEAUIClassInfo@2@EA	4172	0x140033c50
?s_pClassInfo@Bind@DirectUI@@0PEAUIClassInfo@2@EA	4173	0x14000aca8
?s_pClassInfo@Browser@DirectUI@@0PEAUIClassInfo@2@EA	4174	0x140012bc0
?s_pClassInfo@Button@DirectUI@@0PEAUIClassInfo@2@EA	4175	0x140030a74
?s_pClassInfo@CCAVI@DirectUI@@0PEAUIClassInfo@2@EA	4176	0x140003b88
?s_pClassInfo@CCBase@DirectUI@@0PEAUIClassInfo@2@EA	4177	0x140015f48
?s_pClassInfo@CCBaseCheckRadioButton@DirectUI@@0PEAUIClassInfo@2@EA	4178	0x140020004
?s_pClassInfo@CCBaseScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4179	0x140010ea0
?s_pClassInfo@CCCheckBox@DirectUI@@0PEAUIClassInfo@2@EA	4180	0x1400074b8
?s_pClassInfo@CCCommandLink@DirectUI@@0PEAUIClassInfo@2@EA	4181	0x1400132f4
?s_pClassInfo@CCHScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4182	0x140022c44
?s_pClassInfo@CCListBox@DirectUI@@0PEAUIClassInfo@2@EA	4183	0x14003e394
?s_pClassInfo@CCListView@DirectUI@@0PEAUIClassInfo@2@EA	4184	0x140035f60
?s_pClassInfo@CCProgressBar@DirectUI@@0PEAUIClassInfo@2@EA	4185	0x140013ff4
?s_pClassInfo@CCPushButton@DirectUI@@0PEAUIClassInfo@2@EA	4186	0x14003c548
?s_pClassInfo@CCRadioButton@DirectUI@@0PEAUIClassInfo@2@EA	4187	0x140031d50
?s_pClassInfo@CCSysLink@DirectUI@@0PEAUIClassInfo@2@EA	4188	0x1400319cc
?s_pClassInfo@CCTrackBar@DirectUI@@0PEAUIClassInfo@2@EA	4189	0x140029ba8
?s_pClassInfo@CCTreeView@DirectUI@@0PEAUIClassInfo@2@EA	4190	0x140016690
?s_pClassInfo@CCVScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4191	0x14001b3c4
?s_pClassInfo@CheckBoxGlyph@DirectUI@@0PEAUIClassInfo@2@EA	4192	0x14001c1c8
?s_pClassInfo@Clipper@DirectUI@@0PEAUIClassInfo@2@EA	4193	0x1400236c8
?s_pClassInfo@Combobox@DirectUI@@0PEAUIClassInfo@2@EA	4194	0x14000f4c4
?s_pClassInfo@DialogElement@DirectUI@@0PEAUIClassInfo@2@EA	4195	0x1400192c4
?s_pClassInfo@Edit@DirectUI@@0PEAUIClassInfo@2@EA	4196	0x140024714
?s_pClassInfo@Element@DirectUI@@0PEAUIClassInfo@2@EA	4197	0x14001e6b8
?s_pClassInfo@ElementWithHWND@DirectUI@@0PEAUIClassInfo@2@EA	4198	0x14002b338
?s_pClassInfo@Expandable@DirectUI@@0PEAUIClassInfo@2@EA	4199	0x14000726c
?s_pClassInfo@Expando@DirectUI@@0PEAUIClassInfo@2@EA	4200	0x14002ecd4
?s_pClassInfo@ExpandoButtonGlyph@DirectUI@@0PEAUIClassInfo@2@EA	4201	0x1400123e8
?s_pClassInfo@HWNDElement@DirectUI@@0PEAUIClassInfo@2@EA	4202	0x140020338
?s_pClassInfo@HWNDHost@DirectUI@@0PEAUIClassInfo@2@EA	4203	0x140017a18
?s_pClassInfo@Macro@DirectUI@@0PEAUIClassInfo@2@EA	4204	0x140039c2c
?s_pClassInfo@Movie@DirectUI@@0PEAUIClassInfo@2@EA	4205	0x1400389a0
?s_pClassInfo@Navigator@DirectUI@@0PEAUIClassInfo@2@EA	4206	0x140038a3c
?s_pClassInfo@PText@DirectUI@@0PEAUIClassInfo@2@EA	4207	0x14003c038
?s_pClassInfo@Page@DirectUI@@0PEAUIClassInfo@2@EA	4208	0x14000c618
?s_pClassInfo@Pages@DirectUI@@0PEAUIClassInfo@2@EA	4209	0x14001d2b8
?s_pClassInfo@Progress@DirectUI@@0PEAUIClassInfo@2@EA	4210	0x14003bdf4
?s_pClassInfo@PushButton@DirectUI@@0PEAUIClassInfo@2@EA	4211	0x14000968c
?s_pClassInfo@RadioButtonGlyph@DirectUI@@0PEAUIClassInfo@2@EA	4212	0x14000e36c
?s_pClassInfo@RefPointElement@DirectUI@@0PEAUIClassInfo@2@EA	4213	0x140001938
?s_pClassInfo@RepeatButton@DirectUI@@0PEAUIClassInfo@2@EA	4214	0x1400132b4
?s_pClassInfo@Repeater@DirectUI@@0PEAUIClassInfo@2@EA	4215	0x140024be4
?s_pClassInfo@ScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4216	0x140030438
?s_pClassInfo@ScrollViewer@DirectUI@@0PEAUIClassInfo@2@EA	4217	0x140027d6c
?s_pClassInfo@Selector@DirectUI@@0PEAUIClassInfo@2@EA	4218	0x14002f5bc
?s_pClassInfo@SelectorNoDefault@DirectUI@@0PEAUIClassInfo@2@EA	4219	0x1400200a8
?s_pClassInfo@StyledScrollViewer@DirectUI@@0PEAUIClassInfo@2@EA	4220	0x140009d88
?s_pClassInfo@TextGraphic@DirectUI@@0PEAUIClassInfo@2@EA	4221	0x1400070f8
?s_pClassInfo@Thumb@DirectUI@@0PEAUIClassInfo@2@EA	4222	0x140027b68
?s_pClassInfo@UnknownElement@DirectUI@@0PEAUIClassInfo@2@EA	4223	0x1400373fc
?s_pClassInfo@Viewer@DirectUI@@0PEAUIClassInfo@2@EA	4224	0x1400325d4
?s_pClassInfo@XBaby@DirectUI@@0PEAUIClassInfo@2@EA	4225	0x140011fa4
?s_pClassInfo@XElement@DirectUI@@0PEAUIClassInfo@2@EA	4226	0x14001c2d0
?s_pfnImagehlpApiVersionEx@CallstackTracker@DirectUI@@0P6APEAUAPI_VERSION@@PEAU3@@ZEA	4227	0x14003e700
?s_pfnRtlCaptureStackBackTrace@CallstackTracker@DirectUI@@0P6AGKKPEAPEAXPEAK@ZEA	4228	0x140025cac
?s_pfnSymFromAddr@CallstackTracker@DirectUI@@0P6AHPEAX_KPEA_KPEAU_SYMBOL_INFO@@@ZEA	4229	0x14003761c
?s_pfnSymGetModuleInfo64@CallstackTracker@DirectUI@@0P6AHPEAX_KPEAU_IMAGEHLP_MODULE64@@@ZEA	4230	0x1400349c0
?s_pfnSymInitialize@CallstackTracker@DirectUI@@0P6AHPEAXPEBDH@ZEA	4231	0x140006f78
?s_pfnSymLoadModule64@CallstackTracker@DirectUI@@0P6A_KPEAX0PEBD1_KK@ZEA	4232	0x140034548
?s_pfnSymSetOptions@CallstackTracker@DirectUI@@0P6AKK@ZEA	4233	0x140032618
?s_uButtonFocusChangeMsg@XElement@DirectUI@@2IB	4234	0x1400055dc
?s_uInvokeHelperMsg@InvokeHelper@DirectUI@@0IB	4235	0x14003df2c
?s_uNavigateOutMsg@XElement@DirectUI@@2IB	4236	0x140019dec
?s_uUnhandledSyscharMsg@XElement@DirectUI@@2IB	4237	0x14000ca3c
ARGBColorFromEnumI	4238	0x1400144f4
AllowAllScalingPlateaus	4239	0x14000a288
BlurBitmap	4240	0x14001aa60
BrushFromEnumI	4241	0x14002eb9c
ColorFromEnumI	4242	0x140008fcc
CreateDUIWrapper	4243	0x140020134
CreateDUIWrapperEx	4244	0x140026fe8
CreateDUIWrapperFromResource	4245	0x140005f90
CreateDUIWrapperTouchEx	1274	0x14002cefc
CreateTouchTooltip	4246	0x140026c98
DUI70_DUIXmlParserCreate	4247	0x14000c448
DUI70_DUIXmlParserCreateElement	4248	0x14000f6c0
DUI70_DUIXmlParserDestroy	4249	0x14001cc14
DUI70_DUIXmlParserSetXMLFromResource	4250	0x140024de4
DUI70_ElementAddListener	4251	0x14003e13c
DUI70_ElementDestroy	4252	0x140021d30
DUI70_ElementEndDefer	4253	0x14002ab6c
DUI70_ElementFindDescendent	4254	0x140008e20
DUI70_ElementGetChildren	4255	0x140021d40
DUI70_ElementGetRoot	4256	0x140024cf4
DUI70_ElementRemoveListener	4257	0x14003a1d0
DUI70_ElementSetAccRole	4258	0x140030d14
DUI70_ElementSetAccessible	4259	0x140020108
DUI70_ElementSetContentAlign	4260	0x14000e4d4
DUI70_ElementSetContentString	4261	0x14003dfc4
DUI70_ElementSetFont	4262	0x14003a080
DUI70_ElementSetID	4263	0x140029c14
DUI70_ElementSetLayoutPos	4264	0x1400207d4
DUI70_ElementSetVisible	4265	0x14003d15c
DUI70_ElementStartDefer	4266	0x14001d1cc
DUI70_IsTouchButtonClickEqual	4267	0x140002698
DUI70_RichTextCreate	4268	0x14003da14
DUI70_RichTextSetConstrainLayout	4269	0x140020af8
DUI70_ValueRelease	4270	0x14000b7d4
DUIDrawShadowText	4271	0x1400142d0
DUIStopPVLAnimation	4272	0x140038998
DisableAnimations	4273	0x14001dd4c
DisableInitCallstackTracking	4274	0x1400325f0
DrawShadowTextEx	4275	0x14003d714
DuiCreateObject	1442	0x14003b0b0
ElementFromGadget	4276	0x140028d84
EnableAnimations	4277	0x140017d34
FlushThemeHandles	4278	0x140012160
ForceDebugBreak	4279	0x1400172cc
GetDesktopDPI	4280	0x140009f08
GetElementDataEntry	4281	0x14002a0b4
GetElementMacro	4282	0x140027d70
GetFontCache	4283	0x14002a5e4
GetScaleFactor	4284	0x14002da2c
GetThemeHandle	4285	0x14001a484
HStrDup	4286	0x140011710
HrSysAllocString	4287	0x140002fc4
InitPreprocessor	4288	0x14000a2f4
InitProcessPriv	4289	0x140025408
InitThread	4290	0x14002f884
IsAnimationsEnabled	4291	0x14002f750
IsPalette	4292	0x1400244e0
IsUIAutomationProviderEnabled	4293	0x140038f14
MultiByteToUnicode	4294	0x14002ac60
NotifyAccessibilityEvent	4295	0x1400143ac
PreprocessBuffer	4296	0x140010618
ProcessAlphaBitmapI	4297	0x140022a18
PurgeThemeHandles	4298	0x140035ae4
RegisterAllControls	4299	0x140027138
RegisterBaseControls	4300	0x140036ef8
RegisterBrowserControls	4301	0x1400344c4
RegisterCommonControls	4302	0x14002afac
RegisterExtendedControls	4303	0x1400224c0
RegisterMacroControls	4304	0x140008400
RegisterMiscControls	4305	0x14001ae2c
RegisterPVLBehaviorFactory	4306	0x14003bfc4
RegisterStandardControls	4307	0x1400168cc
RegisterXControls	4308	0x140040d48
SetDefAction	4309	0x14003c010
SetDesktopDPIOverride	4310	0x140033f90
SkipDLLUnloadInitChecks	4311	0x14003f2b4
StartMessagePump	4312	0x140005b98
StopMessagePump	4313	0x140010744
StrToID	4314	0x14000b854
UiaHideOnGetObject	4315	0x14003d208
UiaOnDestroySink	4316	0x14001b854
UiaOnGetObject	4317	0x14001cc90
UiaOnToolTip	4318	0x14001ad80
UnInitProcessPriv	4319	0x14001c500
UnInitThread	4320	0x14002c15c
UnicodeToMultiByte	4321	0x140006324

Version Infos

Description	Data
LegalCopyright	Microsoft Corporation. All rights reserv
InternalName	bitsp
FileVersion	7.5.7600.16385 (win7_rtm.090713-
CompanyName	Microsoft Corporati
ProductName	Microsoft Windows Operating S
ProductVersion	6.1.7600
FileDescription	Background Intellig
OriginalFilename	kbdy
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2021 23:01:19.763142109 CEST	62389	53	192.168.2.4	8.8.8.8
Sep 28, 2021 23:01:19.784262896 CEST	53	62389	8.8.8.8	192.168.2.4
Sep 28, 2021 23:01:52.057288885 CEST	49910	53	192.168.2.4	8.8.8.8
Sep 28, 2021 23:01:52.084511042 CEST	53	49910	8.8.8.8	192.168.2.4
Sep 28, 2021 23:02:09.880069017 CEST	55854	53	192.168.2.4	8.8.8.8
Sep 28, 2021 23:02:09.899612904 CEST	53	55854	8.8.8.8	192.168.2.4
Sep 28, 2021 23:02:10.816236019 CEST	64549	53	192.168.2.4	8.8.8.8
Sep 28, 2021 23:02:10.835623026 CEST	53	64549	8.8.8.8	192.168.2.4
Sep 28, 2021 23:02:11.568450928 CEST	63153	53	192.168.2.4	8.8.8.8
Sep 28, 2021 23:02:11.591790915 CEST	53	63153	8.8.8.8	192.168.2.4
Sep 28, 2021 23:02:11.598397970 CEST	52991	53	192.168.2.4	8.8.8.8
Sep 28, 2021 23:02:11.626929045 CEST	53	52991	8.8.8.8	192.168.2.4
Sep 28, 2021 23:02:12.032902002 CEST	53700	53	192.168.2.4	8.8.8.8
Sep 28, 2021 23:02:12.050344944 CEST	53	53700	8.8.8.8	192.168.2.4
Sep 28, 2021 23:02:12.539891005 CEST	51726	53	192.168.2.4	8.8.8.8
Sep 28, 2021 23:02:12.559621096 CEST	53	51726	8.8.8.8	192.168.2.4
Sep 28, 2021 23:02:13.104403019 CEST	56794	53	192.168.2.4	8.8.8.8
Sep 28, 2021 23:02:13.124618053 CEST	53	56794	8.8.8.8	192.168.2.4
Sep 28, 2021 23:02:13.275161028 CEST	56534	53	192.168.2.4	8.8.8.8
Sep 28, 2021 23:02:13.309830904 CEST	53	56534	8.8.8.8	192.168.2.4
Sep 28, 2021 23:02:13.633522987 CEST	56627	53	192.168.2.4	8.8.8.8
Sep 28, 2021 23:02:13.651467085 CEST	53	56627	8.8.8.8	192.168.2.4
Sep 28, 2021 23:02:14.809829950 CEST	56621	53	192.168.2.4	8.8.8.8
Sep 28, 2021 23:02:14.829245090 CEST	53	56621	8.8.8.8	192.168.2.4
Sep 28, 2021 23:02:16.289144039 CEST	63116	53	192.168.2.4	8.8.8.8
Sep 28, 2021 23:02:16.337327957 CEST	53	63116	8.8.8.8	192.168.2.4
Sep 28, 2021 23:02:16.995388985 CEST	64078	53	192.168.2.4	8.8.8.8
Sep 28, 2021 23:02:17.015357018 CEST	53	64078	8.8.8.8	192.168.2.4
Sep 28, 2021 23:02:34.889803886 CEST	64801	53	192.168.2.4	8.8.8.8
Sep 28, 2021 23:02:34.910386086 CEST	53	64801	8.8.8.8	192.168.2.4
Sep 28, 2021 23:03:13.483036041 CEST	61721	53	192.168.2.4	8.8.8.8
Sep 28, 2021 23:03:13.510296106 CEST	53	61721	8.8.8.8	192.168.2.4
Sep 28, 2021 23:03:16.768007040 CEST	51255	53	192.168.2.4	8.8.8.8
Sep 28, 2021 23:03:16.796010017 CEST	53	51255	8.8.8.8	192.168.2.4

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll64.exe PID: 7012 Parent PID: 5300

General

Start time:	23:01:25
Start date:	28/09/2021
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe 'C:\Users\user\Desktop\PSnPApRPsG.dll'
Imagebase:	0x7ff7b3380000
File size:	1136128 bytes
MD5 hash:	E0CC9D126C39A9D2FA1CAD5027EBBD18
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 7056 Parent PID: 7012

General

Start time:	23:01:26
Start date:	28/09/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\PSnPApRPsG.dll',#1
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 7092 Parent PID: 7056

General

Start time:	23:01:26
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe 'C:\Users\user\Desktop\PSnPApRPsG.dll',#1
Imagebase:	0x7ff7f3d00000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000004.00000002.761772602.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 7120 Parent PID: 7012

General

Start time:	23:01:27
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\PSnPApRPsG.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ
Imagebase:	0x7ff7f3d00000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000005.00000002.677061553.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 3424 Parent PID: 7092

General

Start time:	23:01:28
Start date:	28/09/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 4388 Parent PID: 7012

General

Start time:	23:01:30
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\PSnPApRPsG.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ
Imagebase:	0x7ff7f3d00000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000008.00000002.684710947.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6328 Parent PID: 7012

General

Start time:	23:01:33
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\PSnPApRPsG.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ
Imagebase:	0x7ff7f3d00000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000009.00000002.691449064.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: tcmsetup.exe PID: 6868 Parent PID: 3424

General

Start time:	23:02:09
Start date:	28/09/2021
Path:	C:\Windows\System32\tcmsetup.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\tcmsetup.exe
Imagebase:	0x7ff65b780000
File size:	16384 bytes
MD5 hash:	0DDA495155D552D024593C4B3246C8FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: tcmsetup.exe PID: 6980 Parent PID: 3424

General

Start time:	23:02:11
Start date:	28/09/2021
Path:	C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\72PXeqK\tcmsetup.exe
Imagebase:	0x7ff708130000
File size:	16384 bytes
MD5 hash:	0DDA495155D552D024593C4B3246C8FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000012.00000002.791585057.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: RdpSaUacHelper.exe PID: 5052 Parent PID: 3424

General

Start time:	23:02:22
Start date:	28/09/2021
Path:	C:\Windows\System32\RdpSaUacHelper.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\RdpSaUacHelper.exe
Imagebase:	0x7ff79a8d0000
File size:	29184 bytes
MD5 hash:	DA88A7B872B1A52F2465D12CFBA4EDAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: RdpSaUacHelper.exe PID: 6204 Parent PID: 3424

General

Start time:	23:02:23
Start date:	28/09/2021
Path:	C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\hUhx9Ta\RdpSaUacHelper.exe
Imagebase:	0x7ff677470000
File size:	29184 bytes
MD5 hash:	DA88A7B872B1A52F2465D12CFBA4EDAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000014.00000002.818480177.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: msdt.exe PID: 1568 Parent PID: 3424

General

Start time:	23:02:35
Start date:	28/09/2021
Path:	C:\Windows\System32\msdt.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msdt.exe
Imagebase:	0x7ff7544e0000
File size:	1560576 bytes
MD5 hash:	8BE43BAF1F37DA5AB31A53CA1C07EE0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: msdt.exe PID: 5628 Parent PID: 3424

General

Start time:	23:02:36
Start date:	28/09/2021
Path:	C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\nmYaGulOu\msdt.exe
Imagebase:	0x7ff6edaf0000
File size:	1560576 bytes
MD5 hash:	8BE43BAF1F37DA5AB31A53CA1C07EE0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000017.00000002.846583663.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: bdechangepin.exe PID: 6688 Parent PID: 3424

General

Start time:	23:02:49
Start date:	28/09/2021
Path:	C:\Windows\System32\bdechangepin.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\bdechangepin.exe
Imagebase:	0x7ff79fd40000
File size:	369664 bytes
MD5 hash:	013D00A367D851B0EC869F209337754E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: bdechangepin.exe PID: 6608 Parent PID: 3424

General

Start time:	23:02:54
Start date:	28/09/2021
Path:	C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\RjGeORx\bdechangepin.exe
Imagebase:	0x7ff7a2af0000
File size:	369664 bytes
MD5 hash:	013D00A367D851B0EC869F209337754E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000001A.00000002.885485800.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: ProximityUxHost.exe PID: 4584 Parent PID: 3424

General

Start time:	23:03:06
Start date:	28/09/2021
Path:	C:\Windows\System32\ProximityUxHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\ProximityUxHost.exe
Imagebase:	0x7ff6e9370000
File size:	264480 bytes
MD5 hash:	E7F0E9B3779E54CD271959C600A2A531
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: ProximityUxHost.exe PID: 5376 Parent PID: 3424

General

Start time:	23:03:13
Start date:	28/09/2021
Path:	C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\yC4r\ProximityUxHost.exe
Imagebase:	0x7ff70c010000
File size:	264480 bytes
MD5 hash:	E7F0E9B3779E54CD271959C600A2A531
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000001D.00000002.924400956.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: psr.exe PID: 3064 Parent PID: 3424

General

Start time:	23:03:24
Start date:	28/09/2021
Path:	C:\Windows\System32\psr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\psr.exe
Imagebase:	0x7ff6aeb80000
File size:	600576 bytes
MD5 hash:	3B8262EB45E790BF7FA648CEE2CCCB7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: psr.exe PID: 5152 Parent PID: 3424

General

Start time:	23:03:26
Start date:	28/09/2021
Path:	C:\Users\user\AppData\Local\Tp5KLY\psr.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Tp5KLY\psr.exe
Imagebase:	0x7ff631db0000
File size:	600576 bytes
MD5 hash:	3B8262EB45E790BF7FA648CEE2CCCB7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000001F.00000002.955848713.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: psr.exe PID: 1716 Parent PID: 3424

General

Start time:	23:03:39
Start date:	28/09/2021
Path:	C:\Windows\System32\psr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\psr.exe
Imagebase:	0x7ff6aeb80000
File size:	600576 bytes
MD5 hash:	3B8262EB45E790BF7FA648CEE2CCCB7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: psr.exe PID: 5520 Parent PID: 3424

General

Start time:	23:03:40
Start date:	28/09/2021
Path:	C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\ifnj9zHVv\psr.exe
Imagebase:	0x7ff6a2d70000
File size:	600576 bytes
MD5 hash:	3B8262EB45E790BF7FA648CEE2CCCB7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000021.00000002.982719749.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: wlrmdr.exe PID: 5688 Parent PID: 3424

General

Start time:	23:03:52
Start date:	28/09/2021
Path:	C:\Windows\System32\wlrmdr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wlrmdr.exe
Imagebase:	0x7ff60a940000
File size:	65704 bytes
MD5 hash:	4849E997AF1274DD145672A2F9BC0827
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: wlrmdr.exe PID: 5696 Parent PID: 3424

General

Start time:	23:03:56
Start date:	28/09/2021
Path:	C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\PVSXo\wlrmdr.exe
Imagebase:	0x7ff70e3f0000
File size:	65704 bytes
MD5 hash:	4849E997AF1274DD145672A2F9BC0827
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000024.00000002.1017398501.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: DevicePairingWizard.exe PID: 5468 Parent PID: 3424

General

Start time:	23:04:08
Start date:	28/09/2021
Path:	C:\Windows\System32\DevicePairingWizard.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\DevicePairingWizard.exe
Imagebase:	0x7ff684110000
File size:	92160 bytes
MD5 hash:	E23643C785D498FF73B5C9D7EA173C3D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: DevicePairingWizard.exe PID: 2832 Parent PID: 3424

General

Start time:	23:04:14
Start date:	28/09/2021
Path:	C:\Users\user\AppData\Local\YaR\DevicePairingWizard.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\YaR\DevicePairingWizard.exe
Imagebase:	0x7ff621230000
File size:	92160 bytes
MD5 hash:	E23643C785D498FF73B5C9D7EA173C3D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000026.00000002.1056321571.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: PresentationSettings.exe PID: 2108 Parent PID: 3424

General

Start time:	23:04:26
Start date:	28/09/2021
Path:	C:\Windows\System32\PresentationSettings.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\PresentationSettings.exe
Imagebase:	0x7ff63db90000
File size:	222208 bytes
MD5 hash:	76086DD04B6760277A2B897345A0B457
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: PresentationSettings.exe PID: 1072 Parent PID: 3424

General

Start time:	23:04:27
Start date:	28/09/2021
Path:	C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\br5u0t\PresentationSettings.exe
Imagebase:	0x7ff7b1f30000
File size:	222208 bytes
MD5 hash:	76086DD04B6760277A2B897345A0B457
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000028.00000002.1082755771.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll64.exe PID: 7012 Parent PID: 5300 loaddll64.exeCOMMON

Executed Functions

Function 00000001400495B0, Relevance: 8.7, APIs: 2, Strings: 2, Instructions: 1727COMMON

Download Yara Rule

Strings

}*, xrefs: 0000000140049BDD
}*, xrefs: 0000000140049620

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: b2d8981d994e193b974dd97b3248349f041180fa9e1ee75c24f96b4e32672199
Instruction ID: dfe71950bb4b00d773a2c1e4d7d9ca62016f185058a51a46645e99606ce0912a
Opcode Fuzzy Hash: b2d8981d994e193b974dd97b3248349f041180fa9e1ee75c24f96b4e32672199
Instruction Fuzzy Hash: CDF2E476601B8481EB269F17D5503EE77A1F78EBC8F9A4025EB0A077B5DB38C945C348

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140036F30, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE ref: 000000014003704B
EntryPoint.PSNPAPRPSG ref: 00000001400370EE

Strings

d, xrefs: 0000000140037032
)8GV, xrefs: 0000000140037008

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ConsoleEntryFreePoint
String ID: )8GV$d
API String ID: 3550414006-3589632123
Opcode ID: d05d8187567b24d43b5378db4c26f8457bb6311b4b9be5c519ef70a53fb6d972
Instruction ID: d510f836e5bc92855b025e221ee4853bd72dbb3d22a76ed0b2795177c136f2ac
Opcode Fuzzy Hash: d05d8187567b24d43b5378db4c26f8457bb6311b4b9be5c519ef70a53fb6d972
Instruction Fuzzy Hash: 2C91983230064096EB26EB66D0513EE23A5AB9C7D4F914526BB1E47BFBEE34CA05C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005C340, Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 886COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE ref: 000000014005D101

