Play interactive tour

Edit tour

Windows Analysis Report 1zdJLxxTnh

Overview

General Information

Sample Name:	1zdJLxxTnh (renamed file extension from none to dll)
Analysis ID:	492776
MD5:	784adf3295b7eafe53aa80da302b1b5d
SHA1:	c79da77a4d00ec47594e007f9a174de43b5028d3
SHA256:	69af86da86fc2f9639f010e0b729b1c2ce33a272d199aeedc4c873d98a2b83b4
Tags:	Dridexexe
Infos:
Most interesting Screenshot:

Detection

Dridex

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Dridex unpacked file

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Changes memory attributes in foreign processes to executable or writable

Queues an APC in another process (thread injection)

Machine Learning detection for dropped file

Uses Atom Bombing / ProGate to inject into other processes

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Queries the installation date of Windows

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

PE file contains strange resources

Drops PE files

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Binary contains a suspicious time stamp

PE file contains more sections than normal

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 7152 cmdline: loaddll64.exe 'C:\Users\user\Desktop\1zdJLxxTnh.dll' MD5: E0CC9D126C39A9D2FA1CAD5027EBBD18)

cmd.exe (PID: 5808 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\1zdJLxxTnh.dll',#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 1012 cmdline: rundll32.exe 'C:\Users\user\Desktop\1zdJLxxTnh.dll',#1 MD5: 73C519F050C20580F8A62C849D49215A)

explorer.exe (PID: 3352 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

ProximityUxHost.exe (PID: 5800 cmdline: C:\Windows\system32\ProximityUxHost.exe MD5: E7F0E9B3779E54CD271959C600A2A531)

ProximityUxHost.exe (PID: 4896 cmdline: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe MD5: E7F0E9B3779E54CD271959C600A2A531)

rstrui.exe (PID: 492 cmdline: C:\Windows\system32\rstrui.exe MD5: 3E8AFFA54035412F86663C8B44CAA2E5)

irftp.exe (PID: 4740 cmdline: C:\Windows\system32\irftp.exe MD5: F1C2D10CA8161DB689CD4FDE756E2DBB)

irftp.exe (PID: 6684 cmdline: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe MD5: F1C2D10CA8161DB689CD4FDE756E2DBB)

SystemPropertiesComputerName.exe (PID: 5792 cmdline: C:\Windows\system32\SystemPropertiesComputerName.exe MD5: BEE134E1F23AFD3AE58191D265BB9070)

sessionmsg.exe (PID: 5252 cmdline: C:\Windows\system32\sessionmsg.exe MD5: 1F7CEA0216DE48B877C16F95C7DA1F0F)

sessionmsg.exe (PID: 5724 cmdline: C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe MD5: 1F7CEA0216DE48B877C16F95C7DA1F0F)

WindowsActionDialog.exe (PID: 6136 cmdline: C:\Windows\system32\WindowsActionDialog.exe MD5: 991359EE1E9C1958EB5D0F7314774123)

WindowsActionDialog.exe (PID: 1840 cmdline: C:\Users\user\AppData\Local\buYWmbl3\WindowsActionDialog.exe MD5: 991359EE1E9C1958EB5D0F7314774123)

irftp.exe (PID: 4592 cmdline: C:\Windows\system32\irftp.exe MD5: F1C2D10CA8161DB689CD4FDE756E2DBB)

irftp.exe (PID: 6252 cmdline: C:\Users\user\AppData\Local\hJiut\irftp.exe MD5: F1C2D10CA8161DB689CD4FDE756E2DBB)

osk.exe (PID: 6228 cmdline: C:\Windows\system32\osk.exe MD5: 88B09DE7D0DF1D2E9BCA9BAE1346CB23)

rundll32.exe (PID: 5904 cmdline: rundll32.exe C:\Users\user\Desktop\1zdJLxxTnh.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6588 cmdline: rundll32.exe C:\Users\user\Desktop\1zdJLxxTnh.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5848 cmdline: rundll32.exe C:\Users\user\Desktop\1zdJLxxTnh.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ MD5: 73C519F050C20580F8A62C849D49215A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000000C.00000002.289547097.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000003.00000002.365405591.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000000D.00000002.296819494.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000024.00000002.491095361.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000021.00000002.459843217.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000004.00000002.283056136.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000001C.00000002.430835734.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000016.00000002.402800394.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000026.00000002.532861365.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
Click to see the 5 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: 1zdJLxxTnh.dll	Metadefender: Detection: 62%			Perma Link
Source: 1zdJLxxTnh.dll	ReversingLabs: Detection: 77%

Antivirus / Scanner detection for submitted sample

Show sources

Source: 1zdJLxxTnh.dll

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\XVzc21m9h\DUI70.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\94LPZAU0\WINMM.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\hJiut\MFC42u.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\nPqx0Ph\DUser.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\cp4nWp\VERSION.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\XVzc21m9h\DUI70.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\XVzc21m9h\DUI70.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\XVzc21m9h\DUI70.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\94LPZAU0\WINMM.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\hJiut\MFC42u.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\nPqx0Ph\DUser.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\cp4nWp\VERSION.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\XVzc21m9h\DUI70.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\XVzc21m9h\DUI70.dll	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3CA2CA0 BCryptOpenAlgorithmProvider,BCryptGetProperty,BCryptGetProperty,BCryptGenerateSymmetricKey,BCryptDestroyKey,BCryptCloseAlgorithmProvider,CoTaskMemFree,	22_2_00007FF7A3CA2CA0
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3CACC10 BCryptGenRandom,memcpy,BCryptEncrypt,memcpy,BCryptEncrypt,	22_2_00007FF7A3CACC10
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3CA2E8C BCryptDestroyKey,BCryptCloseAlgorithmProvider,CoTaskMemFree,CoTaskMemFree,	22_2_00007FF7A3CA2E8C
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3CACE10 memset,memcpy,BCryptEncrypt,BCryptDestroyKey,BCryptCloseAlgorithmProvider,CoTaskMemFree,	22_2_00007FF7A3CACE10
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3CA2A04 BCryptDecrypt,memset,BCryptDecrypt,memcpy,BCryptDestroyKey,BCryptCloseAlgorithmProvider,CoTaskMemFree,	22_2_00007FF7A3CA2A04

Source: 1zdJLxxTnh.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: ProximityUxHost.pdbGCTL source: ProximityUxHost.exe, 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp, ProximityUxHost.exe.8.dr
Source:	Binary string: WindowsActionDialog.pdb source: WindowsActionDialog.exe, 00000024.00000002.493551175.00007FF6A5E0B000.00000002.00020000.sdmp, WindowsActionDialog.exe.8.dr
Source:	Binary string: SessionMsg.pdb source: sessionmsg.exe, 00000021.00000002.461103553.00007FF67936A000.00000002.00020000.sdmp, sessionmsg.exe.8.dr
Source:	Binary string: irftp.pdbGCTL source: irftp.exe, 0000001C.00000002.431900352.00007FF7EDB65000.00000002.00020000.sdmp, irftp.exe, 00000026.00000000.510674509.00007FF65A355000.00000002.00020000.sdmp, irftp.exe0.8.dr
Source:	Binary string: PresentationHost.pdbGCTL source: PresentationHost.exe.8.dr
Source:	Binary string: SessionMsg.pdbGCTL source: sessionmsg.exe, 00000021.00000002.461103553.00007FF67936A000.00000002.00020000.sdmp, sessionmsg.exe.8.dr
Source:	Binary string: WindowsActionDialog.pdbGCTL source: WindowsActionDialog.exe, 00000024.00000002.493551175.00007FF6A5E0B000.00000002.00020000.sdmp, WindowsActionDialog.exe.8.dr
Source:	Binary string: PresentationHost.pdb source: PresentationHost.exe.8.dr
Source:	Binary string: CameraSettingsUIHost.pdbGCTL source: CameraSettingsUIHost.exe.8.dr
Source:	Binary string: CameraSettingsUIHost.pdb source: CameraSettingsUIHost.exe.8.dr
Source:	Binary string: ProximityUxHost.pdb source: ProximityUxHost.exe, 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp, ProximityUxHost.exe.8.dr
Source:	Binary string: irftp.pdb source: irftp.exe, 0000001C.00000002.431900352.00007FF7EDB65000.00000002.00020000.sdmp, irftp.exe, 00000026.00000000.510674509.00007FF65A355000.00000002.00020000.sdmp, irftp.exe0.8.dr

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005D290 FindFirstFileExW,	0_2_000000014005D290
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB5B908 FindFirstFileW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,	28_2_00007FF7EDB5B908
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB5C018 FindFirstFileW,lstrcmpW,lstrcmpW,CreateFileW,GetFileSize,CloseHandle,FindNextFileW,FindClose,	28_2_00007FF7EDB5C018
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A34C018 FindFirstFileW,lstrcmpW,lstrcmpW,CreateFileW,GetFileSize,CloseHandle,FindNextFileW,FindClose,	38_2_00007FF65A34C018
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A34B908 FindFirstFileW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,	38_2_00007FF65A34B908

Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe

Code function: 28_2_00007FF7EDB5A6E8 select,recv,GetLastError,select,

28_2_00007FF7EDB5A6E8

E-Banking Fraud:

Yara detected Dridex unpacked file

Show sources

Source: Yara match	File source: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.289547097.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.365405591.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.296819494.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.491095361.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.459843217.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.283056136.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.430835734.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.402800394.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.532861365.0000000140001000.00000020.00020000.sdmp, type: MEMORY

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140034870	0_2_0000000140034870
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140035270	0_2_0000000140035270
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140048AC0	0_2_0000000140048AC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005C340	0_2_000000014005C340
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140065B80	0_2_0000000140065B80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006A4B0	0_2_000000014006A4B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400524B0	0_2_00000001400524B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140026CC0	0_2_0000000140026CC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014004BD40	0_2_000000014004BD40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400495B0	0_2_00000001400495B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140036F30	0_2_0000000140036F30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140069010	0_2_0000000140069010
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140001010	0_2_0000000140001010
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140066020	0_2_0000000140066020
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002F840	0_2_000000014002F840
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005D850	0_2_000000014005D850
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140064080	0_2_0000000140064080
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140010880	0_2_0000000140010880
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400688A0	0_2_00000001400688A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002D0D0	0_2_000000014002D0D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400018D0	0_2_00000001400018D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140016100	0_2_0000000140016100
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014001D100	0_2_000000014001D100
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002A110	0_2_000000014002A110
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014001D910	0_2_000000014001D910
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140015120	0_2_0000000140015120
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000B120	0_2_000000014000B120
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014004F940	0_2_000000014004F940
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140039140	0_2_0000000140039140
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140023140	0_2_0000000140023140
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140057950	0_2_0000000140057950
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014001E170	0_2_000000014001E170
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140002980	0_2_0000000140002980
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400611A0	0_2_00000001400611A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400389A0	0_2_00000001400389A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400381A0	0_2_00000001400381A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002E1B0	0_2_000000014002E1B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400139D0	0_2_00000001400139D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400319F0	0_2_00000001400319F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002EA00	0_2_000000014002EA00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022A00	0_2_0000000140022A00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003B220	0_2_000000014003B220
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140067A40	0_2_0000000140067A40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140069A50	0_2_0000000140069A50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140007A60	0_2_0000000140007A60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003AAC0	0_2_000000014003AAC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003A2E0	0_2_000000014003A2E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140062B00	0_2_0000000140062B00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140018300	0_2_0000000140018300
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002FB20	0_2_000000014002FB20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140031340	0_2_0000000140031340
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022340	0_2_0000000140022340
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140017B40	0_2_0000000140017B40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000BB40	0_2_000000014000BB40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014004EB60	0_2_000000014004EB60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140005370	0_2_0000000140005370
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002CB80	0_2_000000014002CB80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B390	0_2_000000014006B390
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140054BA0	0_2_0000000140054BA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140033BB0	0_2_0000000140033BB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400263C0	0_2_00000001400263C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400123C0	0_2_00000001400123C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140063BD0	0_2_0000000140063BD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400663F0	0_2_00000001400663F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140023BF0	0_2_0000000140023BF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B41B	0_2_000000014006B41B
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B424	0_2_000000014006B424
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B42D	0_2_000000014006B42D
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B436	0_2_000000014006B436
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B43D	0_2_000000014006B43D
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140024440	0_2_0000000140024440
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140005C40	0_2_0000000140005C40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B446	0_2_000000014006B446
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005F490	0_2_000000014005F490
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022D00	0_2_0000000140022D00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140035520	0_2_0000000140035520
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140019D20	0_2_0000000140019D20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140030530	0_2_0000000140030530
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140023530	0_2_0000000140023530
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140031540	0_2_0000000140031540
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140033540	0_2_0000000140033540
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014007BD50	0_2_000000014007BD50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140078570	0_2_0000000140078570
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140019580	0_2_0000000140019580
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400205A0	0_2_00000001400205A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140025DB0	0_2_0000000140025DB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140071DC0	0_2_0000000140071DC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000C5C0	0_2_000000014000C5C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002DDE0	0_2_000000014002DDE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140031DF0	0_2_0000000140031DF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000DDF0	0_2_000000014000DDF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140001620	0_2_0000000140001620
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140018630	0_2_0000000140018630
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140032650	0_2_0000000140032650
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140064E80	0_2_0000000140064E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140016E80	0_2_0000000140016E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140007EA0	0_2_0000000140007EA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400286B0	0_2_00000001400286B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140006EB0	0_2_0000000140006EB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400276C0	0_2_00000001400276C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002FEC0	0_2_000000014002FEC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002EED0	0_2_000000014002EED0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002B6E0	0_2_000000014002B6E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140053F20	0_2_0000000140053F20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022730	0_2_0000000140022730
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140029780	0_2_0000000140029780
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140018F80	0_2_0000000140018F80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003EFB0	0_2_000000014003EFB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400067B0	0_2_00000001400067B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400667D0	0_2_00000001400667D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140060FE0	0_2_0000000140060FE0
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3CAA8E0	22_2_00007FF7A3CAA8E0
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3C8F0B4	22_2_00007FF7A3C8F0B4
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3C9ECB8	22_2_00007FF7A3C9ECB8
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3C8B868	22_2_00007FF7A3C8B868
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3C91018	22_2_00007FF7A3C91018
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3C98408	22_2_00007FF7A3C98408
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3CA7400	22_2_00007FF7A3CA7400
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3CA0800	22_2_00007FF7A3CA0800
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3C9CF68	22_2_00007FF7A3C9CF68
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3CA9F38	22_2_00007FF7A3CA9F38
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3C85B08	22_2_00007FF7A3C85B08
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3CAD6B0	22_2_00007FF7A3CAD6B0
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3C992C0	22_2_00007FF7A3C992C0
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3CAB260	22_2_00007FF7A3CAB260
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3C99A7C	22_2_00007FF7A3C99A7C
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3C945BC	22_2_00007FF7A3C945BC
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3CA4960	22_2_00007FF7A3CA4960
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3C94158	22_2_00007FF7A3C94158
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3CA9530	22_2_00007FF7A3CA9530
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3C8913C	22_2_00007FF7A3C8913C
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB5E264	28_2_00007FF7EDB5E264
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB57A6C	28_2_00007FF7EDB57A6C
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB5F0E0	28_2_00007FF7EDB5F0E0
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB59104	28_2_00007FF7EDB59104
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB61CB0	28_2_00007FF7EDB61CB0
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB53C70	28_2_00007FF7EDB53C70
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB54890	28_2_00007FF7EDB54890
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB58C24	28_2_00007FF7EDB58C24
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB573E0	28_2_00007FF7EDB573E0
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB527C4	28_2_00007FF7EDB527C4
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB57770	28_2_00007FF7EDB57770
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB5534C	28_2_00007FF7EDB5534C
Source: C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe	Code function: 33_2_00007FF679361E94	33_2_00007FF679361E94
Source: C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe	Code function: 33_2_00007FF6793644E0	33_2_00007FF6793644E0
Source: C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe	Code function: 33_2_00007FF679361778	33_2_00007FF679361778
Source: C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe	Code function: 33_2_00007FF679363B58	33_2_00007FF679363B58
Source: C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe	Code function: 33_2_00007FF679363168	33_2_00007FF679363168
Source: C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe	Code function: 33_2_00007FF679364A20	33_2_00007FF679364A20
Source: C:\Users\user\AppData\Local\buYWmbl3\WindowsActionDialog.exe	Code function: 36_2_00007FF6A5E046D8	36_2_00007FF6A5E046D8
Source: C:\Users\user\AppData\Local\buYWmbl3\WindowsActionDialog.exe	Code function: 36_2_00007FF6A5E03E8C	36_2_00007FF6A5E03E8C
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A34534C	38_2_00007FF65A34534C
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A347770	38_2_00007FF65A347770
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A348C24	38_2_00007FF65A348C24
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A3427C4	38_2_00007FF65A3427C4
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A3473E0	38_2_00007FF65A3473E0
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A344890	38_2_00007FF65A344890
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A351CB0	38_2_00007FF65A351CB0
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A343C70	38_2_00007FF65A343C70
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A349104	38_2_00007FF65A349104
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A34F0E0	38_2_00007FF65A34F0E0
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A34E264	38_2_00007FF65A34E264
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A347A6C	38_2_00007FF65A347A6C

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140046C90 NtClose,	0_2_0000000140046C90
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006A4B0 NtQuerySystemInformation,	0_2_000000014006A4B0
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB585A0 RtlInitUnicodeString,NtCreateFile,SetWaitableTimer,socket,CancelIo,CloseHandle,NtDeviceIoControlFile,closesocket,CancelIo,CloseHandle,SetWaitableTimer,NtDeviceIoControlFile,	28_2_00007FF7EDB585A0
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB58994 NtDeviceIoControlFile,WaitForSingleObject,memset,MultiByteToWideChar,lstrlenW,Sleep,memset,	28_2_00007FF7EDB58994
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB58900 PostMessageW,NtDeviceIoControlFile,	28_2_00007FF7EDB58900
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB587B0 PostMessageW,NtDeviceIoControlFile,closesocket,CloseHandle,SetWaitableTimer,	28_2_00007FF7EDB587B0
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A3487B0 PostMessageW,NtDeviceIoControlFile,closesocket,CloseHandle,SetWaitableTimer,	38_2_00007FF65A3487B0
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A348900 PostMessageW,NtDeviceIoControlFile,	38_2_00007FF65A348900
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A348994 NtDeviceIoControlFile,WaitForSingleObject,memset,MultiByteToWideChar,lstrlenW,Sleep,memset,	38_2_00007FF65A348994
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A3485A0 RtlInitUnicodeString,NtCreateFile,SetWaitableTimer,socket,CancelIo,CloseHandle,NtDeviceIoControlFile,closesocket,CancelIo,CloseHandle,SetWaitableTimer,NtDeviceIoControlFile,	38_2_00007FF65A3485A0

Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe

Code function: 28_2_00007FF7EDB585A0: RtlInitUnicodeString,NtCreateFile,SetWaitableTimer,socket,CancelIo,CloseHandle,NtDeviceIoControlFile,closesocket,CancelIo,CloseHandle,SetWaitableTimer,NtDeviceIoControlFile,

28_2_00007FF7EDB585A0

Source: irftp.exe.8.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: irftp.exe0.8.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: 1zdJLxxTnh.dll

Binary or memory string: OriginalFilenamekbdyj% vs 1zdJLxxTnh.dll

Source: irftp.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe0.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe0.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe0.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe0.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe0.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe0.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe0.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe0.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe0.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe0.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: DUI70.dll.8.dr	Static PE information: Number of sections : 36 > 10
Source: 1zdJLxxTnh.dll	Static PE information: Number of sections : 35 > 10
Source: DUI70.dll0.8.dr	Static PE information: Number of sections : 36 > 10
Source: DUI70.dll1.8.dr	Static PE information: Number of sections : 36 > 10
Source: WINMM.dll.8.dr	Static PE information: Number of sections : 36 > 10
Source: VERSION.dll.8.dr	Static PE information: Number of sections : 36 > 10
Source: DUser.dll.8.dr	Static PE information: Number of sections : 36 > 10
Source: MFC42u.dll.8.dr	Static PE information: Number of sections : 36 > 10

Source: 1zdJLxxTnh.dll	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DUI70.dll.8.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WINMM.dll.8.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DUser.dll.8.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DUI70.dll0.8.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: MFC42u.dll.8.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: VERSION.dll.8.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DUI70.dll1.8.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 1zdJLxxTnh.dll	Metadefender: Detection: 62%
Source: 1zdJLxxTnh.dll	ReversingLabs: Detection: 77%