Strings

sy;, xrefs: 000000014005C9ED
sy;, xrefs: 000000014005C420

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InfoSystem
String ID: sy;$sy;
API String ID: 31276548-3660992706
Opcode ID: 4ba7a1a776c1b2a8194e3aee1005776fcb25fed3b21deabde970c8a1fedf5655
Instruction ID: 6e6b9d6b41ba510f9365bd6ae70f9dc3139515c8db1fe8c3f4a6c85962f57752
Opcode Fuzzy Hash: 4ba7a1a776c1b2a8194e3aee1005776fcb25fed3b21deabde970c8a1fedf5655
Instruction Fuzzy Hash: 2A82DB72215B848AEB26CF27D4507E977E1F789BC4F498426EB4A077B6DB39C941C380

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004BD40, Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 789COMMON

Download Yara Rule

Strings

}*, xrefs: 000000014004C37C
}*, xrefs: 000000014004BDB0

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: 7295418c03dacbe62c915b6dd4b980e4d41f822c5e8600d002afc3f8743a909a
Instruction ID: 589d9863290c94d963c78ae1aba4b537ce1e649f887b860e334c2c2edf70769e
Opcode Fuzzy Hash: 7295418c03dacbe62c915b6dd4b980e4d41f822c5e8600d002afc3f8743a909a
Instruction Fuzzy Hash: B872E172211B8081EBA68F23D4547ED77A1F78DBC4F8A5125EB4A477B6EB38C944C348

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D290, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 000000014005D2ED

Strings

., xrefs: 000000014005D36A

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindFirst
String ID: .
API String ID: 1974802433-248832578
Opcode ID: 676bd74008c321f1f054d2561c231ee4757c1d63a5241c01311e4a1111e2dca9
Instruction ID: 4bac0f1caae8588fed560e2f4dd75fe3b4005a9d196e6938d52e54566134f4c2
Opcode Fuzzy Hash: 676bd74008c321f1f054d2561c231ee4757c1d63a5241c01311e4a1111e2dca9
Instruction Fuzzy Hash: C841A43260564085FB76DB26E1003AD73A1A748BF8F184713EF69177E9DB7AC982C742

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140026CC0, Relevance: 2.9, Strings: 2, Instructions: 362COMMON

Download Yara Rule

Strings

)8GV, xrefs: 0000000140027120
)8GV, xrefs: 000000014002703B

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: )8GV$)8GV
API String ID: 0-993736920
Opcode ID: 5886ea82fe4a1d5b647365e044932bffc6999eebc1d65fac80672f325e465605
Instruction ID: e7db99c2ed76c24e9271fdfca30502f9120cd4f12b6678b2f47d4e41cadbe873
Opcode Fuzzy Hash: 5886ea82fe4a1d5b647365e044932bffc6999eebc1d65fac80672f325e465605
Instruction Fuzzy Hash: 3BF18F7272064095EB52EB72D8913EE6365FB993C8F900426BB0E47AFADF34CA45C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006A4B0, Relevance: 1.7, APIs: 1, Instructions: 237nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 000000014006A550

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: c571d8b9788f13bc1a6c9d6d9ec75b3e860dc3d379630f9026fe8c942d3d5bbc
Instruction ID: ba306794fc56961ae9be9e8108b60f4a03202e28571258f9feaa1cffdeadac3d
Opcode Fuzzy Hash: c571d8b9788f13bc1a6c9d6d9ec75b3e860dc3d379630f9026fe8c942d3d5bbc
Instruction Fuzzy Hash: 25B16E36601B409AE712EF26D9403EE33A6F7497C8F645825EB4E47BA6DF38D524CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140048AC0, Relevance: 1.7, APIs: 1, Instructions: 185libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL ref: 0000000140048CDE

Part of subcall function 000000014005D1F0: FindNextFileW.KERNELBASE(?,?,CD3BEB56,0000000140048BFE), ref: 000000014005D21B

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindLoadNext
String ID:
API String ID: 50669962-0
Opcode ID: aa0438968589772fc8f2a9ec3ebe64abc64651e75ec2b3921e4afd98a3b5e278
Instruction ID: 5bbbb247b64301f03cc62f5655f26b2922a91791dd430743fbd3ba68f8766a4f
Opcode Fuzzy Hash: aa0438968589772fc8f2a9ec3ebe64abc64651e75ec2b3921e4afd98a3b5e278
Instruction Fuzzy Hash: 07819D3261568092FB22EB26E4513EE6365FBD83D4F814521FB4A57AEBEF38C605C704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140035270, Relevance: 1.7, APIs: 1, Instructions: 181COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140046C90: NtClose.NTDLL ref: 0000000140046CBE

ExitProcess.KERNEL32 ref: 00000001400354E1

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseExitProcess
String ID:
API String ID: 3487036407-0
Opcode ID: 5c30d9f3bf3ad5247cfe131953472b6de56d2531a4e84ebcbfa6a909151eb5a4
Instruction ID: 3d479053040576d7404e3dfab4813d6254088c9544e20b556efee73ce8d776a8
Opcode Fuzzy Hash: 5c30d9f3bf3ad5247cfe131953472b6de56d2531a4e84ebcbfa6a909151eb5a4
Instruction Fuzzy Hash: 5771BF32710A5096FB16EB72D4513EE2365AB883D9F844522BF5E53AFADF35C906C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046C90, Relevance: 1.5, APIs: 1, Instructions: 19nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL ref: 0000000140046CBE

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: daec19cacdd098f1244212ea8e14a5d3e1bd9439d57025bc9e494c2d8b520846
Instruction ID: acc9ee73913d888b71121e4cedfe861758cf19cabea33dd7822bbf7d3cf7603a
Opcode Fuzzy Hash: daec19cacdd098f1244212ea8e14a5d3e1bd9439d57025bc9e494c2d8b520846
Instruction Fuzzy Hash: 42E08CA1741A0041EF265276D0803A812809B4D7B4E194B209A7D0B3E0EA3888898716

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400524B0, Relevance: .8, Instructions: 815COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1fe821b06c1a4823bb9271ec043e796f757224c870123343ecb03a76390b80a
Instruction ID: bccbce3911ab829ef3288d496869760cb1404da12fac801df191153d1e38d36e
Opcode Fuzzy Hash: b1fe821b06c1a4823bb9271ec043e796f757224c870123343ecb03a76390b80a
Instruction Fuzzy Hash: 9172CD72601B9485FB26CF17D4503E967A1FB8EFC4F998426EB0A077A5EB39C945C380

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140065B80, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef59d8dad7016460516c65c54e0757d465c5ab080b3c9532efa0d5a42b826e15
Instruction ID: 84a8ec628d281786b49b5e6f6f6dec0d0376b1c45e732984354cafa0c8984479
Opcode Fuzzy Hash: ef59d8dad7016460516c65c54e0757d465c5ab080b3c9532efa0d5a42b826e15
Instruction Fuzzy Hash: D761947121164102FE76B72399047EE5292AFAD3E4F650B21BF6E47BF9EE38C9018740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140034870, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9551ae3eb8102b5ebebf946a3998feeee295eeedab946ed72fd7e67ef554d99f
Instruction ID: 713527809b35fed6260ebd230ad48717dd4fa7a304d79e310e96a8de0daf9cee
Opcode Fuzzy Hash: 9551ae3eb8102b5ebebf946a3998feeee295eeedab946ed72fd7e67ef554d99f
Instruction Fuzzy Hash: 5A717D32B04B4095FB12EBB2E4913DF67A5FBC8388F954025BB4957AAADF38D445CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140061360, Relevance: 6.3, APIs: 4, Instructions: 290registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 0000000140061459
RegEnumKeyW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 00000001400614B4
RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 0000000140061539
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002,?), ref: 0000000140061664

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close$EnumOpen
String ID:
API String ID: 138425441-0
Opcode ID: 672031fc434e6626b90ea1da62f3c38a687c8b9296ffac50e7f6928d6a85a361
Instruction ID: 4377045c35190c944746a6ea10b9b47c13ce871b5e3b3a15cce40fdff127085f
Opcode Fuzzy Hash: 672031fc434e6626b90ea1da62f3c38a687c8b9296ffac50e7f6928d6a85a361
Instruction Fuzzy Hash: 5BC1A43120568082FE629B16E8503EEA791E7C97E0F6C4A21FB6E47BE5DE78C941C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000227E28A2252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00000227E28A23B0
VirtualProtect.KERNELBASE ref: 00000227E28A2471
RtlAvlRemoveNode.NTDLL ref: 00000227E28A25B4
VirtualProtect.KERNELBASE ref: 00000227E28A2677

Memory Dump Source

Source File: 00000001.00000002.700277716.00000227E28A0000.00000040.00000001.sdmp, Offset: 00000227E28A0000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 6453f0ffba29cb13ccafce2cfabc6bf5abf62f8b65b38cfe44aaa1dfd2363d26
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 0AB163B6618BC486D7B0CB5AE44179EB7A1F7D9B80F118026EE8953B58DF79C8418F40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005F9F0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 000000014005FA4B

Strings

4aX, xrefs: 000000014005FA09

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DescriptorSecurity$ConvertString
String ID: 4aX
API String ID: 3907675253-4042356595
Opcode ID: a1249fc2010d9d5d05952f0359ba200457e66aefbced3d07103a2c3463c61beb
Instruction ID: 5c7b4eddd96f597e19123db416744eb931adcf52cf9da5c093af566d74744993
Opcode Fuzzy Hash: a1249fc2010d9d5d05952f0359ba200457e66aefbced3d07103a2c3463c61beb
Instruction Fuzzy Hash: EC216D72214B4582EA12EF66E1403DEB3A0FB8C7C4F844525EB8D07B6AEF39D625C745

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DAE0, Relevance: 3.1, APIs: 2, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44297aa2126b14dcd4d9c9accf23e52108ed4399094c5e3af94dd8103b7f7b57
Instruction ID: c5574eec75406f68cf122a08b4571db932f63f1e1c7d3e43579234279b4bb767
Opcode Fuzzy Hash: 44297aa2126b14dcd4d9c9accf23e52108ed4399094c5e3af94dd8103b7f7b57
Instruction Fuzzy Hash: A151D03130464182FA72EA63A4507EA77A2BB8CBD4F154527BF5A077E2EF7AC801C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DD30, Relevance: 3.1, APIs: 2, Instructions: 122fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 000000014005DDD8
ReadFile.KERNELBASE ref: 000000014005DE49

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 00f6d0f3771a8cfa98223a140d65de6735ec101d3a44d5ddd75e2d9def7749f0
Instruction ID: 869152f87e2051f324d9e8f0f01270def7d2743b76a8e6c9a5e95a296a3a7e26
Opcode Fuzzy Hash: 00f6d0f3771a8cfa98223a140d65de6735ec101d3a44d5ddd75e2d9def7749f0
Instruction Fuzzy Hash: A541583161464087EA62DB3AA4447AAB3A1FBD87E0F144712BB6D4B7F5DF39C802DB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBB9, Relevance: 3.1, APIs: 2, Instructions: 79filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: 8a0a731fb1e22280383dc4c244850d697ffee92b9dbadae0b2290ba2595e9be9
Instruction ID: 944ab0cbe82d54181631abf043b2a82f72de4fdca767e43f24bb2c72b9c0c91f
Opcode Fuzzy Hash: 8a0a731fb1e22280383dc4c244850d697ffee92b9dbadae0b2290ba2595e9be9
Instruction Fuzzy Hash: 8D21B431214A4581EA72DB66A0407EA3795F78CBE4F184617EFAE077E5DF7AC806C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBD2, Relevance: 3.1, APIs: 2, Instructions: 77filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: d6d835041d1b41abb3b5fe648f8f275da576c4891ed88a603463ed8b7f508fb5
Instruction ID: bee1728ae0ee1a0caa625709e376bb4aadd3217f15d1bcce0d190476addee932
Opcode Fuzzy Hash: d6d835041d1b41abb3b5fe648f8f275da576c4891ed88a603463ed8b7f508fb5
Instruction Fuzzy Hash: BE21D332311A4581EA72DA66A0407EA3795B78CBE4F184527AF9D077E5DE7AC806C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBE8, Relevance: 3.1, APIs: 2, Instructions: 76filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: 6bbc7cb38f56b555cae5d46dc9eb85d7f0e424b0d62445df59964c24eed4e9f3
Instruction ID: a00dbcca095f64b26cda9c271166364bdf2e86a9b80154192fb139b54d898421
Opcode Fuzzy Hash: 6bbc7cb38f56b555cae5d46dc9eb85d7f0e424b0d62445df59964c24eed4e9f3
Instruction Fuzzy Hash: 5521E532315A4581EA72DB62A0407EE3791F78CBE4F184517AFAD077E5DE7AC806C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140060D10, Relevance: 3.1, APIs: 2, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,000000014004890D), ref: 0000000140060D85
RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,000000014004890D), ref: 0000000140060DE8

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0af55b123fcd85ad11f65efe4d0ac2719b06ecdcd8a99680970ae4064010c44f
Instruction ID: 09cc4365fb23fa9fe14c599ab373ea3e5ec1bde103bfdbf39ccb6e9a9538c2db
Opcode Fuzzy Hash: 0af55b123fcd85ad11f65efe4d0ac2719b06ecdcd8a99680970ae4064010c44f
Instruction Fuzzy Hash: F521A37671569046EF52CB56E8003AFA391EB897F4F184621BF9C07BE8EA38D582C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBF8, Relevance: 3.1, APIs: 2, Instructions: 73filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: eb6f16229e65501cd5258548e2b4ff06530ad065b40e2a3bf9e2a9b945b11f61
Instruction ID: 68fcab11a3bde380270331896f94efb0ab36e54eb9d04e7f46ecdc112822b6b1
Opcode Fuzzy Hash: eb6f16229e65501cd5258548e2b4ff06530ad065b40e2a3bf9e2a9b945b11f61
Instruction Fuzzy Hash: 6821C132315A4541EA72DB62A0407EA3795F78CBE4F184627EFAD077E5DE7AC806C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046F60, Relevance: 1.7, APIs: 1, Instructions: 216COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0000000140046FDE

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 505a76da9390751f76a813a8bc9fce4b727984ade222f3073bfceff6bf9580dc
Instruction ID: 560481d37deeb2f3cc02cd101c0a384bc9ca8e36dca6fa428839860d024f360c
Opcode Fuzzy Hash: 505a76da9390751f76a813a8bc9fce4b727984ade222f3073bfceff6bf9580dc
Instruction Fuzzy Hash: EDA15D3271064099EB12EFB6C4913EE2365A7987C8F915126BF0D67AFAEF34C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005FDA0, Relevance: 1.6, APIs: 1, Instructions: 144synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNELBASE ref: 000000014005FEFE

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 6be956e981540fc735b56164f72d0aea79e48331418f8fd9eaab398243b5d8cf
Instruction ID: 2cd33cf12082532a652157af79f02d7873b375395221c82c38bac87e111ef697
Opcode Fuzzy Hash: 6be956e981540fc735b56164f72d0aea79e48331418f8fd9eaab398243b5d8cf
Instruction Fuzzy Hash: 6E51B2326117408AEB66EB22A0013EE6291EB9DBC4F580535FF4E477E6DF39C802D790

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D1F0, Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,?,CD3BEB56,0000000140048BFE), ref: 000000014005D21B

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: ff4ac6c2ef48f38791092f6d6c449714fc18167456ec2ef2bc1084d7df7feef3
Instruction ID: fe48dd106ee2d63de4642147a978de6f9e341aec22c75ad1205c2678dbe1ece1
Opcode Fuzzy Hash: ff4ac6c2ef48f38791092f6d6c449714fc18167456ec2ef2bc1084d7df7feef3
Instruction Fuzzy Hash: 80115B7561034082FF76DA6691047E933E1EB697C8F051013EF59472E9EB36C8D2C751

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140060BA0, Relevance: 1.5, APIs: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32 ref: 0000000140060C16

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: a3c12b60ccc1d223e9782810bc36042d204e1f874336debb41352ff4bff3a234
Instruction ID: 650aff04d41c3b1619de3e88208a4500c6b85af191ab70c767efd2679610bbe3
Opcode Fuzzy Hash: a3c12b60ccc1d223e9782810bc36042d204e1f874336debb41352ff4bff3a234
Instruction Fuzzy Hash: 1C112E72204B8486D7219F12E84039EB7A5F788B90FA89529EB8D43B58DF39D991CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046690, Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

RtlCreateHeap.NTDLL ref: 00000001400466DD

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 21b05e3ef22cad88cebd019d8e45e363c17e6ba0707ecabdd33f955b9f4b15ed
Instruction ID: 54976bf3431427af6da968cf6b263ec8d4a99ac7c2bea2f2fd5649cd882baac1
Opcode Fuzzy Hash: 21b05e3ef22cad88cebd019d8e45e363c17e6ba0707ecabdd33f955b9f4b15ed
Instruction Fuzzy Hash: B901D635706A8082EB528712FA4039A73A0F78C3C4F198524EF884B7A5EF38C8518B44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046730, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

RtlDeleteBoundaryDescriptor.NTDLL ref: 000000014004678C

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: BoundaryDeleteDescriptor
String ID:
API String ID: 3203483114-0
Opcode ID: 7b0e43f28c4f526d6edd5220e1ccf75e5ddb2081b4342278c18d43c75b4d1ee9
Instruction ID: 7e2fcedd46cf55f04110c2a11ced308778be976df41b62f125aabd7639a18320
Opcode Fuzzy Hash: 7b0e43f28c4f526d6edd5220e1ccf75e5ddb2081b4342278c18d43c75b4d1ee9
Instruction Fuzzy Hash: 70F0F878A4730141FE6A63B354543A511821FCC7C4F0E8834AF095B7A6EE38CD518699

Uniqueness

Uniqueness Score: -1.00%

Function 00000227E28A2057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,00000227E28A29A8), ref: 00000227E28A20A7

Memory Dump Source

Source File: 00000001.00000002.700277716.00000227E28A0000.00000040.00000001.sdmp, Offset: 00000227E28A0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 3e391defbf0ebec1d67061d89ce7769a7f250bfd5c08a69c94ca6cb69e184279
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 88315CB2719B8086D780DF1AE45575A7BA0F389BD4F219026EF8D87B18DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000000014002B6E0, Relevance: 8.2, Strings: 6, Instructions: 741COMMON

Download Yara Rule

Strings

GNOP, xrefs: 000000014002B9CB
3050, xrefs: 000000014002BB42
0020, xrefs: 000000014002B98B
4040, xrefs: 000000014002BB6A
0020, xrefs: 000000014002BB49
3050, xrefs: 000000014002B992

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: 0020$0020$3050$3050$4040$GNOP
API String ID: 0-829999343
Opcode ID: 537da1a0c1bbc7e636232495bc2fdab7c2537f76630bc9218dea00809d8f4601
Instruction ID: 282167bc52f218920562f67345f8403ae15435ff558287d674a5e0b6e797f698
Opcode Fuzzy Hash: 537da1a0c1bbc7e636232495bc2fdab7c2537f76630bc9218dea00809d8f4601
Instruction Fuzzy Hash: 4172507261068195EB22EF26D8913EE6365FB983C8F804016FB4E475FAEF34CA45C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140071DC0, Relevance: 5.7, Strings: 4, Instructions: 682COMMON

Download Yara Rule

Strings

ERCP, xrefs: 0000000140071EED
VUUU, xrefs: 000000014007211B
VUUU, xrefs: 000000014007213B
VUUU, xrefs: 0000000140072194

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU
API String ID: 0-2165971703
Opcode ID: 203c99bb3d64071a34d91be2023c6ff0f734778017a54347eb9ef20583df3fc0
Instruction ID: a95f611128f1d5d13a9bca75b656ea52fec65ffdb08565925219bb8e60db198b
Opcode Fuzzy Hash: 203c99bb3d64071a34d91be2023c6ff0f734778017a54347eb9ef20583df3fc0
Instruction Fuzzy Hash: 2252BE727046848AEB6A8F6AD5503ED7BA1F3087D8F144116FF569BAE8D73CC981C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400667D0, Relevance: 5.4, Strings: 4, Instructions: 448COMMON

Download Yara Rule

Strings

SW, xrefs: 0000000140066A1A
SW, xrefs: 0000000140066CA6
SW, xrefs: 0000000140066A69
SW, xrefs: 0000000140066C49

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: SW$SW$SW$SW
API String ID: 0-1120820918
Opcode ID: 517e9c748c7166ea23e42337479b6e8f1bff1248af9cf0015b4bedbae01fd632
Instruction ID: 5271b3b9b35d550c8de01999338ba1aa790ab169e66fccb1d44a6718ff6f2241
Opcode Fuzzy Hash: 517e9c748c7166ea23e42337479b6e8f1bff1248af9cf0015b4bedbae01fd632
Instruction Fuzzy Hash: 4C026D3170160146EB62EB73D8603EE2396AB9C3C8F554925BB4D87BEAEF35DA01C310

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140031DF0, Relevance: 5.3, Strings: 4, Instructions: 270COMMON

Download Yara Rule

Strings

GC,, xrefs: 0000000140032008
GC,, xrefs: 00000001400321D7
GC,, xrefs: 0000000140031FC2
GC,, xrefs: 000000014003216C

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: GC,$GC,$GC,$GC,
API String ID: 0-2774350030
Opcode ID: 98649618faad92dfac345ced2ac743c97f2c410892ae2dd8dadb9da2da6be478
Instruction ID: dd0ba4053c6bdb050c0e262549aa376da4335980b2dde8bb0cc8774c9fa84b1c
Opcode Fuzzy Hash: 98649618faad92dfac345ced2ac743c97f2c410892ae2dd8dadb9da2da6be478
Instruction Fuzzy Hash: 39B14A3232168096EA16EB22D4513EFA765FBDC7C4F854425FB4E57ABAEE38C605C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140057950, Relevance: 4.5, Strings: 2, Instructions: 1977COMMON

Download Yara Rule

Strings

}*, xrefs: 00000001400579C0
}*, xrefs: 0000000140057F89

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: a0a69438047e54f28e9ccb842af0afe3b69bef60083965763f3b059d71ba89a0
Instruction ID: 7c281f25cbc51a2c663274e483e0a5d4adc9f9b548fde4e06667abda5a9e2262
Opcode Fuzzy Hash: a0a69438047e54f28e9ccb842af0afe3b69bef60083965763f3b059d71ba89a0
Instruction Fuzzy Hash: 6E03CB72201B8482EB26CF23D4543ED67A1F78DBC4F994416EF4A177A6EB3AC945C380

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400263C0, Relevance: 4.3, Strings: 3, Instructions: 519COMMON

Download Yara Rule

Strings

)8GV, xrefs: 0000000140026A4D
)8GV, xrefs: 00000001400267B0
@, xrefs: 0000000140026B3F

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: )8GV$)8GV$@
API String ID: 0-2802744955
Opcode ID: a3e8ee5ab549556569e9006b525bd9d1ac3761a68850dd604f4cfbeaa6d7384c
Instruction ID: d4403fa2ef2757ed15b0d897a8d3d48ae9d82dee7601a7ae60b507309942f45e
Opcode Fuzzy Hash: a3e8ee5ab549556569e9006b525bd9d1ac3761a68850dd604f4cfbeaa6d7384c
Instruction Fuzzy Hash: 8F326E72610A8095FB22EB72D8513EE6365FB997C8F940026BB4E476FADF34CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400067B0, Relevance: 4.2, Strings: 3, Instructions: 406COMMON

Download Yara Rule

Strings

GET, xrefs: 000000014000688D, 000000014000689B
*/*, xrefs: 0000000140006D02
POST, xrefs: 0000000140006CF6

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: */*$GET$POST
API String ID: 0-3233530491
Opcode ID: f5c0abb872f3f3a9c24645541f102443df8f6c01efe130de31add9333cb11604
Instruction ID: 6cf15a5ed41f927c804a0d4041fd2741414eb33ceb6b5d93e391305a3a4948eb
Opcode Fuzzy Hash: f5c0abb872f3f3a9c24645541f102443df8f6c01efe130de31add9333cb11604
Instruction Fuzzy Hash: 57125C72610A8196EB11EF72E8913DE6765F7883D8F904122FB4E57AAADF34C249C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140035520, Relevance: 3.9, Strings: 3, Instructions: 117COMMON

Download Yara Rule

Strings

{QN, xrefs: 00000001400355E1
GC,, xrefs: 0000000140035622
GC,, xrefs: 0000000140035665

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: GC,$GC,${QN
API String ID: 0-3150587038
Opcode ID: fd0f7604477b89c46016288274ae5da6e1d22dae5e6d5d6e9033f3dbe6d447d0
Instruction ID: 9244b60d004d0bd22f383007071d62e4da67c70af0efad37e4d475a9577969ab
Opcode Fuzzy Hash: fd0f7604477b89c46016288274ae5da6e1d22dae5e6d5d6e9033f3dbe6d447d0
Instruction Fuzzy Hash: D851B3726017408AEB26AF72A0517DF3392EB98398F559529FB4E0BBE9DF39C401C741

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140025DB0, Relevance: 2.9, Strings: 2, Instructions: 401COMMON

Download Yara Rule

Strings

0, xrefs: 0000000140025FF4
GC,, xrefs: 0000000140025E65

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: 0$GC,
API String ID: 0-3557465234
Opcode ID: 666bbe70a71d3c2c69398fa3d4293e156315b44e2ec60054ed199f516d69305b
Instruction ID: 8e8f5bced65d739128878f1be46f709eb140c798bd495bd8ba2efbba04664ca7
Opcode Fuzzy Hash: 666bbe70a71d3c2c69398fa3d4293e156315b44e2ec60054ed199f516d69305b
Instruction Fuzzy Hash: 90F1C132705B8086EB56DB26A5503EE77A5F788BC8F544029FF8A47BA9DF38C845C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002FB20, Relevance: 2.7, Strings: 2, Instructions: 200COMMON

Download Yara Rule

Strings

cLpS, xrefs: 000000014002FB76
cLpS, xrefs: 000000014002FB46

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: cLpS$cLpS
API String ID: 0-581437482
Opcode ID: 34fd53aa0ebdbc9f7987fe69826bd589cd4ce70c6830deca293095981677af5c
Instruction ID: d6b56411a1e340b191dd7f08d0c8a8920ca136b0ade9766ce73097337fe28e3c
Opcode Fuzzy Hash: 34fd53aa0ebdbc9f7987fe69826bd589cd4ce70c6830deca293095981677af5c
Instruction Fuzzy Hash: F5916E32700A41A6FB12EB72D5513ED2366AB983D8F900126BF1D97AFADF34D919D340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140039140, Relevance: 2.1, Strings: 1, Instructions: 866COMMON