Source: 1zdJLxxTnh.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe 'C:\Users\user\Desktop\1zdJLxxTnh.dll'
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\1zdJLxxTnh.dll',#1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\1zdJLxxTnh.dll',#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1zdJLxxTnh.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1zdJLxxTnh.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1zdJLxxTnh.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\ProximityUxHost.exe C:\Windows\system32\ProximityUxHost.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\rstrui.exe C:\Windows\system32\rstrui.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\irftp.exe C:\Windows\system32\irftp.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe C:\Users\user\AppData\Local\94LPZAU0\irftp.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SystemPropertiesComputerName.exe C:\Windows\system32\SystemPropertiesComputerName.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\sessionmsg.exe C:\Windows\system32\sessionmsg.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\WindowsActionDialog.exe C:\Windows\system32\WindowsActionDialog.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\buYWmbl3\WindowsActionDialog.exe C:\Users\user\AppData\Local\buYWmbl3\WindowsActionDialog.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\irftp.exe C:\Windows\system32\irftp.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\hJiut\irftp.exe C:\Users\user\AppData\Local\hJiut\irftp.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\osk.exe C:\Windows\system32\osk.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\1zdJLxxTnh.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1zdJLxxTnh.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1zdJLxxTnh.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1zdJLxxTnh.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\1zdJLxxTnh.dll',#1	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\ProximityUxHost.exe C:\Windows\system32\ProximityUxHost.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\rstrui.exe C:\Windows\system32\rstrui.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\irftp.exe C:\Windows\system32\irftp.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SystemPropertiesComputerName.exe C:\Windows\system32\SystemPropertiesComputerName.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\sessionmsg.exe C:\Windows\system32\sessionmsg.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\WindowsActionDialog.exe C:\Windows\system32\WindowsActionDialog.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\buYWmbl3\WindowsActionDialog.exe C:\Users\user\AppData\Local\buYWmbl3\WindowsActionDialog.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\irftp.exe C:\Windows\system32\irftp.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\hJiut\irftp.exe C:\Users\user\AppData\Local\hJiut\irftp.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\osk.exe C:\Windows\system32\osk.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto

Jump to behavior

Source: irftp.exe0.8.dr

Binary string: \Device\IrDAIrDA:TinyTP:LsapSelOBEX:IrXferOBEXControl Panel\InfraredControl Panel\Infrared\GlobalControl Panel\Infrared\IrTranPAllowSendShowTrayIconPlaySoundRecvdFilesLocationDisableIrTranPv1DisableIrCOMMExploreOnCompletionSaveAsUPFireventsIrMon: ReadUserPreferences::Failed to init sockets

Source: classification engine

Classification label: mal96.troj.evad.winDLL@44/15@0/0

Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe

Code function: 22_2_00007FF7A3C9C510 TlsGetValue,TlsSetValue,CoCreateInstance,LoadStringW,GetLastError,CoAddRefServerProcess,TlsGetValue,TlsSetValue,

22_2_00007FF7A3C9C510

Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe

Code function: 28_2_00007FF7EDB5D8A0 GetDiskFreeSpaceExW,WideCharToMultiByte,SystemTimeToFileTime,GetLastError,DeregisterEventSource,

28_2_00007FF7EDB5D8A0

Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe

Code function: 22_2_00007FF7A3C8D49C FormatMessageW,GetLastError,

22_2_00007FF7A3C8D49C

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\1zdJLxxTnh.dll',#1

Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Mutant created: \Sessions\1\BaseNamedObjects\{7fb3532d-2e0a-67b3-786e-e42cc8f8f32e}
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Mutant created: \Sessions\1\BaseNamedObjects\{7252c30c-5638-f414-012b-360ce55d73af}

Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe

Code function: 22_2_00007FF7A3CA3AA0 FindResourceExW,LoadResource,LockResource,

22_2_00007FF7A3CA3AA0

Source: 1zdJLxxTnh.dll

Static PE information: More than 4320 > 100 exports found

Source: 1zdJLxxTnh.dll

Static PE information: Image base 0x140000000 > 0x60000000

Source: 1zdJLxxTnh.dll

Static file information: File size 2068480 > 1048576

Source: 1zdJLxxTnh.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: ProximityUxHost.pdbGCTL source: ProximityUxHost.exe, 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp, ProximityUxHost.exe.8.dr
Source:	Binary string: WindowsActionDialog.pdb source: WindowsActionDialog.exe, 00000024.00000002.493551175.00007FF6A5E0B000.00000002.00020000.sdmp, WindowsActionDialog.exe.8.dr
Source:	Binary string: SessionMsg.pdb source: sessionmsg.exe, 00000021.00000002.461103553.00007FF67936A000.00000002.00020000.sdmp, sessionmsg.exe.8.dr
Source:	Binary string: irftp.pdbGCTL source: irftp.exe, 0000001C.00000002.431900352.00007FF7EDB65000.00000002.00020000.sdmp, irftp.exe, 00000026.00000000.510674509.00007FF65A355000.00000002.00020000.sdmp, irftp.exe0.8.dr
Source:	Binary string: PresentationHost.pdbGCTL source: PresentationHost.exe.8.dr
Source:	Binary string: SessionMsg.pdbGCTL source: sessionmsg.exe, 00000021.00000002.461103553.00007FF67936A000.00000002.00020000.sdmp, sessionmsg.exe.8.dr
Source:	Binary string: WindowsActionDialog.pdbGCTL source: WindowsActionDialog.exe, 00000024.00000002.493551175.00007FF6A5E0B000.00000002.00020000.sdmp, WindowsActionDialog.exe.8.dr
Source:	Binary string: PresentationHost.pdb source: PresentationHost.exe.8.dr
Source:	Binary string: CameraSettingsUIHost.pdbGCTL source: CameraSettingsUIHost.exe.8.dr
Source:	Binary string: CameraSettingsUIHost.pdb source: CameraSettingsUIHost.exe.8.dr
Source:	Binary string: ProximityUxHost.pdb source: ProximityUxHost.exe, 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp, ProximityUxHost.exe.8.dr
Source:	Binary string: irftp.pdb source: irftp.exe, 0000001C.00000002.431900352.00007FF7EDB65000.00000002.00020000.sdmp, irftp.exe, 00000026.00000000.510674509.00007FF65A355000.00000002.00020000.sdmp, irftp.exe0.8.dr

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000000140056A4D push rdi; ret

0_2_0000000140056A4E

Source: 1zdJLxxTnh.dll	Static PE information: section name: .qkm
Source: 1zdJLxxTnh.dll	Static PE information: section name: .cvjb
Source: 1zdJLxxTnh.dll	Static PE information: section name: .tlmkv
Source: 1zdJLxxTnh.dll	Static PE information: section name: .wucsxe
Source: 1zdJLxxTnh.dll	Static PE information: section name: .fltwtj
Source: 1zdJLxxTnh.dll	Static PE information: section name: .tblq
Source: 1zdJLxxTnh.dll	Static PE information: section name: .hcmjm
Source: 1zdJLxxTnh.dll	Static PE information: section name: .nagyk
Source: 1zdJLxxTnh.dll	Static PE information: section name: .jrucz
Source: 1zdJLxxTnh.dll	Static PE information: section name: .rnr
Source: 1zdJLxxTnh.dll	Static PE information: section name: .rdc
Source: 1zdJLxxTnh.dll	Static PE information: section name: .umrigl
Source: 1zdJLxxTnh.dll	Static PE information: section name: .nepl
Source: 1zdJLxxTnh.dll	Static PE information: section name: .akkqh
Source: 1zdJLxxTnh.dll	Static PE information: section name: .cvbwr
Source: 1zdJLxxTnh.dll	Static PE information: section name: .ftrk
Source: 1zdJLxxTnh.dll	Static PE information: section name: .ubbf
Source: 1zdJLxxTnh.dll	Static PE information: section name: .ulwqi
Source: 1zdJLxxTnh.dll	Static PE information: section name: .imcflb
Source: 1zdJLxxTnh.dll	Static PE information: section name: .hgmkm
Source: 1zdJLxxTnh.dll	Static PE information: section name: .cnoij
Source: 1zdJLxxTnh.dll	Static PE information: section name: .qgdv
Source: 1zdJLxxTnh.dll	Static PE information: section name: .hsbye
Source: 1zdJLxxTnh.dll	Static PE information: section name: .cdn
Source: 1zdJLxxTnh.dll	Static PE information: section name: .hte
Source: 1zdJLxxTnh.dll	Static PE information: section name: .vcnknm
Source: 1zdJLxxTnh.dll	Static PE information: section name: .thfe
Source: 1zdJLxxTnh.dll	Static PE information: section name: .tat
Source: 1zdJLxxTnh.dll	Static PE information: section name: .xqltbd
Source: ProximityUxHost.exe.8.dr	Static PE information: section name: .imrsiv
Source: sessionmsg.exe.8.dr	Static PE information: section name: .imrsiv
Source: WindowsActionDialog.exe.8.dr	Static PE information: section name: .imrsiv
Source: CameraSettingsUIHost.exe.8.dr	Static PE information: section name: .imrsiv
Source: DUI70.dll.8.dr	Static PE information: section name: .qkm
Source: DUI70.dll.8.dr	Static PE information: section name: .cvjb
Source: DUI70.dll.8.dr	Static PE information: section name: .tlmkv
Source: DUI70.dll.8.dr	Static PE information: section name: .wucsxe
Source: DUI70.dll.8.dr	Static PE information: section name: .fltwtj
Source: DUI70.dll.8.dr	Static PE information: section name: .tblq
Source: DUI70.dll.8.dr	Static PE information: section name: .hcmjm
Source: DUI70.dll.8.dr	Static PE information: section name: .nagyk
Source: DUI70.dll.8.dr	Static PE information: section name: .jrucz
Source: DUI70.dll.8.dr	Static PE information: section name: .rnr
Source: DUI70.dll.8.dr	Static PE information: section name: .rdc
Source: DUI70.dll.8.dr	Static PE information: section name: .umrigl
Source: DUI70.dll.8.dr	Static PE information: section name: .nepl
Source: DUI70.dll.8.dr	Static PE information: section name: .akkqh
Source: DUI70.dll.8.dr	Static PE information: section name: .cvbwr
Source: DUI70.dll.8.dr	Static PE information: section name: .ftrk
Source: DUI70.dll.8.dr	Static PE information: section name: .ubbf
Source: DUI70.dll.8.dr	Static PE information: section name: .ulwqi
Source: DUI70.dll.8.dr	Static PE information: section name: .imcflb
Source: DUI70.dll.8.dr	Static PE information: section name: .hgmkm
Source: DUI70.dll.8.dr	Static PE information: section name: .cnoij
Source: DUI70.dll.8.dr	Static PE information: section name: .qgdv
Source: DUI70.dll.8.dr	Static PE information: section name: .hsbye
Source: DUI70.dll.8.dr	Static PE information: section name: .cdn
Source: DUI70.dll.8.dr	Static PE information: section name: .hte
Source: DUI70.dll.8.dr	Static PE information: section name: .vcnknm
Source: DUI70.dll.8.dr	Static PE information: section name: .thfe
Source: DUI70.dll.8.dr	Static PE information: section name: .tat
Source: DUI70.dll.8.dr	Static PE information: section name: .xqltbd
Source: DUI70.dll.8.dr	Static PE information: section name: .ypfdqp
Source: WINMM.dll.8.dr	Static PE information: section name: .qkm
Source: WINMM.dll.8.dr	Static PE information: section name: .cvjb
Source: WINMM.dll.8.dr	Static PE information: section name: .tlmkv
Source: WINMM.dll.8.dr	Static PE information: section name: .wucsxe
Source: WINMM.dll.8.dr	Static PE information: section name: .fltwtj
Source: WINMM.dll.8.dr	Static PE information: section name: .tblq
Source: WINMM.dll.8.dr	Static PE information: section name: .hcmjm
Source: WINMM.dll.8.dr	Static PE information: section name: .nagyk
Source: WINMM.dll.8.dr	Static PE information: section name: .jrucz
Source: WINMM.dll.8.dr	Static PE information: section name: .rnr
Source: WINMM.dll.8.dr	Static PE information: section name: .rdc
Source: WINMM.dll.8.dr	Static PE information: section name: .umrigl
Source: WINMM.dll.8.dr	Static PE information: section name: .nepl
Source: WINMM.dll.8.dr	Static PE information: section name: .akkqh
Source: WINMM.dll.8.dr	Static PE information: section name: .cvbwr
Source: WINMM.dll.8.dr	Static PE information: section name: .ftrk
Source: WINMM.dll.8.dr	Static PE information: section name: .ubbf
Source: WINMM.dll.8.dr	Static PE information: section name: .ulwqi
Source: WINMM.dll.8.dr	Static PE information: section name: .imcflb
Source: WINMM.dll.8.dr	Static PE information: section name: .hgmkm
Source: WINMM.dll.8.dr	Static PE information: section name: .cnoij
Source: WINMM.dll.8.dr	Static PE information: section name: .qgdv
Source: WINMM.dll.8.dr	Static PE information: section name: .hsbye
Source: WINMM.dll.8.dr	Static PE information: section name: .cdn
Source: WINMM.dll.8.dr	Static PE information: section name: .hte
Source: WINMM.dll.8.dr	Static PE information: section name: .vcnknm
Source: WINMM.dll.8.dr	Static PE information: section name: .thfe
Source: WINMM.dll.8.dr	Static PE information: section name: .tat
Source: WINMM.dll.8.dr	Static PE information: section name: .xqltbd
Source: WINMM.dll.8.dr	Static PE information: section name: .nghj
Source: DUser.dll.8.dr	Static PE information: section name: .qkm
Source: DUser.dll.8.dr	Static PE information: section name: .cvjb
Source: DUser.dll.8.dr	Static PE information: section name: .tlmkv
Source: DUser.dll.8.dr	Static PE information: section name: .wucsxe
Source: DUser.dll.8.dr	Static PE information: section name: .fltwtj
Source: DUser.dll.8.dr	Static PE information: section name: .tblq
Source: DUser.dll.8.dr	Static PE information: section name: .hcmjm
Source: DUser.dll.8.dr	Static PE information: section name: .nagyk
Source: DUser.dll.8.dr	Static PE information: section name: .jrucz
Source: DUser.dll.8.dr	Static PE information: section name: .rnr
Source: DUser.dll.8.dr	Static PE information: section name: .rdc
Source: DUser.dll.8.dr	Static PE information: section name: .umrigl
Source: DUser.dll.8.dr	Static PE information: section name: .nepl
Source: DUser.dll.8.dr	Static PE information: section name: .akkqh
Source: DUser.dll.8.dr	Static PE information: section name: .cvbwr
Source: DUser.dll.8.dr	Static PE information: section name: .ftrk
Source: DUser.dll.8.dr	Static PE information: section name: .ubbf
Source: DUser.dll.8.dr	Static PE information: section name: .ulwqi
Source: DUser.dll.8.dr	Static PE information: section name: .imcflb
Source: DUser.dll.8.dr	Static PE information: section name: .hgmkm
Source: DUser.dll.8.dr	Static PE information: section name: .cnoij
Source: DUser.dll.8.dr	Static PE information: section name: .qgdv
Source: DUser.dll.8.dr	Static PE information: section name: .hsbye
Source: DUser.dll.8.dr	Static PE information: section name: .cdn
Source: DUser.dll.8.dr	Static PE information: section name: .hte
Source: DUser.dll.8.dr	Static PE information: section name: .vcnknm
Source: DUser.dll.8.dr	Static PE information: section name: .thfe
Source: DUser.dll.8.dr	Static PE information: section name: .tat
Source: DUser.dll.8.dr	Static PE information: section name: .xqltbd
Source: DUser.dll.8.dr	Static PE information: section name: .lebs
Source: DUI70.dll0.8.dr	Static PE information: section name: .qkm
Source: DUI70.dll0.8.dr	Static PE information: section name: .cvjb
Source: DUI70.dll0.8.dr	Static PE information: section name: .tlmkv
Source: DUI70.dll0.8.dr	Static PE information: section name: .wucsxe
Source: DUI70.dll0.8.dr	Static PE information: section name: .fltwtj
Source: DUI70.dll0.8.dr	Static PE information: section name: .tblq
Source: DUI70.dll0.8.dr	Static PE information: section name: .hcmjm
Source: DUI70.dll0.8.dr	Static PE information: section name: .nagyk
Source: DUI70.dll0.8.dr	Static PE information: section name: .jrucz
Source: DUI70.dll0.8.dr	Static PE information: section name: .rnr
Source: DUI70.dll0.8.dr	Static PE information: section name: .rdc
Source: DUI70.dll0.8.dr	Static PE information: section name: .umrigl
Source: DUI70.dll0.8.dr	Static PE information: section name: .nepl
Source: DUI70.dll0.8.dr	Static PE information: section name: .akkqh
Source: DUI70.dll0.8.dr	Static PE information: section name: .cvbwr
Source: DUI70.dll0.8.dr	Static PE information: section name: .ftrk
Source: DUI70.dll0.8.dr	Static PE information: section name: .ubbf
Source: DUI70.dll0.8.dr	Static PE information: section name: .ulwqi
Source: DUI70.dll0.8.dr	Static PE information: section name: .imcflb
Source: DUI70.dll0.8.dr	Static PE information: section name: .hgmkm
Source: DUI70.dll0.8.dr	Static PE information: section name: .cnoij
Source: DUI70.dll0.8.dr	Static PE information: section name: .qgdv
Source: DUI70.dll0.8.dr	Static PE information: section name: .hsbye
Source: DUI70.dll0.8.dr	Static PE information: section name: .cdn
Source: DUI70.dll0.8.dr	Static PE information: section name: .hte
Source: DUI70.dll0.8.dr	Static PE information: section name: .vcnknm
Source: DUI70.dll0.8.dr	Static PE information: section name: .thfe
Source: DUI70.dll0.8.dr	Static PE information: section name: .tat
Source: DUI70.dll0.8.dr	Static PE information: section name: .xqltbd
Source: DUI70.dll0.8.dr	Static PE information: section name: .lzkq
Source: MFC42u.dll.8.dr	Static PE information: section name: .qkm
Source: MFC42u.dll.8.dr	Static PE information: section name: .cvjb
Source: MFC42u.dll.8.dr	Static PE information: section name: .tlmkv
Source: MFC42u.dll.8.dr	Static PE information: section name: .wucsxe
Source: MFC42u.dll.8.dr	Static PE information: section name: .fltwtj
Source: MFC42u.dll.8.dr	Static PE information: section name: .tblq
Source: MFC42u.dll.8.dr	Static PE information: section name: .hcmjm
Source: MFC42u.dll.8.dr	Static PE information: section name: .nagyk
Source: MFC42u.dll.8.dr	Static PE information: section name: .jrucz
Source: MFC42u.dll.8.dr	Static PE information: section name: .rnr
Source: MFC42u.dll.8.dr	Static PE information: section name: .rdc
Source: MFC42u.dll.8.dr	Static PE information: section name: .umrigl
Source: MFC42u.dll.8.dr	Static PE information: section name: .nepl
Source: MFC42u.dll.8.dr	Static PE information: section name: .akkqh
Source: MFC42u.dll.8.dr	Static PE information: section name: .cvbwr
Source: MFC42u.dll.8.dr	Static PE information: section name: .ftrk
Source: MFC42u.dll.8.dr	Static PE information: section name: .ubbf
Source: MFC42u.dll.8.dr	Static PE information: section name: .ulwqi
Source: MFC42u.dll.8.dr	Static PE information: section name: .imcflb
Source: MFC42u.dll.8.dr	Static PE information: section name: .hgmkm
Source: MFC42u.dll.8.dr	Static PE information: section name: .cnoij
Source: MFC42u.dll.8.dr	Static PE information: section name: .qgdv
Source: MFC42u.dll.8.dr	Static PE information: section name: .hsbye
Source: MFC42u.dll.8.dr	Static PE information: section name: .cdn
Source: MFC42u.dll.8.dr	Static PE information: section name: .hte
Source: MFC42u.dll.8.dr	Static PE information: section name: .vcnknm
Source: MFC42u.dll.8.dr	Static PE information: section name: .thfe
Source: MFC42u.dll.8.dr	Static PE information: section name: .tat
Source: MFC42u.dll.8.dr	Static PE information: section name: .xqltbd
Source: MFC42u.dll.8.dr	Static PE information: section name: .qhr
Source: VERSION.dll.8.dr	Static PE information: section name: .qkm
Source: VERSION.dll.8.dr	Static PE information: section name: .cvjb
Source: VERSION.dll.8.dr	Static PE information: section name: .tlmkv
Source: VERSION.dll.8.dr	Static PE information: section name: .wucsxe
Source: VERSION.dll.8.dr	Static PE information: section name: .fltwtj
Source: VERSION.dll.8.dr	Static PE information: section name: .tblq
Source: VERSION.dll.8.dr	Static PE information: section name: .hcmjm
Source: VERSION.dll.8.dr	Static PE information: section name: .nagyk
Source: VERSION.dll.8.dr	Static PE information: section name: .jrucz
Source: VERSION.dll.8.dr	Static PE information: section name: .rnr
Source: VERSION.dll.8.dr	Static PE information: section name: .rdc
Source: VERSION.dll.8.dr	Static PE information: section name: .umrigl
Source: VERSION.dll.8.dr	Static PE information: section name: .nepl
Source: VERSION.dll.8.dr	Static PE information: section name: .akkqh
Source: VERSION.dll.8.dr	Static PE information: section name: .cvbwr
Source: VERSION.dll.8.dr	Static PE information: section name: .ftrk
Source: VERSION.dll.8.dr	Static PE information: section name: .ubbf
Source: VERSION.dll.8.dr	Static PE information: section name: .ulwqi
Source: VERSION.dll.8.dr	Static PE information: section name: .imcflb
Source: VERSION.dll.8.dr	Static PE information: section name: .hgmkm
Source: VERSION.dll.8.dr	Static PE information: section name: .cnoij
Source: VERSION.dll.8.dr	Static PE information: section name: .qgdv
Source: VERSION.dll.8.dr	Static PE information: section name: .hsbye
Source: VERSION.dll.8.dr	Static PE information: section name: .cdn
Source: VERSION.dll.8.dr	Static PE information: section name: .hte
Source: VERSION.dll.8.dr	Static PE information: section name: .vcnknm
Source: VERSION.dll.8.dr	Static PE information: section name: .thfe
Source: VERSION.dll.8.dr	Static PE information: section name: .tat
Source: VERSION.dll.8.dr	Static PE information: section name: .xqltbd
Source: VERSION.dll.8.dr	Static PE information: section name: .pwi
Source: DUI70.dll1.8.dr	Static PE information: section name: .qkm
Source: DUI70.dll1.8.dr	Static PE information: section name: .cvjb
Source: DUI70.dll1.8.dr	Static PE information: section name: .tlmkv
Source: DUI70.dll1.8.dr	Static PE information: section name: .wucsxe
Source: DUI70.dll1.8.dr	Static PE information: section name: .fltwtj
Source: DUI70.dll1.8.dr	Static PE information: section name: .tblq
Source: DUI70.dll1.8.dr	Static PE information: section name: .hcmjm
Source: DUI70.dll1.8.dr	Static PE information: section name: .nagyk
Source: DUI70.dll1.8.dr	Static PE information: section name: .jrucz
Source: DUI70.dll1.8.dr	Static PE information: section name: .rnr
Source: DUI70.dll1.8.dr	Static PE information: section name: .rdc
Source: DUI70.dll1.8.dr	Static PE information: section name: .umrigl
Source: DUI70.dll1.8.dr	Static PE information: section name: .nepl
Source: DUI70.dll1.8.dr	Static PE information: section name: .akkqh
Source: DUI70.dll1.8.dr	Static PE information: section name: .cvbwr
Source: DUI70.dll1.8.dr	Static PE information: section name: .ftrk
Source: DUI70.dll1.8.dr	Static PE information: section name: .ubbf
Source: DUI70.dll1.8.dr	Static PE information: section name: .ulwqi
Source: DUI70.dll1.8.dr	Static PE information: section name: .imcflb
Source: DUI70.dll1.8.dr	Static PE information: section name: .hgmkm
Source: DUI70.dll1.8.dr	Static PE information: section name: .cnoij
Source: DUI70.dll1.8.dr	Static PE information: section name: .qgdv
Source: DUI70.dll1.8.dr	Static PE information: section name: .hsbye
Source: DUI70.dll1.8.dr	Static PE information: section name: .cdn
Source: DUI70.dll1.8.dr	Static PE information: section name: .hte
Source: DUI70.dll1.8.dr	Static PE information: section name: .vcnknm
Source: DUI70.dll1.8.dr	Static PE information: section name: .thfe
Source: DUI70.dll1.8.dr	Static PE information: section name: .tat
Source: DUI70.dll1.8.dr	Static PE information: section name: .xqltbd
Source: DUI70.dll1.8.dr	Static PE information: section name: .tvyui