Download Yara Rule

Strings

D, xrefs: 0000000140039B2B

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 0452af0be93170f0712028ec6d1a4f1ed763d309de66f3c97f53239ecee0938c
Instruction ID: a2166a60d7ca2b4a0d1872d5e3506bb785f107662951e93f9f6f62b20c08bf0e
Opcode Fuzzy Hash: 0452af0be93170f0712028ec6d1a4f1ed763d309de66f3c97f53239ecee0938c
Instruction Fuzzy Hash: 32827E3222468186EB13EB26D4907EF6365FBD8794F904612FB5A47AFADF38C605C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000C5C0, Relevance: 2.1, Strings: 1, Instructions: 865COMMON

Download Yara Rule

Strings

GET, xrefs: 000000014000C5D5

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: GET
API String ID: 0-1805413626
Opcode ID: 27aa1fcbf8bb0fd35ba8f1726e1321bde18c1ec1ebf4c6ce6eb5ba4c065116bb
Instruction ID: e67aa13565bd515be4758c424d677281e7e48e69fdea67d752e56d6b70eb8f16
Opcode Fuzzy Hash: 27aa1fcbf8bb0fd35ba8f1726e1321bde18c1ec1ebf4c6ce6eb5ba4c065116bb
Instruction Fuzzy Hash: 7182CFB262568082FB52EB26E491BEE6761F7C97C8F851022FB4A576E7CF38C505C701

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140015120, Relevance: 2.1, APIs: 1, Instructions: 555COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32 ref: 000000014001530B

Part of subcall function 0000000140046C90: NtClose.NTDLL ref: 0000000140046CBE

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseEnvironmentExpandStrings
String ID:
API String ID: 1839112984-0
Opcode ID: 0c8cab0b1b935b3a37cb31b96907ffd9b34d960d626d1d55b93d79ad55693549
Instruction ID: c0dbe0ee55e83fb6c0f3bef3624a57e5635b4c6ed11a4d6c977be8f15ec7e338
Opcode Fuzzy Hash: 0c8cab0b1b935b3a37cb31b96907ffd9b34d960d626d1d55b93d79ad55693549
Instruction Fuzzy Hash: CB427E32710A4096FB12EB72D4913EE6765EB983D8F814422BB4D4BAFAEF34C645C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140019D20, Relevance: 2.0, APIs: 1, Instructions: 546COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 687ffdf343c2e9789a5d1ebb489b5c539987e33f75712a11b993f063ce15b1a2
Instruction ID: abc698a25be580435ac5d46bd6b01b3c7dd535f90f9c32282677b8a643a0cbd6
Opcode Fuzzy Hash: 687ffdf343c2e9789a5d1ebb489b5c539987e33f75712a11b993f063ce15b1a2
Instruction Fuzzy Hash: 3C427D3271068095FB22EB76D8513EE2361EB993C8F904121BB0E5BAFAEF79C545C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140019580, Relevance: 2.0, APIs: 1, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 127911a31568296dbbdbd0e7203d4322e69c18d1e401fad8c93ef71fb1fa4fd2
Instruction ID: 0bcce83d19b55e388762cc41cc2fbdfa61478623d1bee2f25155124e52c32027
Opcode Fuzzy Hash: 127911a31568296dbbdbd0e7203d4322e69c18d1e401fad8c93ef71fb1fa4fd2
Instruction Fuzzy Hash: 8A128E3271468095FB22EB72D8913EE2355EB997C4F804026BB4E5BAFADF35C605C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006EB0, Relevance: 1.9, Strings: 1, Instructions: 651COMMON

Download Yara Rule

Strings

cLpS, xrefs: 00000001400072A3

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: cLpS
API String ID: 0-2886372077
Opcode ID: 39b3e9410c272ead3331ad6fef3a5a390c12b147565654b66b7ca87bf70ff1a0
Instruction ID: 96b4c198141fe6e7034ab14ad9d5ea3cda72442e6a1109ae0a48173783152c86
Opcode Fuzzy Hash: 39b3e9410c272ead3331ad6fef3a5a390c12b147565654b66b7ca87bf70ff1a0
Instruction Fuzzy Hash: CF528D7272464092FA12EB62E8517EE63A5FB9C7C4F814022BB4E57BBADF38C505C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400139D0, Relevance: 1.8, Strings: 1, Instructions: 571COMMON

Download Yara Rule

Strings

m, xrefs: 000000014001422E

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateMutex
String ID: m
API String ID: 1964310414-3775001192
Opcode ID: 079af9642e33be8b1418e23995d0953d3028e11a16e9caecd14c6a2ac72b7534
Instruction ID: 0a9d90af75a6ede7406656d6adb6787827cf479cbe6b14872f7c626c13ea0b6d
Opcode Fuzzy Hash: 079af9642e33be8b1418e23995d0953d3028e11a16e9caecd14c6a2ac72b7534
Instruction Fuzzy Hash: 6A529B32710A80A6F74EEB32C5913EE7369F788384F904026AB2947AE6DF34D576C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001D100, Relevance: 1.7, Strings: 1, Instructions: 497COMMON

Download Yara Rule

Strings

s( j, xrefs: 000000014001D128

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: s( j
API String ID: 0-1450404818
Opcode ID: 19985d2dc72a707ec5f83c91129fc97538500d80b5f4466283615156a38f1139
Instruction ID: 6f5b3d0b06e06ce3defbe5b62ba999e8dce43b7996f1ec96da6707378b1ebcba
Opcode Fuzzy Hash: 19985d2dc72a707ec5f83c91129fc97538500d80b5f4466283615156a38f1139
Instruction Fuzzy Hash: 14325632715B9085EB16EF66D8513ED73A5FB88B88F454026EB4E5BBAADF38C505C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140029780, Relevance: 1.7, Strings: 1, Instructions: 491COMMON

Download Yara Rule

Strings

kw9b, xrefs: 000000014002989A

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseEnumValue
String ID: kw9b
API String ID: 858281747-837114885
Opcode ID: e8ba736cc1ae897b53590531b1c8201d906e4f93dc6415c10813659a3bbeb7cc
Instruction ID: a79da12e532d7eb86b4034213f2927d281404f76e1d3d8be4d202bd2a10f559e
Opcode Fuzzy Hash: e8ba736cc1ae897b53590531b1c8201d906e4f93dc6415c10813659a3bbeb7cc
Instruction Fuzzy Hash: D622A03270064056FB22EB62E4513EE6361EB8C7D8F814625BB4E57AFADF38CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140033BB0, Relevance: 1.7, Strings: 1, Instructions: 454COMMON

Download Yara Rule

Strings

U, xrefs: 000000014003408F

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 1612c2b18446cb3e650eba47dd8b229cab4fb8fae804e2c9001081e94953d27d
Instruction ID: 04dcf981b535b3d5a04f4e0f983876b723d65533687fb2a3abc72c4897885b35
Opcode Fuzzy Hash: 1612c2b18446cb3e650eba47dd8b229cab4fb8fae804e2c9001081e94953d27d
Instruction Fuzzy Hash: 7A22A032714A8095FB22EB76D4913EE2761EB993D4F900122BB4E5BAFADF38C545C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023530, Relevance: 1.7, Strings: 1, Instructions: 430COMMON

Download Yara Rule

Strings

Content-Type, xrefs: 000000014002385F

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: Content-Type
API String ID: 0-2058190213
Opcode ID: cd802d8b45f15130d3c27f80ef655ed1c5064d239956586ea4d9a7fa25c30ca4
Instruction ID: 8ed0294b40edec3e111ebf6e63eddced9ff886ac8d86313f53d4d34ac86a637b
Opcode Fuzzy Hash: cd802d8b45f15130d3c27f80ef655ed1c5064d239956586ea4d9a7fa25c30ca4
Instruction Fuzzy Hash: D0128B7271064096EB26EB72D0953EE63A5EB9D7C8F804029FB4E576B6DF34C909C341

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400389A0, Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

0, xrefs: 0000000140038A46

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID: 0
API String ID: 3535843008-4108050209
Opcode ID: 7016f170174e11ab425f8740a2873dc54fd790cf1ab3d78218ff6c8b86cc580b
Instruction ID: 021d52728ad99ff4b45c00a2ee63d530dbb35c35c3e7b67721d4418a9cae59c0
Opcode Fuzzy Hash: 7016f170174e11ab425f8740a2873dc54fd790cf1ab3d78218ff6c8b86cc580b
Instruction Fuzzy Hash: A4D1483271064185EB22EB66D8503EF6365FB987C8F944421FF4E57AAAEF34CA05C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400205A0, Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

, xrefs: 000000014002069B

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 13b354268872ef66367d09f0eaf7f41c1b6cce90139d1ccde9a6c23eddc411d2
Instruction ID: 091f4e73938a5afec608f70625f4eed5baac112ec883e15b973b01c59944fd94
Opcode Fuzzy Hash: 13b354268872ef66367d09f0eaf7f41c1b6cce90139d1ccde9a6c23eddc411d2
Instruction Fuzzy Hash: 8FB1903271164156FB26EB72C0513EE2365A78C7C8F554429BF0E67BEAEE34D906C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002EED0, Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

, xrefs: 000000014002F04E

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 266006fd5134fcae821d54f81f057cdba6f5be873c6199ef93d4c42334c526d2
Instruction ID: 79bcb73a3e0a748e54816e3c2b9a8955141e4b7d1d3c260807ef7fd3e9233e09
Opcode Fuzzy Hash: 266006fd5134fcae821d54f81f057cdba6f5be873c6199ef93d4c42334c526d2
Instruction Fuzzy Hash: 4681AF3171528042FA66AB63A5513EE6382BBDC7C0F954839BF0E57BEADE38C9019750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023140, Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

tI*k, xrefs: 0000000140023300

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: tI*k
API String ID: 0-257501792
Opcode ID: b15996fbae463eef0efc9f4e5c4cbf386dde064011b2806a6f0ecd12f6b98297
Instruction ID: 2b3e36108f388e75195695150bf3b7502d87346db4925aa772ee75e92517338c
Opcode Fuzzy Hash: b15996fbae463eef0efc9f4e5c4cbf386dde064011b2806a6f0ecd12f6b98297
Instruction Fuzzy Hash: C891B332710A41C6FB12EB73D4913ED2365AB987C8F815026BF0E67AABDE34C605C391

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140078570, Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

ERCP, xrefs: 00000001400785BF

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: ERCP
API String ID: 0-1384759551
Opcode ID: 9a8959bd3d8286152fe3b07e5e9b9c99826fd1463cb640f02497020a3b8cf481
Instruction ID: 36d71a898891e4cfc692b0c24b63e4f8a605753b41eb4ec31f3d0d909baacb04
Opcode Fuzzy Hash: 9a8959bd3d8286152fe3b07e5e9b9c99826fd1463cb640f02497020a3b8cf481
Instruction Fuzzy Hash: 8541C2677244554AE3189F2598213BE2391F7E8781B008838BBC7C3B99E97CCE41C754

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004F940, Relevance: .9, Instructions: 873COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb12e34294cccc152743157d68ecf537d73dadfb1b78744b1cf0542ab0e03321
Instruction ID: fc2f62d5942ef41123ea32f2955be4f6aadf7052ab01c2248917173129c7cd0f
Opcode Fuzzy Hash: cb12e34294cccc152743157d68ecf537d73dadfb1b78744b1cf0542ab0e03321
Instruction Fuzzy Hash: 8A82BD72301B8486EB269F23D4503EE67A5F78DFC4F964022EB4A577A6DB38C945C384

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140053F20, Relevance: .8, Instructions: 808COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7250f98c0d712e4fed8a9177b7990c03dbf5da58cb0dd37bc7f0a46ed34db0c
Instruction ID: b1defcb4bfd3908c290bb80924a7f4486985742b072abc47c5e9bd5be53152ef
Opcode Fuzzy Hash: d7250f98c0d712e4fed8a9177b7990c03dbf5da58cb0dd37bc7f0a46ed34db0c
Instruction Fuzzy Hash: FF72CE32601BA482EB26CF17E4503ED77A5FB99BC8F9A4016EB49477B6DB36C941C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140054BA0, Relevance: .8, Instructions: 797COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6290f3f4936625c1500c9bb5ab49f73b0f0e92f6783c0cfd327242af27f29f
Instruction ID: 8249503d4e55669e8e7119aec1729776b7b2f3ca46fae70a891a003f6664f3d4
Opcode Fuzzy Hash: 0b6290f3f4936625c1500c9bb5ab49f73b0f0e92f6783c0cfd327242af27f29f
Instruction Fuzzy Hash: 3472DF32201B9486EB26DB17E4603ED77A5FB9DBC5F894012EB4A477B6DB3AC941C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140016E80, Relevance: .7, Instructions: 739COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 570444da3395dbff037c1797def2714c1b19642f17c99ed10635228c9c88b714
Instruction ID: 4fdb0601fab6f7a848b28641239d596080eab1ec2c6ff824b21f12e2ef69b5a1
Opcode Fuzzy Hash: 570444da3395dbff037c1797def2714c1b19642f17c99ed10635228c9c88b714
Instruction Fuzzy Hash: 48722D32724A4095EB02EB76D4913EE6765EB983C4FC05012BB4E879BBEF38C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004EB60, Relevance: .7, Instructions: 687COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf02e0b346a645ce41284f4b25ae6de0e0561089bc0c4212f6de5587c4ccb21
Instruction ID: d53d10191d1a85c044aba7f3ec212ac92ce5176a248edb2932ce54add84afe44
Opcode Fuzzy Hash: bbf02e0b346a645ce41284f4b25ae6de0e0561089bc0c4212f6de5587c4ccb21
Instruction Fuzzy Hash: 9D52BE72601B8081EB269F23D4543EE77A1F78CBC4F8A5426EB4A577B6DB38D845C348

Uniqueness

Uniqueness Score: -1.00%

Function 000000014007BD50, Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1d6ac494662c45c571e96f77a6e8211c4f0b163f6c515dcb42af03e52a945a
Instruction ID: 9c06e88039ccf999e040ad7794a2e2d02b6699145a9792014979c24fd1337f6c
Opcode Fuzzy Hash: dd1d6ac494662c45c571e96f77a6e8211c4f0b163f6c515dcb42af03e52a945a
Instruction Fuzzy Hash: B4623CB76206548BD7668F26C080B6C37B1F35DFA8F25521ADF0A43799CB39D891CB90

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003B220, Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c541702096c1ae675d9f8552b841f1df762d73269a6d039e8a3e529e919bb3f5
Instruction ID: acd1ff4a64a9c803ec812a22a8ce79600e1464d52fdb42fb628072365476121f
Opcode Fuzzy Hash: c541702096c1ae675d9f8552b841f1df762d73269a6d039e8a3e529e919bb3f5
Instruction Fuzzy Hash: 64429E31301A8141FA23EB6698513EF6391EB8C7E8F544616BF5A5BBEAEE38C505C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140024440, Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc2a6e3d2e1231b3fe707f0d0f35a30ce2f56e53bfff03d4db06bbddff5caabd
Instruction ID: 78f3400fd7e206f6a511ea736ed45412fb3e7259efd4ed926287f6c9bd4c6aa7
Opcode Fuzzy Hash: fc2a6e3d2e1231b3fe707f0d0f35a30ce2f56e53bfff03d4db06bbddff5caabd
Instruction Fuzzy Hash: E6427C32204A8096EB66EB32D0513EE67A4E79D3C8F914026F79A876F7DF38C945C741

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018630, Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44882556ec0b6035508ab17f7b7fd4b756285181e69dc9f77d466bd3c4569491
Instruction ID: 8108868c1ca7c4f1afbe8bd34af9d7f1e96dfbbf12b1edd0cffad3fdf1fa0b6f
Opcode Fuzzy Hash: 44882556ec0b6035508ab17f7b7fd4b756285181e69dc9f77d466bd3c4569491
Instruction Fuzzy Hash: 3F429E3231068095FB22EB72D8913EE6765EB983D8F844122BB0D97AFADF34C645C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023BF0, Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060d71c651ab3aed04444553114f4ea5a7531cc3ca58c37faf4133b09f387ec2
Instruction ID: 183f2e46b23aa86a2c091461a645f9a581571388db0d92becfc597eb429af356
Opcode Fuzzy Hash: 060d71c651ab3aed04444553114f4ea5a7531cc3ca58c37faf4133b09f387ec2
Instruction Fuzzy Hash: 0732AB3271064089EB16EB36D4513EE27A5EB8CBD8F555126FF0E877BADE38C4868340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400123C0, Relevance: .5, Instructions: 544COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf04223ec18bb60842fe7fa632ea836e81c8b6d6b17b3371276cc931bd38ff2
Instruction ID: 71edd40f2b1ab928f6f3b4ddf8d26af45cb7d1258c95c78617a62a1a74f3288a
Opcode Fuzzy Hash: baf04223ec18bb60842fe7fa632ea836e81c8b6d6b17b3371276cc931bd38ff2
Instruction Fuzzy Hash: BF32AC3261068195EB12EB26D4913EE2765FB983C8F814122FB4E57AFBEF38C645C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B120, Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8328b10af82aab1ef65ff433d7820bced4cba86e0066b221c3c838f9fd1e431
Instruction ID: 3ba19fba285517c5acd5c21b3c9b7592edaf423ca2de06bba8230fcf7af2400b
Opcode Fuzzy Hash: e8328b10af82aab1ef65ff433d7820bced4cba86e0066b221c3c838f9fd1e431
Instruction Fuzzy Hash: 3C429B72624A8095FB12EB62D4957EE2365FB983C8F814022FB0D57ABBDF34C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400381A0, Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ee38f4c6dee734349d5b0dcc202e437ae908f573234f4aff5f510a5883c84b0
Instruction ID: eb795f204498a8d956ef0de19ff8bd43d97085c04d8ed5933d3115b51340510f
Opcode Fuzzy Hash: 7ee38f4c6dee734349d5b0dcc202e437ae908f573234f4aff5f510a5883c84b0
Instruction Fuzzy Hash: 7022793270064186EA23EB2AD4957EF63A5EB88BD4F554626FF0A477F6EE34C506C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003A2E0, Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8d1907d2a62ce1ae108db488a351868ceb64fffc9dd42578434a0f34ae656a
Instruction ID: 697e8bd1027fccc09012cb901671f32632dfdae7722e2c733c5167ca59ce0a7a
Opcode Fuzzy Hash: 1e8d1907d2a62ce1ae108db488a351868ceb64fffc9dd42578434a0f34ae656a
Instruction Fuzzy Hash: AE227C3271064186EA23EB26D4513EF63A1FB89BD4F544625EB4A577F6EF38C50AC340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B390, Relevance: .5, Instructions: 458COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b3dc1032e7b852d429d3288fc6d56ff3ef19d98c02d1d103b4f123b92fc1f1
Instruction ID: 5c003effdee5129b35cf12aebe167f862a01b0c8d0d2f43ab9f1123e32a30f31
Opcode Fuzzy Hash: 71b3dc1032e7b852d429d3288fc6d56ff3ef19d98c02d1d103b4f123b92fc1f1
Instruction Fuzzy Hash: 8C0203B21082A489F7768B26C9413FA7BE2E759788F254906FB8A435F5D738C9C1D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000DDF0, Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e375be9be99e9838cc7803ed6e7672458d2ec84ccfc9a0c18b017f9565b827c
Instruction ID: c2c66f55aa66479377f68c186b881699d763759fa92e2ffabb716b860ed1a50b
Opcode Fuzzy Hash: 2e375be9be99e9838cc7803ed6e7672458d2ec84ccfc9a0c18b017f9565b827c
Instruction Fuzzy Hash: CD224D72710A8091EB12EB72D4913EE6765FB987C8F904116FB4E876BAEF38C245C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005C40, Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f513173c25ae17789a403cea68c9e18d94625c6d02a52581dcb230289bad16b3
Instruction ID: 217fabc6e38e1d640ccd999207fddb20e056db183073941d35cbdb4b11e649c3
Opcode Fuzzy Hash: f513173c25ae17789a403cea68c9e18d94625c6d02a52581dcb230289bad16b3
Instruction Fuzzy Hash: 10229B72620A8091EB12EB62E4957EE2365F79D7C4F814022FB4E576BBDF38C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140067A40, Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed167cb2d41bf65051b1e1e6ca4fc372791feb4efe79826a7b7afb1d034e643
Instruction ID: 3448a1cfdf5732c1482eebf940cb1862e5db89764351cf67f11e8459266109f6
Opcode Fuzzy Hash: 6ed167cb2d41bf65051b1e1e6ca4fc372791feb4efe79826a7b7afb1d034e643
Instruction Fuzzy Hash: CD026C727006418AEB12DF26D4907EE73A6F788BC4F614525EB0E977AADF34D90AC740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000BB40, Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8296aae514971c10519780c04e533f569930ad849b100b0340065f0f39cb86db
Instruction ID: a963730c34943060851cd64ea719675db259de8104656558a9074d2de6a51302
Opcode Fuzzy Hash: 8296aae514971c10519780c04e533f569930ad849b100b0340065f0f39cb86db
Instruction Fuzzy Hash: 41128F7222468096FB52EB22D4917EE6765FBD93C8F811022FB4E57AABDF38C505C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140069010, Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: 95963d20b21cf3e2b12cfe18c6fe82eaabeff9446a80277d54ce9a7fffb05132
Instruction ID: 5afa6d75f76fbbc9d7f53df6043056336d1db5d7591574d5123318d553f9c856
Opcode Fuzzy Hash: 95963d20b21cf3e2b12cfe18c6fe82eaabeff9446a80277d54ce9a7fffb05132
Instruction Fuzzy Hash: 19124E3272469096EB12EF72D8913DE6765FB987C8F815022BB0D57AABDF34C605C710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001E170, Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 9b801c6cfe21829965e01690717934929f301b57ebd9e24914ab7e4ccc7a8bd8
Instruction ID: ac8bef764291a5126b18a53dad73757551fec454a5992e6944e07fe4b855ac86
Opcode Fuzzy Hash: 9b801c6cfe21829965e01690717934929f301b57ebd9e24914ab7e4ccc7a8bd8
Instruction Fuzzy Hash: 2A023B32724A80A2FB52EB72D4913EE6764FB983C4F815022BB4D57AEADF35C545C710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002FEC0, Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4119716334bae8ce4a12a511c9ef3e68b40bfa4d08e13555b81686db08763198
Instruction ID: b67327a95b15ec145a913cc43aeca3e3a8a77925bd43874970612b3ea802a6ff
Opcode Fuzzy Hash: 4119716334bae8ce4a12a511c9ef3e68b40bfa4d08e13555b81686db08763198
Instruction Fuzzy Hash: A802707272064095EB02EB66D4913EE6765FB987C8F905022FB4D83ABBEF34C649C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002980, Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 8eff327b3244b5e4bcb204ecf2616417784072c62e8997917ef3bb952dc9c563
Instruction ID: 5d574d698b33f004de0812fa71b34c36bbdae31478704d480fb686f148b39898
Opcode Fuzzy Hash: 8eff327b3244b5e4bcb204ecf2616417784072c62e8997917ef3bb952dc9c563
Instruction Fuzzy Hash: EB024C72324A8096FB12EB62D4913EE6765EB983D4FC15022BB4E57AEBDF34C605C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018F80, Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae8c2c1811faa848f940e4a298acd31fbb5db82ef74365df61737aab6befccc0
Instruction ID: d38a929efe70148cd0bcafb05e8c0916e90d43f0c382b2c9e415ecaf47ade149
Opcode Fuzzy Hash: ae8c2c1811faa848f940e4a298acd31fbb5db82ef74365df61737aab6befccc0
Instruction Fuzzy Hash: C8F16D32610A8095FB12EB76D8513EE6365EB983D8F940521BB0E57AFBEF35C605C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140010880, Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d8f91d721c478637f80766b80e37fef242b82150883bd374cc6845ff3be0a72
Instruction ID: f0fb79f68922493fed5bc905321703954c20a875d362dace52344ff7232635a8
Opcode Fuzzy Hash: 8d8f91d721c478637f80766b80e37fef242b82150883bd374cc6845ff3be0a72
Instruction Fuzzy Hash: D7029272320AA19AEB42DF36C8917EE2724F748789F805016FF4B57AAAEF35C545C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001D910, Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: 05ee41dc75372f3184bd1bd526553eb93c41a596f4ef0b14bf7d6c74ff3eb6f4
Instruction ID: 9c3e8f75c9e591130820bb2956cb3806339feb13e112d9af22726fcddd3bd126
Opcode Fuzzy Hash: 05ee41dc75372f3184bd1bd526553eb93c41a596f4ef0b14bf7d6c74ff3eb6f4
Instruction Fuzzy Hash: 12026C32314A8095FB52EB72D4917EE2765EB983C4F805022BB4E97AEBDF35C649C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140033540, Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76dd430cce1ce6768c64dce55b4180b759221ef9574e8c45ed07b1ebd879cb4c
Instruction ID: d0d419901b6e3c3183ee3913f1137c5e588d0fadc92f77f7791849e6aeb29d3b
Opcode Fuzzy Hash: 76dd430cce1ce6768c64dce55b4180b759221ef9574e8c45ed07b1ebd879cb4c
Instruction Fuzzy Hash: 8A029132614A8095EB22EF32D4913EE6765FB98388F904412FB4E57AFADF34C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140017B40, Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb9de39e3049ab5455ed32541b517d82ebf0524dcb0a324d3a012e30b74715a
Instruction ID: fccd9241a873054b7c24d42fb58abb6f012b2f7f19fe3a4c061a127f88627f2a
Opcode Fuzzy Hash: adb9de39e3049ab5455ed32541b517d82ebf0524dcb0a324d3a012e30b74715a
Instruction Fuzzy Hash: 41E18E3271068095FB12EB76D8917EE6765EB983C8F804021BB0D5BAEBEF35C645C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002CB80, Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b6f1b094effc9f245018c12fb0bd54aed54c11f9143a05f6df0da17f49fd19b
Instruction ID: 02ee9b89192d395c78975687d30e6fb06be8b995001c736011e159ca0d17724c
Opcode Fuzzy Hash: 9b6f1b094effc9f245018c12fb0bd54aed54c11f9143a05f6df0da17f49fd19b
Instruction Fuzzy Hash: E2E13D32714A4095EB02EB66D4913EE6765FB983D8F900012FB4D97AFAEF34CA49C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400018D0, Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b36c55cc0c64182b75bd054714d27820267f0f2f65f1b0bf4452dbf409dd159
Instruction ID: 95da75048f27146dafc5de9d612871b80806eb61125b8034b1f63b71f4cba504
Opcode Fuzzy Hash: 4b36c55cc0c64182b75bd054714d27820267f0f2f65f1b0bf4452dbf409dd159
Instruction Fuzzy Hash: 47F12C3262498096EB12EB62D8513ED6365FBD8388F814522BB4E479FBEF74CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003AAC0, Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7780c785dee08e0bb9155763342d8440fe36315939b45b58d1687e3de4f63a
Instruction ID: cf5fdc312f2229dc6ff813412d90ddbabd12b8e4de7574aebc9877f7d05b411a
Opcode Fuzzy Hash: 9e7780c785dee08e0bb9155763342d8440fe36315939b45b58d1687e3de4f63a
Instruction Fuzzy Hash: 28D19032711A4195EB12EB76D4903EE23A1EB993C4F844425BF4E57BEAEF38C605C350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140064080, Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16253b5d55ff71ace7e49d720cc951c571e11621ee8e21fa8c6a30ce5dfdcbdc
Instruction ID: bf23390ce128f79092fde7b2b9043ef6653a4f1b38eae35900255c6e9c132ad5
Opcode Fuzzy Hash: 16253b5d55ff71ace7e49d720cc951c571e11621ee8e21fa8c6a30ce5dfdcbdc
Instruction Fuzzy Hash: ABC1D4231282D04BD7569B3764503FAAE91E79A3C8F280655FFC997AEBD63CC2149B10