Source: DUI70.dll.8.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x24017f
Source: 1zdJLxxTnh.dll	Static PE information: real checksum: 0x7d786c40 should be: 0x204ddc
Source: DUI70.dll0.8.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x2499f9
Source: DUI70.dll1.8.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x2443fc
Source: WINMM.dll.8.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x2084b0
Source: VERSION.dll.8.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x2058c8
Source: DUser.dll.8.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x2056b9
Source: MFC42u.dll.8.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x20b855

Source: WindowsActionDialog.exe.8.dr

Static PE information: 0xBDD86903 [Sat Dec 6 07:28:03 2070 UTC]

Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\94LPZAU0\WINMM.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\cp4nWp\VERSION.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\buYWmbl3\WindowsActionDialog.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\XVzc21m9h\DUI70.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\cp4nWp\PresentationHost.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\fk8bXjSn\DUI70.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\hJiut\irftp.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\XVzc21m9h\CameraSettingsUIHost.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\buYWmbl3\DUI70.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\nPqx0Ph\DUser.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\hJiut\MFC42u.dll	Jump to dropped file

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe

Last function: Thread delayed

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\cp4nWp\VERSION.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\cp4nWp\PresentationHost.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\XVzc21m9h\CameraSettingsUIHost.exe	Jump to dropped file

Source: C:\Windows\System32\loaddll64.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000000014005C340 GetSystemInfo,

0_2_000000014005C340

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005D290 FindFirstFileExW,	0_2_000000014005D290
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB5B908 FindFirstFileW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,	28_2_00007FF7EDB5B908
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB5C018 FindFirstFileW,lstrcmpW,lstrcmpW,CreateFileW,GetFileSize,CloseHandle,FindNextFileW,FindClose,	28_2_00007FF7EDB5C018
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A34C018 FindFirstFileW,lstrcmpW,lstrcmpW,CreateFileW,GetFileSize,CloseHandle,FindNextFileW,FindClose,	38_2_00007FF65A34C018
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A34B908 FindFirstFileW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,	38_2_00007FF65A34B908

Source: explorer.exe, 00000008.00000000.309714093.0000000008919000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.308851272.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.295042071.0000000008778000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 00000008.00000000.308851272.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 00000008.00000000.288081947.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.288081947.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: explorer.exe, 00000008.00000000.331363758.000000000EE50000.00000004.00000001.sdmp	Binary or memory string: 63}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&
Source: explorer.exe, 00000008.00000000.283823557.0000000000B7D000.00000004.00000020.sdmp	Binary or memory string: 0d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1
Source: explorer.exe, 00000008.00000000.308851272.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000

Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe

Code function: 22_2_00007FF7A3C88454 GetCurrentThreadId,memset,IsDebuggerPresent,OutputDebugStringW,

22_2_00007FF7A3C88454

Source: C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe

Code function: 33_2_00007FF6793672D0 GetLastError,_vsnprintf,OutputDebugStringA,SetLastError,

33_2_00007FF6793672D0

Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe

Code function: 22_2_00007FF7A3C944D4 GetProcessHeap,HeapFree,CloseHandle,CloseHandle,CloseHandle,

22_2_00007FF7A3C944D4

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000000140048AC0 LdrLoadDll,FindClose,

0_2_0000000140048AC0

Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3CB0740 SetUnhandledExceptionFilter,	22_2_00007FF7A3CB0740
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3CB09B4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_00007FF7A3CB09B4
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB63498 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF7EDB63498
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB63840 SetUnhandledExceptionFilter,	28_2_00007FF7EDB63840
Source: C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe	Code function: 33_2_00007FF679367E80 SetUnhandledExceptionFilter,	33_2_00007FF679367E80
Source: C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe	Code function: 33_2_00007FF679367AA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	33_2_00007FF679367AA4
Source: C:\Users\user\AppData\Local\buYWmbl3\WindowsActionDialog.exe	Code function: 36_2_00007FF6A5E08450 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	36_2_00007FF6A5E08450
Source: C:\Users\user\AppData\Local\buYWmbl3\WindowsActionDialog.exe	Code function: 36_2_00007FF6A5E08750 SetUnhandledExceptionFilter,	36_2_00007FF6A5E08750
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A353498 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	38_2_00007FF65A353498
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A353840 SetUnhandledExceptionFilter,	38_2_00007FF65A353840

HIPS / PFW / Operating System Protection Evasion:

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: DUI70.dll.8.dr

Jump to dropped file

Changes memory attributes in foreign processes to executable or writable

Show sources

Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFC8DD4EFE0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFC8DD4E000 protect: page execute read	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFC8BAD2A20 protect: page execute and read and write	Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Windows\System32\rundll32.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Uses Atom Bombing / ProGate to inject into other processes

Show sources

Source: C:\Windows\System32\rundll32.exe

Atom created: 405553565741544156488D6C24D14881EC98 0x00000000 inc eax 0x00000001 push ebp 0x00000002 push ebx 0x00000003 push esi 0x00000004 push edi 0x00000005 inc ecx 0x00000006 push esp 0x00000007 inc ecx 0x00000008 push esi 0x00000009 dec eax 0x0000000a lea ebp, dword ptr [esp-2Fh] 0x0000000e dec eax 0x0000000f sub esp, 00000098h

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\1zdJLxxTnh.dll',#1

Jump to behavior

Source: explorer.exe, 00000008.00000000.283813716.0000000000B68000.00000004.00000020.sdmp	Binary or memory string: Progman\Pr
Source: explorer.exe, 00000008.00000000.337845036.00000000011E0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000008.00000000.337845036.00000000011E0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000000.337845036.00000000011E0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000008.00000000.337845036.00000000011E0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000008.00000000.295042071.0000000008778000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndh

Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\buYWmbl3\WindowsActionDialog.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\buYWmbl3\WindowsActionDialog.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Queries volume information: unknown VolumeInformation

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe

Code function: 22_2_00007FF7A3CB08D0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

22_2_00007FF7A3CB08D0

Source: C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe	Code function: 22_2_00007FF7A3C9C8A0 TlsGetValue,TlsSetValue,?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z,?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z,?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z,?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z,?CreateBool@Value@DirectUI@@SAPEAV12@_N@Z,?AccessibleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ,?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z,?_ZeroRelease@Value@DirectUI@@AEAAXXZ,StrToID,?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z,?GetClassInfoPtr@ModernProgressBar@DirectUI@@SAPEAUIClassInfo@2@XZ,?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ,TlsGetValue,TlsSetValue,	22_2_00007FF7A3C9C8A0
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB5EE8C socket,WSAGetLastError,memset,setsockopt,WSAGetLastError,closesocket,setsockopt,memset,bind,listen,CreateIoCompletionPort,	28_2_00007FF7EDB5EE8C
Source: C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	Code function: 28_2_00007FF7EDB5A078 WSAStartup,OpenFileMappingW,MapViewOfFile,CloseHandle,GetLastError,DbgPrint,lstrcmpA,WSASocketW,UnmapViewOfFile,WSAGetLastError,DbgPrint,socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,closesocket,	28_2_00007FF7EDB5A078
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A34A078 WSAStartup,OpenFileMappingW,MapViewOfFile,CloseHandle,GetLastError,DbgPrint,lstrcmpA,WSASocketW,UnmapViewOfFile,WSAGetLastError,DbgPrint,socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,closesocket,	38_2_00007FF65A34A078
Source: C:\Users\user\AppData\Local\hJiut\irftp.exe	Code function: 38_2_00007FF65A34EE8C socket,WSAGetLastError,memset,setsockopt,WSAGetLastError,closesocket,setsockopt,memset,bind,listen,CreateIoCompletionPort,	38_2_00007FF65A34EE8C

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Exploitation for Client Execution1	Path Interception	Process Injection312	Masquerading1	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection312	LSASS Memory	Security Software Discovery31	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Rundll321	NTDS	File and Directory Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing2	LSA Secrets	System Information Discovery25	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Timestomp1	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
1zdJLxxTnh.dll	63%	Metadefender		Browse
1zdJLxxTnh.dll	78%	ReversingLabs	Win64.Infostealer.Dridex
1zdJLxxTnh.dll	100%	Avira	HEUR/AGEN.1114452

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\XVzc21m9h\DUI70.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\94LPZAU0\WINMM.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\hJiut\MFC42u.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\nPqx0Ph\DUser.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\cp4nWp\VERSION.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\XVzc21m9h\DUI70.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\XVzc21m9h\DUI70.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\XVzc21m9h\DUI70.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\94LPZAU0\WINMM.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\hJiut\MFC42u.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\nPqx0Ph\DUser.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\cp4nWp\VERSION.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\XVzc21m9h\DUI70.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\XVzc21m9h\DUI70.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\XVzc21m9h\CameraSettingsUIHost.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\XVzc21m9h\CameraSettingsUIHost.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
3.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
28.2.irftp.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
36.2.WindowsActionDialog.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.loaddll64.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.ProximityUxHost.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
38.2.irftp.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
33.2.sessionmsg.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	492776
Start date:	29.09.2021
Start time:	01:05:07
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	1zdJLxxTnh (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal96.troj.evad.winDLL@44/15@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 38% (good quality ratio 20.7%) Quality average: 40.3% Quality standard deviation: 42.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.54.113.53, 20.82.209.183, 20.54.110.249, 40.112.88.60, 8.252.5.126, 8.241.126.249, 8.248.137.254, 8.238.85.254, 67.27.157.254, 20.199.120.85, 23.10.249.43, 23.10.249.26, 20.199.120.182, 20.82.210.154, 204.79.197.200, 13.107.21.200 Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, www.bing.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, client.wns.windows.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, dual-a-0001.a-msedge.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, wu-shim.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/492776/sample/1zdJLxxTnh.dll