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002D0D0, Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f12721fbfba6283dc7958c84227ce6bb15a7590cb07e0c84499cdb4845d6b172
Instruction ID: d0d512be425b72175eef7d799d9923e381f6a995b1e0446f0295c878f1c0c086
Opcode Fuzzy Hash: f12721fbfba6283dc7958c84227ce6bb15a7590cb07e0c84499cdb4845d6b172
Instruction Fuzzy Hash: CED13972724A4091EB02EB76D4913EE6765F7983C8F904016BB4D97ABAEF38C605C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140030530, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da2952e0823b3d5a59f73c7ab384f762a6d9a624e53a469d815e2d2c0d7a72ca
Instruction ID: 96955b53f7f5b4430e01eb0035ad3df088e7672fa3a311151148bede835f9000
Opcode Fuzzy Hash: da2952e0823b3d5a59f73c7ab384f762a6d9a624e53a469d815e2d2c0d7a72ca
Instruction Fuzzy Hash: E7C16136B0564089FB22EB76D0613EF27A1AB9C388F554425BF4E976FADE34C506C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002A110, Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 8317b6107b79d8746eb836802ab66d92c4c2213a6f1849c4bee5ec7b69d23b54
Instruction ID: 08807915bc927436db1a901aa043915a979950c5e23cf508b5f0d65b77d78aa9
Opcode Fuzzy Hash: 8317b6107b79d8746eb836802ab66d92c4c2213a6f1849c4bee5ec7b69d23b54
Instruction Fuzzy Hash: 0CD17032614A8096EB02EB26D4513EE6364FBD97C4F815122FB4D57AEBDF38CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005F490, Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c98a7c03b056bf897b50c999e530441a062f43ea8ff7e63b9bd448889a0739
Instruction ID: f96005f1b71c62cd91ec633b0fa556b6f093996ab6e40a041e3cbd638a23d0d9
Opcode Fuzzy Hash: 29c98a7c03b056bf897b50c999e530441a062f43ea8ff7e63b9bd448889a0739
Instruction Fuzzy Hash: C1C1BD3270164096FB12EF76D4413ED23A4EB883A8F484622BF2D57AE6EF38D955D350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022D00, Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005ad93020e0817431c5e85dbe6d11178de2602f8c4bd9af456519582a9ff990
Instruction ID: 38de139323f3e079e5738bdd278af51575638bb101dd3218b17e6965c0953cb4
Opcode Fuzzy Hash: 005ad93020e0817431c5e85dbe6d11178de2602f8c4bd9af456519582a9ff990
Instruction Fuzzy Hash: 1DB16A3671062094FB46EBA2D8A17DE2365BB89BC8F825025FF0D67BA7DE38C505C354

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140031540, Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97dd306fff28f1ab02ecd5c90015a73acd09471cf75e7327e0331e3ccb750c21
Instruction ID: bfe4e87f351d28bd3d3693bc96d2151355ab9388d993d4a46e39ffd0a3f78ad6
Opcode Fuzzy Hash: 97dd306fff28f1ab02ecd5c90015a73acd09471cf75e7327e0331e3ccb750c21
Instruction Fuzzy Hash: E6C16332704A809AFB22EBB2D4513EE2365AB9C3D8F854521BF1E676EADF30C505C354

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140062B00, Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfd4a30f1a27aef1054c36b1d99c0610af0cc08103e55e4b01f0e7caa7c836f
Instruction ID: f23c3879964f3f83b961310f1bad7f7be1ef7afa2b68ec7d59790f469601a501
Opcode Fuzzy Hash: bcfd4a30f1a27aef1054c36b1d99c0610af0cc08103e55e4b01f0e7caa7c836f
Instruction Fuzzy Hash: A9A10231211E8145EBA79A2798543EF27A6AB8C3D4F645825FF0E5B6E9EF34C901C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B41B, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16274a22d167cb7459d5025cfc47ed7afc639167fa2c9c1057ca1fd72c03709f
Instruction ID: c0d98bc7e162404dc537a7c1af49e5fbe25e03b535df8b2493956c53732576b9
Opcode Fuzzy Hash: 16274a22d167cb7459d5025cfc47ed7afc639167fa2c9c1057ca1fd72c03709f
Instruction Fuzzy Hash: B2A114F31182A486FB778A2685413FA7FE2E719789F254402FB8A435F6C63CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140066020, Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a77b3ded0776d671925a3aad9e7cc492f01908de9f9e7db45f2ad695b1e2ca
Instruction ID: d17e179c4ad3c1814a715198efb3da372d22ab0628f3c9d9f6a3a053a6971865
Opcode Fuzzy Hash: 39a77b3ded0776d671925a3aad9e7cc492f01908de9f9e7db45f2ad695b1e2ca
Instruction Fuzzy Hash: 79A1903271164045EB22EB7298507EE67E6AB9C3C8F550925BF4D47BEAEF34CA068310

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007A60, Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb3ae0ca8b09634f6b3eb7f35d10a75bd1e51e3d218a5b4533eb8f41dc86bd2
Instruction ID: 7cb660c1bafc6db3c15f0a4866a94b05aa7759728bb06ab0739d07cd917ce7e2
Opcode Fuzzy Hash: 8bb3ae0ca8b09634f6b3eb7f35d10a75bd1e51e3d218a5b4533eb8f41dc86bd2
Instruction Fuzzy Hash: 33B18C7262464191EB12EB62E4913EE6365FB9C7C4F801022FB4E47ABBDF38C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B43D, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8327572ae460ec67bee7642bc1df1dfc8e00bf19c98c3d2f0bb37742338d2b
Instruction ID: ff1b56ecf022c2229069a5389c0477a62f006b84fd5f9f69eebb894724ab9066
Opcode Fuzzy Hash: dc8327572ae460ec67bee7642bc1df1dfc8e00bf19c98c3d2f0bb37742338d2b
Instruction Fuzzy Hash: 44A125F21182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B424, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92fc6e297697f72d3d55b197ac04fe50775a4f95a26f4c9e919e5e137ab98750
Instruction ID: f965aa676d2cc64f6a485257af634002c7fef1377d4791c8bed9b1b7e56d6411
Opcode Fuzzy Hash: 92fc6e297697f72d3d55b197ac04fe50775a4f95a26f4c9e919e5e137ab98750
Instruction Fuzzy Hash: 79A115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B42D, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e075c1df208aa39fb877a834bfc4403f559291216783e55fb63477ae2eadfdc
Instruction ID: 86c182e730ead1fa639f737d8458d4edb1cdee6041daaa12aedc2aef895c7c0c
Opcode Fuzzy Hash: 1e075c1df208aa39fb877a834bfc4403f559291216783e55fb63477ae2eadfdc
Instruction Fuzzy Hash: 83A115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B436, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68406ce4345875cbc0110dbe212228596ffa7fd34d07f9d141f7f6a9cf54bfa
Instruction ID: 7a8579acbe1e06e5dcc528155c10978c06d1d02f61772b3afab02cdca005db6d
Opcode Fuzzy Hash: b68406ce4345875cbc0110dbe212228596ffa7fd34d07f9d141f7f6a9cf54bfa
Instruction Fuzzy Hash: 3EA115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B446, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a2fa5d4e375044cfc16d96b5b502da69406d12098659286745a9d4aecf6a6c
Instruction ID: 9b5f4d2890da7bc9148b0c777fb781a5a0913674a9f0c1f21bc34f13756e8484
Opcode Fuzzy Hash: 20a2fa5d4e375044cfc16d96b5b502da69406d12098659286745a9d4aecf6a6c
Instruction Fuzzy Hash: 37A114F31182A489FB778A2685413FA7FE2E719789F254402FB8A475F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140069A50, Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847c53cd22c21084d67cb822d3c8f80ec4024bd4884789ed31c06eb0f484aec6
Instruction ID: 9e8436de532ad8a8b9d83a7ce7f67d33a1e65f1b543d517c902b78be038a8119
Opcode Fuzzy Hash: 847c53cd22c21084d67cb822d3c8f80ec4024bd4884789ed31c06eb0f484aec6
Instruction Fuzzy Hash: 6FA19F3271464095EB22EB72D4913EE63A5A78C7C8F914426FF0D57AFAEE38C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001010, Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b042d90c0f8c1feaf42d72467fc8ea1d5898c5b9afd74594c11dc23e78b13021
Instruction ID: 891caef274385c1d9a1a05b5f8e139ad0eea2bdcde326525a3acf11d5ee056db
Opcode Fuzzy Hash: b042d90c0f8c1feaf42d72467fc8ea1d5898c5b9afd74594c11dc23e78b13021
Instruction Fuzzy Hash: 79918D7270164095EB16EF66E4507EE23A5ABDC7C4F448425BF4E97BA6EE34C906C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002EA00, Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe13e77ec2a6c39a7eeb857abf77be5bd43dd3bfff72b646a5cfb36ea006c22
Instruction ID: 09ec91f3f7d35e473cfa3e72b303784d96220d522314983c3d838af10b8059fe
Opcode Fuzzy Hash: dbe13e77ec2a6c39a7eeb857abf77be5bd43dd3bfff72b646a5cfb36ea006c22
Instruction Fuzzy Hash: C4A16E32314A8095FB22EB72D8513EE2365EB987D4F940426BB4D57AFADF34CA05C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018300, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce67bfafa3a41e60d72f08d4a165a2184096e63d57257d43e1b540ba17e5e704
Instruction ID: 9282ef7f3f2e177ec3162a27807bc3d77d508fe5c2bed51c5ff564ba7b898efa
Opcode Fuzzy Hash: ce67bfafa3a41e60d72f08d4a165a2184096e63d57257d43e1b540ba17e5e704
Instruction Fuzzy Hash: 99912232B15A4099FB12EBB2D4913ED23659B9C7C8F814525BF0DA76EBEE34C609C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002E1B0, Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: e13badc4eecd54d72134e33fa3c908df50463b4c7afbc823f6efb99f8860a50f
Instruction ID: a01e236db0e61280ae7bc249da652572acbbc64743681568c883ee8cb5c556df
Opcode Fuzzy Hash: e13badc4eecd54d72134e33fa3c908df50463b4c7afbc823f6efb99f8860a50f
Instruction Fuzzy Hash: D7916C3272468092FB12EB62D4957DE6365FB9C7C4F811022BB4D43AABDF78C544CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003EFB0, Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bec047f33ee0572188590f4278c6d3b9bee721e36306d1774188d0e8c9170a8
Instruction ID: 2085d5fbde7ab3b46fd7c59f247d5158c6ccb74e37f4a5dfc0e2ff2c0c09d730
Opcode Fuzzy Hash: 9bec047f33ee0572188590f4278c6d3b9bee721e36306d1774188d0e8c9170a8
Instruction Fuzzy Hash: 87814F36204A85C6EB679B2BE9403AF6B61F38DBD0F594512EF9A477B5CE38C442D310

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400276C0, Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edcdc2154c5838ab1c8625022021c2da12bae5cdd39a93ebf1f5cb6a04e32108
Instruction ID: bfac23c94d9038130fb0cc9f6c7292f6f1aa2b418e68c536fc9a693e481bc66c
Opcode Fuzzy Hash: edcdc2154c5838ab1c8625022021c2da12bae5cdd39a93ebf1f5cb6a04e32108
Instruction Fuzzy Hash: 1E91B13270164096FB22EB22D4517EE23A0EB9C3C8F855426BB4E57AFADF34C944C351

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140064E80, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bede4ae264e8185b0f9f24becd31f8195eff363a0612df846459a6d3a9af60c0
Instruction ID: 348a5c641c523964159132b8cb670365254cd557f13034448bd6fc243d7f1d42
Opcode Fuzzy Hash: bede4ae264e8185b0f9f24becd31f8195eff363a0612df846459a6d3a9af60c0
Instruction Fuzzy Hash: AB81503271064095FB12EB76D8913EE63A5AB9D7C8F944621BF0D4BAEAEF34C605C350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140016100, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e54b42b1a183fcc3e26b712d0c98e0febe665e521d345cd27406ffce54824ba
Instruction ID: 4362bffb4ce140633d60009826b42a117c21897de7dbf4a94b418fc321f1d931
Opcode Fuzzy Hash: 0e54b42b1a183fcc3e26b712d0c98e0febe665e521d345cd27406ffce54824ba
Instruction Fuzzy Hash: 35812032714A809AFB12EB72D4513ED2365EB9C388F814425BB4E67AEBEF35C605C354

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140032650, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 1556071639309c0f3bf9c98b804d70b10111ac1c0d30ce30fda26827df1e6222
Instruction ID: a8b049447ef23dc7a2f3147d56ae0c312f8ac6a7955db6ed7517384e00930876
Opcode Fuzzy Hash: 1556071639309c0f3bf9c98b804d70b10111ac1c0d30ce30fda26827df1e6222
Instruction Fuzzy Hash: 0371893270264096FB66AB7294503EE6391EB9C7C8F054526BB1D47BEAEF39C905C360

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400663F0, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d7b3c9e63ec17fbb3decf34851c1318d937a82485f1e960baa699eab580419
Instruction ID: 4c1290556f20f3e20b66d81894b0d385f6ea8bc2319cc982c81cb2944955426d
Opcode Fuzzy Hash: 53d7b3c9e63ec17fbb3decf34851c1318d937a82485f1e960baa699eab580419
Instruction Fuzzy Hash: 6E61B031301A4041EA66E737A9517EF97929F9D7D0FA44621BF5E877FAEE38C9028700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D850, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ec1b3edf0780c5c25e1336ba948ef3e7aec6e0b63b2610df3acb1851feab05
Instruction ID: 50d9e92313d7fbe24902196c924c1612cff9653e99501bbf2772a847790ebefc
Opcode Fuzzy Hash: 17ec1b3edf0780c5c25e1336ba948ef3e7aec6e0b63b2610df3acb1851feab05
Instruction Fuzzy Hash: 7D618D3271464496FB22EB72C0913EE23A5ABDC7C8F854422BF4D57AEAEE35C501C791

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001620, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e611ef6babe13b88f779e8dc5a7611e7c7a64f37548e21c7e35d19833addd5d9
Instruction ID: f8f81a1e6eeb4aa67bd22a5a7a70358e1ddf5b3241a247c9d5674b6b5ab46101
Opcode Fuzzy Hash: e611ef6babe13b88f779e8dc5a7611e7c7a64f37548e21c7e35d19833addd5d9
Instruction Fuzzy Hash: 9061C43262465091FB21EB26E0517EE6360FBCD7C4F815122BB5D47AEAEF79C541CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400319F0, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: ac7f08871eadb0e88aebf12c8c96c3d08f64978839d47a5fff32e650f5283656
Instruction ID: f33abad4c1c8ba015261be05896130ca5dc3e7c07ce7e813c180037223ea8262
Opcode Fuzzy Hash: ac7f08871eadb0e88aebf12c8c96c3d08f64978839d47a5fff32e650f5283656
Instruction Fuzzy Hash: 08718E32714A809AEB12EF76D4913EE7761F798388F844026FB4D47AAADF74C548CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400688A0, Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: c6b0428fc7416c9690bb78137e55356240e86da8257680fa94455239788aca03
Instruction ID: 125c4d10a522e701d1fb6d0f1aef761f583aa31ccbb75f1db25899523a723602
Opcode Fuzzy Hash: c6b0428fc7416c9690bb78137e55356240e86da8257680fa94455239788aca03
Instruction Fuzzy Hash: 0151633271468052FB22EBB6E4513EE6761EBD83C4F951122BB4D47AEADE38C544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022730, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025899d978c00459a39b97666279dda4e96ed2cbcc4f77a24580eef4709ea6a8
Instruction ID: af2d80f9b144edbe9aa630ca6e788b257520dbedf888a3db325da96401233726
Opcode Fuzzy Hash: 025899d978c00459a39b97666279dda4e96ed2cbcc4f77a24580eef4709ea6a8
Instruction Fuzzy Hash: FA612832600B8085E755DF36A481BDD33A9F78DB88FA84138EF990B36ADF318055D768

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140031340, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f431bbfb257fb34b4f249f0b6c1a5781a1840d33aa954166e75b638a15f3be8f
Instruction ID: 50cb9f747c07e87171e39f534f7bbd71060f83f950b2ada1a46c15cbddfc577a
Opcode Fuzzy Hash: f431bbfb257fb34b4f249f0b6c1a5781a1840d33aa954166e75b638a15f3be8f
Instruction Fuzzy Hash: A0511B32700A4096FB12EB76D4917EE2365AB9C7C8F954421BF0DA7AEADF34C605C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002F840, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1a38846fc5b12dd28166e38272f044d4b391af603d2f1471411a8db1635f5ab
Instruction ID: 9602d307e9de31d357e639a9611a18ab9b6f2b9e1d5f0c6a8a00986c6f50d329
Opcode Fuzzy Hash: e1a38846fc5b12dd28166e38272f044d4b391af603d2f1471411a8db1635f5ab
Instruction Fuzzy Hash: 7F51AD32200A40A2EA22EB22D9957FE63A5F7DC7D0F854626FB0D836B6DF34C556D710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002DDE0, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 92949d39d4540ea38b5c00f16dffcfa1214f5dbdd9c806517ba7762cbc11b342
Instruction ID: aca98edda921e0e11dbb2b437e66833b6d9475281c93859f86ded24665675a69
Opcode Fuzzy Hash: 92949d39d4540ea38b5c00f16dffcfa1214f5dbdd9c806517ba7762cbc11b342
Instruction Fuzzy Hash: E5516E3271465095FB52EB76E4913EE6761EBD8388F850026BB4E479EADF38C948CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140060FE0, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1f30609a35c92b6828c9fb432082ebd1e5c5e84766b67bb61e5bcc9401a082
Instruction ID: 51a026cb75a50cc44213724d5bb8c382370875f63e51d6fdf42d7c4c4c07ed92
Opcode Fuzzy Hash: 1c1f30609a35c92b6828c9fb432082ebd1e5c5e84766b67bb61e5bcc9401a082
Instruction Fuzzy Hash: 5D415F32B1066095FB12E77798517EE23A2ABCD7C4FA94421BF0E57AEBDE34C5018354

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400611A0, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8619ee3f9ccd1f320a5fbfbf5c9367aa5b7df2049cee1b1ea35a7e4b7e812f95
Instruction ID: fec891e6c53086f7b9094a78f95b73510c7007b912bc3ef8a41aa8e11e9acb14
Opcode Fuzzy Hash: 8619ee3f9ccd1f320a5fbfbf5c9367aa5b7df2049cee1b1ea35a7e4b7e812f95
Instruction Fuzzy Hash: 01413D31B2066095FB12EB7798513EE13A6ABDC7C4F994421BF0E97AEADE38C5058314

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022A00, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a10d479a193238a188e8adb5c0a2baa624421bbad2986b298b06f84ca2b66ec
Instruction ID: 4d6ce7f696a26fe9a74b6bb9734e6d6bbac3d85ccec2ef1c97bdec5ab73240ea
Opcode Fuzzy Hash: 9a10d479a193238a188e8adb5c0a2baa624421bbad2986b298b06f84ca2b66ec
Instruction Fuzzy Hash: FC51D732610B9085E785DF36E4813DD33A9F748F88F58413AAB8D4B7AADF348152C764

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400286B0, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 0dd31b007056381f4657a5f1dbdce23ecbf955912ad383fd51e82bbfc18d9e36
Instruction ID: a9185cf0004c76bb3001b2cb896eaa84c5f9aff40342764b4326ba4d96cea24c
Opcode Fuzzy Hash: 0dd31b007056381f4657a5f1dbdce23ecbf955912ad383fd51e82bbfc18d9e36
Instruction Fuzzy Hash: 9F514632310B81A2E74EDB32E5813D9B369FB8C384F908415EB9813AA6DF35D676D704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022340, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0bc628afaa724f2a407568f7776cab89400c990b0d91b82c0bf42df1747497
Instruction ID: 1e1e8128ca37617077ad8d3bddb138d765a5f71e348f586f351b06e9a9582713
Opcode Fuzzy Hash: 8d0bc628afaa724f2a407568f7776cab89400c990b0d91b82c0bf42df1747497
Instruction Fuzzy Hash: 5C51C773611B9085E745DF36E8813DD37A8F748F88F58413AEB894B6AADF308156C760

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140063BD0, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a990b53e0665ad0886faa979631976ec8b00dc7985899795eb44eacb3e5b3434
Instruction ID: 5f416d68214368cc8d497caad67b5ad9eebcd67f96a0df70edf52f54e079c757
Opcode Fuzzy Hash: a990b53e0665ad0886faa979631976ec8b00dc7985899795eb44eacb3e5b3434
Instruction Fuzzy Hash: DE31F53221099842FBA6471B9C613F93292E79C3E4F649625FB8E537F4D67DC8038B80

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005370, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bce42950a1e8a62078921d64ca997753bf7c09f413ca20ce6f360246a445e94
Instruction ID: 604a730c127844f2816d2636316060c5dd02da03d6f4240a24423d76594c64fe
Opcode Fuzzy Hash: 5bce42950a1e8a62078921d64ca997753bf7c09f413ca20ce6f360246a445e94
Instruction Fuzzy Hash: 55313F32610B9091E749DB36D9813DD73A9F78CB84FA58526A39847AA6DF35C177C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007EA0, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.698738573.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.698728462.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698849368.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.698874372.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.698892981.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc6e0ee29a39c7d5a8b9bac5d98e7e3adc62a080d0eb157144b98198d9367420
Instruction ID: 1d8fa33d8030516f9812c7435f1c2f5fee2e6c5a40d503ba1f82db291cb841dc
Opcode Fuzzy Hash: cc6e0ee29a39c7d5a8b9bac5d98e7e3adc62a080d0eb157144b98198d9367420
Instruction Fuzzy Hash: 7131DC32600B4080E745DF3699813EDB3E9FBACB88FA9853697484A9B6DF35C157D310

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 7092 Parent PID: 7056 rundll32.exeCOMMON

Executed Functions

Function 0000025065E12252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0000025065E123B0
VirtualProtect.KERNELBASE ref: 0000025065E12471
RtlAvlRemoveNode.NTDLL ref: 0000025065E125B4
VirtualProtect.KERNELBASE ref: 0000025065E12677

Memory Dump Source

Source File: 00000004.00000002.762287444.0000025065E10000.00000040.00000001.sdmp, Offset: 0000025065E10000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 4f4599a630eabd8f4939c0c98ec4f439d396d8a071a83b816fb024017dcd0839
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 69B14276618BC486DB70CF1AE88079EB7A1F799B80F508026EF8953B58DB79C8518F40

Uniqueness

Uniqueness Score: -1.00%

Function 0000025065E12057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000025065E129A8), ref: 0000025065E120A7

Memory Dump Source

Source File: 00000004.00000002.762287444.0000025065E10000.00000040.00000001.sdmp, Offset: 0000025065E10000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 0e35008f6c7f104acf6a9a63286abb0bd690c6363261ff45969d2724d949d8c6
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: D9315C72615B8086DB90DF1AE89475E7BA4F389BC4F604026EF8D87B18DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 7120 Parent PID: 7012 rundll32.exeCOMMON

Executed Functions

Function 0000027ECA902252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0000027ECA9023B0
VirtualProtect.KERNELBASE ref: 0000027ECA902471
RtlAvlRemoveNode.NTDLL ref: 0000027ECA9025B4
VirtualProtect.KERNELBASE ref: 0000027ECA902677

Memory Dump Source

Source File: 00000005.00000002.677361665.0000027ECA900000.00000040.00000001.sdmp, Offset: 0000027ECA900000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 42d1ab20fe992aa4238f2f75e2a26f70f6bb05d72b359b5e29d5327f99f9bdb3
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 06B1447A618BC486DB70CB1AF44179AB7A1F7C9B80F11802AEF8D57B58DB79C8418F44

Uniqueness

Uniqueness Score: -1.00%

Function 0000027ECA902057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000027ECA9029A8), ref: 0000027ECA9020A7

Memory Dump Source

Source File: 00000005.00000002.677361665.0000027ECA900000.00000040.00000001.sdmp, Offset: 0000027ECA900000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 096dc99641d955673c35aa5ea34b011ab7162b52f332dba58f45a1f5256877bd
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 6F313876615B9086DB80DF1AE45575A7BB0F389BC4F218026EF8E87B18DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 4388 Parent PID: 7012 rundll32.exeCOMMON

Executed Functions

Function 000001A61B9A2252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001A61B9A23B0
VirtualProtect.KERNELBASE ref: 000001A61B9A2471
RtlAvlRemoveNode.NTDLL ref: 000001A61B9A25B4
VirtualProtect.KERNELBASE ref: 000001A61B9A2677

Memory Dump Source

Source File: 00000008.00000002.685979113.000001A61B9A0000.00000040.00000001.sdmp, Offset: 000001A61B9A0000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 0c1ae8109f8de5cc49b477b4facff2d29c56b190eee108c6bf05d0533f6639c3
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: ABB15776619BD486D770CB1AE4407DEBBA1F7CAB80F148026DEC957B68DB79C8428F40

Uniqueness

Uniqueness Score: -1.00%

Function 000001A61B9A2057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001A61B9A29A8), ref: 000001A61B9A20A7

Memory Dump Source

Source File: 00000008.00000002.685979113.000001A61B9A0000.00000040.00000001.sdmp, Offset: 000001A61B9A0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: b12d4fe92f332104a74d1ca55262582a39cf017f1b46ec5b9a1f1dc39ec1bffa
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 3A312DB2715B9086D790DF1AE45479A7BA0F38ABD4F209026EF4D97B28DF39C446CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6328 Parent PID: 7012 rundll32.exeCOMMON

Executed Functions

Function 0000021502542252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00000215025423B0
VirtualProtect.KERNELBASE ref: 0000021502542471
RtlAvlRemoveNode.NTDLL ref: 00000215025425B4
VirtualProtect.KERNELBASE ref: 0000021502542677

Memory Dump Source

Source File: 00000009.00000002.691877400.0000021502540000.00000040.00000001.sdmp, Offset: 0000021502540000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 9bfc784d1cef6560a948c447560a98edb19fe0efaa8cb7bfd0793bc0fd8346a2
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 3CB14376618BD486D730CB5AE4407EEB7A0F7D9B84F108026EE8D97B58DB7AC8418F40

Uniqueness

Uniqueness Score: -1.00%

Function 0000021502542057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,00000215025429A8), ref: 00000215025420A7

Memory Dump Source

Source File: 00000009.00000002.691877400.0000021502540000.00000040.00000001.sdmp, Offset: 0000021502540000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: d7da8220f6cb8597fe8c9c4518eaf666b01cdee558a9997c1b0af5f33b0940c0
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: E0315E72615B90C6D780DF1AE45479A7BA1F389BC4F208026EF4D87B18DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: tcmsetup.exe PID: 6980 Parent PID: 3424 tcmsetup.exeCOMMON

Executed Functions

Function 000001E83DAA2252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001E83DAA23B0
VirtualProtect.KERNELBASE ref: 000001E83DAA2471
RtlAvlRemoveNode.NTDLL ref: 000001E83DAA25B4
VirtualProtect.KERNELBASE ref: 000001E83DAA2677

Memory Dump Source

Source File: 00000012.00000002.792072316.000001E83DAA0000.00000040.00000001.sdmp, Offset: 000001E83DAA0000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 0ad3566e3f2f7d1a90c4862d7c01a70e3a9baf637a1efac98ebd9f1d6a84e49f
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: F5B14076618AC586D770CB1AE440BDEB7A1F789B80F108126EE8D57B98DB79C8528F40

Uniqueness

Uniqueness Score: -1.00%

Function 000001E83DAA2057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001E83DAA29A8), ref: 000001E83DAA20A7

Memory Dump Source

Source File: 00000012.00000002.792072316.000001E83DAA0000.00000040.00000001.sdmp, Offset: 000001E83DAA0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: ad83bfd4c0053e493615c4fe7ca137ac2ceecaa0464fb72ed16aab7bea32154d
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 1A312B72615B9086D790DF1AE45479A7BA0F389BD4F209126EF8D87B58DF3AC446CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF708131A38, Relevance: 54.5, APIs: 18, Strings: 13, Instructions: 252registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF708131A9C
RegQueryValueExW.ADVAPI32 ref: 00007FF708131ADF
RegCloseKey.ADVAPI32 ref: 00007FF708131AEE
RegQueryValueExW.ADVAPI32 ref: 00007FF708131B54
lstrcmpiW.KERNEL32 ref: 00007FF708131B77
RegQueryValueExW.ADVAPI32 ref: 00007FF708131BC9
RegOpenKeyExW.ADVAPI32 ref: 00007FF708131C04
RegQueryValueExW.ADVAPI32 ref: 00007FF708131C76
RegOpenKeyExW.ADVAPI32 ref: 00007FF708131CAC
RegCreateKeyExW.ADVAPI32 ref: 00007FF708131D0B

Part of subcall function 00007FF708131098: _vsnwprintf.MSVCRT ref: 00007FF7081310DB

Part of subcall function 00007FF708131730: lstrlenW.KERNEL32 ref: 00007FF70813175D
Part of subcall function 00007FF708131730: RegOpenKeyExW.ADVAPI32 ref: 00007FF708131784
Part of subcall function 00007FF708131730: RegEnumKeyExW.ADVAPI32 ref: 00007FF7081317C1
Part of subcall function 00007FF708131730: RegCloseKey.ADVAPI32 ref: 00007FF7081317FE

RegSetValueExW.ADVAPI32 ref: 00007FF708131D74
RegSetValueExW.ADVAPI32 ref: 00007FF708131DBC
RegSetValueExW.ADVAPI32 ref: 00007FF708131DED
RegSetValueExW.ADVAPI32 ref: 00007FF708131E1E
RegCloseKey.ADVAPI32 ref: 00007FF708131E41
RegCloseKey.ADVAPI32 ref: 00007FF708131E4C
RegCloseKey.ADVAPI32 ref: 00007FF708131E57
RegCloseKey.ADVAPI32 ref: 00007FF708131E97

Strings

RemoteSP.TSP, xrefs: 00007FF708131B62, 00007FF708131E2F
%s%d, xrefs: 00007FF708131AF6
Software\Microsoft\Windows\CurrentVersion\Telephony\Providers, xrefs: 00007FF708131A8A
NumServers, xrefs: 00007FF708131DAA
NoDSQuery, xrefs: 00007FF708131E17
Server, xrefs: 00007FF708131D23
NumProviders, xrefs: 00007FF708131AD3
ProviderFilename, xrefs: 00007FF708131B0E
ProviderID, xrefs: 00007FF708131B85
Provider, xrefs: 00007FF708131C16, 00007FF708131CBE
Software\Microsoft\Windows\CurrentVersion\Telephony, xrefs: 00007FF708131BF6, 00007FF708131C9E
ConnectionOrientedOnly, xrefs: 00007FF708131DE6
NextProviderID, xrefs: 00007FF708131C6F

Memory Dump Source

Source File: 00000012.00000002.793341838.00007FF708131000.00000020.00020000.sdmp, Offset: 00007FF708130000, based on PE: true

Associated: 00000012.00000002.793330415.00007FF708130000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793350688.00007FF708133000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793371638.00007FF708136000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$Close$OpenQuery$CreateEnum_vsnwprintflstrcmpilstrlen
String ID: %s%d$ConnectionOrientedOnly$NextProviderID$NoDSQuery$NumProviders$NumServers$Provider$ProviderFilename$ProviderID$RemoteSP.TSP$Server$Software\Microsoft\Windows\CurrentVersion\Telephony$Software\Microsoft\Windows\CurrentVersion\Telephony\Providers
API String ID: 2086805834-1850957566
Opcode ID: 4c19c9a9fac9e5165c98be9fcc999e08091b25ec35bffd10fe93e32ea1d9e182
Instruction ID: e67ffd864f9ef6a43d2e5fe9f4c60df866ac5e14a5018596a5840a7068a0493e
Opcode Fuzzy Hash: 4c19c9a9fac9e5165c98be9fcc999e08091b25ec35bffd10fe93e32ea1d9e182
Instruction Fuzzy Hash: 79C12F32A18B8296E710DF25F8405AAF7A4FF84794F80413AEA9D53B68DF3CD145CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF708131618, Relevance: 10.6, APIs: 7, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32 ref: 00007FF708131642
GetModuleHandleW.KERNEL32 ref: 00007FF70813164A
LoadStringW.USER32 ref: 00007FF70813166C
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7081316B1
CheckTokenMembership.ADVAPI32 ref: 00007FF7081316C5
FreeSid.ADVAPI32 ref: 00007FF7081316CF
GetCommandLineW.KERNEL32 ref: 00007FF7081316EB

Memory Dump Source

Source File: 00000012.00000002.793341838.00007FF708131000.00000020.00020000.sdmp, Offset: 00007FF708130000, based on PE: true

Associated: 00000012.00000002.793330415.00007FF708130000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793350688.00007FF708133000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793371638.00007FF708136000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateCheckCommandFreeHandleHeapInformationInitializeLineLoadMembershipModuleStringToken
String ID:
API String ID: 2373574249-0
Opcode ID: 9f0ad4ba2ea82fd13c0075e6588e772a48121fab1d7f13258ea1f32ce02120f3
Instruction ID: b850514ca29faf5f79a650b5ad39aa624ba8eae73e375ffcbd9039a8c604efa1
Opcode Fuzzy Hash: 9f0ad4ba2ea82fd13c0075e6588e772a48121fab1d7f13258ea1f32ce02120f3
Instruction Fuzzy Hash: 04311A72A186429AE710AFA5F8812A9F7B0BF48748F84043DDA4D86B55DF3CD144CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF708132530, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF70813253B

Memory Dump Source

Source File: 00000012.00000002.793341838.00007FF708131000.00000020.00020000.sdmp, Offset: 00007FF708130000, based on PE: true

Associated: 00000012.00000002.793330415.00007FF708130000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793350688.00007FF708133000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793371638.00007FF708136000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: fc7876e266b1eb918d6017b6e41b53aa56d1fca9e91e7b95d553857eecc88851
Instruction ID: 6d721bfcf59c0015812cd9e2d367342e44423ef83218e0ee17400c6a03b94181
Opcode Fuzzy Hash: fc7876e266b1eb918d6017b6e41b53aa56d1fca9e91e7b95d553857eecc88851
Instruction Fuzzy Hash: 36B01210F25403D1E604BB21FC89060D2A0BFDC305FC04434C01D80220DF2C919FC718

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF708131834, Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 114registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF708131883
RegOpenKeyExW.ADVAPI32 ref: 00007FF7081318B1
RegQueryValueExW.ADVAPI32 ref: 00007FF7081318EF
RegQueryValueExW.ADVAPI32 ref: 00007FF70813195C
lstrcmpiW.KERNEL32 ref: 00007FF708131974
RegQueryValueExW.ADVAPI32 ref: 00007FF7081319D9
RegCloseKey.ADVAPI32 ref: 00007FF708131A00
RegCloseKey.ADVAPI32 ref: 00007FF708131A0B

Strings

NumProviders, xrefs: 00007FF7081318E8
RemoteSP.TSP, xrefs: 00007FF708131966
%s%d, xrefs: 00007FF708131916, 00007FF708131995
ProviderFilename, xrefs: 00007FF70813190B
Software\Microsoft\Windows\CurrentVersion\Telephony\Providers, xrefs: 00007FF708131875
ProviderID, xrefs: 00007FF70813198A
Software\Microsoft\Windows\CurrentVersion\Telephony, xrefs: 00007FF7081318A7

Memory Dump Source

Source File: 00000012.00000002.793341838.00007FF708131000.00000020.00020000.sdmp, Offset: 00007FF708130000, based on PE: true

Associated: 00000012.00000002.793330415.00007FF708130000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793350688.00007FF708133000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793371638.00007FF708136000.00000002.00020000.sdmp Download File

Similarity

API ID: QueryValue$CloseOpen$lstrcmpi
String ID: %s%d$NumProviders$ProviderFilename$ProviderID$RemoteSP.TSP$Software\Microsoft\Windows\CurrentVersion\Telephony$Software\Microsoft\Windows\CurrentVersion\Telephony\Providers
API String ID: 4128747602-1241624445
Opcode ID: 05f56f3666456f6ae9fde3b67b7b18990df310996cddf8079657648cae49b3dc
Instruction ID: 2f169fb39b249f8f475ce41318f31e0e04823778d4f23ebbbd29f2a62ce70c17
Opcode Fuzzy Hash: 05f56f3666456f6ae9fde3b67b7b18990df310996cddf8079657648cae49b3dc
Instruction Fuzzy Hash: FF513172618B86A6E750DF25F8406AAF3A4FF84744F804139EA9D43B58DF3CD548CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF708131184, Relevance: 22.6, APIs: 15, Instructions: 143memorywindowCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32 ref: 00007FF7081311C6
LoadStringW.USER32 ref: 00007FF7081311EF
LoadStringW.USER32 ref: 00007FF708131209
LoadStringW.USER32 ref: 00007FF708131234
LoadStringW.USER32 ref: 00007FF70813125F
LoadStringW.USER32 ref: 00007FF70813128A
LoadStringW.USER32 ref: 00007FF7081312B5
LoadStringW.USER32 ref: 00007FF7081312E0
LoadStringW.USER32 ref: 00007FF70813130B
LoadStringW.USER32 ref: 00007FF708131336
LoadStringW.USER32 ref: 00007FF708131361
LoadStringW.USER32 ref: 00007FF70813138C
LoadStringW.USER32 ref: 00007FF7081313B7
MessageBoxW.USER32 ref: 00007FF7081313CA
GlobalFree.KERNEL32 ref: 00007FF7081313D3

Memory Dump Source

Source File: 00000012.00000002.793341838.00007FF708131000.00000020.00020000.sdmp, Offset: 00007FF708130000, based on PE: true

Associated: 00000012.00000002.793330415.00007FF708130000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793350688.00007FF708133000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793371638.00007FF708136000.00000002.00020000.sdmp Download File

Similarity

API ID: LoadString$Global$AllocFreeMessage
String ID:
API String ID: 1213047509-0
Opcode ID: b944c5d9f2da28ea229f1585787c04252e1c41b715c4396d476b2571a57e3141
Instruction ID: 7060f4ef5f2cd8b1e4ede72ff9f8e144a95f2fe698af3aee0ada77b077bd27e6
Opcode Fuzzy Hash: b944c5d9f2da28ea229f1585787c04252e1c41b715c4396d476b2571a57e3141
Instruction Fuzzy Hash: 20611C61A0CB8791E620AB52FC106FAF394BF88B84F90503AD94D53B54CF7CD205DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7081320CC, Relevance: 12.1, APIs: 8, Instructions: 128sleepCOMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 00007FF7081320D1
_amsg_exit.MSVCRT ref: 00007FF70813210C
Sleep.KERNEL32 ref: 00007FF708132118
_initterm.MSVCRT ref: 00007FF7081321A6
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7081321D3
exit.MSVCRT ref: 00007FF708132264
_cexit.MSVCRT ref: 00007FF708132273
_ismbblead.MSVCRT ref: 00007FF708132296

Memory Dump Source

Source File: 00000012.00000002.793341838.00007FF708131000.00000020.00020000.sdmp, Offset: 00007FF708130000, based on PE: true

Associated: 00000012.00000002.793330415.00007FF708130000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793350688.00007FF708133000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793371638.00007FF708136000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_cexit_initterm_ismbbleadexit
String ID:
API String ID: 3033372379-0
Opcode ID: 2f5b8a0873d6b6dd734121f66301a2c39a04754dc4fba0fdba4e4cdb98533d44
Instruction ID: 33f28781c00d0425e15f772165772d92b4648c9c3ce49bbc14b3d35452bad66c
Opcode Fuzzy Hash: 2f5b8a0873d6b6dd734121f66301a2c39a04754dc4fba0fdba4e4cdb98533d44
Instruction Fuzzy Hash: 23512521A0C60286E761BB10FD503B9E7A1BF48B96FD8413DDA5D932A0DF3CE944C628

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF708131EA4, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 55synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?,?,?,?,00007FF70813160C), ref: 00007FF708131ED0
WaitForSingleObject.KERNEL32(?,?,?,?,?,00007FF70813160C), ref: 00007FF708131EF3
CompareStringW.KERNEL32(?,?,?,?,?,00007FF70813160C), ref: 00007FF708131F1C
ReleaseMutex.KERNEL32(?,?,?,?,?,00007FF70813160C), ref: 00007FF708131F60
CloseHandle.KERNEL32(?,?,?,?,?,00007FF70813160C), ref: 00007FF708131F69

Part of subcall function 00007FF708131114: LoadStringW.USER32 ref: 00007FF70813114A
Part of subcall function 00007FF708131114: MessageBoxW.USER32 ref: 00007FF708131165

Strings

TapisrvProviderListMutex, xrefs: 00007FF708131EC5

Memory Dump Source

Source File: 00000012.00000002.793341838.00007FF708131000.00000020.00020000.sdmp, Offset: 00007FF708130000, based on PE: true

Associated: 00000012.00000002.793330415.00007FF708130000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793350688.00007FF708133000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793371638.00007FF708136000.00000002.00020000.sdmp Download File

Similarity

API ID: MutexString$CloseCompareCreateHandleLoadMessageObjectReleaseSingleWait
String ID: TapisrvProviderListMutex
API String ID: 3222632342-2731996739
Opcode ID: a7e18b2df272d7e3e592116573023446da628ac9c4c85670b5f955c9f6e34887
Instruction ID: 291d70e3034d028ccf3e60220307e5357993fe2d604dbaba4475d8a2427608fd
Opcode Fuzzy Hash: a7e18b2df272d7e3e592116573023446da628ac9c4c85670b5f955c9f6e34887
Instruction Fuzzy Hash: 7921CD20A0CA47A2F721BB21FD011B8F292AF40754FD0053DF92E067D1EF2CA405C22C

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7081326D0, Relevance: 9.0, APIs: 6, Instructions: 50threadCOMMON

Download Yara Rule

APIs

Ge.KERNEL32 ref: 00007FF708132701
GetCurrentProcessId.KERNEL32 ref: 00007FF70813270F
GetCurrentThreadId.KERNEL32 ref: 00007FF70813271B
GetTickCount.KERNEL32 ref: 00007FF708132727
GetTickCount.KERNEL32 ref: 00007FF708132737
QueryPerformanceCounter.KERNEL32 ref: 00007FF708132752

Memory Dump Source

Source File: 00000012.00000002.793341838.00007FF708131000.00000020.00020000.sdmp, Offset: 00007FF708130000, based on PE: true

Associated: 00000012.00000002.793330415.00007FF708130000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793350688.00007FF708133000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793371638.00007FF708136000.00000002.00020000.sdmp Download File

Similarity

API ID: CountCurrentTick$CounterPerformanceProcessQueryThread
String ID:
API String ID: 2132534333-0
Opcode ID: 10cda0f111db438d5730ed7db41f620db645d9ab672fa1b54e26988e34210a76
Instruction ID: 8cf57d4f26fe470c59cf845b6e017690493c4f60beba42d86064222c99cd7df1
Opcode Fuzzy Hash: 10cda0f111db438d5730ed7db41f620db645d9ab672fa1b54e26988e34210a76
Instruction Fuzzy Hash: F5110B26704B418AEB00EF61FC451A8B3A4FF09B59B800A39EA6D83754EF7DD5A4C394

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF708131730, Relevance: 7.6, APIs: 5, Instructions: 63registrystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF70813175D
RegOpenKeyExW.ADVAPI32 ref: 00007FF708131784
RegEnumKeyExW.ADVAPI32 ref: 00007FF7081317C1
RegDeleteKeyW.ADVAPI32 ref: 00007FF7081317F1
RegCloseKey.ADVAPI32 ref: 00007FF7081317FE

Memory Dump Source

Source File: 00000012.00000002.793341838.00007FF708131000.00000020.00020000.sdmp, Offset: 00007FF708130000, based on PE: true

Associated: 00000012.00000002.793330415.00007FF708130000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793350688.00007FF708133000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793371638.00007FF708136000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseDeleteEnumOpenlstrlen
String ID:
API String ID: 160701936-0
Opcode ID: 26e3c5c84e820053ec67964d558dcf5b6fb1109476804e3b94e096b514ccd805
Instruction ID: f8b95d69621d4c08666868ffee1c24ee75eea3b2874edb57ebc67776a22c3044
Opcode Fuzzy Hash: 26e3c5c84e820053ec67964d558dcf5b6fb1109476804e3b94e096b514ccd805
Instruction Fuzzy Hash: 82216221718A8192E7509B15FC4836AE3A4FF88BC5F940135EA8D87B54DF7CD545C718

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF708132310, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF708132383
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7081323A2
RtlVirtualUnwind.KERNEL32 ref: 00007FF7081323EF
__raise_securityfailure.LIBCMT ref: 00007FF7081324D4

Memory Dump Source

Source File: 00000012.00000002.793341838.00007FF708131000.00000020.00020000.sdmp, Offset: 00007FF708130000, based on PE: true

Associated: 00000012.00000002.793330415.00007FF708130000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793350688.00007FF708133000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.793371638.00007FF708136000.00000002.00020000.sdmp Download File

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 9f626070250a4cc36a193cd0c2b1c9dd6076a3d8f4a93f64f889e3fc88516dc1
Instruction ID: 14cfdadd8eb29f5bff642b0148233145c380a5948f3937d9af0e902e7120129f
Opcode Fuzzy Hash: 9f626070250a4cc36a193cd0c2b1c9dd6076a3d8f4a93f64f889e3fc88516dc1
Instruction Fuzzy Hash: 7541A035A08B01D5EA10AB19FC903A5F3A5FF88B44FD0413ADA8D82764DF7DE548C768

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RdpSaUacHelper.exe PID: 6204 Parent PID: 3424 RdpSaUacHelper.exeCOMMON

Executed Functions

Function 0000015CCEC12252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0000015CCEC123B0
VirtualProtect.KERNELBASE ref: 0000015CCEC12471
RtlAvlRemoveNode.NTDLL ref: 0000015CCEC125B4
VirtualProtect.KERNELBASE ref: 0000015CCEC12677

Memory Dump Source

Source File: 00000014.00000002.818817641.0000015CCEC10000.00000040.00000001.sdmp, Offset: 0000015CCEC10000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 3f3badc5411e28ba65433edd8826b338179dadf869eb7a8194b4336d06bf545c
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 37B12376618BC58AD770CF1AE4407DAB7A1F7C9B80F108126EE8D97B58DB79C8518F40

Uniqueness

Uniqueness Score: -1.00%

Function 0000015CCEC12057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000015CCEC129A8), ref: 0000015CCEC120A7

Memory Dump Source

Source File: 00000014.00000002.818817641.0000015CCEC10000.00000040.00000001.sdmp, Offset: 0000015CCEC10000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 725964f937dd7590b81b3415f9a7ddc361ab9f795dd4d056b308a36e9f1f6291
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 07312B72615B90CAD790DF1AE45479A7BA0F389BD5F205026EF8D87B18DF3AC446CB40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF677471BF4, Relevance: 84.7, APIs: 38, Strings: 10, Instructions: 739fileregistrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF677471C53
GetCurrentProcessId.KERNEL32 ref: 00007FF677471C63
ProcessIdToSessionId.KERNEL32 ref: 00007FF677471C71
GetLastError.KERNEL32 ref: 00007FF677471C7B
OpenProcess.KERNEL32 ref: 00007FF677471CEF
GetLastError.KERNEL32 ref: 00007FF677471CFD
CoSetProxyBlanket.OLE32 ref: 00007FF677471ED9
CreateFileMappingW.KERNEL32 ref: 00007FF677471FBC
GetLastError.KERNEL32 ref: 00007FF677471FCB
MapViewOfFile.KERNEL32 ref: 00007FF677472043
GetLastError.KERNEL32 ref: 00007FF677472051
SysFreeString.OLEAUT32 ref: 00007FF677472210
CreateEventW.KERNEL32 ref: 00007FF677472231
DuplicateHandle.KERNEL32 ref: 00007FF677472263
UnmapViewOfFile.KERNEL32 ref: 00007FF677472281
DuplicateHandle.KERNEL32 ref: 00007FF6774722AB
RegSetKeyValueW.ADVAPI32 ref: 00007FF6774722D8
SysFreeString.OLEAUT32 ref: 00007FF67747269A
GetLastError.KERNEL32 ref: 00007FF6774726A5
GetLastError.KERNEL32 ref: 00007FF6774726D8

Part of subcall function 00007FF67747106C: TraceMessage.ADVAPI32 ref: 00007FF6774710EB

SysAllocStringByteLen.OLEAUT32 ref: 00007FF677472134

Part of subcall function 00007FF677471020: TraceMessage.ADVAPI32 ref: 00007FF67747105E

RegDeleteKeyValueW.ADVAPI32 ref: 00007FF677471DC7

Part of subcall function 00007FF677473190: GetModuleHandleExA.KERNEL32 ref: 00007FF6774731C4
Part of subcall function 00007FF677473190: GetProcAddress.KERNEL32 ref: 00007FF6774731DA
Part of subcall function 00007FF677473190: FreeLibrary.KERNEL32 ref: 00007FF6774731FA

UnmapViewOfFile.KERNEL32 ref: 00007FF67747273F
CloseHandle.KERNEL32 ref: 00007FF677472749
CloseHandle.KERNEL32 ref: 00007FF67747275A
CloseHandle.KERNEL32 ref: 00007FF67747276D
CloseHandle.KERNEL32 ref: 00007FF67747277F
CloseHandle.KERNEL32 ref: 00007FF677472796

Strings

CoCreateInSession failed!, xrefs: 00007FF677471F1A
WaitForMultipleObjects failed!, xrefs: 00007FF6774723C0
CRdpSaComUtils::s_CoCreateInSession failed!, xrefs: 00007FF677471E86
spProxy->GetSessionAgentProcessHandle failed!, xrefs: 00007FF6774721EE
m_InvitationManager.Initialize failed!, xrefs: 00007FF677471D96
Software\Microsoft\Terminal Services\SessionAgent\Handles, xrefs: 00007FF677471DC0, 00007FF6774722D1, 00007FF677472411
GenCryptoSecureKey failed!, xrefs: 00007FF67747210C
SignalNamedEvent failed!, xrefs: 00007FF677472511
%8.8x, xrefs: 00007FF677471D36
FindInteractiveUserProcess failed!, xrefs: 00007FF677471F81

Memory Dump Source

Source File: 00000014.00000002.820559575.00007FF677471000.00000020.00020000.sdmp, Offset: 00007FF677470000, based on PE: true

Associated: 00000014.00000002.820542146.00007FF677470000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820579246.00007FF677475000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820600877.00007FF677479000.00000002.00020000.sdmp Download File

Similarity

API ID: Handle$ErrorLast$Close$File$FreeProcessStringView$CreateDuplicateMessageTraceUnmapValue$AddressAllocBlanketByteCurrentDeleteEventLibraryMappingModuleOpenProcProxySessionmemset
String ID: %8.8x$CRdpSaComUtils::s_CoCreateInSession failed!$CoCreateInSession failed!$FindInteractiveUserProcess failed!$GenCryptoSecureKey failed!$SignalNamedEvent failed!$Software\Microsoft\Terminal Services\SessionAgent\Handles$WaitForMultipleObjects failed!$m_InvitationManager.Initialize failed!$spProxy->GetSessionAgentProcessHandle failed!
API String ID: 2335468240-259160827
Opcode ID: ff1b2e3574e43d26786fc7d9bfd6bf52694fa37dca2209b398758e9b60d6b716
Instruction ID: 6e530fb88afda43835e96258feca6bee8d252b08f47b84de3b4c5a583d9f00ba
Opcode Fuzzy Hash: ff1b2e3574e43d26786fc7d9bfd6bf52694fa37dca2209b398758e9b60d6b716
Instruction Fuzzy Hash: D6725A23A28A8286FB659B67D45437923E5FF88B48F500535CD4DCB6A9DF3CE90683C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6774727F8, Relevance: 54.6, APIs: 30, Strings: 1, Instructions: 358memoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF677472814
InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF677472836
GetLastError.KERNEL32 ref: 00007FF677472840
GetCurrentProcess.KERNEL32 ref: 00007FF6774728A6
OpenProcessToken.ADVAPI32 ref: 00007FF6774728B8
GetLastError.KERNEL32 ref: 00007FF6774728C2
GetTokenInformation.ADVAPI32 ref: 00007FF67747290D
GetLastError.KERNEL32 ref: 00007FF67747291B
LocalAlloc.KERNEL32 ref: 00007FF677472932
memset.MSVCRT ref: 00007FF677472995
GetTokenInformation.ADVAPI32 ref: 00007FF6774729B0
GetLastError.KERNEL32 ref: 00007FF6774729BA
GetTokenInformation.ADVAPI32 ref: 00007FF677472A39
GetLastError.KERNEL32 ref: 00007FF677472A47
memset.MSVCRT ref: 00007FF677472ABF
GetTokenInformation.ADVAPI32 ref: 00007FF677472ADD
GetLastError.KERNEL32 ref: 00007FF677472AE7
SetSecurityDescriptorOwner.ADVAPI32 ref: 00007FF677472B33
GetLastError.KERNEL32 ref: 00007FF677472B3D
SetSecurityDescriptorGroup.ADVAPI32 ref: 00007FF677472B89
GetLastError.KERNEL32 ref: 00007FF677472B93
InitializeAcl.ADVAPI32 ref: 00007FF677472BE2
GetLastError.KERNEL32 ref: 00007FF677472BEC
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF677472C3B
GetLastError.KERNEL32 ref: 00007FF677472C45