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\94LPZAU0\irftp.exe	kVNcnRiK3f.dll	Get hash	malicious	Browse
	y5ByLDz3o1.dll	Get hash	malicious	Browse
	6jxIVk0kA7.dll	Get hash	malicious	Browse
	QqfX0oJvWr.dll	Get hash	malicious	Browse
	3zec70XUHT.dll	Get hash	malicious	Browse
	9kiaVokmF5.dll	Get hash	malicious	Browse
	N37wjZ34KC.dll	Get hash	malicious	Browse
	f8YMzujfAD.dll	Get hash	malicious	Browse
	siaHBnlRS5.dll	Get hash	malicious	Browse
	Yz2OIFLI6N.dll	Get hash	malicious	Browse
	P7n0h6OhYp.dll	Get hash	malicious	Browse
	fyOtZmdc67.dll	Get hash	malicious	Browse
	4keq2VSf0C.dll	Get hash	malicious	Browse
	FFeeEo1mVe.dll	Get hash	malicious	Browse
	m8ob3WN42p.dll	Get hash	malicious	Browse
	rJyP5pxSI7.dll	Get hash	malicious	Browse
	5pG7H5XLEj.dll	Get hash	malicious	Browse
	0oSZeHvzK2.dll	Get hash	malicious	Browse
	OAn9UHAhxa.dll	Get hash	malicious	Browse
	AMlHS3s1sj.dll	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\94LPZAU0\WINMM.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2076672
Entropy (8bit):	3.638584417742171
Encrypted:	false
SSDEEP:	12288:tVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:0fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	DE6B90EF400CA7533F969DAB0E573346
SHA1:	24B2B6E4E03023D8654BDC636E2BF78E5BC66175
SHA-256:	ABEE6BEE9DAEC86C44CA0BC43CAE8BCD52D192C5F5B8F7CFFCC053002579ED2A
SHA-512:	C10D42A295FFD0C4524109EE5ABEE659A82270F924F62539B2222515B198C207B91F21961128200C48927C603DBA85B41FF45E54A3F6523955174005AF717B96
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.$..DN^.........." ................p..........@....................................@lx}..b.............................................h....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\94LPZAU0\irftp.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	184832
Entropy (8bit):	5.862106385432374
Encrypted:	false
SSDEEP:	3072:gzPq/xfWlkWmvIGaYLZ4yjchpChlyelcU4uuh0SEslWsXxgCzX0Fhf8LL8FT7:Eq5fWlkjuYLLtHyeFSEiXxZzb8FT
MD5:	F1C2D10CA8161DB689CD4FDE756E2DBB
SHA1:	C41E86E9755824D3775E2AD6CAC9A46C7AA1C417
SHA-256:	8854450FEAD134B24FABF4B805434FCFDDF25D2179048410728F8901E0FE0906
SHA-512:	5EBB1AD4261C689E22FE34CFB0C18D71451DD4F3694D8F521D181EB42FF90582D8EF8C8AB43BFC59D224452944D9602DB1030B633856E139442EEF0C2F4428F5
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: kVNcnRiK3f.dll, Detection: malicious, Browse Filename: y5ByLDz3o1.dll, Detection: malicious, Browse Filename: 6jxIVk0kA7.dll, Detection: malicious, Browse Filename: QqfX0oJvWr.dll, Detection: malicious, Browse Filename: 3zec70XUHT.dll, Detection: malicious, Browse Filename: 9kiaVokmF5.dll, Detection: malicious, Browse Filename: N37wjZ34KC.dll, Detection: malicious, Browse Filename: f8YMzujfAD.dll, Detection: malicious, Browse Filename: siaHBnlRS5.dll, Detection: malicious, Browse Filename: Yz2OIFLI6N.dll, Detection: malicious, Browse Filename: P7n0h6OhYp.dll, Detection: malicious, Browse Filename: fyOtZmdc67.dll, Detection: malicious, Browse Filename: 4keq2VSf0C.dll, Detection: malicious, Browse Filename: FFeeEo1mVe.dll, Detection: malicious, Browse Filename: m8ob3WN42p.dll, Detection: malicious, Browse Filename: rJyP5pxSI7.dll, Detection: malicious, Browse Filename: 5pG7H5XLEj.dll, Detection: malicious, Browse Filename: 0oSZeHvzK2.dll, Detection: malicious, Browse Filename: OAn9UHAhxa.dll, Detection: malicious, Browse Filename: AMlHS3s1sj.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PU...4}..4}..4}.{P~..4}.{Py..4}.{Px..4}.{P\|..4}..4\|.c5}.{Pt.74}.{P...4}.{P...4}.Rich.4}.........................PE..d....v.4.........."......6...........4.........@..........................................`.......... ......................................T...,....p..0....`..t............p..........T...........................@i..............@j...............................text....4.......6.................. ..`.rdata.......P.......:..............@..@.data....\|..........................@....pdata..t....`......................@..@.rsrc...0....p......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\XVzc21m9h\CameraSettingsUIHost.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32104
Entropy (8bit):	6.224595599643794
Encrypted:	false
SSDEEP:	768:HYxSW1tZfZjtM2mpgc8WtCpZswKro1PDg:HhAhty8WteuwKrwPDg
MD5:	34F32BC06CDC7AF56607D351B155140D
SHA1:	88EF25BC91BCC908AF743ECA254D6251E5564283
SHA-256:	47238D9ED75D01FD125AC76B500FEEF7F8B27255570AD02D18A4F049B05DF3BD
SHA-512:	D855414779125F4E311ACF4D5EFC8ACA4452323CABD1694798CA90FD5BD76DC70B5D06790A2AE311E7DD19190DCCB134F6EF96AB1B7CF5B8A40AD642B72D5144
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._Lp..-...-...-...U...-..tI...-..tI...-..tI...-..tI...-...-..K-..tI...-..tI..-..tI...-..Rich.-..........................PE..d....\YN..........".........2.......0.........@.................................................... ......................................._.......................Z..h#...........X..T...................`S..(...`R...............S...............................text....(......................... ..`.imrsiv......@...........................rdata.......P......................@..@.data........p.......J..............@....pdata...............L..............@..@.rsrc................P..............@..@.reloc...............X..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\XVzc21m9h\DUI70.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2355200
Entropy (8bit):	4.163841194314587
Encrypted:	false
SSDEEP:	12288:1VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ10+:sfP7fWsK5z9A+WGAW+V5SB6Ct4bnb0
MD5:	DF9A26EBFD0E77955639B4C28CDBCEED
SHA1:	D11A7BDC5C6E5C9C3F3CF4D2F37424A51B56F0E8
SHA-256:	1F6373350BC6604ACBD20A05AF002A90D9EA3D5B91846E9CC2246C58DD6F489E
SHA-512:	F4CCBA5DEA29E8F1597D85F894284286DC11AA18C82CFACAD79F519D3572DB51931402723F1E70B587BF74007E272D2D7079E7291187CCF26351456460985AB1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.$..DN^.........." ................p..........@..............................#.....@lx}..b.............................................dQ...c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\buYWmbl3\DUI70.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2355200
Entropy (8bit):	4.163717824294011
Encrypted:	false
SSDEEP:	12288:iVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ18tr:/fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	EEDAC2477895922DC82316E94D049F45
SHA1:	91ACC4000617F625D237FEFF2978816483250E7B
SHA-256:	67CF8B8F250FCA4EE30D3E2EDFB59193EDCCC021100F4E36B8B2CA69C5CBD6F2
SHA-512:	C3E07B53406D9938B94FB8559232B544AB2A187B600EE9072BA0729FA65DF475239A475791EAC457FFD700899437036DE7A912E60495AC85650B5DE2069D0DF7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.$..DN^.........." ................p..........@..............................#.....@lx}..b.............................................dQ...c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\buYWmbl3\WindowsActionDialog.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	5.897489723280295
Encrypted:	false
SSDEEP:	1536:VgSmVr7b1rKOX4TfOwQaq1WWhrIWSNJy8e:eZVrAThqLfSNwV
MD5:	991359EE1E9C1958EB5D0F7314774123
SHA1:	6456AEA32407B0AEEDD347AFAE5BB12BAB781863
SHA-256:	9F8E465348DBB165B7B0E6A72FCC78D2CE79FB897B1514490CD0DDAB021EA500
SHA-512:	EE6D10A0B75829AAAB55CB9F9EDA967D763F7CACD09F944A9C40B8E5ADDD6BBB6970F069FC64FA1807B547134B3558667A680174AB0366D11A068C6DD70BC3F3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ .%.A.v.A.v.A.v.9Wv.A.v.%.w.A.v.%.w.A.v.%.w.A.v.%.w.A.v.A.v.A.v.%.w.A.v.%;v.A.v.%.w.A.vRich.A.v................PE..d....i..........."..........j.................@.............................@.......'............... ..........................................h.... .......................0......p...T...............................................H............................text............................... ..`.imrsiv..................................rdata...H.......J..................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\cp4nWp\PresentationHost.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	259072
Entropy (8bit):	6.5074250085194665
Encrypted:	false
SSDEEP:	6144:8kfs4/kfxzJTbHfyH5KNXwy3Odjp19k5KNXf:fs4ixzJTbHmKVwy3OdLaKV
MD5:	E3053C73EA240F4C2F7971B3905A91CF
SHA1:	1848AD66BD55E5484616FB85E80BA58BE1D5BA4B
SHA-256:	0BACCDB2B5ACB7B3C2E9085655457532964CAFFF1AE250016CE1A80E839B820C
SHA-512:	167BCC3E2552286F7D985A65674DA2FF0D0AA6A7F0C4C3B43193943B606E0133C06EEB33656EFBB8B827AC9221FB1BA00A49ADCC2489BD4F38DF62A015806DE3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3/.]\|.]\|.]\|...\|.]\|...\|..]\|..^}.]\|..Y}.]\|.\\|..]\|..\}.]\|..T}..]\|..X}.]\|..\|.]\|.._}.]\|Rich.]\|........................PE..d..../............"..........&.................@.............................0............`.......... .......................................p..,........j......l............ ..,....d..T............................#...............$...............................text...o........................... ..`.rdata..............................@..@.data................r..............@....pdata..l............t..............@..@.rsrc....j.......l...~..............@..@.reloc..,.... ......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\cp4nWp\VERSION.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2072576
Entropy (8bit):	3.6295467008086466
Encrypted:	false
SSDEEP:	12288:sVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ZfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	C0296097264DDCD2F205CF026F6156EE
SHA1:	62ADC91C6B674EFD2EA562829802BD1EF8100BDF
SHA-256:	0CDB374DD9EAF41D87A617D8CBF4BCB21EEFF618A31FCCAB6EA9C66FA8251906
SHA-512:	DD745FD15C16F44D9C171680729536B98A415D550B9B41106198C0DE5B187EB9FBA437FA8BBD4CE54337666F5044EA8FC313CAEE4B3E4FC03809710F7F9E4A0F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.$..DN^.........." ................p..........@....................................@lx}..b.............................................+....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\fk8bXjSn\DUI70.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2355200
Entropy (8bit):	4.163555502778555
Encrypted:	false
SSDEEP:	12288:2VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ17:rfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	97899DD22E7099CBD89B24E779B35EF5
SHA1:	765C86A0789108B5301B2A6F5BA847A80F7CF488
SHA-256:	1CD2F440043C296AE7EDAA2F97BCDC6E3F75A563DB30CF26376DC5BE1F536016
SHA-512:	CD3508D410CBC89B8D7B6B2E45348F62C86DDF9FE9A2BF020B7006C1BF1EFEFD632D469BA62D58224BD3920A6B1A84144DDFB0D27CB08E751D9AFCD901A89FB9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.$..DN^.........." ................p..........@..............................#.....@lx}..b.............................................dQ...c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	264480
Entropy (8bit):	6.478365286411354
Encrypted:	false
SSDEEP:	6144:xSt+s2GFGbqEuzhJONjx9UVuCuHpwqr/vt9r+ULJBaBpcIFz:xStzFGbGhoPgMHpwqrHthUB6IF
MD5:	E7F0E9B3779E54CD271959C600A2A531
SHA1:	8006E2D1AA91798E48D8BFDE1EBF94A2D6BA6C0A
SHA-256:	155CE33E0E145314FE9D8911BE69B8CBBD2AC09B7B6D98363F9BAA277C71954E
SHA-512:	E10C3FD9C5F34260323CEC9E8EEDF2290F40254F0FFDCA582DB57D113B32871793CDFFF03D55941EF5E79FA8141803AB353BA4938357A4555233F2D090045338
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........B..B..B..K.`.&..-..A..-...U..-...K..-..U..B..t..-...]..-...C..-..C..RichB..........PE..d...;.*Q.........."............................@............................. ......&................ ..................................................H.......T....... +..........Pa..T...................p3..(...p2...............3...............................text............................... ..`.imrsiv..................................rdata....... ......................@..@.data...x...........................@....pdata..T...........................@..@.rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\hJiut\MFC42u.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2097152
Entropy (8bit):	3.6697318639322516
Encrypted:	false
SSDEEP:	12288:CVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1f+:ffP7fWsK5z9A+WGAW+V5SB6Ct4bnbf
MD5:	6BCACDA8CFA448613A0451AE796AE5C6
SHA1:	64A461FDFE4E9A7F8396360BB20E76621F29E84D
SHA-256:	FE69D758AF8D1751485661FBBBEF32774E6AC762A530ACE05A0588892A979D4E
SHA-512:	214B6361D9677ED81E0CE82470DBB81C831F5A90B7AEC3BF933B955DFBDFB41037EACBE20F08453492C5D0C361D217596E61CE52B5E405B4C24B7192C8B87BD0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.$..DN^.........." ................p..........@.............................. .....@lx}..b..............................................l...c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\hJiut\irftp.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	184832
Entropy (8bit):	5.862106385432374
Encrypted:	false
SSDEEP:	3072:gzPq/xfWlkWmvIGaYLZ4yjchpChlyelcU4uuh0SEslWsXxgCzX0Fhf8LL8FT7:Eq5fWlkjuYLLtHyeFSEiXxZzb8FT
MD5:	F1C2D10CA8161DB689CD4FDE756E2DBB
SHA1:	C41E86E9755824D3775E2AD6CAC9A46C7AA1C417
SHA-256:	8854450FEAD134B24FABF4B805434FCFDDF25D2179048410728F8901E0FE0906
SHA-512:	5EBB1AD4261C689E22FE34CFB0C18D71451DD4F3694D8F521D181EB42FF90582D8EF8C8AB43BFC59D224452944D9602DB1030B633856E139442EEF0C2F4428F5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PU...4}..4}..4}.{P~..4}.{Py..4}.{Px..4}.{P\|..4}..4\|.c5}.{Pt.74}.{P...4}.{P...4}.Rich.4}.........................PE..d....v.4.........."......6...........4.........@..........................................`.......... ......................................T...,....p..0....`..t............p..........T...........................@i..............@j...............................text....4.......6.................. ..`.rdata.......P.......:..............@..@.data....\|..........................@....pdata..t....`......................@..@.rsrc...0....p......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\nPqx0Ph\DUser.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2076672
Entropy (8bit):	3.637582444744564
Encrypted:	false
SSDEEP:	12288:gVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:FfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	A9531A4FBBE843891F8C095078E00403
SHA1:	0C85EFD8F60C8E4ABE9DE5F75E6B4C06D282D7EA
SHA-256:	D7CDF51766A2963B345787D3DB99D39A09F40EC03C522F21D386D920C58BA35F
SHA-512:	881BDDED76845E38AD6426D75700C7E8C5873D783E7360C6B71E7CA4BA75F18B66EC508B17507132AD1015AC29B812C64E398DCE20675ECB285B8068FB6C0399
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.$..DN^.........." ................p..........@....................................@lx}..b..................................................c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74440
Entropy (8bit):	6.20617662830101
Encrypted:	false
SSDEEP:	1536:uC9DVLLFwi//NFlWPP0mTluh1AzxJIdqqP86mSsrvNJYKPd:L3FR/F7+0mTwhswdqqk6mS4RF
MD5:	1F7CEA0216DE48B877C16F95C7DA1F0F
SHA1:	BBF654AC3D1EEC107CF18B9A7AF15FA1ED0F6075
SHA-256:	0E585A4A11586B921D103433AFA215EC419A5ED2940EFD084A47B871F43CC786
SHA-512:	3E724732D4EAA863263D2D4259FF2DF8132486418D23DBBE572E72B766416F2F7100C54EC5F776085F3EB04C33521D50895DDA1DE2947814AB67FEED55E89F50
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:...[...[...[..?...[..?...[..?...[..?...[...[...[..?...[..?<..[..?...[..Rich.[..........................PE..d.....#E.........."......\|...........y.........@....................................s,............... ...............................................P..`....@..l........$...p......`...T............................................................................text....{.......\|.................. ..`.imrsiv..................................rdata...Y.......Z..................@..@.data....0..........................@....pdata..l....@......................@..@.rsrc...`....P......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	4442
Entropy (8bit):	5.478783838366747
Encrypted:	false
SSDEEP:	48:FB5UgQRPrFgsq9CQktB5Unb3q92Wxrdwp6BHCribUY3k:FB5a13QuB50ba9RSpILX3k
MD5:	B2DC6B85154F81B3DD4677C710BD887B
SHA1:	B5A3862164A608B9E4616191876DD21B48F7A3D6
SHA-256:	3438E62E88D5193A7CE2948C465034883BA92EB335F5E8C6A9AFB60C43853BD1
SHA-512:	49318BA9C0F9E53718906521E2029B405E58CF700531CCC53BBEB63E298F8205F49267AD8D1533A514E4EFAF4770138F5F30E7B5923B1495F1F4F1C6479123D4
Malicious:	false
Preview:	........................................user.........................................user.....................RSA1..................V.l4...&..O.5\|z\.C...:h.N./......J.....U...u.R..y0.ZW%..........u..k.0_.U.d...#..t+..I..F}I..E'...pw.s..C.ke.....&.s.......................z..O......A\..1..F..:M...F....,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ....Xf..1..?.8..Xn8m.o..{/.R6U............... .....d.[Dpg....X.P.@qXU....+mP..................T.....JI.ts7...d.r....'.t#...."S....\|.....R.a{.\0.i,..Y.XF't.).Cl<....U.y.R..$b..m1P..=.pS...X% ..J.z?l......t@..xi.rWQ..Y.=..b`<..0....2>...;...eT.Y.c{$. .'Jdw`...O$.Q.....^r1.S...8V.E.-S+=?x...-s...(^.+.S .....T.i.\|f...1.m....}.!......X3.....y....^.!........U..9.)...zbg....V.......X.......=...+,./.;....*k7t......f)..c^o..s....Z....<.~.N.p .!.Y9....`.0.B..WL.7........+W..)&...$.,.F....q.....?..3..>...}..~I..:.$/09..hgtb.A;.B.T.r&u...z........h.Gof.GZ...'.v.....,5.#..s..0..rH.O.w..A......

Static File Info

General
File type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Entropy (8bit):	4.624276841986733
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	1zdJLxxTnh.dll
File size:	2068480
MD5:	784adf3295b7eafe53aa80da302b1b5d
SHA1:	c79da77a4d00ec47594e007f9a174de43b5028d3
SHA256:	69af86da86fc2f9639f010e0b729b1c2ce33a272d199aeedc4c873d98a2b83b4
SHA512:	3fbc71e7f7de7526acd525f98fc18c8af2cef28a44e0b08b0f789f758ca96ce4c631d94b76c85513c2954ea9fa0dd6bbcbf07143ab86861a720b89a018a29860
SSDEEP:	12288:YVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1qxgI:NfP7fWsK5z9A+WGAW+V5SB6Ct4bnbg
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|.

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x140041070
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x5E4E44CC [Thu Feb 20 08:35:24 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6668be91e2c948b183827f040944057f

Entrypoint Preview

Instruction
dec eax
xor eax, eax
dec eax
add eax, 5Ah
dec eax
mov dword ptr [00073D82h], ecx
dec eax
lea ecx, dword ptr [FFFFECABh]
dec eax
mov dword ptr [00073D7Ch], edx
dec eax
add eax, ecx
dec esp
mov dword ptr [00073D92h], ecx
dec esp
mov dword ptr [00073DA3h], ebp
dec esp
mov dword ptr [00073D7Ch], eax
dec esp
mov dword ptr [00073D85h], edi
dec esp
mov dword ptr [00073D86h], esi
dec esp
mov dword ptr [00073D8Fh], esp
dec eax
mov ecx, eax
dec eax
sub ecx, 5Ah
dec eax
mov dword ptr [00073D89h], esi
dec eax
test eax, eax
je 00007F3B609863FFh
dec eax
mov dword ptr [00073D45h], esp
dec eax
mov dword ptr [00073D36h], ebp
dec eax
mov dword ptr [00073D7Fh], ebx
dec eax
mov dword ptr [00073D70h], edi
dec eax
test eax, eax
je 00007F3B609863DEh
jmp ecx
dec eax
add edi, ecx
dec eax
mov dword ptr [FFFFEC37h], ecx
dec eax
xor ecx, eax
jmp ecx
retn 0008h
ud2
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebx
dec eax
sub esp, 00000080h
mov eax, F957B016h
mov byte ptr [esp+7Fh], 00000037h
mov edx, dword ptr [esp+78h]
inc ecx
mov eax, edx
inc ecx
or eax, 5D262B0Ch
inc esp
mov dword ptr [esp+78h], eax
dec eax
mov dword ptr [eax+eax+00h], 00000000h

Rich Headers

Programming Language:

[LNK] VS2012 UPD4 build 61030
[ASM] VS2013 UPD2 build 30501
[ C ] VS2012 UPD2 build 60315
[C++] VS2013 UPD4 build 31101
[RES] VS2012 UPD3 build 60610
[LNK] VS2017 v15.5.4 build 25834
[ C ] VS2017 v15.5.4 build 25834
[ASM] VS2010 build 30319
[EXP] VS2015 UPD1 build 23506
[IMP] VS2008 SP1 build 30729
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD2 build 60315
[C++] VS2015 UPD1 build 23506
[ C ] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1b3010	0x451b2	.xqltbd
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa6390	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc0000	0x468	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc1000	0x2324	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x42000	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x40796	0x41000	False	0.776085486779	data	7.73364605679	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x42000	0x64f2c	0x65000	False	0.702390160891	data	7.86574512659	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa7000	0x178b8	0x18000	False	0.0694580078125	data	3.31515306295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0xbf000	0x12c	0x1000	False	0.06005859375	PEX Binary Archive	0.581723022719	IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc0000	0x880	0x1000	False	0.139892578125	data	1.23838501563	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc1000	0x2324	0x3000	False	0.0498046875	data	4.65321444248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.qkm	0xc4000	0x74a	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.cvjb	0xc5000	0x1e66	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tlmkv	0xc7000	0xbde	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.wucsxe	0xc8000	0x45174	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.fltwtj	0x10e000	0x1267	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tblq	0x110000	0x5a7	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.hcmjm	0x111000	0x45174	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.nagyk	0x157000	0xbde	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.jrucz	0x158000	0x13e	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rnr	0x159000	0x3fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rdc	0x15a000	0x45174	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.umrigl	0x1a0000	0x543	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.nepl	0x1a1000	0x13e	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.akkqh	0x1a2000	0x736	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.cvbwr	0x1a3000	0x15a	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ftrk	0x1a4000	0x3ba	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ubbf	0x1a5000	0x1f7	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ulwqi	0x1a6000	0x5a7	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.imcflb	0x1a7000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.hgmkm	0x1a8000	0x3ba	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.cnoij	0x1a9000	0x13e	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.qgdv	0x1aa000	0x1278	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.hsbye	0x1ac000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.cdn	0x1ad000	0x1278	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.hte	0x1af000	0x389	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vcnknm	0x1b0000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.thfe	0x1b1000	0x1f7	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tat	0x1b2000	0x13e	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xqltbd	0x1b3000	0x451c2	0x46000	False	0.218523297991	data	5.76006812667	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xc00a0	0x370	data	English	United States
RT_MANIFEST	0xc0410	0x56	ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
USER32.dll	LookupIconIdFromDirectoryEx, WaitForInputIdle, GetParent, GetFocus
SETUPAPI.dll	CM_Get_Resource_Conflict_DetailsW
KERNEL32.dll	DeleteCriticalSection, DeleteTimerQueue, TerminateJobObject, GetFileInformationByHandle, GetThreadLocale, GetNamedPipeServerProcessId, GetConsoleFontSize
GDI32.dll	CreateBitmapIndirect, GetPolyFillMode
CRYPT32.dll	CertGetCTLContextProperty
ADVAPI32.dll	AddAccessDeniedObjectAce
SHLWAPI.dll	ChrCmpIW

Exports

Name	Ordinal	Address
??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ	1	0x1400401ec
??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ	2	0x14001e6e0
??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ	3	0x140031bb0
??0?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@QEAA@XZ	4	0x14001fe60
??0?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@QEAA@XZ	5	0x14003aed8
??0?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@QEAA@XZ	6	0x14003ae94
??0?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@QEAA@XZ	7	0x1400032ac
??0?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@QEAA@XZ	8	0x140012448
??0?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@QEAA@XZ	9	0x140034f44
??0?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@QEAA@XZ	10	0x14003f59c
??0?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@QEAA@XZ	11	0x14001229c
??0?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@QEAA@XZ	12	0x1400124b8
??0?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@QEAA@XZ	13	0x14002cc7c
??0?$SafeArrayAccessor@H@DirectUI@@QEAA@XZ	14	0x14002adb4
??0AccessibleButton@DirectUI@@QEAA@$$QEAV01@@Z	15	0x1400412b8
??0AccessibleButton@DirectUI@@QEAA@AEBV01@@Z	16	0x140006654
??0AccessibleButton@DirectUI@@QEAA@XZ	17	0x14000b3e8
??0AnimationStrip@DirectUI@@QEAA@AEBV01@@Z	18	0x140022cb8
??0AnimationStrip@DirectUI@@QEAA@XZ	19	0x140006d20
??0AutoButton@DirectUI@@QEAA@$$QEAV01@@Z	20	0x14000ab6c
??0AutoButton@DirectUI@@QEAA@AEBV01@@Z	21	0x1400287bc
??0AutoButton@DirectUI@@QEAA@XZ	22	0x140023e60
??0AutoLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z	23	0x14002e614
??0AutoThread@DirectUI@@QEAA@XZ	24	0x140028724
??0AutoVariant@DirectUI@@QEAA@XZ	25	0x140005ebc
??0BaseScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	26	0x14001782c
??0BaseScrollBar@DirectUI@@QEAA@AEBV01@@Z	27	0x140020314
??0BaseScrollBar@DirectUI@@QEAA@XZ	28	0x14003deac
??0BaseScrollViewer@DirectUI@@QEAA@AEBV01@@Z	29	0x14001b200
??0BaseScrollViewer@DirectUI@@QEAA@XZ	30	0x140033190
??0Bind@DirectUI@@QEAA@$$QEAV01@@Z	31	0x140039aa0
??0Bind@DirectUI@@QEAA@AEBV01@@Z	32	0x14000b964
??0Bind@DirectUI@@QEAA@XZ	33	0x14003f5c4
??0BorderLayout@DirectUI@@QEAA@AEBV01@@Z	34	0x140014114
??0BorderLayout@DirectUI@@QEAA@XZ	35	0x1400195ac
??0Browser@DirectUI@@QEAA@$$QEAV01@@Z	36	0x14003fcd8
??0Browser@DirectUI@@QEAA@AEBV01@@Z	37	0x14001162c
??0Browser@DirectUI@@QEAA@XZ	38	0x140010930
??0BrowserSelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z	39	0x14000b2a8
??0BrowserSelectionProxy@DirectUI@@QEAA@AEBV01@@Z	40	0x140017c94
??0BrowserSelectionProxy@DirectUI@@QEAA@XZ	41	0x1400100c8
??0Button@DirectUI@@QEAA@AEBV01@@Z	42	0x140040fbc
??0Button@DirectUI@@QEAA@XZ	43	0x14002e420
??0CCAVI@DirectUI@@QEAA@$$QEAV01@@Z	44	0x1400144c0
??0CCAVI@DirectUI@@QEAA@AEBV01@@Z	45	0x14002a6f0
??0CCAVI@DirectUI@@QEAA@XZ	46	0x14002b4e8
??0CCBase@DirectUI@@QEAA@AEBV01@@Z	47	0x140028ae0
??0CCBase@DirectUI@@QEAA@KPEBG@Z	48	0x14000f488
??0CCBaseCheckRadioButton@DirectUI@@QEAA@$$QEAV01@@Z	49	0x14000f30c
??0CCBaseCheckRadioButton@DirectUI@@QEAA@AEBV01@@Z	50	0x1400227ec
??0CCBaseCheckRadioButton@DirectUI@@QEAA@K@Z	51	0x14000405c
??0CCBaseScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	52	0x140039bc0
??0CCBaseScrollBar@DirectUI@@QEAA@AEBV01@@Z	53	0x14003f890
??0CCBaseScrollBar@DirectUI@@QEAA@K@Z	54	0x140011ee0
??0CCCheckBox@DirectUI@@QEAA@$$QEAV01@@Z	55	0x1400298c8
??0CCCheckBox@DirectUI@@QEAA@AEBV01@@Z	56	0x1400363fc
??0CCCheckBox@DirectUI@@QEAA@K@Z	57	0x14000ee78
??0CCCommandLink@DirectUI@@QEAA@$$QEAV01@@Z	58	0x140025bf4
??0CCCommandLink@DirectUI@@QEAA@AEBV01@@Z	59	0x1400316d8
??0CCCommandLink@DirectUI@@QEAA@K@Z	60	0x14001aca8
??0CCHScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	61	0x14003c5e0
??0CCHScrollBar@DirectUI@@QEAA@AEBV01@@Z	62	0x14000bd98
??0CCHScrollBar@DirectUI@@QEAA@XZ	63	0x140015a58
??0CCListBox@DirectUI@@QEAA@$$QEAV01@@Z	64	0x14001fbb8
??0CCListBox@DirectUI@@QEAA@AEBV01@@Z	65	0x140017c10
??0CCListBox@DirectUI@@QEAA@XZ	66	0x14000e7b0
??0CCListView@DirectUI@@QEAA@$$QEAV01@@Z	67	0x140036014
??0CCListView@DirectUI@@QEAA@AEBV01@@Z	68	0x14000f5f8
??0CCListView@DirectUI@@QEAA@XZ	69	0x140022600
??0CCProgressBar@DirectUI@@QEAA@$$QEAV01@@Z	70	0x140014d34
??0CCProgressBar@DirectUI@@QEAA@AEBV01@@Z	71	0x14001bfe0
??0CCProgressBar@DirectUI@@QEAA@XZ	72	0x1400412b8
??0CCPushButton@DirectUI@@QEAA@$$QEAV01@@Z	73	0x14003327c
??0CCPushButton@DirectUI@@QEAA@AEBV01@@Z	74	0x140019dc4
??0CCPushButton@DirectUI@@QEAA@K@Z	75	0x14001585c
??0CCRadioButton@DirectUI@@QEAA@$$QEAV01@@Z	76	0x140020c0c
??0CCRadioButton@DirectUI@@QEAA@AEBV01@@Z	77	0x14001c768
??0CCRadioButton@DirectUI@@QEAA@XZ	78	0x14000688c
??0CCSysLink@DirectUI@@QEAA@$$QEAV01@@Z	79	0x1400332a4
??0CCSysLink@DirectUI@@QEAA@AEBV01@@Z	80	0x1400389ac
??0CCSysLink@DirectUI@@QEAA@XZ	81	0x1400406ac
??0CCTrackBar@DirectUI@@QEAA@$$QEAV01@@Z	82	0x14001d8e4
??0CCTrackBar@DirectUI@@QEAA@AEBV01@@Z	83	0x14003cf3c
??0CCTrackBar@DirectUI@@QEAA@XZ	84	0x140006378
??0CCTreeView@DirectUI@@QEAA@$$QEAV01@@Z	85	0x14001a234
??0CCTreeView@DirectUI@@QEAA@AEBV01@@Z	86	0x14002f880
??0CCTreeView@DirectUI@@QEAA@K@Z	87	0x140007528
??0CCVScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	88	0x140026b60
??0CCVScrollBar@DirectUI@@QEAA@AEBV01@@Z	89	0x14003e994
??0CCVScrollBar@DirectUI@@QEAA@XZ	90	0x14000f490
??0CallstackTracker@DirectUI@@QEAA@XZ	91	0x140006340
??0CheckBoxGlyph@DirectUI@@QEAA@AEBV01@@Z	92	0x140015650
??0CheckBoxGlyph@DirectUI@@QEAA@XZ	93	0x140008b28
??0ClassInfoBase@DirectUI@@QEAA@AEBV01@@Z	94	0x140009e88
??0ClassInfoBase@DirectUI@@QEAA@XZ	95	0x140008e90
??0Clipper@DirectUI@@QEAA@$$QEAV01@@Z	96	0x14000a88c
??0Clipper@DirectUI@@QEAA@AEBV01@@Z	97	0x140034e28
??0Clipper@DirectUI@@QEAA@XZ	98	0x1400171b0
??0Combobox@DirectUI@@QEAA@AEBV01@@Z	99	0x140028ca0
??0Combobox@DirectUI@@QEAA@XZ	100	0x1400202ec
??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z	101	0x140013390
??0DCSurface@DirectUI@@QEAA@AEBV01@@Z	102	0x140018da0
??0DCSurface@DirectUI@@QEAA@PEAUHDC__@@@Z	103	0x14003302c
??0DUIFactory@DirectUI@@QEAA@PEAUHWND__@@@Z	104	0x14003ff50
??0DUIXmlParser@DirectUI@@QEAA@AEBV01@@Z	105	0x140017928
??0DUIXmlParser@DirectUI@@QEAA@XZ	106	0x14000f790
??0DialogElement@DirectUI@@QEAA@$$QEAV01@@Z	107	0x14002a210
??0DialogElement@DirectUI@@QEAA@AEBV01@@Z	108	0x140009988
??0DialogElement@DirectUI@@QEAA@XZ	109	0x140028814
??0DuiAccessible@DirectUI@@QEAA@XZ	110	0x14002cdd0
??0Edit@DirectUI@@QEAA@AEBV01@@Z	111	0x140009008
??0Edit@DirectUI@@QEAA@XZ	112	0x14002fc18
??0Element@DirectUI@@QEAA@AEBV01@@Z	113	0x140023ad4
??0Element@DirectUI@@QEAA@XZ	114	0x140003ac0
??0ElementProvider@DirectUI@@QEAA@XZ	115	0x14001aec4
??0ElementProxy@DirectUI@@IEAA@XZ	116	0x140033074
??0ElementProxy@DirectUI@@QEAA@$$QEAV01@@Z	117	0x1400228cc
??0ElementProxy@DirectUI@@QEAA@AEBV01@@Z	118	0x140011488
??0ElementWithHWND@DirectUI@@QEAA@$$QEAV01@@Z	119	0x14001ae78
??0ElementWithHWND@DirectUI@@QEAA@AEBV01@@Z	120	0x14001d3cc
??0ElementWithHWND@DirectUI@@QEAA@XZ	121	0x14000b31c
??0ExpandCollapseProvider@DirectUI@@QEAA@XZ	122	0x14003e4fc
??0ExpandCollapseProxy@DirectUI@@QEAA@$$QEAV01@@Z	123	0x14001fc14
??0ExpandCollapseProxy@DirectUI@@QEAA@AEBV01@@Z	124	0x14002d0c8
??0ExpandCollapseProxy@DirectUI@@QEAA@XZ	125	0x14001d210
??0Expandable@DirectUI@@QEAA@$$QEAV01@@Z	126	0x14000a0a0
??0Expandable@DirectUI@@QEAA@AEBV01@@Z	127	0x140031b94
??0Expandable@DirectUI@@QEAA@XZ	128	0x140007260
??0Expando@DirectUI@@QEAA@$$QEAV01@@Z	129	0x14003f24c
??0Expando@DirectUI@@QEAA@AEBV01@@Z	130	0x14003ec34
??0Expando@DirectUI@@QEAA@XZ	131	0x140016100
??0ExpandoButtonGlyph@DirectUI@@QEAA@AEBV01@@Z	132	0x140034230
??0ExpandoButtonGlyph@DirectUI@@QEAA@XZ	133	0x14001a844
??0FillLayout@DirectUI@@QEAA@AEBV01@@Z	134	0x1400226bc
??0FillLayout@DirectUI@@QEAA@XZ	135	0x140036754
??0FlowLayout@DirectUI@@QEAA@AEBV01@@Z	136	0x14002e904
??0FlowLayout@DirectUI@@QEAA@XZ	137	0x14000efb4
??0FontCache@DirectUI@@QEAA@$$QEAV01@@Z	138	0x140001b58
??0FontCache@DirectUI@@QEAA@AEBV01@@Z	139	0x1400217a8
??0FontCache@DirectUI@@QEAA@XZ	140	0x1400289d8
??0FontCheckOut@DirectUI@@QEAA@PEAVElement@1@PEAUHDC__@@@Z	141	0x14001324c
??0GridItemProvider@DirectUI@@QEAA@XZ	142	0x140035720
??0GridItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	143	0x140002218
??0GridItemProxy@DirectUI@@QEAA@AEBV01@@Z	144	0x14000a524
??0GridItemProxy@DirectUI@@QEAA@XZ	145	0x14003b2f0
??0GridLayout@DirectUI@@QEAA@AEBV01@@Z	146	0x14001a6d0
??0GridLayout@DirectUI@@QEAA@XZ	147	0x140002bbc
??0GridProvider@DirectUI@@QEAA@XZ	148	0x1400076a4
??0GridProxy@DirectUI@@QEAA@$$QEAV01@@Z	149	0x14001e248
??0GridProxy@DirectUI@@QEAA@AEBV01@@Z	150	0x140016b84
??0GridProxy@DirectUI@@QEAA@XZ	151	0x140003300
??0HWNDElement@DirectUI@@QEAA@AEBV01@@Z	152	0x14002e344
??0HWNDElement@DirectUI@@QEAA@XZ	153	0x14001c50c
??0HWNDElementAccessible@DirectUI@@QEAA@XZ	154	0x140035354
??0HWNDElementProvider@DirectUI@@QEAA@XZ	155	0x140020390
??0HWNDElementProxy@DirectUI@@IEAA@XZ	156	0x140036614
??0HWNDElementProxy@DirectUI@@QEAA@$$QEAV01@@Z	157	0x14003ea90
??0HWNDElementProxy@DirectUI@@QEAA@AEBV01@@Z	158	0x14001a5d0
??0HWNDHost@DirectUI@@QEAA@AEBV01@@Z	159	0x140027a88
??0HWNDHost@DirectUI@@QEAA@XZ	160	0x140004ff8
??0HWNDHostAccessible@DirectUI@@QEAA@XZ	161	0x14002b314
??0HWNDHostClientAccessible@DirectUI@@QEAA@XZ	162	0x1400349bc
??0IDataEngine@DirectUI@@QEAA@AEBU01@@Z	163	0x14000e7c0
??0IDataEngine@DirectUI@@QEAA@XZ	164	0x140039144
??0IDataEntry@DirectUI@@QEAA@AEBU01@@Z	165	0x140024e80
??0IDataEntry@DirectUI@@QEAA@XZ	166	0x140001ca0
??0IProvider@DirectUI@@QEAA@$$QEAV01@@Z	167	0x140022e9c
??0IProvider@DirectUI@@QEAA@AEBV01@@Z	168	0x140001c5c
??0IProvider@DirectUI@@QEAA@XZ	169	0x140011478
??0ISBLeak@DirectUI@@QEAA@$$QEAU01@@Z	170	0x140022774
??0ISBLeak@DirectUI@@QEAA@AEBU01@@Z	171	0x14000d6b8
??0ISBLeak@DirectUI@@QEAA@XZ	172	0x140001954
??0IXElementCP@DirectUI@@QEAA@$$QEAV01@@Z	173	0x14002bdd4
??0IXElementCP@DirectUI@@QEAA@AEBV01@@Z	174	0x140028038
??0IXElementCP@DirectUI@@QEAA@XZ	175	0x140029214
??0IXProviderCP@DirectUI@@QEAA@$$QEAV01@@Z	176	0x1400206f4
??0IXProviderCP@DirectUI@@QEAA@AEBV01@@Z	177	0x140029368
??0IXProviderCP@DirectUI@@QEAA@XZ	178	0x140030b10
??0InvokeHelper@DirectUI@@QEAA@XZ	179	0x14001f8d4
??0InvokeProvider@DirectUI@@QEAA@XZ	180	0x140028aac
??0InvokeProxy@DirectUI@@QEAA@$$QEAV01@@Z	181	0x14002f184
??0InvokeProxy@DirectUI@@QEAA@AEBV01@@Z	182	0x140033840
??0InvokeProxy@DirectUI@@QEAA@XZ	183	0x140011e64
??0ItemList@DirectUI@@QEAA@XZ	184	0x140019480
??0Layout@DirectUI@@QEAA@AEBV01@@Z	185	0x140028020
??0Layout@DirectUI@@QEAA@XZ	186	0x14001a1f0
??0LinkedList@DirectUI@@QEAA@XZ	187	0x140028254
??0Macro@DirectUI@@QEAA@$$QEAV01@@Z	188	0x1400229f0
??0Macro@DirectUI@@QEAA@AEBV01@@Z	189	0x14001226c
??0Macro@DirectUI@@QEAA@XZ	190	0x140008298
??0ModernProgressBar@DirectUI@@QEAA@XZ	191	0x140010344
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	192	0x14000ec30
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	193	0x14001cb50
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@XZ	194	0x140039330
??0ModernProgressRing@DirectUI@@QEAA@XZ	195	0x14003ba5c
??0Movie@DirectUI@@QEAA@AEBV01@@Z	196	0x14003f998
??0Movie@DirectUI@@QEAA@XZ	197	0x140034f34
??0NativeHWNDHost@DirectUI@@QEAA@AEBV01@@Z	198	0x14001c0f0
??0NativeHWNDHost@DirectUI@@QEAA@XZ	199	0x140013338
??0Navigator@DirectUI@@QEAA@$$QEAV01@@Z	200	0x140015750
??0Navigator@DirectUI@@QEAA@AEBV01@@Z	201	0x140037e74
??0Navigator@DirectUI@@QEAA@XZ	202	0x140036cbc
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	203	0x14001509c
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z	204	0x1400218e4
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@XZ	205	0x1400372f4
??0NineGridLayout@DirectUI@@QEAA@AEBV01@@Z	206	0x140016abc
??0NineGridLayout@DirectUI@@QEAA@XZ	207	0x140016134
??0PText@DirectUI@@QEAA@AEBV01@@Z	208	0x1400206d0
??0PText@DirectUI@@QEAA@XZ	209	0x140040c4c
??0Page@DirectUI@@QEAA@$$QEAV01@@Z	210	0x140027508
??0Page@DirectUI@@QEAA@AEBV01@@Z	211	0x1400269c0
??0Page@DirectUI@@QEAA@XZ	212	0x14002acf8
??0Pages@DirectUI@@QEAA@$$QEAV01@@Z	213	0x140014ce4
??0Pages@DirectUI@@QEAA@AEBV01@@Z	214	0x14000ec94
??0Pages@DirectUI@@QEAA@XZ	215	0x14003d3e0
??0Progress@DirectUI@@QEAA@AEBV01@@Z	216	0x14001478c
??0Progress@DirectUI@@QEAA@XZ	217	0x140001498
??0ProgressRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	218	0x140039e98
??0ProgressRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	219	0x14002de34
??0ProgressRangeValueProxy@DirectUI@@QEAA@XZ	220	0x14002561c
??0ProviderProxy@DirectUI@@IEAA@XZ	221	0x140035ff0
??0ProviderProxy@DirectUI@@QEAA@$$QEAV01@@Z	222	0x140008684
??0ProviderProxy@DirectUI@@QEAA@AEBV01@@Z	223	0x140006758
??0Proxy@DirectUI@@QEAA@AEBV01@@Z	224	0x140032478
??0Proxy@DirectUI@@QEAA@XZ	225	0x140031d2c
??0PushButton@DirectUI@@QEAA@$$QEAV01@@Z	226	0x140031ec8
??0PushButton@DirectUI@@QEAA@AEBV01@@Z	227	0x14002fb48
??0PushButton@DirectUI@@QEAA@XZ	228	0x1400277b8
??0RadioButtonGlyph@DirectUI@@QEAA@AEBV01@@Z	229	0x1400152dc
??0RadioButtonGlyph@DirectUI@@QEAA@XZ	230	0x140008264
??0RangeValueProvider@DirectUI@@QEAA@XZ	231	0x140032b30
??0RangeValueProxy@DirectUI@@IEAA@XZ	232	0x14003fad8
??0RangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	233	0x14003cc38
??0RangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	234	0x1400264e8
??0RefPointElement@DirectUI@@QEAA@AEBV01@@Z	235	0x14001522c
??0RefPointElement@DirectUI@@QEAA@XZ	236	0x140005f30
??0RefcountBase@DirectUI@@QEAA@XZ	237	0x1400352b4
??0RepeatButton@DirectUI@@QEAA@AEBV01@@Z	238	0x1400333f8
??0RepeatButton@DirectUI@@QEAA@XZ	239	0x140024894
??0Repeater@DirectUI@@QEAA@$$QEAV01@@Z	240	0x140024a88
??0Repeater@DirectUI@@QEAA@AEBV01@@Z	241	0x1400313dc
??0Repeater@DirectUI@@QEAA@XZ	242	0x140033598
??0ResourceModuleHandles@DirectUI@@QEAA@XZ	243	0x1400390b4
??0RichText@DirectUI@@QEAA@XZ	244	0x14002cd3c
??0RowLayout@DirectUI@@QEAA@AEBV01@@Z	245	0x14002edc0
??0RowLayout@DirectUI@@QEAA@XZ	246	0x140003d00
??0ScrollBar@DirectUI@@QEAA@AEBV01@@Z	247	0x14002d4fc
??0ScrollBar@DirectUI@@QEAA@XZ	248	0x1400213e0
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	249	0x14001274c
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	250	0x14001d1ec
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@XZ	251	0x140006b38
??0ScrollItemProvider@DirectUI@@QEAA@XZ	252	0x14003a55c
??0ScrollItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	253	0x14003cf60
??0ScrollItemProxy@DirectUI@@QEAA@AEBV01@@Z	254	0x14000a394
??0ScrollItemProxy@DirectUI@@QEAA@XZ	255	0x1400332d4
??0ScrollProvider@DirectUI@@QEAA@XZ	256	0x14000e334
??0ScrollProxy@DirectUI@@QEAA@$$QEAV01@@Z	257	0x140038954
??0ScrollProxy@DirectUI@@QEAA@AEBV01@@Z	258	0x14003e758
??0ScrollProxy@DirectUI@@QEAA@XZ	259	0x140033a58
??0ScrollViewer@DirectUI@@QEAA@AEBV01@@Z	260	0x140026308
??0ScrollViewer@DirectUI@@QEAA@XZ	261	0x140001d40
??0SelectionItemProvider@DirectUI@@QEAA@XZ	262	0x14000c750
??0SelectionItemProxy@DirectUI@@IEAA@XZ	263	0x140004a6c
??0SelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	264	0x140039ef8
??0SelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z	265	0x14002ee98
??0SelectionProvider@DirectUI@@QEAA@XZ	266	0x140038ab0
??0SelectionProxy@DirectUI@@IEAA@XZ	267	0x140034e80
??0SelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z	268	0x140024230
??0SelectionProxy@DirectUI@@QEAA@AEBV01@@Z	269	0x140037ed4
??0Selector@DirectUI@@QEAA@AEBV01@@Z	270	0x14004154c
??0Selector@DirectUI@@QEAA@XZ	271	0x14002ac2c
??0SelectorNoDefault@DirectUI@@QEAA@$$QEAV01@@Z	272	0x140005f78
??0SelectorNoDefault@DirectUI@@QEAA@AEBV01@@Z	273	0x140036a2c
??0SelectorNoDefault@DirectUI@@QEAA@XZ	274	0x140009b0c
??0SelectorSelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	275	0x14003bed0
??0SelectorSelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z	276	0x14003dc54
??0SelectorSelectionItemProxy@DirectUI@@QEAA@XZ	277	0x1400404a8
??0SelectorSelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z	278	0x140013cec
??0SelectorSelectionProxy@DirectUI@@QEAA@AEBV01@@Z	279	0x140010958
??0SelectorSelectionProxy@DirectUI@@QEAA@XZ	280	0x14003c49c
??0ShellBorderLayout@DirectUI@@QEAA@AEBV01@@Z	281	0x14001af48
??0ShellBorderLayout@DirectUI@@QEAA@XZ	282	0x14003fc54
??0StyleSheet@DirectUI@@QEAA@$$QEAV01@@Z	283	0x140036df8
??0StyleSheet@DirectUI@@QEAA@AEBV01@@Z	284	0x14001b478
??0StyleSheet@DirectUI@@QEAA@XZ	285	0x14003a33c
??0StyledScrollViewer@DirectUI@@QEAA@AEBV01@@Z	286	0x14003b530
??0StyledScrollViewer@DirectUI@@QEAA@XZ	287	0x14003914c
??0Surface@DirectUI@@QEAA@AEBV01@@Z	288	0x14001c330
??0Surface@DirectUI@@QEAA@XZ	289	0x14002a498
??0TableItemProvider@DirectUI@@QEAA@XZ	290	0x1400346d8