Part of subcall function 00007FF677471020: TraceMessage.ADVAPI32 ref: 00007FF67747105E

CoInitializeSecurity.OLE32 ref: 00007FF677472CB4
LocalAlloc.KERNEL32 ref: 00007FF677472A5B

Part of subcall function 00007FF677473190: GetModuleHandleExA.KERNEL32 ref: 00007FF6774731C4
Part of subcall function 00007FF677473190: GetProcAddress.KERNEL32 ref: 00007FF6774731DA
Part of subcall function 00007FF677473190: FreeLibrary.KERNEL32 ref: 00007FF6774731FA

LocalFree.KERNEL32 ref: 00007FF677472DA1
LocalFree.KERNEL32 ref: 00007FF677472DAF
CloseHandle.KERNEL32 ref: 00007FF677472DBE

Strings

CoInitializeSecurity failed!, xrefs: 00007FF677472D09

Memory Dump Source

Source File: 00000014.00000002.820559575.00007FF677471000.00000020.00020000.sdmp, Offset: 00007FF677470000, based on PE: true

Associated: 00000014.00000002.820542146.00007FF677470000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820579246.00007FF677475000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820600877.00007FF677479000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$SecurityToken$DescriptorInformationLocal$FreeInitializememset$AllocHandleProcess$AddressCloseCurrentDaclGroupLibraryMessageModuleOpenOwnerProcTrace
String ID: CoInitializeSecurity failed!
API String ID: 1832887111-3763069927
Opcode ID: 48e2b61027858e5c8f5b5f4ee4c2a3ca4e2905527d3046ec1ac09f4829c4f8d1
Instruction ID: 6a91829185ba60cb9955579d9b8fbd48b595ca3251053e1a309d179cb1acf77b
Opcode Fuzzy Hash: 48e2b61027858e5c8f5b5f4ee4c2a3ca4e2905527d3046ec1ac09f4829c4f8d1
Instruction Fuzzy Hash: 27026523A2869382FB648B23D88837927A5FF84B88F054535DD4EC769DDF2CE94583C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF677473648, Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 189COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF67747369F
CreateBindCtx.OLE32 ref: 00007FF6774736B6
StringFromCLSID.OLE32 ref: 00007FF677473712
CoTaskMemFree.OLE32 ref: 00007FF67747396B

Part of subcall function 00007FF677473190: GetModuleHandleExA.KERNEL32 ref: 00007FF6774731C4
Part of subcall function 00007FF677473190: GetProcAddress.KERNEL32 ref: 00007FF6774731DA
Part of subcall function 00007FF677473190: FreeLibrary.KERNEL32 ref: 00007FF6774731FA

Strings

Session:%d!clsid:%s, xrefs: 00007FF677473767
pClassFactory->CreateInstance, xrefs: 00007FF6774738F5
MkParseDisplayName, xrefs: 00007FF677473827
pMoniker->BindToObject, xrefs: 00007FF67747389C
StringFromCLSID, xrefs: 00007FF677473756
StringCchPrintf, xrefs: 00007FF6774737C3
CreateBindCtx, xrefs: 00007FF6774736FA

Memory Dump Source

Source File: 00000014.00000002.820559575.00007FF677471000.00000020.00020000.sdmp, Offset: 00007FF677470000, based on PE: true

Associated: 00000014.00000002.820542146.00007FF677470000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820579246.00007FF677475000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820600877.00007FF677479000.00000002.00020000.sdmp Download File

Similarity

API ID: Free$AddressBindCreateFromHandleLibraryModuleProcStringTaskmemset
String ID: CreateBindCtx$MkParseDisplayName$Session:%d!clsid:%s$StringCchPrintf$StringFromCLSID$pClassFactory->CreateInstance$pMoniker->BindToObject
API String ID: 877699110-3611846579
Opcode ID: c730674a2257a61417241bde7bd19cdeb6d04d3200281b7bca659a9a4ffc820f
Instruction ID: 710e9866cfa1ddd9eb2b5d3bf4facc4d91bb0bff9bd5fa82edcbcd85ddf7fd25
Opcode Fuzzy Hash: c730674a2257a61417241bde7bd19cdeb6d04d3200281b7bca659a9a4ffc820f
Instruction Fuzzy Hash: 5EA13923B28B8681EB548B17E48436927A5FB85B48F410432DD8DD77ADDF7CE905C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF677471180, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

WinStationGetAllProcesses.WINSTA ref: 00007FF6774711F2
GetLastError.KERNEL32 ref: 00007FF6774711FC
CloseHandle.KERNEL32 ref: 00007FF67747128A
_wcsicmp.MSVCRT ref: 00007FF6774712CB
OpenProcess.KERNEL32 ref: 00007FF6774712E0
GetLastError.KERNEL32 ref: 00007FF67747130C
CloseHandle.KERNEL32 ref: 00007FF67747138D
WinStationFreeGAPMemory.WINSTA ref: 00007FF6774713A4
QueryFullProcessImageNameW.KERNEL32 ref: 00007FF6774713ED
GetLastError.KERNEL32 ref: 00007FF67747141B
_wcsicmp.MSVCRT ref: 00007FF67747143C

Part of subcall function 00007FF677473190: GetModuleHandleExA.KERNEL32 ref: 00007FF6774731C4
Part of subcall function 00007FF677473190: GetProcAddress.KERNEL32 ref: 00007FF6774731DA
Part of subcall function 00007FF677473190: FreeLibrary.KERNEL32 ref: 00007FF6774731FA

Part of subcall function 00007FF677471020: TraceMessage.ADVAPI32 ref: 00007FF67747105E

Strings

RdpSaProxy.exe, xrefs: 00007FF6774712C4

Memory Dump Source

Source File: 00000014.00000002.820559575.00007FF677471000.00000020.00020000.sdmp, Offset: 00007FF677470000, based on PE: true

Associated: 00000014.00000002.820542146.00007FF677470000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820579246.00007FF677475000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820600877.00007FF677479000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorHandleLast$CloseFreeProcessStation_wcsicmp$AddressFullImageLibraryMemoryMessageModuleNameOpenProcProcessesQueryTrace
String ID: RdpSaProxy.exe
API String ID: 1492961622-67289802
Opcode ID: d991e5fe2a1c7c3278fcd4dd3ed945b2301941528a006ffea35396f884a4ce9e
Instruction ID: a9c28cee4d9c3657001441197193a7539ae98323b84b4647e8f30f2e7472165d
Opcode Fuzzy Hash: d991e5fe2a1c7c3278fcd4dd3ed945b2301941528a006ffea35396f884a4ce9e
Instruction Fuzzy Hash: F6817F73A38682C2FB548B67E44427967A1FB84B88F454435DE4DC7A9CDF7CE8458780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6774733E8, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF677473417
RpcStringBindingComposeW.RPCRT4 ref: 00007FF677473440
RpcBindingFromStringBindingW.RPCRT4 ref: 00007FF677473458
RpcStringFreeW.RPCRT4 ref: 00007FF677473464
LocalAlloc.KERNEL32 ref: 00007FF67747347B
CreateWellKnownSid.ADVAPI32 ref: 00007FF67747349A
GetLastError.KERNEL32 ref: 00007FF6774734A4
LocalFree.KERNEL32 ref: 00007FF677473505
RpcBindingFree.RPCRT4 ref: 00007FF677473516

Strings

ncalrpc, xrefs: 00007FF677473427
201ef99a-7fa0-444c-9399-19ba84f12a1a, xrefs: 00007FF677473433

Memory Dump Source

Source File: 00000014.00000002.820559575.00007FF677471000.00000020.00020000.sdmp, Offset: 00007FF677470000, based on PE: true

Associated: 00000014.00000002.820542146.00007FF677470000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820579246.00007FF677475000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820600877.00007FF677479000.00000002.00020000.sdmp Download File

Similarity

API ID: Binding$FreeString$Local$AllocComposeCreateErrorFromKnownLastWellmemset
String ID: 201ef99a-7fa0-444c-9399-19ba84f12a1a$ncalrpc
API String ID: 2511549665-1484959704
Opcode ID: dcded6a88452cb74369432103c7773a1f858849b7f0860c0b057a27ee41bdc95
Instruction ID: 9eff5db010984f527093da8ddf3428a54094744d135eafe3fc216260011e3a84
Opcode Fuzzy Hash: dcded6a88452cb74369432103c7773a1f858849b7f0860c0b057a27ee41bdc95
Instruction Fuzzy Hash: DF413C33B24B429AE720CF26E8847A977B4FB48748F854135DA4E86A58EF3CD558C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6774732D4, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 75serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(?,?,?,?,?,?,?,?,80070000,00007FF6774732C0), ref: 00007FF677473301
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,80070000,00007FF6774732C0), ref: 00007FF67747330F
OpenServiceW.ADVAPI32(?,?,?,?,?,?,?,?,80070000,00007FF6774732C0), ref: 00007FF67747332C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,80070000,00007FF6774732C0), ref: 00007FF67747333A
CloseServiceHandle.ADVAPI32(?,?,?,?,?,?,?,?,80070000,00007FF6774732C0), ref: 00007FF6774733BC

Strings

AppInfo, xrefs: 00007FF677473322

Memory Dump Source

Source File: 00000014.00000002.820559575.00007FF677471000.00000020.00020000.sdmp, Offset: 00007FF677470000, based on PE: true

Associated: 00000014.00000002.820542146.00007FF677470000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820579246.00007FF677475000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820600877.00007FF677479000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastOpenService$CloseHandleManager
String ID: AppInfo
API String ID: 48634454-3340701128
Opcode ID: 5bfac0fdb877a67edbbb09c3dcf92dfc47016e650c7b799ff4ba871316c6c470
Instruction ID: d011e20a7f130c958908579cadd7e7b40ce4f539252ee087da7a46f817cb6a31
Opcode Fuzzy Hash: 5bfac0fdb877a67edbbb09c3dcf92dfc47016e650c7b799ff4ba871316c6c470
Instruction Fuzzy Hash: F7310B22B2CA82C7FA349B27A45413AB2A1EF48B85F444534DE5E8A759DF2CE5058B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6774741B0, Relevance: 9.0, APIs: 6, Instructions: 50timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6774741E1
GetCurrentProcessId.KERNEL32 ref: 00007FF6774741EF
GetCurrentThreadId.KERNEL32 ref: 00007FF6774741FB
GetTickCount.KERNEL32 ref: 00007FF677474207
GetTickCount.KERNEL32 ref: 00007FF677474217
QueryPerformanceCounter.KERNEL32 ref: 00007FF677474232

Memory Dump Source

Source File: 00000014.00000002.820559575.00007FF677471000.00000020.00020000.sdmp, Offset: 00007FF677470000, based on PE: true

Associated: 00000014.00000002.820542146.00007FF677470000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820579246.00007FF677475000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820600877.00007FF677479000.00000002.00020000.sdmp Download File

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 9657d7b04395a9e2d63580421c56310e06267c4775c6db407f45c0a606ac9656
Instruction ID: fbda2bcf457d3a95a1cc0f8c72c24c72aecde7a7aed1e64c0b517b6123630397
Opcode Fuzzy Hash: 9657d7b04395a9e2d63580421c56310e06267c4775c6db407f45c0a606ac9656
Instruction Fuzzy Hash: A1114A32B15B418BEB00DF72E8440A833E4FB08758B411A31EE6D87B58EF3CD1A48780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF677471AC4, Relevance: 7.6, APIs: 5, Instructions: 81encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00007FF677471AED
GetLastError.KERNEL32 ref: 00007FF677471AF7

Part of subcall function 00007FF677473190: GetModuleHandleExA.KERNEL32 ref: 00007FF6774731C4
Part of subcall function 00007FF677473190: GetProcAddress.KERNEL32 ref: 00007FF6774731DA
Part of subcall function 00007FF677473190: FreeLibrary.KERNEL32 ref: 00007FF6774731FA

Part of subcall function 00007FF677471020: TraceMessage.ADVAPI32 ref: 00007FF67747105E

CryptGenRandom.ADVAPI32 ref: 00007FF677471B67
GetLastError.KERNEL32 ref: 00007FF677471B71
CryptReleaseContext.ADVAPI32 ref: 00007FF677471BDF

Memory Dump Source

Source File: 00000014.00000002.820559575.00007FF677471000.00000020.00020000.sdmp, Offset: 00007FF677470000, based on PE: true

Associated: 00000014.00000002.820542146.00007FF677470000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820579246.00007FF677475000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820600877.00007FF677479000.00000002.00020000.sdmp Download File

Similarity

API ID: Crypt$ContextErrorLast$AcquireAddressFreeHandleLibraryMessageModuleProcRandomReleaseTrace
String ID:
API String ID: 1925393320-0
Opcode ID: 79f76a6d928403969dd896b86a249db10c80ea7a21483ab812040a04ea6fda25
Instruction ID: 98154f1027e3a872d159c3b3380aa22662830bced6b0f4911aa2a5caf5dbd3dc
Opcode Fuzzy Hash: 79f76a6d928403969dd896b86a249db10c80ea7a21483ab812040a04ea6fda25
Instruction Fuzzy Hash: 70316D63B2878282FB589B67D89433563E1FFC4B88F544839CE4DC76A9DE6CD5058780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF677473218, Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

NdrClientCall3.RPCRT4 ref: 00007FF67747327C

Part of subcall function 00007FF6774733E8: memset.MSVCRT ref: 00007FF677473417
Part of subcall function 00007FF6774733E8: RpcStringBindingComposeW.RPCRT4 ref: 00007FF677473440
Part of subcall function 00007FF6774733E8: RpcBindingFromStringBindingW.RPCRT4 ref: 00007FF677473458
Part of subcall function 00007FF6774733E8: RpcStringFreeW.RPCRT4 ref: 00007FF677473464
Part of subcall function 00007FF6774733E8: LocalAlloc.KERNEL32 ref: 00007FF67747347B
Part of subcall function 00007FF6774733E8: LocalFree.KERNEL32 ref: 00007FF677473505
Part of subcall function 00007FF6774733E8: RpcBindingFree.RPCRT4 ref: 00007FF677473516

RpcBindingFree.RPCRT4 ref: 00007FF67747325B

Memory Dump Source

Source File: 00000014.00000002.820559575.00007FF677471000.00000020.00020000.sdmp, Offset: 00007FF677470000, based on PE: true

Associated: 00000014.00000002.820542146.00007FF677470000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820579246.00007FF677475000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820600877.00007FF677479000.00000002.00020000.sdmp Download File

Similarity

API ID: Binding$Free$String$Local$AllocCall3ClientComposeFrommemset
String ID:
API String ID: 2282236844-0
Opcode ID: f640c3d64b8dbb1f25274ad49c5189c464735feeaed59002d3208e90c8df6f39
Instruction ID: 0ee9a7e0b4de8d84f1ed719d524417577841cb78827a98d802190ec9eb2f5824
Opcode Fuzzy Hash: f640c3d64b8dbb1f25274ad49c5189c464735feeaed59002d3208e90c8df6f39
Instruction Fuzzy Hash: DF11A377A2D68282F720AF16E480239A7B4FF85748F600535DE4DCA99CDF3DE5548B84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF677472DD8, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 184registrymemoryCOMMON

Download Yara Rule

APIs

RegisterTraceGuidsW.ADVAPI32 ref: 00007FF677472E72
EtwEventUnregister.NTDLL ref: 00007FF677472E8C
EtwEventRegister.NTDLL ref: 00007FF677472EBB
HeapSetInformation.KERNEL32 ref: 00007FF677472F4D
GetLastError.KERNEL32 ref: 00007FF677472F76
CoInitializeEx.OLE32 ref: 00007FF677472FA6

Part of subcall function 00007FF6774727F8: memset.MSVCRT ref: 00007FF677472814
Part of subcall function 00007FF6774727F8: InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF677472836
Part of subcall function 00007FF6774727F8: GetLastError.KERNEL32 ref: 00007FF677472840
Part of subcall function 00007FF6774727F8: CloseHandle.KERNEL32 ref: 00007FF677472DBE

GetCommandLineW.KERNEL32 ref: 00007FF677473054
CoUninitialize.OLE32 ref: 00007FF6774730C3
UnregisterTraceGuids.ADVAPI32 ref: 00007FF6774730E0

Part of subcall function 00007FF677473190: GetModuleHandleExA.KERNEL32 ref: 00007FF6774731C4
Part of subcall function 00007FF677473190: GetProcAddress.KERNEL32 ref: 00007FF6774731DA
Part of subcall function 00007FF677473190: FreeLibrary.KERNEL32 ref: 00007FF6774731FA

Strings

CoInitializeEx failed!, xrefs: 00007FF677472FF0
InitSecurity failed!, xrefs: 00007FF67747304B
HandleInteractiveUserProcess failed!, xrefs: 00007FF67747309C

Memory Dump Source

Source File: 00000014.00000002.820559575.00007FF677471000.00000020.00020000.sdmp, Offset: 00007FF677470000, based on PE: true

Associated: 00000014.00000002.820542146.00007FF677470000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820579246.00007FF677475000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820600877.00007FF677479000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorEventGuidsHandleInitializeLastRegisterTraceUnregister$AddressCloseCommandDescriptorFreeHeapInformationLibraryLineModuleProcSecurityUninitializememset
String ID: CoInitializeEx failed!$HandleInteractiveUserProcess failed!$InitSecurity failed!
API String ID: 2559604372-2861812489
Opcode ID: b7d662a496183a58ff69025b3eec162354c97ba20104ef10864f12beb07b06fc
Instruction ID: 2bbe05b94c3186ab8b502f87b6786bbc8c83c4812552aaecfa5b0d60440ebda8
Opcode Fuzzy Hash: b7d662a496183a58ff69025b3eec162354c97ba20104ef10864f12beb07b06fc
Instruction Fuzzy Hash: D8914333A29B8295EB109B22E84067563A8FB88B48F588436DD4DD77ACDF3CE45583C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF677471880, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6774718B7
CloseHandle.KERNEL32 ref: 00007FF677471A96

Part of subcall function 00007FF677473118: _vsnwprintf.MSVCRT ref: 00007FF677473158

OpenEventW.KERNEL32 ref: 00007FF67747195D
GetLastError.KERNEL32 ref: 00007FF67747196B

Part of subcall function 00007FF677473190: GetModuleHandleExA.KERNEL32 ref: 00007FF6774731C4
Part of subcall function 00007FF677473190: GetProcAddress.KERNEL32 ref: 00007FF6774731DA
Part of subcall function 00007FF677473190: FreeLibrary.KERNEL32 ref: 00007FF6774731FA

Part of subcall function 00007FF67747106C: TraceMessage.ADVAPI32 ref: 00007FF6774710EB

Strings

m_InvitationManager.Initialize failed!, xrefs: 00007FF677471932
W, xrefs: 00007FF677471A78

Memory Dump Source

Source File: 00000014.00000002.820559575.00007FF677471000.00000020.00020000.sdmp, Offset: 00007FF677470000, based on PE: true

Associated: 00000014.00000002.820542146.00007FF677470000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820579246.00007FF677475000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820600877.00007FF677479000.00000002.00020000.sdmp Download File

Similarity

API ID: Handle$AddressCloseErrorEventFreeLastLibraryMessageModuleOpenProcTrace_vsnwprintfmemset
String ID: W$m_InvitationManager.Initialize failed!
API String ID: 1561775141-1489090608
Opcode ID: 5e14895faaa2b9518b457f0d075d7a282afb3e8bc4ce4b69f641bdc7943bf406
Instruction ID: fcacb548941f776429937be6acaa588f4219377994208680249852b1b9023666
Opcode Fuzzy Hash: 5e14895faaa2b9518b457f0d075d7a282afb3e8bc4ce4b69f641bdc7943bf406
Instruction Fuzzy Hash: 7C515623A28A8381FB608B57D88477923A5BBC4B88F140936CD4DC76ADDF2CE54687C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF67747164C, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF677471460: memset.MSVCRT ref: 00007FF67747149F
Part of subcall function 00007FF677471460: GetCurrentProcessId.KERNEL32 ref: 00007FF6774714A4
Part of subcall function 00007FF677471460: ProcessIdToSessionId.KERNEL32 ref: 00007FF6774714B3
Part of subcall function 00007FF677471460: GetLastError.KERNEL32 ref: 00007FF6774714BD

DuplicateHandle.KERNEL32 ref: 00007FF6774717C9
GetLastError.KERNEL32 ref: 00007FF6774717D3
CloseHandle.KERNEL32 ref: 00007FF67747184C
CloseHandle.KERNEL32 ref: 00007FF67747185F

Part of subcall function 00007FF677473190: GetModuleHandleExA.KERNEL32 ref: 00007FF6774731C4
Part of subcall function 00007FF677473190: GetProcAddress.KERNEL32 ref: 00007FF6774731DA
Part of subcall function 00007FF677473190: FreeLibrary.KERNEL32 ref: 00007FF6774731FA

Strings

FindRdpSessionAgentProxyProcess failed!, xrefs: 00007FF6774716C0
spProxy->GetSessionAgentProcessHandle failed!, xrefs: 00007FF677471796
NotifyInitializationComplete failed!, xrefs: 00007FF67747173A
@, xrefs: 00007FF6774717C1

Memory Dump Source

Source File: 00000014.00000002.820559575.00007FF677471000.00000020.00020000.sdmp, Offset: 00007FF677470000, based on PE: true

Associated: 00000014.00000002.820542146.00007FF677470000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820579246.00007FF677475000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820600877.00007FF677479000.00000002.00020000.sdmp Download File

Similarity

API ID: Handle$CloseErrorLastProcess$AddressCurrentDuplicateFreeLibraryModuleProcSessionmemset
String ID: @$FindRdpSessionAgentProxyProcess failed!$NotifyInitializationComplete failed!$spProxy->GetSessionAgentProcessHandle failed!
API String ID: 1534658783-3816130978
Opcode ID: e57331cc8e7e6830ac4e5185579fe78227a5be0619dea3ccd52d75d83a9097ff
Instruction ID: 78ecc181749d817934450eb5495d441a8f22c269b56a54c0fb215d0079c097c0
Opcode Fuzzy Hash: e57331cc8e7e6830ac4e5185579fe78227a5be0619dea3ccd52d75d83a9097ff
Instruction Fuzzy Hash: 5D516723A2868286EB108B17E48437967B5FB84B88F150835DE4DC77A9CF7CE94687C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF677471460, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF67747149F
GetCurrentProcessId.KERNEL32 ref: 00007FF6774714A4
ProcessIdToSessionId.KERNEL32 ref: 00007FF6774714B3
GetLastError.KERNEL32 ref: 00007FF6774714BD
CloseHandle.KERNEL32 ref: 00007FF67747161D

Part of subcall function 00007FF677473190: GetModuleHandleExA.KERNEL32 ref: 00007FF6774731C4
Part of subcall function 00007FF677473190: GetProcAddress.KERNEL32 ref: 00007FF6774731DA
Part of subcall function 00007FF677473190: FreeLibrary.KERNEL32 ref: 00007FF6774731FA

Part of subcall function 00007FF677471020: TraceMessage.ADVAPI32 ref: 00007FF67747105E

Strings

CRdpSaComUtils::s_GetKnownFolderFilePath failed!, xrefs: 00007FF67747157A
EnumProcess failed!, xrefs: 00007FF6774715ED

Memory Dump Source

Source File: 00000014.00000002.820559575.00007FF677471000.00000020.00020000.sdmp, Offset: 00007FF677470000, based on PE: true

Associated: 00000014.00000002.820542146.00007FF677470000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820579246.00007FF677475000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820600877.00007FF677479000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleProcess$AddressCloseCurrentErrorFreeLastLibraryMessageModuleProcSessionTracememset
String ID: CRdpSaComUtils::s_GetKnownFolderFilePath failed!$EnumProcess failed!
API String ID: 2418640959-4269763327
Opcode ID: ea4dd67ebc0661b38e4fe8d571b13437a6d5c9dfc81672efa31a3a156a4dac55
Instruction ID: 01ca9fe7abaa7bbe988d59fd9f1fc2d3150e69c012f555f1182a4e54acb7f25f
Opcode Fuzzy Hash: ea4dd67ebc0661b38e4fe8d571b13437a6d5c9dfc81672efa31a3a156a4dac55
Instruction Fuzzy Hash: 35514A23A2868282EB508B56E48437967A5FBC8788F454836DD8EC769DDF3CE44587C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF677473ABC, Relevance: 10.6, APIs: 7, Instructions: 143sleepCOMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 00007FF677473AE4
Sleep.KERNEL32 ref: 00007FF677473B1B
_amsg_exit.MSVCRT ref: 00007FF677473B39
_initterm.MSVCRT ref: 00007FF677473BC4
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF677473BF1
exit.MSVCRT ref: 00007FF677473C96
_cexit.MSVCRT ref: 00007FF677473CA5

Memory Dump Source

Source File: 00000014.00000002.820559575.00007FF677471000.00000020.00020000.sdmp, Offset: 00007FF677470000, based on PE: true

Associated: 00000014.00000002.820542146.00007FF677470000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820579246.00007FF677475000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820600877.00007FF677479000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_cexit_inittermexit
String ID:
API String ID: 642454821-0
Opcode ID: 089acf75d01afc8a2c06eef4b5155c29b23ede46cb6ba534e1b82327c472c3d2
Instruction ID: ee863e92025f392f5de1c1723dd520281aa6d25bf1717b01fac719cbef66bbc7
Opcode Fuzzy Hash: 089acf75d01afc8a2c06eef4b5155c29b23ede46cb6ba534e1b82327c472c3d2
Instruction Fuzzy Hash: 82616833A2968286FB609F12E88023977A4FF54B80F444436DE4ED76A9DF3CE8458780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF677473548, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 00007FF677473570
PathCchCombine.API-MS-WIN-CORE-PATH-L1-1-0 ref: 00007FF6774735D1
CoTaskMemFree.OLE32 ref: 00007FF677473635