??0TableItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	291	0x1400141b0
??0TableItemProxy@DirectUI@@QEAA@AEBV01@@Z	292	0x1400391b0
??0TableItemProxy@DirectUI@@QEAA@XZ	293	0x14003003c
??0TableLayout@DirectUI@@QEAA@AEBV01@@Z	294	0x140012778
??0TableLayout@DirectUI@@QEAA@XZ	295	0x14002eaac
??0TableProvider@DirectUI@@QEAA@XZ	296	0x140036d1c
??0TableProxy@DirectUI@@QEAA@$$QEAV01@@Z	297	0x1400377c0
??0TableProxy@DirectUI@@QEAA@AEBV01@@Z	298	0x140024400
??0TableProxy@DirectUI@@QEAA@XZ	299	0x1400028b4
??0TaskPage@DirectUI@@QEAA@AEBV01@@Z	300	0x140038d8c
??0TaskPage@DirectUI@@QEAA@XZ	301	0x140038684
??0TextGraphic@DirectUI@@QEAA@$$QEAV01@@Z	302	0x14002dbec
??0TextGraphic@DirectUI@@QEAA@AEBV01@@Z	303	0x14000aa70
??0TextGraphic@DirectUI@@QEAA@XZ	304	0x140035618
??0Thumb@DirectUI@@QEAA@AEBV01@@Z	305	0x14002be18
??0Thumb@DirectUI@@QEAA@XZ	306	0x140007398
??0ToggleProvider@DirectUI@@QEAA@XZ	307	0x14001ef80
??0ToggleProxy@DirectUI@@QEAA@$$QEAV01@@Z	308	0x14003f638
??0ToggleProxy@DirectUI@@QEAA@AEBV01@@Z	309	0x140025190
??0ToggleProxy@DirectUI@@QEAA@XZ	310	0x1400139ec
??0TouchButton@DirectUI@@QEAA@XZ	311	0x140004e28
??0TouchCheckBox@DirectUI@@QEAA@XZ	312	0x14002d4ec
??0TouchCheckBoxGlyph@DirectUI@@QEAA@XZ	313	0x14001470c
??0TouchCommandButton@DirectUI@@QEAA@XZ	314	0x140022be0
??0TouchEdit2@DirectUI@@QEAA@XZ	315	0x14001fa08
??0TouchHWNDElement@DirectUI@@QEAA@XZ	316	0x14001050c
??0TouchHyperLink@DirectUI@@QEAA@XZ	317	0x14003a824
??0TouchRepeatButton@DirectUI@@QEAA@XZ	318	0x14002950c
??0TouchScrollBar@DirectUI@@QEAA@XZ	319	0x140034064
??0TouchSelect@DirectUI@@QEAA@XZ	320	0x14003325c
??0TouchSelectItem@DirectUI@@QEAA@XZ	321	0x140008ea0
??0UnknownElement@DirectUI@@QEAA@AEBV01@@Z	322	0x140004d10
??0UnknownElement@DirectUI@@QEAA@XZ	323	0x14000d97c
??0ValueProvider@DirectUI@@QEAA@XZ	324	0x140034a2c
??0ValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	325	0x140011400
??0ValueProxy@DirectUI@@QEAA@AEBV01@@Z	326	0x14000b6d0
??0ValueProxy@DirectUI@@QEAA@XZ	327	0x1400156cc
??0VerticalFlowLayout@DirectUI@@QEAA@AEBV01@@Z	328	0x14002ffd4
??0VerticalFlowLayout@DirectUI@@QEAA@XZ	329	0x1400260ec
??0Viewer@DirectUI@@QEAA@AEBV01@@Z	330	0x140003ffc
??0Viewer@DirectUI@@QEAA@XZ	331	0x14003cb30
??0XBaby@DirectUI@@QEAA@AEBV01@@Z	332	0x14002bdec
??0XBaby@DirectUI@@QEAA@XZ	333	0x140022b78
??0XElement@DirectUI@@QEAA@AEBV01@@Z	334	0x1400217ec
??0XElement@DirectUI@@QEAA@XZ	335	0x140025218
??0XHost@DirectUI@@QEAA@XZ	336	0x14002b800
??0XProvider@DirectUI@@QEAA@AEBV01@@Z	337	0x140012b28
??0XProvider@DirectUI@@QEAA@XZ	338	0x140010de4
??0XResourceProvider@DirectUI@@QEAA@$$QEAV01@@Z	339	0x1400087a4
??0XResourceProvider@DirectUI@@QEAA@AEBV01@@Z	340	0x140001d60
??0XResourceProvider@DirectUI@@QEAA@XZ	341	0x140040990
??1?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@UEAA@XZ	342	0x140008c30
??1?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@UEAA@XZ	343	0x140017d7c
??1?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@UEAA@XZ	344	0x140005d54
??1?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@UEAA@XZ	345	0x14001f5b0
??1?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@UEAA@XZ	346	0x14001f50c
??1?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@UEAA@XZ	347	0x1400079cc
??1?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@UEAA@XZ	348	0x14002e594
??1?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@UEAA@XZ	349	0x1400059e4
??1?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@UEAA@XZ	350	0x14000f2b0
??1?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@UEAA@XZ	351	0x14000d75c
??1?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@UEAA@XZ	352	0x1400342c0
??1?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@UEAA@XZ	353	0x1400244a4
??1?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@UEAA@XZ	354	0x14000d650
??1?$SafeArrayAccessor@H@DirectUI@@QEAA@XZ	355	0x1400010a0
??1AccessibleButton@DirectUI@@UEAA@XZ	356	0x1400036d8
??1AnimationStrip@DirectUI@@UEAA@XZ	357	0x14003470c
??1AutoButton@DirectUI@@UEAA@XZ	358	0x14001a030
??1AutoLock@DirectUI@@QEAA@XZ	359	0x140021708
??1AutoThread@DirectUI@@QEAA@XZ	360	0x1400133cc
??1AutoVariant@DirectUI@@QEAA@XZ	361	0x140019ec8
??1BaseScrollViewer@DirectUI@@UEAA@XZ	362	0x140012ddc
??1Bind@DirectUI@@UEAA@XZ	363	0x14002a794
??1BorderLayout@DirectUI@@UEAA@XZ	364	0x140008910
??1Browser@DirectUI@@UEAA@XZ	365	0x14002da08
??1Button@DirectUI@@UEAA@XZ	366	0x140010fac
??1CCAVI@DirectUI@@UEAA@XZ	367	0x14000f33c
??1CCBase@DirectUI@@UEAA@XZ	368	0x14001f3d4
??1CCBaseCheckRadioButton@DirectUI@@UEAA@XZ	369	0x140039a1c
??1CCBaseScrollBar@DirectUI@@UEAA@XZ	370	0x1400025a8
??1CCCheckBox@DirectUI@@UEAA@XZ	371	0x14000fb40
??1CCCommandLink@DirectUI@@UEAA@XZ	372	0x14000dbfc
??1CCHScrollBar@DirectUI@@UEAA@XZ	373	0x1400030d0
??1CCListBox@DirectUI@@UEAA@XZ	374	0x140015f64
??1CCListView@DirectUI@@UEAA@XZ	375	0x1400326d8
??1CCProgressBar@DirectUI@@UEAA@XZ	376	0x140029e50
??1CCPushButton@DirectUI@@UEAA@XZ	377	0x140040ef4
??1CCRadioButton@DirectUI@@UEAA@XZ	378	0x1400319a4
??1CCSysLink@DirectUI@@UEAA@XZ	379	0x140005404
??1CCTrackBar@DirectUI@@UEAA@XZ	380	0x14003bba0
??1CCTreeView@DirectUI@@UEAA@XZ	381	0x14000eb9c
??1CCVScrollBar@DirectUI@@UEAA@XZ	382	0x140002e84
??1CallstackTracker@DirectUI@@QEAA@XZ	383	0x140030574
??1CheckBoxGlyph@DirectUI@@UEAA@XZ	384	0x1400281f8
??1ClassInfoBase@DirectUI@@UEAA@XZ	385	0x140039fa4
??1Clipper@DirectUI@@UEAA@XZ	386	0x140004134
??1Combobox@DirectUI@@UEAA@XZ	387	0x140003714
??1CritSecLock@DirectUI@@QEAA@XZ	388	0x140035b18
??1DCSurface@DirectUI@@UEAA@XZ	389	0x14001d5ec
??1DUIFactory@DirectUI@@QEAA@XZ	390	0x140009d28
??1DUIXmlParser@DirectUI@@UEAA@XZ	391	0x14000871c
??1DialogElement@DirectUI@@UEAA@XZ	392	0x140014358
??1DuiAccessible@DirectUI@@UEAA@XZ	393	0x14002124c
??1Edit@DirectUI@@UEAA@XZ	394	0x14002f418
??1Element@DirectUI@@UEAA@XZ	395	0x14000cb9c
??1ElementProvider@DirectUI@@UEAA@XZ	396	0x14002b388
??1ElementWithHWND@DirectUI@@UEAA@XZ	397	0x14001f0bc
??1ExpandCollapseProvider@DirectUI@@UEAA@XZ	398	0x14003fee4
??1Expandable@DirectUI@@UEAA@XZ	399	0x14000d744
??1Expando@DirectUI@@UEAA@XZ	400	0x140029eac
??1ExpandoButtonGlyph@DirectUI@@UEAA@XZ	401	0x1400098ec
??1FillLayout@DirectUI@@UEAA@XZ	402	0x14002e0c8
??1FlowLayout@DirectUI@@UEAA@XZ	403	0x14000cc4c
??1FontCheckOut@DirectUI@@QEAA@XZ	404	0x140038544
??1GridItemProvider@DirectUI@@UEAA@XZ	405	0x14003086c
??1GridLayout@DirectUI@@UEAA@XZ	406	0x140031e5c
??1GridProvider@DirectUI@@UEAA@XZ	407	0x140023178
??1HWNDElement@DirectUI@@UEAA@XZ	408	0x1400157a8
??1HWNDElementAccessible@DirectUI@@UEAA@XZ	409	0x14002b790
??1HWNDElementProvider@DirectUI@@UEAA@XZ	410	0x14000fc24
??1HWNDHost@DirectUI@@UEAA@XZ	411	0x14002fc9c
??1HWNDHostAccessible@DirectUI@@UEAA@XZ	412	0x140014bbc
??1HWNDHostClientAccessible@DirectUI@@UEAA@XZ	413	0x140008644
??1IDataEngine@DirectUI@@UEAA@XZ	414	0x14003a230
??1IDataEntry@DirectUI@@UEAA@XZ	415	0x140040b2c
??1InvokeHelper@DirectUI@@UEAA@XZ	416	0x14000f4f8
??1InvokeProvider@DirectUI@@UEAA@XZ	417	0x140038820
??1ItemList@DirectUI@@UEAA@XZ	418	0x140010dc4
??1Layout@DirectUI@@UEAA@XZ	419	0x14002a068
??1LinkedList@DirectUI@@QEAA@XZ	420	0x14000e19c
??1Macro@DirectUI@@UEAA@XZ	421	0x1400407f8
??1ModernProgressBar@DirectUI@@UEAA@XZ	422	0x14003b2e0
??1ModernProgressRing@DirectUI@@UEAA@XZ	423	0x140036e10
??1Movie@DirectUI@@UEAA@XZ	424	0x1400200ec
??1NativeHWNDHost@DirectUI@@UEAA@XZ	425	0x14001e8b4
??1Navigator@DirectUI@@UEAA@XZ	426	0x14003dc00
??1NineGridLayout@DirectUI@@UEAA@XZ	427	0x14001fce8
??1PText@DirectUI@@UEAA@XZ	428	0x1400310ac
??1Page@DirectUI@@UEAA@XZ	429	0x14000ce54
??1Pages@DirectUI@@UEAA@XZ	430	0x1400396c0
??1Progress@DirectUI@@UEAA@XZ	431	0x140041288
??1Proxy@DirectUI@@UEAA@XZ	432	0x1400319e4
??1PushButton@DirectUI@@UEAA@XZ	433	0x140004c64
??1RadioButtonGlyph@DirectUI@@UEAA@XZ	434	0x14002d688
??1RangeValueProvider@DirectUI@@UEAA@XZ	435	0x14002425c
??1RefPointElement@DirectUI@@UEAA@XZ	436	0x140035c40
??1RefcountBase@DirectUI@@UEAA@XZ	437	0x14003d114
??1RepeatButton@DirectUI@@UEAA@XZ	438	0x14002a280
??1Repeater@DirectUI@@UEAA@XZ	439	0x14004127c
??1ResourceModuleHandles@DirectUI@@QEAA@XZ	440	0x1400415ac
??1RichText@DirectUI@@UEAA@XZ	441	0x14002dd4c
??1RowLayout@DirectUI@@UEAA@XZ	442	0x14001cf60
??1ScrollBar@DirectUI@@UEAA@XZ	443	0x140026f84
??1ScrollItemProvider@DirectUI@@UEAA@XZ	444	0x140013ef4
??1ScrollProvider@DirectUI@@UEAA@XZ	445	0x14002ef3c
??1ScrollViewer@DirectUI@@UEAA@XZ	446	0x140015d18
??1SelectionItemProvider@DirectUI@@UEAA@XZ	447	0x140012560
??1SelectionProvider@DirectUI@@UEAA@XZ	448	0x14003bcb0
??1Selector@DirectUI@@UEAA@XZ	449	0x14003f9ec
??1SelectorNoDefault@DirectUI@@UEAA@XZ	450	0x140031b4c
??1ShellBorderLayout@DirectUI@@UEAA@XZ	451	0x14001dfc8
??1StyledScrollViewer@DirectUI@@UEAA@XZ	452	0x14002b424
??1Surface@DirectUI@@UEAA@XZ	453	0x14000b514
??1TableItemProvider@DirectUI@@UEAA@XZ	454	0x1400124b4
??1TableLayout@DirectUI@@UEAA@XZ	455	0x14000de44
??1TableProvider@DirectUI@@UEAA@XZ	456	0x140024d80
??1TaskPage@DirectUI@@UEAA@XZ	457	0x140004bfc
??1TextGraphic@DirectUI@@UEAA@XZ	458	0x14001d83c
??1Thumb@DirectUI@@UEAA@XZ	459	0x140029654
??1ToggleProvider@DirectUI@@UEAA@XZ	460	0x14003202c
??1TouchButton@DirectUI@@UEAA@XZ	461	0x14002ff64
??1TouchCheckBox@DirectUI@@UEAA@XZ	462	0x140004094
??1TouchCheckBoxGlyph@DirectUI@@UEAA@XZ	463	0x14002ea18
??1TouchHWNDElement@DirectUI@@UEAA@XZ	464	0x140004d0c
??1TouchHyperLink@DirectUI@@UEAA@XZ	465	0x14001c198
??1TouchScrollBar@DirectUI@@UEAA@XZ	466	0x1400387c4
??1TouchSelect@DirectUI@@UEAA@XZ	467	0x14000f6cc
??1TouchSelectItem@DirectUI@@UEAA@XZ	468	0x14002ae38
??1UnknownElement@DirectUI@@UEAA@XZ	469	0x140037428
??1ValueProvider@DirectUI@@UEAA@XZ	470	0x14000cc84
??1VerticalFlowLayout@DirectUI@@UEAA@XZ	471	0x14002a32c
??1Viewer@DirectUI@@UEAA@XZ	472	0x140001274
??1XBaby@DirectUI@@UEAA@XZ	473	0x14002b454
??1XElement@DirectUI@@UEAA@XZ	474	0x140010d04
??1XHost@DirectUI@@QEAA@XZ	475	0x140032d98
??1XProvider@DirectUI@@UEAA@XZ	476	0x14000bba4
??4?$FunctionDefinition@H@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	477	0x14001e720
??4?$FunctionDefinition@H@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	478	0x140015c4c
??4?$FunctionDefinition@K@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	479	0x140014628
??4?$FunctionDefinition@K@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	480	0x14000f2ac
??4?$FunctionDefinition@PEAVValue@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	481	0x14003b730
??4?$FunctionDefinition@PEAVValue@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	482	0x14003f35c
??4?$FunctionDefinition@UScaledRECT@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	483	0x14000d270
??4?$FunctionDefinition@UScaledRECT@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	484	0x14002f83c
??4?$FunctionDefinition@UScaledSIZE@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	485	0x140031df8
??4?$FunctionDefinition@UScaledSIZE@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	486	0x14000d160
??4ACCESSIBLEROLE@AccessibleButton@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	487	0x14000db90
??4ACCESSIBLEROLE@AccessibleButton@DirectUI@@QEAAAEAU012@AEBU012@@Z	488	0x14002069c
??4AccessibleButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	489	0x14003aaa0
??4AccessibleButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	490	0x14003488c
??4AnimationStrip@DirectUI@@QEAAAEAV01@AEBV01@@Z	491	0x14001afec
??4AutoButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	492	0x14003023c
??4AutoButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	493	0x1400172d0
??4AutoLock@DirectUI@@QEAAAEAV01@AEBV01@@Z	494	0x14002b8e0
??4AutoThread@DirectUI@@QEAAAEAV01@AEBV01@@Z	495	0x140013484
??4AutoVariant@DirectUI@@QEAAAEAV01@AEBV01@@Z	496	0x140020528
??4BaseScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	497	0x14003dd94
??4BaseScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	498	0x140010688
??4BaseScrollViewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	499	0x140021cec
??4Bind@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	500	0x140007754
??4Bind@DirectUI@@QEAAAEAV01@AEBV01@@Z	501	0x14001f870
??4BorderLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	502	0x14000e970
??4Browser@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	503	0x1400159b4
??4Browser@DirectUI@@QEAAAEAV01@AEBV01@@Z	504	0x140025dbc
??4BrowserSelectionProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	505	0x14002b90c
??4BrowserSelectionProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	506	0x14003e0c0
??4Button@DirectUI@@QEAAAEAV01@AEBV01@@Z	507	0x140003cf8
??4CCAVI@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	508	0x140022738
??4CCAVI@DirectUI@@QEAAAEAV01@AEBV01@@Z	509	0x14001cde4
??4CCBase@DirectUI@@QEAAAEAV01@AEBV01@@Z	510	0x14002fd34
??4CCBaseCheckRadioButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	511	0x140010bc4
??4CCBaseCheckRadioButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	512	0x140013788
??4CCBaseScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	513	0x140014838
??4CCBaseScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	514	0x14003e094
??4CCCheckBox@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	515	0x14002ca68
??4CCCheckBox@DirectUI@@QEAAAEAV01@AEBV01@@Z	516	0x14001cc18
??4CCCommandLink@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	517	0x1400206d8
??4CCCommandLink@DirectUI@@QEAAAEAV01@AEBV01@@Z	518	0x140005eac
??4CCHScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	519	0x14001d144
??4CCHScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	520	0x14002ae9c
??4CCListBox@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	521	0x1400192d4
??4CCListBox@DirectUI@@QEAAAEAV01@AEBV01@@Z	522	0x140002e58
??4CCListView@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	523	0x14001fc40
??4CCListView@DirectUI@@QEAAAEAV01@AEBV01@@Z	524	0x140004b98
??4CCProgressBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	525	0x1400362a4
??4CCProgressBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	526	0x1400176bc
??4CCPushButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	527	0x14002f66c
??4CCPushButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	528	0x140040298
??4CCRadioButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	529	0x14000d840
??4CCRadioButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	530	0x14002e53c
??4CCSysLink@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	531	0x14000ec70
??4CCSysLink@DirectUI@@QEAAAEAV01@AEBV01@@Z	532	0x14000c9bc
??4CCTrackBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	533	0x140008b84
??4CCTrackBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	534	0x140024138
??4CCTreeView@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	535	0x14003f60c
??4CCTreeView@DirectUI@@QEAAAEAV01@AEBV01@@Z	536	0x14003bcf4
??4CCVScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	537	0x140004964
??4CCVScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	538	0x140009d14
??4CallstackTracker@DirectUI@@QEAAAEAV01@AEBV01@@Z	539	0x1400202a0
??4CheckBoxGlyph@DirectUI@@QEAAAEAV01@AEBV01@@Z	540	0x14000aa1c
??4ClassInfoBase@DirectUI@@QEAAAEAV01@AEBV01@@Z	541	0x140006294
??4Clipper@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	542	0x140032984
??4Clipper@DirectUI@@QEAAAEAV01@AEBV01@@Z	543	0x14003f67c
??4Combobox@DirectUI@@QEAAAEAV01@AEBV01@@Z	544	0x14000ca74
??4CritSecLock@DirectUI@@QEAAAEAV01@AEBV01@@Z	545	0x1400287dc
??4DCSurface@DirectUI@@QEAAAEAV01@AEBV01@@Z	546	0x140009108
??4DUIFactory@DirectUI@@QEAAAEAV01@AEBV01@@Z	547	0x140028de8
??4DUIXmlParser@DirectUI@@QEAAAEAV01@AEBV01@@Z	548	0x140015ab8
??4DialogElement@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	549	0x140009d08
??4DialogElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	550	0x14003915c
??4DialogElementCore@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	551	0x1400059ec
??4DialogElementCore@DirectUI@@QEAAAEAV01@AEBV01@@Z	552	0x14002c758
??4DuiNavigate@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	553	0x14001c768
??4DuiNavigate@DirectUI@@QEAAAEAV01@AEBV01@@Z	554	0x1400068e4
??4Edit@DirectUI@@QEAAAEAV01@AEBV01@@Z	555	0x14002f720
??4Element@DirectUI@@QEAAAEAV01@AEBV01@@Z	556	0x14000ea88
??4ElementProviderManager@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	557	0x14002c4c0
??4ElementProviderManager@DirectUI@@QEAAAEAV01@AEBV01@@Z	558	0x14001d970
??4ElementProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	559	0x140033b3c
??4ElementProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	560	0x14002759c
??4ElementWithHWND@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	561	0x14002a8f4
??4ElementWithHWND@DirectUI@@QEAAAEAV01@AEBV01@@Z	562	0x1400074f4
??4EventManager@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	563	0x14001c230
??4EventManager@DirectUI@@QEAAAEAV01@AEBV01@@Z	564	0x1400384fc
??4ExpandCollapseProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	565	0x1400170e0
??4ExpandCollapseProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	566	0x14001d880
??4Expandable@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	567	0x1400232c4
??4Expandable@DirectUI@@QEAAAEAV01@AEBV01@@Z	568	0x140008474
??4Expando@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	569	0x1400086c0
??4Expando@DirectUI@@QEAAAEAV01@AEBV01@@Z	570	0x14000ab88
??4ExpandoButtonGlyph@DirectUI@@QEAAAEAV01@AEBV01@@Z	571	0x140027b60
??4Expression@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	572	0x140025774
??4Expression@DirectUI@@QEAAAEAV01@AEBV01@@Z	573	0x14000742c
??4FillLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	574	0x140001284
??4FlowLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	575	0x1400306ac
??4FontCache@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	576	0x140011c7c
??4FontCache@DirectUI@@QEAAAEAV01@AEBV01@@Z	577	0x140013f0c
??4FontCheckOut@DirectUI@@QEAAAEAV01@AEBV01@@Z	578	0x140016f74
??4GridItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	579	0x140001d78
??4GridItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	580	0x140005bbc
??4GridLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	581	0x1400045a8
??4GridProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	582	0x140017b78
??4GridProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	583	0x14000ee10
??4HWNDElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	584	0x14002409c
??4HWNDElementProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	585	0x14002ea70
??4HWNDElementProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	586	0x140035d90
??4HWNDHost@DirectUI@@QEAAAEAV01@AEBV01@@Z	587	0x14001a568
??4IDataEngine@DirectUI@@QEAAAEAU01@AEBU01@@Z	588	0x1400044c8
??4IDataEntry@DirectUI@@QEAAAEAU01@AEBU01@@Z	589	0x140035c8c
??4IProvider@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	590	0x140032714
??4IProvider@DirectUI@@QEAAAEAV01@AEBV01@@Z	591	0x140008068
??4ISBLeak@DirectUI@@QEAAAEAU01@$$QEAU01@@Z	592	0x140034c8c
??4ISBLeak@DirectUI@@QEAAAEAU01@AEBU01@@Z	593	0x1400132f4
??4IXElementCP@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	594	0x140009ac4
??4IXElementCP@DirectUI@@QEAAAEAV01@AEBV01@@Z	595	0x14002d668
??4IXProviderCP@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	596	0x140008e74
??4IXProviderCP@DirectUI@@QEAAAEAV01@AEBV01@@Z	597	0x140013300
??4InvokeManager@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	598	0x140026188
??4InvokeManager@DirectUI@@QEAAAEAV01@AEBV01@@Z	599	0x14002c8b0
??4InvokeProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	600	0x14000dce0
??4InvokeProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	601	0x14003dcd8
??4Layout@DirectUI@@QEAAAEAV01@AEBV01@@Z	602	0x14000bb00
??4LinkedList@DirectUI@@QEAAAEAV01@AEBV01@@Z	603	0x14000c33c
??4LinkedListNode@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	604	0x140026c28
??4LinkedListNode@DirectUI@@QEAAAEAV01@AEBV01@@Z	605	0x14002efac
??4Macro@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	606	0x140035a84
??4Macro@DirectUI@@QEAAAEAV01@AEBV01@@Z	607	0x1400088ac
??4ModernProgressBarRangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	608	0x140032018
??4ModernProgressBarRangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	609	0x140035158
??4Movie@DirectUI@@QEAAAEAV01@AEBV01@@Z	610	0x140032ed4
??4NativeHWNDHost@DirectUI@@QEAAAEAV01@AEBV01@@Z	611	0x1400385a8
??4NavReference@DirectUI@@QEAAAEAU01@$$QEAU01@@Z	612	0x140012fd8
??4NavReference@DirectUI@@QEAAAEAU01@AEBU01@@Z	613	0x14002b198
??4NavScoring@DirectUI@@QEAAAEAU01@$$QEAU01@@Z	614	0x140036810
??4NavScoring@DirectUI@@QEAAAEAU01@AEBU01@@Z	615	0x14000f248
??4Navigator@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	616	0x140010ad4
??4Navigator@DirectUI@@QEAAAEAV01@AEBV01@@Z	617	0x1400322fc
??4NavigatorSelectionItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	618	0x140013e28
??4NavigatorSelectionItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	619	0x1400028c8
??4NineGridLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	620	0x1400113b8
??4PText@DirectUI@@QEAAAEAV01@AEBV01@@Z	621	0x14003f24c
??4PVLAnimation@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	622	0x14001638c
??4PVLAnimation@DirectUI@@QEAAAEAV01@AEBV01@@Z	623	0x14003c7c4
??4Page@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	624	0x140039c18
??4Page@DirectUI@@QEAAAEAV01@AEBV01@@Z	625	0x140034958
??4Pages@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	626	0x140012114
??4Pages@DirectUI@@QEAAAEAV01@AEBV01@@Z	627	0x140023528
??4Progress@DirectUI@@QEAAAEAV01@AEBV01@@Z	628	0x1400119fc
??4ProgressRangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	629	0x14002792c
??4ProgressRangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	630	0x1400332dc
??4ProviderProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	631	0x14000fb4c
??4ProviderProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	632	0x140019d98
??4Proxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	633	0x14003b020
??4PushButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	634	0x1400401b0
??4PushButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	635	0x140031c24
??4RadioButtonGlyph@DirectUI@@QEAAAEAV01@AEBV01@@Z	636	0x140002960
??4RangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	637	0x14003e444
??4RangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	638	0x1400184c0
??4RefPointElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	639	0x140020d44
??4RepeatButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	640	0x14002149c
??4Repeater@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	641	0x14000709c
??4Repeater@DirectUI@@QEAAAEAV01@AEBV01@@Z	642	0x140011294
??4ResourceModuleHandles@DirectUI@@QEAAAEAV01@AEBV01@@Z	643	0x14001f29c
??4RowLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	644	0x140030658
??4Schema@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	645	0x14001bfb4
??4Schema@DirectUI@@QEAAAEAV01@AEBV01@@Z	646	0x14002a298
??4ScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	647	0x140013514
??4ScrollBarRangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	648	0x140038508
??4ScrollBarRangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	649	0x14000ae8c
??4ScrollItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	650	0x14002a5e8
??4ScrollItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	651	0x140028950
??4ScrollProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	652	0x14001526c
??4ScrollProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	653	0x140039f98
??4ScrollViewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	654	0x14003f1c8
??4SelectionItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	655	0x140033fe8
??4SelectionItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	656	0x1400083d8
??4SelectionProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	657	0x140035450
??4SelectionProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	658	0x14001a518
??4Selector@DirectUI@@QEAAAEAV01@AEBV01@@Z	659	0x14000db48
??4SelectorNoDefault@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	660	0x140002d7c
??4SelectorNoDefault@DirectUI@@QEAAAEAV01@AEBV01@@Z	661	0x14001ce5c
??4SelectorSelectionItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	662	0x140017d78
??4SelectorSelectionItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	663	0x140036ecc
??4SelectorSelectionProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	664	0x14000b12c
??4SelectorSelectionProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	665	0x1400362d4
??4ShellBorderLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	666	0x14001332c
??4StyleSheet@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	667	0x14002b4f8
??4StyleSheet@DirectUI@@QEAAAEAV01@AEBV01@@Z	668	0x1400160b0
??4StyledScrollViewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	669	0x1400294c4
??4Surface@DirectUI@@QEAAAEAV01@AEBV01@@Z	670	0x140017cb0
??4TableItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	671	0x14000dd78
??4TableItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	672	0x14000a818
??4TableLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	673	0x14000cf5c
??4TableProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	674	0x14003f5e4
??4TableProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	675	0x14003a990
??4TaskPage@DirectUI@@QEAAAEAV01@AEBV01@@Z	676	0x14002ebdc
??4TextGraphic@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	677	0x14000bb34
??4TextGraphic@DirectUI@@QEAAAEAV01@AEBV01@@Z	678	0x1400335b8
??4Thumb@DirectUI@@QEAAAEAV01@AEBV01@@Z	679	0x1400049d8
??4ToggleProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	680	0x140015d2c
??4ToggleProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	681	0x14003ad18
??4UnknownElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	682	0x14000ebb0
??4Value@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	683	0x140013c14
??4Value@DirectUI@@QEAAAEAV01@AEBV01@@Z	684	0x1400030d4
??4ValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	685	0x14002b4c4
??4ValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	686	0x14003ac24
??4VerticalFlowLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	687	0x14002ce84
??4Viewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	688	0x1400233a8
??4XBaby@DirectUI@@QEAAAEAV01@AEBV01@@Z	689	0x140023198
??4XElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	690	0x14000387c
??4XHost@DirectUI@@QEAAAEAV01@AEBV01@@Z	691	0x140027e44
??4XProvider@DirectUI@@QEAAAEAV01@AEBV01@@Z	692	0x140017d6c
??4XResourceProvider@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	693	0x140006a14
??4XResourceProvider@DirectUI@@QEAAAEAV01@AEBV01@@Z	694	0x140029f00
??B?$SafeArrayAccessor@H@DirectUI@@QEAAPEAHXZ	695	0x140040434
??BTaskPage@DirectUI@@QEAAPEAU_PSP@@XZ	696	0x1400293e0
??_7?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@6BIProvider@1@@	697	0x140005350
??_7?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@6BRefcountBase@1@@	698	0x140037d60
??_7?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@6BIProvider@1@@	699	0x14003cc58
??_7?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@6BRefcountBase@1@@	700	0x1400290b4
??_7?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@6BIProvider@1@@	701	0x14001541c
??_7?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@6BRefcountBase@1@@	702	0x140008af8
??_7?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@6BIProvider@1@@	703	0x140030a24
??_7?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@6BRefcountBase@1@@	704	0x14002dcb4
??_7?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@6BIProvider@1@@	705	0x140035e84
??_7?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@6BRefcountBase@1@@	706	0x14001fc4c
??_7?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@6BIProvider@1@@	707	0x14001b238
??_7?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@6BRefcountBase@1@@	708	0x14002e880
??_7?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@6BIProvider@1@@	709	0x140037ff4
??_7?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@6BRefcountBase@1@@	710	0x14001bad8
??_7?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@6BIProvider@1@@	711	0x140036670
??_7?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@6BRefcountBase@1@@	712	0x140014a64
??_7?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@6BIProvider@1@@	713	0x140019c90
??_7?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@6BRefcountBase@1@@	714	0x14000d444
??_7?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@6BIProvider@1@@	715	0x14002dc78
??_7?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@6BRefcountBase@1@@	716	0x14000ea30
??_7?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@6BIProvider@1@@	717	0x1400018b8
??_7?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@6BRefcountBase@1@@	718	0x14003826c
??_7?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@6BIProvider@1@@	719	0x14001d44c
??_7?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@6BRefcountBase@1@@	720	0x14002e318
??_7?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@6BIProvider@1@@	721	0x14001f550
??_7?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@6BRefcountBase@1@@	722	0x14000e630
??_7AccessibleButton@DirectUI@@6B@	723	0x14001b878
??_7AnimationStrip@DirectUI@@6B@	724	0x14003e3a4
??_7AutoButton@DirectUI@@6B@	725	0x1400079d0
??_7BaseScrollBar@DirectUI@@6B@	726	0x140001eb8
??_7BaseScrollViewer@DirectUI@@6BElement@1@@	727	0x140040c5c
??_7BaseScrollViewer@DirectUI@@6BIElementListener@1@@	728	0x140041784
??_7Bind@DirectUI@@6B@	729	0x14003b268
??_7BorderLayout@DirectUI@@6B@	730	0x14003a204
??_7Browser@DirectUI@@6B@	731	0x14002453c
??_7BrowserSelectionProxy@DirectUI@@6B@	732	0x140023874
??_7Button@DirectUI@@6B@	733	0x140024ae0
??_7CCAVI@DirectUI@@6B@	734	0x14002fd7c
??_7CCBase@DirectUI@@6B@	735	0x14002d788
??_7CCBaseCheckRadioButton@DirectUI@@6B@	736	0x140005750
??_7CCBaseScrollBar@DirectUI@@6BBaseScrollBar@1@@	737	0x14001938c
??_7CCBaseScrollBar@DirectUI@@6BCCBase@1@@	738	0x14003c6e8
??_7CCCheckBox@DirectUI@@6B@	739	0x14003c938
??_7CCCommandLink@DirectUI@@6B@	740	0x14000f17c
??_7CCHScrollBar@DirectUI@@6BBaseScrollBar@1@@	741	0x14003374c
??_7CCHScrollBar@DirectUI@@6BCCBase@1@@	742	0x14001bd20
??_7CCListBox@DirectUI@@6B@	743	0x14001ad40
??_7CCListView@DirectUI@@6B@	744	0x140029d00
??_7CCProgressBar@DirectUI@@6B@	745	0x140022034
??_7CCPushButton@DirectUI@@6B@	746	0x140031ce8
??_7CCRadioButton@DirectUI@@6B@	747	0x14002dfa8
??_7CCSysLink@DirectUI@@6B@	748	0x140031a58
??_7CCTrackBar@DirectUI@@6B@	749	0x140032334
??_7CCTreeView@DirectUI@@6B@	750	0x14002b8b4
??_7CCVScrollBar@DirectUI@@6BBaseScrollBar@1@@	751	0x14002feec
??_7CCVScrollBar@DirectUI@@6BCCBase@1@@	752	0x14003f428
??_7CheckBoxGlyph@DirectUI@@6B@	753	0x140009c20
??_7ClassInfoBase@DirectUI@@6B@	754	0x14001840c
??_7Clipper@DirectUI@@6B@	755	0x14000d5d8
??_7Combobox@DirectUI@@6B@	756	0x140024504
??_7DCSurface@DirectUI@@6B@	757	0x1400091fc
??_7DUIXmlParser@DirectUI@@6B@	758	0x14000726c
??_7DialogElement@DirectUI@@6BHWNDElement@1@@	759	0x140023310
??_7DialogElement@DirectUI@@6BIDialogElement@1@@	760	0x140013d78
??_7DialogElement@DirectUI@@6BIElementListener@1@@	761	0x14002e244
??_7DuiAccessible@DirectUI@@6BIAccIdentity@@@	762	0x14002176c
??_7DuiAccessible@DirectUI@@6BIAccessible@@@	763	0x140011f90
??_7DuiAccessible@DirectUI@@6BIEnumVARIANT@@@	764	0x140041350
??_7DuiAccessible@DirectUI@@6BIOleWindow@@@	765	0x14001b444
??_7DuiAccessible@DirectUI@@6BIServiceProvider@@@	766	0x14002a9e4
??_7Edit@DirectUI@@6B@	767	0x14001222c
??_7Element@DirectUI@@6B@	768	0x14003e550
??_7ElementProvider@DirectUI@@6BIRawElementProviderAdviseEvents@@@	769	0x14002b5e4
??_7ElementProvider@DirectUI@@6BIRawElementProviderFragment@@@	770	0x14000a8d0
??_7ElementProvider@DirectUI@@6BIRawElementProviderSimple2@@@	771	0x140026038
??_7ElementProvider@DirectUI@@6BRefcountBase@1@@	772	0x14000372c
??_7ElementWithHWND@DirectUI@@6B@	773	0x14002c678
??_7ExpandCollapseProvider@DirectUI@@6B@	774	0x1400189f0
??_7ExpandCollapseProvider@DirectUI@@6BIProvider@1@@	775	0x14003c308
??_7ExpandCollapseProvider@DirectUI@@6BRefcountBase@1@@	776	0x140024f78
??_7ExpandCollapseProxy@DirectUI@@6B@	777	0x1400120b4
??_7Expandable@DirectUI@@6B@	778	0x14001dfd4
??_7Expando@DirectUI@@6B@	779	0x140015070
??_7ExpandoButtonGlyph@DirectUI@@6B@	780	0x14002970c
??_7FillLayout@DirectUI@@6B@	781	0x140030a20
??_7FlowLayout@DirectUI@@6B@	782	0x14003d2f4
??_7FontCache@DirectUI@@6B@	783	0x140020dfc
??_7GridItemProvider@DirectUI@@6B@	784	0x140035f88
??_7GridItemProvider@DirectUI@@6BIProvider@1@@	785	0x14000d800
??_7GridItemProvider@DirectUI@@6BRefcountBase@1@@	786	0x140027ecc
??_7GridItemProxy@DirectUI@@6B@	787	0x14000be2c
??_7GridLayout@DirectUI@@6B@	788	0x140037bc4
??_7GridProvider@DirectUI@@6B@	789	0x14002f0d0
??_7GridProvider@DirectUI@@6BIProvider@1@@	790	0x140032824
??_7GridProvider@DirectUI@@6BRefcountBase@1@@	791	0x140037b48
??_7GridProxy@DirectUI@@6B@	792	0x14001efb8
??_7HWNDElement@DirectUI@@6B@	793	0x140014d84
??_7HWNDElementAccessible@DirectUI@@6BIAccIdentity@@@	794	0x140040d1c
??_7HWNDElementAccessible@DirectUI@@6BIAccessible@@@	795	0x1400137f4
??_7HWNDElementAccessible@DirectUI@@6BIEnumVARIANT@@@	796	0x140028578
??_7HWNDElementAccessible@DirectUI@@6BIOleWindow@@@	797	0x140027d40
??_7HWNDElementAccessible@DirectUI@@6BIServiceProvider@@@	798	0x140040634
??_7HWNDElementProvider@DirectUI@@6B@	799	0x140041174
??_7HWNDElementProvider@DirectUI@@6BIRawElementProviderAdviseEvents@@@	800	0x140019af8
??_7HWNDElementProvider@DirectUI@@6BIRawElementProviderFragment@@@	801	0x140025550
??_7HWNDElementProvider@DirectUI@@6BIRawElementProviderSimple2@@@	802	0x14003dc00
??_7HWNDElementProvider@DirectUI@@6BRefcountBase@1@@	803	0x14000e76c
??_7HWNDHost@DirectUI@@6B@	804	0x14002a474
??_7HWNDHostAccessible@DirectUI@@6BIAccIdentity@@@	805	0x140026f8c
??_7HWNDHostAccessible@DirectUI@@6BIAccessible@@@	806	0x14000e31c
??_7HWNDHostAccessible@DirectUI@@6BIEnumVARIANT@@@	807	0x14000e6a4
??_7HWNDHostAccessible@DirectUI@@6BIOleWindow@@@	808	0x1400134c4
??_7HWNDHostAccessible@DirectUI@@6BIServiceProvider@@@	809	0x1400158cc
??_7HWNDHostClientAccessible@DirectUI@@6BIAccIdentity@@@	810	0x1400199d4
??_7HWNDHostClientAccessible@DirectUI@@6BIAccessible@@@	811	0x14003c3fc
??_7HWNDHostClientAccessible@DirectUI@@6BIEnumVARIANT@@@	812	0x1400038e0
??_7HWNDHostClientAccessible@DirectUI@@6BIOleWindow@@@	813	0x140030380
??_7HWNDHostClientAccessible@DirectUI@@6BIServiceProvider@@@	814	0x140039b9c
??_7IDataEngine@DirectUI@@6B@	815	0x14000fa9c
??_7IDataEntry@DirectUI@@6B@	816	0x140025f98
??_7ISBLeak@DirectUI@@6B@	817	0x1400381f4
??_7IXElementCP@DirectUI@@6B@	818	0x140015150
??_7IXProviderCP@DirectUI@@6B@	819	0x140032ef4
??_7InvokeHelper@DirectUI@@6B@	820	0x140034894
??_7InvokeProvider@DirectUI@@6B@	821	0x140016fc0
??_7InvokeProvider@DirectUI@@6BIProvider@1@@	822	0x14001e39c
??_7InvokeProvider@DirectUI@@6BRefcountBase@1@@	823	0x140032cc8
??_7InvokeProxy@DirectUI@@6B@	824	0x140018234
??_7Layout@DirectUI@@6B@	825	0x14000a360
??_7Macro@DirectUI@@6B@	826	0x1400176ec
??_7ModernProgressBarRangeValueProxy@DirectUI@@6B@	827	0x14001fce8
??_7Movie@DirectUI@@6B@	828	0x14000a2f8
??_7NativeHWNDHost@DirectUI@@6B@	829	0x140023f88
??_7Navigator@DirectUI@@6B@	830	0x140006574
??_7NavigatorSelectionItemProxy@DirectUI@@6B@	831	0x14002d874
??_7NineGridLayout@DirectUI@@6B@	832	0x14002ca58
??_7PText@DirectUI@@6B@	833	0x1400133d0
??_7Page@DirectUI@@6B@	834	0x140040248
??_7Pages@DirectUI@@6B@	835	0x140039210
??_7Progress@DirectUI@@6B@	836	0x14000be84
??_7ProgressRangeValueProxy@DirectUI@@6B@	837	0x14002e590
??_7Proxy@DirectUI@@6B@	838	0x140021f0c
??_7PushButton@DirectUI@@6B@	839	0x14003ce4c
??_7RadioButtonGlyph@DirectUI@@6B@	840	0x14002f6d4
??_7RangeValueProvider@DirectUI@@6B@	841	0x140006758
??_7RangeValueProvider@DirectUI@@6BIProvider@1@@	842	0x14003101c
??_7RangeValueProvider@DirectUI@@6BRefcountBase@1@@	843	0x140006e38
??_7RangeValueProxy@DirectUI@@6B@	844	0x140001bc4
??_7RefPointElement@DirectUI@@6B@	845	0x140032018
??_7RefcountBase@DirectUI@@6B@	846	0x140025f10
??_7RepeatButton@DirectUI@@6B@	847	0x1400301c4
??_7Repeater@DirectUI@@6B@	848	0x140020678
??_7RowLayout@DirectUI@@6B@	849	0x140033580
??_7ScrollBar@DirectUI@@6BBaseScrollBar@1@@	850	0x140041070
??_7ScrollBar@DirectUI@@6BElement@1@@	851	0x14002e3a8
??_7ScrollBarRangeValueProxy@DirectUI@@6B@	852	0x14003ed24
??_7ScrollItemProvider@DirectUI@@6B@	853	0x140038104
??_7ScrollItemProvider@DirectUI@@6BIProvider@1@@	854	0x140003354
??_7ScrollItemProvider@DirectUI@@6BRefcountBase@1@@	855	0x14002325c
??_7ScrollItemProxy@DirectUI@@6B@	856	0x140032ad8
??_7ScrollProvider@DirectUI@@6B@	857	0x140020670
??_7ScrollProvider@DirectUI@@6BIProvider@1@@	858	0x1400214d0
??_7ScrollProvider@DirectUI@@6BRefcountBase@1@@	859	0x14000786c
??_7ScrollProxy@DirectUI@@6B@	860	0x1400344e4
??_7ScrollViewer@DirectUI@@6BElement@1@@	861	0x14001a540
??_7ScrollViewer@DirectUI@@6BIElementListener@1@@	862	0x140032884
??_7SelectionItemProvider@DirectUI@@6B@	863	0x140040b3c
??_7SelectionItemProvider@DirectUI@@6BIProvider@1@@	864	0x140030834
??_7SelectionItemProvider@DirectUI@@6BRefcountBase@1@@	865	0x14003106c
??_7SelectionItemProxy@DirectUI@@6B@	866	0x140020ad0
??_7SelectionProvider@DirectUI@@6B@	867	0x14001f7a8
??_7SelectionProvider@DirectUI@@6BIProvider@1@@	868	0x140037d8c
??_7SelectionProvider@DirectUI@@6BRefcountBase@1@@	869	0x140022580
??_7SelectionProxy@DirectUI@@6B@	870	0x14003eab4
??_7Selector@DirectUI@@6B@	871	0x140036e6c
??_7SelectorNoDefault@DirectUI@@6B@	872	0x14002d6b0
??_7SelectorSelectionItemProxy@DirectUI@@6B@	873	0x1400097fc
??_7SelectorSelectionProxy@DirectUI@@6B@	874	0x14001aaf0
??_7ShellBorderLayout@DirectUI@@6B@	875	0x14003dce0
??_7StyleSheet@DirectUI@@6B@	876	0x140014e60
??_7StyledScrollViewer@DirectUI@@6BElement@1@@	877	0x1400215b4
??_7StyledScrollViewer@DirectUI@@6BIElementListener@1@@	878	0x1400066b8
??_7Surface@DirectUI@@6B@	879	0x14003bdec
??_7TableItemProvider@DirectUI@@6B@	880	0x1400332b0
??_7TableItemProvider@DirectUI@@6BIProvider@1@@	881	0x14003ae70
??_7TableItemProvider@DirectUI@@6BRefcountBase@1@@	882	0x140009b48
??_7TableItemProxy@DirectUI@@6B@	883	0x14001e06c
??_7TableLayout@DirectUI@@6B@	884	0x14003847c
??_7TableProvider@DirectUI@@6B@	885	0x14000e6e8
??_7TableProvider@DirectUI@@6BIProvider@1@@	886	0x14003d8b8
??_7TableProvider@DirectUI@@6BRefcountBase@1@@	887	0x14001b410
??_7TableProxy@DirectUI@@6B@	888	0x14001ebd4
??_7TaskPage@DirectUI@@6BIElementListener@1@@	889	0x14003828c
??_7TaskPage@DirectUI@@6BIXProviderCP@1@@	890	0x140031254
??_7TextGraphic@DirectUI@@6B@	891	0x140003794
??_7Thumb@DirectUI@@6B@	892	0x140032a90
??_7ToggleProvider@DirectUI@@6B@	893	0x140014070
??_7ToggleProvider@DirectUI@@6BIProvider@1@@	894	0x140008898
??_7ToggleProvider@DirectUI@@6BRefcountBase@1@@	895	0x140006750
??_7ToggleProxy@DirectUI@@6B@	896	0x14000ef98
??_7UnknownElement@DirectUI@@6B@	897	0x14001a2dc
??_7ValueProvider@DirectUI@@6B@	898	0x14003d0a0
??_7ValueProvider@DirectUI@@6BIProvider@1@@	899	0x140009f24
??_7ValueProvider@DirectUI@@6BRefcountBase@1@@	900	0x140002e3c
??_7ValueProxy@DirectUI@@6B@	901	0x140026e58
??_7VerticalFlowLayout@DirectUI@@6B@	902	0x14004108c
??_7Viewer@DirectUI@@6B@	903	0x140025c38
??_7XBaby@DirectUI@@6B@	904	0x140003a38
??_7XBaby@DirectUI@@6BHWNDElement@1@@	905	0x14002ff94
??_7XBaby@DirectUI@@6BIDialogElement@1@@	906	0x140020d28
??_7XBaby@DirectUI@@6BIElementListener@1@@	907	0x14002d94c
??_7XElement@DirectUI@@6BHWNDHost@1@@	908	0x14001134c
??_7XElement@DirectUI@@6BIXElementCP@1@@	909	0x14001d0e0
??_7XProvider@DirectUI@@6B@	910	0x14003569c
??_7XResourceProvider@DirectUI@@6B@	911	0x14003c124
??_FCCBase@DirectUI@@QEAAXXZ	912	0x140026c18
??_FCCBaseScrollBar@DirectUI@@QEAAXXZ	913	0x14000e810
??_FCCCheckBox@DirectUI@@QEAAXXZ	914	0x14001c2e0
??_FCCCommandLink@DirectUI@@QEAAXXZ	915	0x140012a20
??_FCCPushButton@DirectUI@@QEAAXXZ	916	0x140020c4c
??_FCCTreeView@DirectUI@@QEAAXXZ	917	0x14001193c
?AbsorbsShortcutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	918	0x14000a200
?AccDefActionProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	919	0x14002eb00
?AccDescProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	920	0x14001c5f0
?AccHelpProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	921	0x140036740
?AccItemStatusProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	922	0x140024898
?AccItemTypeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	923	0x14002753c
?AccNameProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	924	0x14003add4
?AccNavigate@DuiAccessible@DirectUI@@SAJPEAVElement@2@JPEAPEAV32@@Z	925	0x140029c9c
?AccRoleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	926	0x140041328
?AccStateProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	927	0x1400361d4
?AccValueProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	928	0x140022980
?AcceleratorKeyProperty@Schema@DirectUI@@2HA	929	0x14001c468
?Access@?$SafeArrayAccessor@H@DirectUI@@QEAAJPEAUtagSAFEARRAY@@G@Z	930	0x140041254
?AccessKeyProperty@Schema@DirectUI@@2HA	931	0x14000b5f0
?AccessibleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	932	0x140007284
?ActionInitiated@Navigator@DirectUI@@SA?AVUID@@XZ	933	0x14003b328
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z	934	0x14002a958
?ActivateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z	935	0x140015f28
?ActivateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z	936	0x140001cf4
?ActiveProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	937	0x140003a5c
?ActiveStateChanged@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	938	0x14002630c
?ActualReferencePointProp@RefPointElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	939	0x1400037c0
?Add@BaseScrollViewer@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	940	0x140012560
?Add@Element@DirectUI@@QEAAJPEAV12@@Z	941	0x140029a98
?Add@Element@DirectUI@@QEAAJPEAV12@P6AHPEBX1@Z@Z	942	0x14000ecf0
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z	943	0x14000ef30
?Add@ElementProviderManager@DirectUI@@SAJPEAVElementProvider@2@@Z	944	0x140011128
?Add@Expando@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	945	0x14000aaac
?Add@LinkedList@DirectUI@@QEAAXPEAVLinkedListNode@2@@Z	946	0x1400036dc
?Add@Macro@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	947	0x1400395c4
?Add@Pages@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	948	0x14001c4cc
?Add@TouchEdit2@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	949	0x140026c1c
?Add@TouchSelect@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	950	0x14002178c
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z	951	0x14003dfdc
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ	952	0x1400297f4
?AddChildren@ScrollViewer@DirectUI@@MEAAJXZ	953	0x14002cfac
?AddChildren@StyledScrollViewer@DirectUI@@MEAAJXZ	954	0x140030d08
?AddElement@TouchSelect@DirectUI@@QEAAJPEAVElement@2@PEBG@Z	955	0x14001e3a4
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z	956	0x14002246c
?AddRectangleChange@EventManager@DirectUI@@CAJPEAVElement@2@_N1@Z	957	0x140035bfc
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ	958	0x140007570
?AddRef@DuiAccessible@DirectUI@@UEAAKXZ	959	0x14001e21c
?AddRef@Element@DirectUI@@QEAAKXZ	960	0x14001e61c
?AddRef@ElementProvider@DirectUI@@UEAAKXZ	961	0x140005004
?AddRef@ExpandCollapseProvider@DirectUI@@UEAAKXZ	962	0x14001fff8
?AddRef@GridItemProvider@DirectUI@@UEAAKXZ	963	0x140027a40
?AddRef@GridProvider@DirectUI@@UEAAKXZ	964	0x140021584
?AddRef@HWNDElementProvider@DirectUI@@UEAAKXZ	965	0x14002c52c
?AddRef@InvokeProvider@DirectUI@@UEAAKXZ	966	0x1400259b4
?AddRef@RangeValueProvider@DirectUI@@UEAAKXZ	967	0x140040d74
?AddRef@RefcountBase@DirectUI@@QEAAJXZ	968	0x140023864
?AddRef@ScrollItemProvider@DirectUI@@UEAAKXZ	969	0x14001c5cc
?AddRef@ScrollProvider@DirectUI@@UEAAKXZ	970	0x140006f10
?AddRef@SelectionItemProvider@DirectUI@@UEAAKXZ	971	0x140021b74
?AddRef@SelectionProvider@DirectUI@@UEAAKXZ	972	0x14000d158
?AddRef@TableItemProvider@DirectUI@@UEAAKXZ	973	0x140031ec4
?AddRef@TableProvider@DirectUI@@UEAAKXZ	974	0x14003e27c
?AddRef@ToggleProvider@DirectUI@@UEAAKXZ	975	0x140029614
?AddRef@Value@DirectUI@@QEAAXXZ	976	0x1400063fc
?AddRef@ValueProvider@DirectUI@@UEAAKXZ	977	0x140027ed0
?AddRef@XProvider@DirectUI@@UEAAKXZ	978	0x14003c6a0
?AddRulesToStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAVStyleSheet@2@PEBGPEAV?$DynamicArray@UXMLParserCond@DirectUI@@$0A@@2@PEAV?$DynamicArray@PEAG$0A@@2@@Z	979	0x140002ce0
?AddString@CCListBox@DirectUI@@QEAAHPEBG@Z	980	0x1400017e4
?AddString@Combobox@DirectUI@@QEAAHPEBG@Z	981	0x140007490
?AddString@TouchSelect@DirectUI@@QEAAJPEBG@Z	982	0x14003c920
?AddString@TouchSelect@DirectUI@@QEAAJPEBGPEAPEAVElement@2@@Z	983	0x14003edfc
?AddStringWithLabelOverride@TouchSelect@DirectUI@@QEAAJPEBG0PEAPEAVElement@2@@Z	984	0x140032e9c
?AddToSelection@NavigatorSelectionItemProxy@DirectUI@@AEAAJPEAVBrowser@2@@Z	985	0x140004174
?AddToSelection@SelectionItemProvider@DirectUI@@UEAAJXZ	986	0x140021a60
?AddToSelection@SelectorSelectionItemProxy@DirectUI@@AEAAJXZ	987	0x14003012c
?AdvanceFrame@AnimationStrip@DirectUI@@IEAAXXZ	988	0x140022bf8
?AdvanceFrame@Movie@DirectUI@@SA?AVUID@@XZ	989	0x14000e628
?AdviseEventAdded@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z	990	0x1400104a0
?AdviseEventAdded@EventManager@DirectUI@@SAJHPEAUtagSAFEARRAY@@@Z	991	0x140022880
?AdviseEventRemoved@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z	992	0x1400369ac
?AdviseEventRemoved@EventManager@DirectUI@@SAJHPEAUtagSAFEARRAY@@@Z	993	0x14001a0c0
?AliasedRenderingProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	994	0x140020a80
?AlphaProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	995	0x14002a42c
?AnimatePopupOnDismissProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	996	0x1400386d8
?AnimateScroll@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	997	0x1400132b8
?AnimationChange@Element@DirectUI@@SA?AVUID@@XZ	998	0x140024fcc
?AnimationProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	999	0x140005754
?AnimationStatusChange@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1000	0x140027c0c
?ApplySinkRegion@HWNDHost@DirectUI@@AEAAXPEBUtagRECT@@_N@Z	1001	0x140010d94
?Arrow@Expando@DirectUI@@KAGXZ	1002	0x140036aec
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ	1003	0x14002f58c
?AsyncContentLoadedEvent@Schema@DirectUI@@2HA	1004	0x14001b1dc
?Attach@Layout@DirectUI@@UEAAXPEAVElement@2@@Z	1005	0x14000fe74
?AttachCtrlSubclassProc@HWNDHost@DirectUI@@KAXPEAUHWND__@@@Z	1006	0x14001d2f8
?AutoGroupingProp@CCRadioButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1007	0x14000a570
?AutoStartProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1008	0x14000ac90
?AutoStopProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1009	0x140008028
?AutomationFocusChangedEvent@Schema@DirectUI@@2HA	1010	0x140020b64
?AutomationIdProperty@Schema@DirectUI@@2HA	1011	0x14003512c
?AutomationPropertyChangedEvent@Schema@DirectUI@@2HA	1012	0x140012fe0
?BackgroundOwnerIDProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	1013	0x14002f184
?BackgroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1014	0x14002dc0c
?BaselineProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1015	0x14000df80
?BorderColorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1016	0x140039ed4
?BorderStyleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1017	0x140026028
?BorderThicknessProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1018	0x1400115e4
?BoundingRectangleProperty@Schema@DirectUI@@2HA	1019	0x140009c90
?BroadcastEvent@Element@DirectUI@@QEAAXPEAUEvent@2@@Z	1020	0x14001c0d8
?BufferingProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	1021	0x14001a7ec
?BuildCacheInfo@FlowLayout@DirectUI@@IEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@_N@Z	1022	0x14000c040
?BuildCacheInfo@VerticalFlowLayout@DirectUI@@IEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@_N@Z	1023	0x14002850c
?BuildElement@Macro@DirectUI@@MEAAJXZ	1024	0x140016084
?BuildElement@Repeater@DirectUI@@MEAAJXZ	1025	0x140020a04
?ButtonClassAcceptsEnterKeyProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	1026	0x140032120
?ButtonControlType@Schema@DirectUI@@2HA	1027	0x14003ae78
?CacheParser@XBaby@DirectUI@@UEAAXPEAVDUIXmlParser@2@@Z	1028	0x140016d7c
?CalendarControlType@Schema@DirectUI@@2HA	1029	0x14001d0b0
?CanPerformManualVisualSwap@TouchScrollViewer@DirectUI@@QEAA_NXZ	1030	0x14001073c
?CanSetFocus@HWNDElement@DirectUI@@UEAA_NXZ	1031	0x1400156dc
?CanSetFocus@XBaby@DirectUI@@UEAA_NXZ	1032	0x14000b398
?CanSetFocus@XProvider@DirectUI@@UEAAJPEA_N@Z	1033	0x140018f30
?CancelClick@TouchButton@DirectUI@@QEAA_NW4ClickDevice@12@@Z	1034	0x140022028
?CancelCurrentDrag@TouchSlider@DirectUI@@QEAAXXZ	1035	0x140026bc0
?CaptureCallstackFrames@CallstackTracker@DirectUI@@QEAAHXZ	1036	0x1400012e4
?CapturedProp@Button@DirectUI@@SAPEBUPropertyInfo@2@XZ	1037	0x140015c20
?CapturedProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1038	0x140007574
?CaretMoved@TouchEditBase@DirectUI@@SA?AVUID@@XZ	1039	0x140022630
?CheckBoxControlType@Schema@DirectUI@@2HA	1040	0x1400164a4
?CheckScroll@BaseScrollViewer@DirectUI@@AEAAXPEAVBaseScrollBar@2@HHH@Z	1041	0x140007a18
?CheckedStateProp@TouchCheckBox@DirectUI@@SAPEBUPropertyInfo@2@XZ	1042	0x1400018d4
?ChildrenProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1043	0x1400081b8
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z	1044	0x14001726c
?ClassNameProperty@Schema@DirectUI@@2HA	1045	0x140036690
?ClassProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1046	0x1400307c0
?ClearButtonClicked@TouchEdit2@DirectUI@@SA?AVUID@@XZ	1047	0x14003fc50
?ClearCacheDirty@Layout@DirectUI@@IEAAXXZ	1048