Part of subcall function 00007FF677473190: GetModuleHandleExA.KERNEL32 ref: 00007FF6774731C4
Part of subcall function 00007FF677473190: GetProcAddress.KERNEL32 ref: 00007FF6774731DA
Part of subcall function 00007FF677473190: FreeLibrary.KERNEL32 ref: 00007FF6774731FA

Strings

SHGetKnownFolderPath, xrefs: 00007FF6774735B4
PathCchCombine, xrefs: 00007FF677473609
RdpSaProxy.exe, xrefs: 00007FF6774735C2

Memory Dump Source

Source File: 00000014.00000002.820559575.00007FF677471000.00000020.00020000.sdmp, Offset: 00007FF677470000, based on PE: true

Associated: 00000014.00000002.820542146.00007FF677470000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820579246.00007FF677475000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820600877.00007FF677479000.00000002.00020000.sdmp Download File

Similarity

API ID: FreePath$AddressCombineFolderHandleKnownLibraryModuleProcTask
String ID: PathCchCombine$RdpSaProxy.exe$SHGetKnownFolderPath
API String ID: 3618514633-3505859108
Opcode ID: 5370ce4a514e16cc94f80f9eb66ac0801c27398766ab2dc1f1c6cb545872e5e1
Instruction ID: 299050439d9887a9e5796075b2275852c288332441d49567346ef0e9a49c9ef3
Opcode Fuzzy Hash: 5370ce4a514e16cc94f80f9eb66ac0801c27398766ab2dc1f1c6cb545872e5e1
Instruction Fuzzy Hash: FB213722B386C691EB149B26E84436567A1FB84B48F864835CD4DC37A9DE3CE549C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF677473190, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExA.KERNEL32 ref: 00007FF6774731C4
GetProcAddress.KERNEL32 ref: 00007FF6774731DA
FreeLibrary.KERNEL32 ref: 00007FF6774731FA

Strings

EventActivityIdControl, xrefs: 00007FF6774731D3
Advapi32.dll, xrefs: 00007FF6774731B7

Memory Dump Source

Source File: 00000014.00000002.820559575.00007FF677471000.00000020.00020000.sdmp, Offset: 00007FF677470000, based on PE: true

Associated: 00000014.00000002.820542146.00007FF677470000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820579246.00007FF677475000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820600877.00007FF677479000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: Advapi32.dll$EventActivityIdControl
API String ID: 4061214504-2884944642
Opcode ID: aedf27af08363e8be096298960b95e9e45329b81911291d16bc972695f86c7c2
Instruction ID: f66b007e2679ae8baeab4bd1b5964b1a3ee28c79a05dee992eece5ea699524b2
Opcode Fuzzy Hash: aedf27af08363e8be096298960b95e9e45329b81911291d16bc972695f86c7c2
Instruction Fuzzy Hash: F2011E73B38B4186EB20DB22E85116AB3A0FB88794F451535E98E8672CDE3CE1458F80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF677473D50, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF677473E63
RtlLookupFunctionEntry.NTDLL ref: 00007FF677473E82
RtlVirtualUnwind.NTDLL ref: 00007FF677473ECF
__raise_securityfailure.LIBCMT ref: 00007FF677473FB4

Memory Dump Source

Source File: 00000014.00000002.820559575.00007FF677471000.00000020.00020000.sdmp, Offset: 00007FF677470000, based on PE: true

Associated: 00000014.00000002.820542146.00007FF677470000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820579246.00007FF677475000.00000002.00020000.sdmp Download File
Associated: 00000014.00000002.820600877.00007FF677479000.00000002.00020000.sdmp Download File

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 6d447b2be52b3f6fec34675dfd94ab88545c1124e7dba97d2668506a416f3c4c
Instruction ID: 813f24054763cb6284d7d90dacfb073bf851d4c8754e6913e32c645540472228
Opcode Fuzzy Hash: 6d447b2be52b3f6fec34675dfd94ab88545c1124e7dba97d2668506a416f3c4c
Instruction Fuzzy Hash: EA41EA76A29B86C1EB508B1AF890365B3A8FB88754F914136DE8DC3768DF7CE544C780

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: msdt.exe PID: 5628 Parent PID: 3424 msdt.exeCOMMON

Executed Functions

Function 000001DA97CC2252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001DA97CC23B0
VirtualProtect.KERNELBASE ref: 000001DA97CC2471
RtlAddFunctionTable.NTDLL ref: 000001DA97CC25B4
VirtualProtect.KERNELBASE ref: 000001DA97CC2677

Memory Dump Source

Source File: 00000017.00000002.846936816.000001DA97CC0000.00000040.00000001.sdmp, Offset: 000001DA97CC0000, based on PE: true

Similarity

API ID: ProtectVirtual$FunctionTable
String ID:
API String ID: 847647671-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: a407fe90d3cd93910930cdc048548080df23c6b9342a401887463fec93dd16fa
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: F5B14476618BC486DB70CB1AE4407DEBBA1F7C9B84F548026EEC957B58DB79C8428F40

Uniqueness

Uniqueness Score: -1.00%

Function 000001DA97CC2057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001DA97CC29A8), ref: 000001DA97CC20A7

Memory Dump Source

Source File: 00000017.00000002.846936816.000001DA97CC0000.00000040.00000001.sdmp, Offset: 000001DA97CC0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 15c9a3ff6f279a70bef0c2d92b8d8cae167dc7897a9ac16d3b4fd49d67b571ba
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 57315EB2715B8086D780DF1AE45479A7BA0F789BC4F604026EF4D87B18DF39C442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF6EDB0C6FC, Relevance: 66.7, APIs: 34, Strings: 4, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C744
HeapFree.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C752
GetProcessHeap.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C779
HeapFree.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C787
GetProcessHeap.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C79D
HeapFree.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C7AB
GetProcessHeap.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C7BE
HeapFree.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C7CC
GetProcessHeap.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C7DF
HeapFree.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C7ED
GetProcessHeap.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C803
HeapFree.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C811
GetProcessHeap.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C82A
HeapFree.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C838
GetProcessHeap.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C851
HeapFree.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C85F
GetProcessHeap.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C875
HeapFree.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C883
GetProcessHeap.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C899
HeapFree.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C8A7
GetProcessHeap.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C8C0
HeapFree.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C8CE
GetProcessHeap.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C8E7
HeapFree.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C8F5
GetProcessHeap.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C90E
HeapFree.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C91C
GetProcessHeap.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C935
HeapFree.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C943
GetProcessHeap.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C95C
HeapFree.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C96A
SysFreeString.OLEAUT32 ref: 00007FF6EDB0C983
SysFreeString.OLEAUT32 ref: 00007FF6EDB0C99C
SysFreeString.OLEAUT32 ref: 00007FF6EDB0C9B5
FreeLibrary.KERNEL32(?,?,Dwz ERROR: %s:%d - hr = 0x%08X,00000001,?,00007FF6EDAF1408), ref: 00007FF6EDB0C9D6

Strings

Provider::~Provider, xrefs: 00007FF6EDB0C9F2
Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB0C70E
Problem unloading provider DLL., xrefs: 00007FF6EDB0C9EB
Dwz DEBUG: %s:%d - %s, xrefs: 00007FF6EDB0C9FE

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$Process$String$Library
String ID: Dwz DEBUG: %s:%d - %s$Dwz ERROR: %s:%d - hr = 0x%08X$Problem unloading provider DLL.$Provider::~Provider
API String ID: 2736793415-2740810768
Opcode ID: 4544ad6ef881ee71429c72cae43563e5010675a241e39d03dcc5ee0248409cc2
Instruction ID: e107ba2f41898ea9823b259467e531a9a4df5fffa23f40f124c2a17fff4a160c
Opcode Fuzzy Hash: 4544ad6ef881ee71429c72cae43563e5010675a241e39d03dcc5ee0248409cc2
Instruction Fuzzy Hash: 18910FB6A05F8282E7559F62AA0836A73A1FF46FD4F084035CD4D93B5CFF3A9044931A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB17F18, Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 266memoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6EDB17F6D
GetProcessHeap.KERNEL32 ref: 00007FF6EDB17F7C
HeapAlloc.KERNEL32 ref: 00007FF6EDB17F8D
SysAllocString.OLEAUT32 ref: 00007FF6EDB18246
GetProcessHeap.KERNEL32 ref: 00007FF6EDB1828D
HeapFree.KERNEL32 ref: 00007FF6EDB1829B
GetProcessHeap.KERNEL32 ref: 00007FF6EDB182A6
HeapFree.KERNEL32 ref: 00007FF6EDB182B4
GetProcessHeap.KERNEL32 ref: 00007FF6EDB182BF
HeapFree.KERNEL32 ref: 00007FF6EDB182CD

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB17FAB, 00007FF6EDB17FEE, 00007FF6EDB18073, 00007FF6EDB180B9, 00007FF6EDB1822A
DwzTryLoadFileResource, xrefs: 00007FF6EDB17FA4, 00007FF6EDB17FE7, 00007FF6EDB1806C, 00007FF6EDB180C0, 00007FF6EDB18221
@, , xrefs: 00007FF6EDB18003

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$Free$Alloc$PrintString_vsnprintfmemset
String ID: @, $Dwz ERROR: %s:%d - hr = 0x%08X$DwzTryLoadFileResource
API String ID: 3611533035-295717804
Opcode ID: 9fbb553af93f78b660d6311e873d9579d05472507765a9d162fa2dfc25bd076e
Instruction ID: ad45bc66a9991cd0c8b668dbe3fe4d1e6258b270c5a203eb777dab1ed43ed409
Opcode Fuzzy Hash: 9fbb553af93f78b660d6311e873d9579d05472507765a9d162fa2dfc25bd076e
Instruction Fuzzy Hash: 87B1B4A7F08B4296E711CB66D8047AA37A1BF4AB84F404135CD0DDB794FE7EE5098349

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB16720, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6EDB16756
GetProcessHeap.KERNEL32 ref: 00007FF6EDB1675B
HeapAlloc.KERNEL32 ref: 00007FF6EDB1676C
GetProcessHeap.KERNEL32 ref: 00007FF6EDB168EF
HeapFree.KERNEL32 ref: 00007FF6EDB168FD

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB16790, 00007FF6EDB168E3
%s\%s, xrefs: 00007FF6EDB1682A
%s\*, xrefs: 00007FF6EDB167A7
AddPathToCabContext, xrefs: 00007FF6EDB1677F, 00007FF6EDB168D7

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$AllocFreePrint_vsnprintfmemset
String ID: %s\%s$%s\*$AddPathToCabContext$Dwz ERROR: %s:%d - hr = 0x%08X
API String ID: 734778969-3034797083
Opcode ID: 754105c15728c97d576da620d34b09d99090fe34fafccc178d4413e15ea2d653
Instruction ID: 12bce44fb3123a400f5e976e3df827f1fa7bc9f4957bb36443cee7311f47ead3
Opcode Fuzzy Hash: 754105c15728c97d576da620d34b09d99090fe34fafccc178d4413e15ea2d653
Instruction Fuzzy Hash: D2518FA3B08B4286F710DB15E8447BA7795AF86B84F400136DA4DC3699FF7EE509C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB256C4, Relevance: 24.1, APIs: 16, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,00000000,?,00007FF6EDB180A4), ref: 00007FF6EDB256EE
GetLastError.KERNEL32 ref: 00007FF6EDB25708
LoadResource.KERNEL32 ref: 00007FF6EDB25727
GetLastError.KERNEL32 ref: 00007FF6EDB2573B
LockResource.KERNEL32 ref: 00007FF6EDB25757
SizeofResource.KERNEL32 ref: 00007FF6EDB25775
GetLastError.KERNEL32 ref: 00007FF6EDB25782
GlobalAlloc.KERNEL32 ref: 00007FF6EDB257B1
GetLastError.KERNEL32 ref: 00007FF6EDB257C7
GlobalLock.KERNEL32 ref: 00007FF6EDB257DF
GetLastError.KERNEL32 ref: 00007FF6EDB257F5
memcpy.MSVCRT ref: 00007FF6EDB25813
CreateStreamOnHGlobal.OLE32 ref: 00007FF6EDB25823
FreeResource.KERNEL32 ref: 00007FF6EDB25833
GlobalUnlock.KERNEL32 ref: 00007FF6EDB25841
GlobalFree.KERNEL32 ref: 00007FF6EDB25853

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorGlobalLastResource$FreeLock$AllocCreateFindLoadSizeofStreamUnlockmemcpy
String ID:
API String ID: 3671948303-0
Opcode ID: 2c720db49409c8a5a32701da01f01f58fd9d3bdb4ebdf29e0b84294cbafb0ca0
Instruction ID: 9218484564b8bca3fabc24d63d7eca496b01596a68393d4cfb39b3cec7f1a03b
Opcode Fuzzy Hash: 2c720db49409c8a5a32701da01f01f58fd9d3bdb4ebdf29e0b84294cbafb0ca0
Instruction Fuzzy Hash: 2641B693F08B4786F6115B6BA88833671D0BF46BA5F800235DD1AC77D4FEBEE405921A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB28F0C, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FF6EDB28FC8
SysFreeString.OLEAUT32 ref: 00007FF6EDB291AC
SysFreeString.OLEAUT32 ref: 00007FF6EDB291BA

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

Strings

Package::set_Engine, xrefs: 00007FF6EDB290FE
Met ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB28F4F, 00007FF6EDB28FAA, 00007FF6EDB2910F, 00007FF6EDB29198
PackageCollection::InitializePackage, xrefs: 00007FF6EDB28F48, 00007FF6EDB28F9E, 00007FF6EDB2918C

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free$AllocPrint_vsnprintf
String ID: Met ERROR: %s:%d - hr = 0x%08X$Package::set_Engine$PackageCollection::InitializePackage
API String ID: 711938272-3561917804
Opcode ID: 7d439a45a6d04b1f40dee32bf8bcb9cf4722f4a7a7e8f7c4637e6317b824360b
Instruction ID: fb12099d4ccc9c092595c53cde275cd9f9506da9bc2524098c03a58753b64fa2
Opcode Fuzzy Hash: 7d439a45a6d04b1f40dee32bf8bcb9cf4722f4a7a7e8f7c4637e6317b824360b
Instruction Fuzzy Hash: 31819FA7B48B4692FB218B56E8447797660BF4AB88F040536CA0DC7794FF7EE501D30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB1DF30, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 105encryptionCOMMON

Download Yara Rule

APIs

CertFreeCertificateContext.CRYPT32 ref: 00007FF6EDB1E0AE

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB1DF85, 00007FF6EDB1E09A
MatchCertificate, xrefs: 00007FF6EDB1DF74, 00007FF6EDB1E08E

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: CertCertificateContextFreePrint_vsnprintf
String ID: Dwz ERROR: %s:%d - hr = 0x%08X$MatchCertificate
API String ID: 842556206-1114545066
Opcode ID: 408ed42cda28fc81f6fae6581590f314a977eef61dd4b02a40aeae7d3b57741f
Instruction ID: 5480bf0391149b0307b327006d40e70772d71f8bdd48c382fbfad19e5d0a08b6
Opcode Fuzzy Hash: 408ed42cda28fc81f6fae6581590f314a977eef61dd4b02a40aeae7d3b57741f
Instruction Fuzzy Hash: 524191B2B08B4286E7108B55E48476E73A0FB86B80F504139DA8DC7A54FF7EE549C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB1D690, Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32 ref: 00007FF6EDB1D6C6
GetProcessHeap.KERNEL32 ref: 00007FF6EDB1D6F0
HeapFree.KERNEL32 ref: 00007FF6EDB1D6FE
GetProcessHeap.KERNEL32 ref: 00007FF6EDB1D704
HeapAlloc.KERNEL32 ref: 00007FF6EDB1D715
OpenEventW.KERNEL32 ref: 00007FF6EDB1D766
AllowSetForegroundWindow.USER32 ref: 00007FF6EDB1D77B
SetEvent.KERNEL32 ref: 00007FF6EDB1D784
GetLastError.KERNEL32 ref: 00007FF6EDB1D792
SetForegroundWindow.USER32 ref: 00007FF6EDB1D7CD

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

CloseHandle.KERNEL32 ref: 00007FF6EDB1D864
GetProcessHeap.KERNEL32 ref: 00007FF6EDB1D86F
HeapFree.KERNEL32 ref: 00007FF6EDB1D87D

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB1D7F1, 00007FF6EDB1D81E, 00007FF6EDB1D84B
W, xrefs: 00007FF6EDB1D831
Instance::ActivateThread, xrefs: 00007FF6EDB1D7E6, 00007FF6EDB1D812, 00007FF6EDB1D83F

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$EventForegroundFreeWindow$AllocAllowCloseErrorHandleLastMultipleObjectsOpenPrintWait_vsnprintf
String ID: Dwz ERROR: %s:%d - hr = 0x%08X$Instance::ActivateThread$W
API String ID: 936547728-2893472722
Opcode ID: 881015868200128596947e1929c9be2316e2e68cb09a70dc0f2475ac73dae360
Instruction ID: 44e8d128b5b5342a6edb7df361e844fbea4bd9bf76dbbee56750e810f49b9a87
Opcode Fuzzy Hash: 881015868200128596947e1929c9be2316e2e68cb09a70dc0f2475ac73dae360
Instruction Fuzzy Hash: 9651A0A3B18A4282FB24DB56E8043797291AF46B90F445235C94EC76E4FF7EE509D30E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDAF6720, Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

?StartDefer@Element@DirectUI@@QEAAXPEAK@Z.DUI70 ref: 00007FF6EDAF675C
?EndDefer@Element@DirectUI@@QEAAXK@Z.DUI70 ref: 00007FF6EDAF6992

Strings

page, xrefs: 00007FF6EDAF6839
Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDAF67D3, 00007FF6EDAF691B
ProgressPage::SetVisible, xrefs: 00007FF6EDAF67CC, 00007FF6EDAF6914
progress, xrefs: 00007FF6EDAF67EB, 00007FF6EDAF687B

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: Defer@DirectElement@$Start
String ID: Dwz ERROR: %s:%d - hr = 0x%08X$ProgressPage::SetVisible$page$progress
API String ID: 2038970047-229227084
Opcode ID: 9a5b0293f6e818756453ad1437ce34634ff06b0488094e88c1cbd7d0a781d123
Instruction ID: f8f37c29a34bd127b638be5e834f1cba972c0af7be730810c58cc9030b242abd
Opcode Fuzzy Hash: 9a5b0293f6e818756453ad1437ce34634ff06b0488094e88c1cbd7d0a781d123
Instruction Fuzzy Hash: 107190A3B08B4282FB108B6AD88477937A0FB45B88F144575CA4DD7794FF7EE605834A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB12EE0, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 138windowkeyboardCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6EDB12FEB
SendMessageW.USER32 ref: 00007FF6EDB1300C
?PropSheet_SendMessage@TaskPage@DirectUI@@IEAA_JI_K_J@Z.DUI70 ref: 00007FF6EDB13047
SendMessageW.USER32 ref: 00007FF6EDB1305B
GetKeyState.USER32 ref: 00007FF6EDB130D0

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB12F89, 00007FF6EDB130B0
UploadFilePage::EnableViewButton, xrefs: 00007FF6EDB130A5
open, xrefs: 00007FF6EDB12FB5
btnView, xrefs: 00007FF6EDB1306E
UploadFilePage::NotifyHandler, xrefs: 00007FF6EDB12F7D

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: Send$Message$DirectMessage@Page@PropSheet_StateTask
String ID: Dwz ERROR: %s:%d - hr = 0x%08X$UploadFilePage::EnableViewButton$UploadFilePage::NotifyHandler$btnView$open
API String ID: 2214018680-2743614645
Opcode ID: 229f3594d50a83579a071758cdddd684e4e65c2ebc14ad03d674a0833623f178
Instruction ID: 34c9bb96775f8117c88e3ed23461f4a88166579ad887e8f7a896fde91426333d
Opcode Fuzzy Hash: 229f3594d50a83579a071758cdddd684e4e65c2ebc14ad03d674a0833623f178
Instruction Fuzzy Hash: EE51D2B3A08A4286F7208B25E85877A3290FB86B94F500135DA5DC7BD4FF7FD549870A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB0BF34, Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF6EDB0BF5E
SysAllocString.OLEAUT32 ref: 00007FF6EDB0BF6B
SysAllocString.OLEAUT32 ref: 00007FF6EDB0BF92
SysFreeString.OLEAUT32 ref: 00007FF6EDB0C0AF
SysFreeString.OLEAUT32 ref: 00007FF6EDB0C0BD
VariantClear.OLEAUT32 ref: 00007FF6EDB0C0C7

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB0C07B
Package, xrefs: 00007FF6EDB0BF8B
Answers::CreatePackageNode, xrefs: 00007FF6EDB0C070
Default, xrefs: 00007FF6EDB0BFE7

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$AllocFreeVariant$ClearInit
String ID: Answers::CreatePackageNode$Default$Dwz ERROR: %s:%d - hr = 0x%08X$Package
API String ID: 2225245433-4029201092
Opcode ID: f8d3487d99c4bb791247af93efbf846a0b71d2c377775f31055c3067b867c15b
Instruction ID: 43074a599f04fa03f756788b05fdc6d42f8c4ebe1dd2dc7be58192f883bcaeac
Opcode Fuzzy Hash: f8d3487d99c4bb791247af93efbf846a0b71d2c377775f31055c3067b867c15b
Instruction Fuzzy Hash: 27416C62B08A16C6EB018B66D8547A83360BB46BC8F148135DD0EC7764FF3FD546C349

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB04710, Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 144COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6EDB0475E
?Click@Button@DirectUI@@SA?AVUID@@XZ.DUI70 ref: 00007FF6EDB047C2
StrToID.DUI70 ref: 00007FF6EDB048CF
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z.DUI70 ref: 00007FF6EDB048DB
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z.DUI70 ref: 00007FF6EDB04904

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB047AC
EditPage::OnListenedEvent, xrefs: 00007FF6EDB047A0
W, xrefs: 00007FF6EDB04792
edit, xrefs: 00007FF6EDB04786
browse, xrefs: 00007FF6EDB047ED
fileedit, xrefs: 00007FF6EDB04776

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: Direct$Element@$Button@Click@ContentDescendent@FindString@V12@memset
String ID: Dwz ERROR: %s:%d - hr = 0x%08X$EditPage::OnListenedEvent$W$browse$edit$fileedit
API String ID: 3065952098-652274403
Opcode ID: 26ee0db5c7b952abc0ba60ec76927ce2a7ecf287c6d7ed461d1c662c034703d9
Instruction ID: 8089ac6a7c4097dd724f7d89f68a20704cbe5dcbfa6f24c02c6a89f1ccd20ac5
Opcode Fuzzy Hash: 26ee0db5c7b952abc0ba60ec76927ce2a7ecf287c6d7ed461d1c662c034703d9
Instruction Fuzzy Hash: F66182B3708782CAEA24CB16E54076973A1FB86784F404536DA4DCB684FF3EE955C709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB01F0C, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 116windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6EDB01F43
GetWindowLongW.USER32 ref: 00007FF6EDB01F67
GetSystemMetrics.USER32 ref: 00007FF6EDB01FC7
GetSystemMetrics.USER32 ref: 00007FF6EDB01FD4
ImageList_Create.COMCTL32 ref: 00007FF6EDB01FF0
ImageList_ReplaceIcon.COMCTL32 ref: 00007FF6EDB02012
SendMessageW.USER32 ref: 00007FF6EDB02068
SendMessageW.USER32 ref: 00007FF6EDB02081

Part of subcall function 00007FF6EDB18768: SysFreeString.OLEAUT32 ref: 00007FF6EDB188A9
Part of subcall function 00007FF6EDB18768: SysFreeString.OLEAUT32 ref: 00007FF6EDB188BC

GetLastError.KERNEL32 ref: 00007FF6EDB020A9

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB01FA7, 00007FF6EDB02033
InteractivityChoice::MakeButtonImageList, xrefs: 00007FF6EDB01F9B, 00007FF6EDB02022

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeImageList_MessageMetricsSendStringSystem$CreateErrorIconLastLongPrintReplaceWindow_vsnprintfmemset
String ID: Dwz ERROR: %s:%d - hr = 0x%08X$InteractivityChoice::MakeButtonImageList
API String ID: 1637229690-1485535294
Opcode ID: b0b7116ff56fdca448d6a67e6c34d9c144c61a37f9265b9bf7adfb7c335f8838
Instruction ID: e318e4a14ea8315c1dc910d43ddac923884a5257469ddd154f24f4b55538a935
Opcode Fuzzy Hash: b0b7116ff56fdca448d6a67e6c34d9c144c61a37f9265b9bf7adfb7c335f8838
Instruction Fuzzy Hash: 8A41BCB3F04A218AF310CB65E8447AE36A0BB49B98F404236DE0993688FF7ED544C749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB1EE98, Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 229memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,00000000,00000000,?,00000000,00000000,00000000,?,00007FF6EDB1F2B4,?,?,00000000), ref: 00007FF6EDB1EF0E
HeapAlloc.KERNEL32(?,?,?,00000000,00000000,?,00000000,00000000,00000000,?,00007FF6EDB1F2B4,?,?,00000000), ref: 00007FF6EDB1EF1F
SysFreeString.OLEAUT32 ref: 00007FF6EDB1F092
SysFreeString.OLEAUT32 ref: 00007FF6EDB1F158
SysFreeString.OLEAUT32 ref: 00007FF6EDB1F16A
GetProcessHeap.KERNEL32(?,?,?,00000000,00000000,?,00000000,00000000,00000000,?,00007FF6EDB1F2B4,?,?,00000000), ref: 00007FF6EDB1F1A9
HeapFree.KERNEL32(?,?,?,00000000,00000000,?,00000000,00000000,00000000,?,00007FF6EDB1F2B4,?,?,00000000), ref: 00007FF6EDB1F1B7

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB1EEF0, 00007FF6EDB1F13A
GetResolutionsRunHelper, xrefs: 00007FF6EDB1EEE4, 00007FF6EDB1F12F

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$String$Process$Alloc
String ID: Dwz ERROR: %s:%d - hr = 0x%08X$GetResolutionsRunHelper
API String ID: 1648245399-2938934751
Opcode ID: d613dfe70f8ded11e9cb0f4155b1ac63a70c8a46c9b216ab8a5e6e9d4dcf545b
Instruction ID: fe3122dfe1874ac37aa73778b4d76651cbc0bc81a3525715b62a895957610a82
Opcode Fuzzy Hash: d613dfe70f8ded11e9cb0f4155b1ac63a70c8a46c9b216ab8a5e6e9d4dcf545b
Instruction Fuzzy Hash: 2A9146A3B08A4686FB118BA6D85476D3660BF49B88F100436CE0DD7B54FF7EE509D30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB32E90, Relevance: 15.1, APIs: 10, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6EDB32ED3
GetLastError.KERNEL32 ref: 00007FF6EDB32EDF
GetProcessHeap.KERNEL32 ref: 00007FF6EDB32EF4
HeapAlloc.KERNEL32 ref: 00007FF6EDB32F02

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocByteCharErrorLastMultiProcessWide
String ID:
API String ID: 1114924977-0
Opcode ID: 6e58ded8200588199e4ddd67d1cfd059f519fa127fd4016bbfe7f740c4cd0bb6
Instruction ID: 0ecaa9e86ececceab378e0d21f26586d4b00f43c41f4be9af681268a5e68c761
Opcode Fuzzy Hash: 6e58ded8200588199e4ddd67d1cfd059f519fa127fd4016bbfe7f740c4cd0bb6
Instruction Fuzzy Hash: 0D31A4B7A04B4283E7209F66E80876977A0FB4AFA0F444535CE5983794FFBDE0049709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB25ECC, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6EDB25A38: SysFreeString.OLEAUT32 ref: 00007FF6EDB25AA1
Part of subcall function 00007FF6EDB25A38: SysFreeString.OLEAUT32 ref: 00007FF6EDB25AE8

Part of subcall function 00007FF6EDB2566C: SysFreeString.OLEAUT32 ref: 00007FF6EDB2568B
Part of subcall function 00007FF6EDB2566C: SysAllocString.OLEAUT32 ref: 00007FF6EDB25697

GetProcessHeap.KERNEL32 ref: 00007FF6EDB25FAC
HeapAlloc.KERNEL32 ref: 00007FF6EDB25FBB
memset.MSVCRT ref: 00007FF6EDB25FD2
SysFreeString.OLEAUT32 ref: 00007FF6EDB2603F

Strings

UploadUrl, xrefs: 00007FF6EDB25F11
//Diagnostic, xrefs: 00007FF6EDB25F27
SessionId, xrefs: 00007FF6EDB25EF1
DownloadUrl, xrefs: 00007FF6EDB25FFD

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free$AllocHeap$Processmemset
String ID: //Diagnostic$DownloadUrl$SessionId$UploadUrl
API String ID: 1264233546-2039993532
Opcode ID: f6a190d8ad64c46efff129e041b4c99317c68cfce87d1ff7042e4eb15782ec46
Instruction ID: 6cc608a0ac47049e880769a2004aa4d342a9d1522565be76d178c20521c8550f
Opcode Fuzzy Hash: f6a190d8ad64c46efff129e041b4c99317c68cfce87d1ff7042e4eb15782ec46
Instruction Fuzzy Hash: A2513AA3609A4686EB11CF66D8943A933A4FB4AB8CF444136DA0D87764FF3ED455C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB156EC, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FF6EDB15739
RegSetValueExW.ADVAPI32 ref: 00007FF6EDB1577D
RegCloseKey.ADVAPI32 ref: 00007FF6EDB157BE

Part of subcall function 00007FF6EDB1580C: memset.MSVCRT ref: 00007FF6EDB15824
Part of subcall function 00007FF6EDB1580C: GetProcessHeap.KERNEL32 ref: 00007FF6EDB158E3
Part of subcall function 00007FF6EDB1580C: HeapFree.KERNEL32 ref: 00007FF6EDB158F1

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB156F3, 00007FF6EDB157A6, 00007FF6EDB157F2
DwzRegWriteValue, xrefs: 00007FF6EDB1579B
Software\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy, xrefs: 00007FF6EDB15706
EnableQueryRemoteServer, xrefs: 00007FF6EDB15769
EnableLocalTroubleshooting, xrefs: 00007FF6EDB157E9

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$CloseCreateFreeProcessValuememset
String ID: Dwz ERROR: %s:%d - hr = 0x%08X$DwzRegWriteValue$EnableLocalTroubleshooting$EnableQueryRemoteServer$Software\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy
API String ID: 3405824089-312955563
Opcode ID: c3922f44c0e8c727aa0f775393489268e068f6a87925bf672282891f50b5a225
Instruction ID: fba4cd18ccdc80e424f6e13d82b6e7bce0bf6fb4d596bddd77e28f256de7799e
Opcode Fuzzy Hash: c3922f44c0e8c727aa0f775393489268e068f6a87925bf672282891f50b5a225
Instruction Fuzzy Hash: 78319EB3B08B1286E7109F56E4847BA72A0FB45B94F400235EA5CC7694FF7ED609C749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB07F20, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FF6EDB07F64
SafeArrayCreate.OLEAUT32 ref: 00007FF6EDB07FA6
SysFreeString.OLEAUT32 ref: 00007FF6EDB08001

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

Strings

InteractivityUIPage::GetUserChoices, xrefs: 00007FF6EDB07F77, 00007FF6EDB07FC1
Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB07F88, 00007FF6EDB07FCC
Run, xrefs: 00007FF6EDB07F4E
NotRun, xrefs: 00007FF6EDB07F3F

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$AllocArrayCreateFreePrintSafe_vsnprintf
String ID: Dwz ERROR: %s:%d - hr = 0x%08X$InteractivityUIPage::GetUserChoices$NotRun$Run
API String ID: 3409592313-1293613164
Opcode ID: d4accb19656b8881c0a06a5ddb1a202c0f235734b80145744f10774f2e07bf64
Instruction ID: 64f0714c52cd249d5f7dc8a6177c6d07aaa99d8dc905936b279a08b89e276764
Opcode Fuzzy Hash: d4accb19656b8881c0a06a5ddb1a202c0f235734b80145744f10774f2e07bf64
Instruction Fuzzy Hash: 5721CEB6B08B82C3EB108B06E8443A5B360BB8A794F404035DA4DC7B54FFBEE545C74A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB0AF24, Relevance: 13.6, APIs: 6, Strings: 3, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6EDB0B0D0
HeapFree.KERNEL32 ref: 00007FF6EDB0B0DE

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB0AF78, 00007FF6EDB0AFBF
Answers::GetAnswer, xrefs: 00007FF6EDB0AF6C, 00007FF6EDB0AFB3
/Packages/Interaction[@ID='%s'], xrefs: 00007FF6EDB0B049

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreePrintProcess_vsnprintf
String ID: /Packages/Interaction[@ID='%s']$Answers::GetAnswer$Dwz ERROR: %s:%d - hr = 0x%08X
API String ID: 686152144-3300043486
Opcode ID: ff4366f0a141339b97a3449a899c1b2b5aed22b5f29a3a9a9a87686d417fb019
Instruction ID: 7af5e8455d9f7920170221b3c6f5afee07e4acf78fbdd30041e753d305d6fd88
Opcode Fuzzy Hash: ff4366f0a141339b97a3449a899c1b2b5aed22b5f29a3a9a9a87686d417fb019
Instruction Fuzzy Hash: 8F515CA2B08B82C2EB109B56D55477A7251AF9ABC4F004036EA0DD7B95FF7EE501834E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDAF2F20, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 126keyboardwindowCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FF6EDAF2F4C
ForwardGadgetMessage.DUSER ref: 00007FF6EDAF2FCB
GetKeyState.USER32 ref: 00007FF6EDAF3004
GetKeyState.USER32 ref: 00007FF6EDAF3085
CallNextHookEx.USER32 ref: 00007FF6EDAF30E3

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDAF3061
BrowserSink::TranslateAcceleratorW, xrefs: 00007FF6EDAF3055

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: State$CallForwardGadgetHookMessageNextValue
String ID: BrowserSink::TranslateAcceleratorW$Dwz ERROR: %s:%d - hr = 0x%08X
API String ID: 1049943200-1258161915
Opcode ID: 8315afab5d670f96aefc39d8a177e2970420e817fa91202a2b3af7359d3ac450
Instruction ID: 25e051d0a366c9ed8abfaeadc01ff202337565fe9e97afadd7f27c54ebd029b2
Opcode Fuzzy Hash: 8315afab5d670f96aefc39d8a177e2970420e817fa91202a2b3af7359d3ac450
Instruction Fuzzy Hash: DB514E73B08B4682EB648F5AE44437977A0FB45B84F244076CA4E837A0FF7EE541830A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB14690, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,00000001,00007FF6EDB15B55), ref: 00007FF6EDB146AA
HeapAlloc.KERNEL32(?,?,?,?,00000001,00007FF6EDB15B55), ref: 00007FF6EDB146BB
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00007FF6EDB15B55), ref: 00007FF6EDB14793
HeapFree.KERNEL32(?,?,?,?,00000001,00007FF6EDB15B55), ref: 00007FF6EDB147A1

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB146DF, 00007FF6EDB14722
UpdateUITextByID, xrefs: 00007FF6EDB146CE, 00007FF6EDB14716

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$AllocFreePrint_vsnprintf
String ID: Dwz ERROR: %s:%d - hr = 0x%08X$UpdateUITextByID
API String ID: 1684767720-1019319468
Opcode ID: 8718cbbc57213eff24c6a9aae0faa9b5fdd65feab43585dee8644fa80f663ef2
Instruction ID: 8ad1d04cf52a1431494f6a53e5c3e75c86017e2dd5f1013d8caba62926346171
Opcode Fuzzy Hash: 8718cbbc57213eff24c6a9aae0faa9b5fdd65feab43585dee8644fa80f663ef2
Instruction Fuzzy Hash: F831D2A2B08B8286E7209F56E8443297350FF4ABC0F544035DA4DCBB98FF7EE505834A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB326E0, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 48COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 00007FF6EDB32747
SysFreeString.OLEAUT32 ref: 00007FF6EDB3275B
SysFreeString.OLEAUT32 ref: 00007FF6EDB3276F
SysFreeString.OLEAUT32 ref: 00007FF6EDB32783

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

Strings

Resolution::~Resolution, xrefs: 00007FF6EDB32728
m_Extension not null on object destructor, xrefs: 00007FF6EDB32718
Met DEBUG: %s:%d - %s, xrefs: 00007FF6EDB3272F

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeString$Print_vsnprintf
String ID: Met DEBUG: %s:%d - %s$Resolution::~Resolution$m_Extension not null on object destructor
API String ID: 1465492589-1037351039
Opcode ID: 8e0e42ac140eb6a120ccf64cf36b85113752f030e2cd73670f73a8a3dfee2a01
Instruction ID: de38392b61ecc3939068b15709e5b1b9fdb817f4a9488fbdc1150d9fafec7dcf
Opcode Fuzzy Hash: 8e0e42ac140eb6a120ccf64cf36b85113752f030e2cd73670f73a8a3dfee2a01
Instruction Fuzzy Hash: 7B218EA7A0AA0693EF158F21E9583787360FF45B08F140234CA0D8B194FF7EE815D38A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDAFB6F4, Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 274COMMON

Download Yara Rule

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDAFB733, 00007FF6EDAFB927
), xrefs: 00007FF6EDAFBA4D
7, xrefs: 00007FF6EDAFBA32
PageManager::CreateNextPage, xrefs: 00007FF6EDAFB73A
Packages_ElevatedDiagnose, xrefs: 00007FF6EDAFB91C

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocPrintProcess_vsnprintf
String ID: )$7$Dwz ERROR: %s:%d - hr = 0x%08X$Packages_ElevatedDiagnose$PageManager::CreateNextPage
API String ID: 3370976713-1003848629
Opcode ID: 1d4b78f4b21e3d0bc2751c0c43edfb649fdc57828c6e6bedb9ab736b248b4f30
Instruction ID: f3dcf67c7be91524cfa21a1e929b80c1b8af35a112120f9854e6d2c5b78bccc6
Opcode Fuzzy Hash: 1d4b78f4b21e3d0bc2751c0c43edfb649fdc57828c6e6bedb9ab736b248b4f30
Instruction Fuzzy Hash: 95C17C63B0874286FAA09B19D48077C32A5AF85B54F254675DA1DC33E1FF3EEA40874A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB196C8, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 118memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FF6EDB196EF
SysFreeString.OLEAUT32 ref: 00007FF6EDB19855

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB19713, 00007FF6EDB19779, 00007FF6EDB197C9, 00007FF6EDB19841
AppendElement, xrefs: 00007FF6EDB19702, 00007FF6EDB1976E, 00007FF6EDB197B8, 00007FF6EDB19836

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$AllocFreePrint_vsnprintf
String ID: AppendElement$Dwz ERROR: %s:%d - hr = 0x%08X
API String ID: 1314548331-95411995
Opcode ID: d85842c3cbd613056cf6d17909c2724e07e2d4490441e6d67316a68c6ee79ad2
Instruction ID: 9cba6083e4abce4008bd5b8bc42ce2d98474d3f552cbf094e3b0b2881ff804ab
Opcode Fuzzy Hash: d85842c3cbd613056cf6d17909c2724e07e2d4490441e6d67316a68c6ee79ad2
Instruction Fuzzy Hash: 4C5169A7B08B8282EB158B56E8443A97760BF86BC0F004136DA0DC7764FF3EE505C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDAF6EC0, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00007FF6EDAF6EEE
GetLastError.KERNEL32 ref: 00007FF6EDAF6EF8

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

GetProcessHeap.KERNEL32 ref: 00007FF6EDAF6F37
HeapFree.KERNEL32 ref: 00007FF6EDAF6F45

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDAF6F20
ProgressPage::ShowPageMinimumTimeCallback, xrefs: 00007FF6EDAF6F14

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$ErrorEventFreeLastPrintProcess_vsnprintf
String ID: Dwz ERROR: %s:%d - hr = 0x%08X$ProgressPage::ShowPageMinimumTimeCallback
API String ID: 2048745188-4101929148
Opcode ID: fcd87db38a6c967a8495d864a6a67efbff2905fc21aa7df6201ca02ef7f7f46e
Instruction ID: aacb40328aae25d045b77d8b8a6618e919b486e98cf3963cafd59e59e11ce221
Opcode Fuzzy Hash: fcd87db38a6c967a8495d864a6a67efbff2905fc21aa7df6201ca02ef7f7f46e
Instruction Fuzzy Hash: 34018C72B1A64282FB189B2AD8143743391BF55B40F584079C94DC7260FE3EE546C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDAFAE4C, Relevance: 8.8, APIs: 7, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,00007FF6EDAFAC31), ref: 00007FF6EDAFAE75
HeapAlloc.KERNEL32(?,?,?,00007FF6EDAFAC31), ref: 00007FF6EDAFAE88
memcpy.MSVCRT ref: 00007FF6EDAFAF0C

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcessmemcpy
String ID:
API String ID: 4164033339-0
Opcode ID: e58b03d9868a169cb802f15eec81358cd2b1dbd129c4f932ae53d1fd0f1faf1e
Instruction ID: 01981e5ba14951d2132a8a3bf379c42b5d97267a89fa1dad0c6f84535ba0687a
Opcode Fuzzy Hash: e58b03d9868a169cb802f15eec81358cd2b1dbd129c4f932ae53d1fd0f1faf1e
Instruction Fuzzy Hash: 65416573A05B4286E714CF2AE80876977A0EB48F90F188134DA6987798FF3DE551C709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB10720, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 00007FF6EDB10861

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB1084C
Provider::GetKeywords, xrefs: 00007FF6EDB10845

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreePrintString_vsnprintf
String ID: Dwz ERROR: %s:%d - hr = 0x%08X$Provider::GetKeywords
API String ID: 853022338-1467038387
Opcode ID: 2821dfbbccb03d720bb9190b161cded6d96fb5d79734f5d0dee314b1a74fdba5
Instruction ID: 5a780b9017de1be9721f0dd26524f2fe411bdd932e9baf36565072be97c107be
Opcode Fuzzy Hash: 2821dfbbccb03d720bb9190b161cded6d96fb5d79734f5d0dee314b1a74fdba5
Instruction Fuzzy Hash: 304180A3F0860286FB209F65D4447B836A0FB45788F140236DA4ECB684FF7ED449C78A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDAF5E60, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 00007FF6EDAF5F27
SysFreeString.OLEAUT32 ref: 00007FF6EDAF5F35

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDAF5EC4, 00007FF6EDAF5F13
IntroPage::OnGetInfoTip, xrefs: 00007FF6EDAF5EB8, 00007FF6EDAF5F07
%s%s, xrefs: 00007FF6EDAF5EDE

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeString$Print_vsnprintf
String ID: %s%s$Dwz ERROR: %s:%d - hr = 0x%08X$IntroPage::OnGetInfoTip
API String ID: 1465492589-432333135
Opcode ID: 07adf403d805e3153c1f397c3404bbb031eac55e9087d8c7b2ac56c26f6d64df
Instruction ID: 368df2ad6b4473dcb660861fdf0423990206fad91fa40d295487ebb32f1a7e0c
Opcode Fuzzy Hash: 07adf403d805e3153c1f397c3404bbb031eac55e9087d8c7b2ac56c26f6d64df
Instruction Fuzzy Hash: 012191A3B0964242E720AB15E5403BC7261BF49B88F610175DE4DC7B99FF3EE642874A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB02E60, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32 ref: 00007FF6EDB02F41

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB02EAB, 00007FF6EDB02EE2, 00007FF6EDB02F22
Packages_GetCallback, xrefs: 00007FF6EDB02ED6, 00007FF6EDB02F11
InteractivityPage::OnWizNext, xrefs: 00007FF6EDB02E9F

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: ArrayDestroySafe
String ID: Dwz ERROR: %s:%d - hr = 0x%08X$InteractivityPage::OnWizNext$Packages_GetCallback
API String ID: 4225690600-3431348806
Opcode ID: 20edfa6d5cc9b9f06d4f2b759c75c514e6276951fa598b3d55066d268d5c77b6
Instruction ID: ef306d8d8f60cec6597860a5d58ba0aa3150608e740f01650a771e273e9f314f
Opcode Fuzzy Hash: 20edfa6d5cc9b9f06d4f2b759c75c514e6276951fa598b3d55066d268d5c77b6
Instruction Fuzzy Hash: 9331C2A3B08642D2E7108B46E9403A9B720FB45B90F904236DA5CC7AE4FFBEE505D349

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB20F34, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 00007FF6EDB20F81
SysAllocString.OLEAUT32 ref: 00007FF6EDB20F94

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB20F65
Packages_SetCategory, xrefs: 00007FF6EDB20F59

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$AllocFreePrint_vsnprintf
String ID: Dwz ERROR: %s:%d - hr = 0x%08X$Packages_SetCategory
API String ID: 1314548331-3508842083
Opcode ID: 0c00d564c1e6a2d68acb8b105974b0179fe79ef97193ad552f3a25b71db482b8
Instruction ID: 131d301514adedeb0bd036f445e1a30bb0c04df54c6e71ddf9f3aae4f5216540
Opcode Fuzzy Hash: 0c00d564c1e6a2d68acb8b105974b0179fe79ef97193ad552f3a25b71db482b8
Instruction Fuzzy Hash: BEF06D77E08A0185FB109B11E5943B9B320EF86B88F540035DA0DC7A68FF3ED585C34A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB20EBC, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 00007FF6EDB20F09
SysAllocString.OLEAUT32 ref: 00007FF6EDB20F1C

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB20EED
Packages_SetIcon, xrefs: 00007FF6EDB20EE1

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$AllocFreePrint_vsnprintf
String ID: Dwz ERROR: %s:%d - hr = 0x%08X$Packages_SetIcon
API String ID: 1314548331-216816780
Opcode ID: 1d41f92f3f8752b4a052980591401ad41f9061087b14e678445924c9236af2ae
Instruction ID: 1e4e273db27cd3dc956318f01e8b59a6e3acecc3454d886674e581e5a68cc420
Opcode Fuzzy Hash: 1d41f92f3f8752b4a052980591401ad41f9061087b14e678445924c9236af2ae
Instruction Fuzzy Hash: 3FF08163E08A4286EB118B15E584379B360EF86B88F540035DA4DC7658FF3FD885C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDAFA710, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00007FF6EDAFA720
GetLastError.KERNEL32 ref: 00007FF6EDAFA72A

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDAFA74D
FinalWERReportPage::OnSetActive, xrefs: 00007FF6EDAFA746

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorEventLastPrint_vsnprintf
String ID: Dwz ERROR: %s:%d - hr = 0x%08X$FinalWERReportPage::OnSetActive
API String ID: 3293750152-4034139814
Opcode ID: bcb574d1ff3fa25c0a0db73ce386e362ad8b09da51715eaf428fb9daaf6836d1
Instruction ID: 86bf6a9ec80f53dff23908187c97f2787b780b35f75e78a1f69a7a13a8108d5b
Opcode Fuzzy Hash: bcb574d1ff3fa25c0a0db73ce386e362ad8b09da51715eaf428fb9daaf6836d1
Instruction Fuzzy Hash: 28F05E66F1860342FB145B6AD9047B523A1BF91B44F988032C84DC7258FF7FE241D71A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDAF3700, Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00007FF6EDAF3717
GetGadgetFocus.DUSER ref: 00007FF6EDAF3722
ForwardGadgetMessage.DUSER ref: 00007FF6EDAF375C
IsChild.USER32 ref: 00007FF6EDAF376F

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: FocusGadget$ChildForwardMessage
String ID:
API String ID: 368028167-0
Opcode ID: 8974cc6f27fa2303f74cba7ce257a4dc5ea0dd336933af38dd8bda040bde4607
Instruction ID: 22a2f5c8680c73785b75afcc52a51557ee2409def8cefbe85c85738c93fbdd9f
Opcode Fuzzy Hash: 8974cc6f27fa2303f74cba7ce257a4dc5ea0dd336933af38dd8bda040bde4607
Instruction Fuzzy Hash: 33115B67B09E85C6EB209B16E508229B360FB45FC0F584571DA8D87B28FF7DE541C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB28EA0, Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,00007FF6EDB27CA1), ref: 00007FF6EDB28EB5
HeapAlloc.KERNEL32(?,?,?,?,?,00007FF6EDB27CA1), ref: 00007FF6EDB28EC5

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

Strings

Met ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB28EEA
PackageCollection::AllocatePackages, xrefs: 00007FF6EDB28ED9

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocPrintProcess_vsnprintf
String ID: Met ERROR: %s:%d - hr = 0x%08X$PackageCollection::AllocatePackages
API String ID: 3370976713-1287687051
Opcode ID: 36ff5f0ae5fda4eca405f79bbd54388bec237178548f044f37cfbb38ba3360f0
Instruction ID: 527028d3dd2116703814129795b5bc8377f1df47c61bab754f09f7a5aa63e798
Opcode Fuzzy Hash: 36ff5f0ae5fda4eca405f79bbd54388bec237178548f044f37cfbb38ba3360f0
Instruction Fuzzy Hash: 15F0CDB3B09B8282E7109F59E04036973A0FB08B58F540539CA0C87B14FE7EE895C74D

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB0E71C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 00007FF6EDB0E7B2

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB0E75E
Configuration::TextFromSingleNode, xrefs: 00007FF6EDB0E753

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeString
String ID: Configuration::TextFromSingleNode$Dwz ERROR: %s:%d - hr = 0x%08X
API String ID: 3341692771-1898475934
Opcode ID: ddd06fe7d8e7640284a414a1a5120866ce7685aa1b15f736bd268d2d0586d660
Instruction ID: 71a0c37c3834d0b4c1c9a71658c7c6e768f46da97b052383414928726e034876
Opcode Fuzzy Hash: ddd06fe7d8e7640284a414a1a5120866ce7685aa1b15f736bd268d2d0586d660
Instruction Fuzzy Hash: EC2149B7B08B4682EB108B56E64036977A0EB89BD0F004136DA4DC7768FF7EE440C749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB2EF00, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FF6EDB2EF4A

Strings

PackageInfo::get_Publisher, xrefs: 00007FF6EDB2EF21
Met ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB2EF2C

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocString
String ID: Met ERROR: %s:%d - hr = 0x%08X$PackageInfo::get_Publisher
API String ID: 2525500382-2733436590
Opcode ID: f10b795aa4019124be9f414e72085f5b1f7e77805d818d311a6a43beca4691bb
Instruction ID: 7e60b9bfd0dd9c2ef496303d101da3e7c0b6314026e856c35b3d5478ad9195c9
Opcode Fuzzy Hash: f10b795aa4019124be9f414e72085f5b1f7e77805d818d311a6a43beca4691bb
Instruction Fuzzy Hash: 29F0A4A3F0974282FB104B46E4C07387260AF49788F248439EA0CDB354FF3EE9508309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB2EE80, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FF6EDB2EECA

Strings

PackageInfo::get_Description, xrefs: 00007FF6EDB2EEA1
Met ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB2EEAC

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocString
String ID: Met ERROR: %s:%d - hr = 0x%08X$PackageInfo::get_Description
API String ID: 2525500382-1246293730
Opcode ID: 65b5fc1b2c70e03bdcdbdb30af67497dd6de4f33bc2ae90e61975d457317f8cc
Instruction ID: 88f6a9fe9e9445130f7376bc7b15687f957bce3dc62b8bd74bca291dbb41f66e
Opcode Fuzzy Hash: 65b5fc1b2c70e03bdcdbdb30af67497dd6de4f33bc2ae90e61975d457317f8cc
Instruction Fuzzy Hash: D7F0C8A3B0974282EB509F46E4407787260AF49768F644139DD4CCB754FF3FD855830A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EDB076C0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

SafeArrayCreate.OLEAUT32 ref: 00007FF6EDB076DF

Part of subcall function 00007FF6EDAFCF60: _vsnprintf.MSVCRT ref: 00007FF6EDAFCF9F
Part of subcall function 00007FF6EDAFCF60: DbgPrintEx.NTDLL ref: 00007FF6EDAFCFD8

Strings

Dwz ERROR: %s:%d - hr = 0x%08X, xrefs: 00007FF6EDB07700
InteractivityTextPage::GetUserChoices, xrefs: 00007FF6EDB076EF

Memory Dump Source

Source File: 00000017.00000002.854940366.00007FF6EDAF1000.00000020.00020000.sdmp, Offset: 00007FF6EDAF0000, based on PE: true

Associated: 00000017.00000002.854928535.00007FF6EDAF0000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855099641.00007FF6EDB38000.00000002.00020000.sdmp Download File
Associated: 00000017.00000002.855162516.00007FF6EDB4E000.00000004.00020000.sdmp Download File
Associated: 00000017.00000002.855187916.00007FF6EDB4F000.00000002.00020000.sdmp Download File

Similarity

API ID: ArrayCreatePrintSafe_vsnprintf
String ID: Dwz ERROR: %s:%d - hr = 0x%08X$InteractivityTextPage::GetUserChoices
API String ID: 2301700293-2275007817
Opcode ID: 19cb39427e54c1b7d78ccaf96f02bb7534910bfc453c522a6534b1b7b3483955
Instruction ID: 7f0c2ff1c187fcf914d1974e09a5af08516622b226107b13b9422d6f32e266e1
Opcode Fuzzy Hash: 19cb39427e54c1b7d78ccaf96f02bb7534910bfc453c522a6534b1b7b3483955
Instruction Fuzzy Hash: 75F0CD73708781C3E7008F65E4802A8B360EB89788F54453ADA4C87228FFBED558C749

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report PSnPApRPsG

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre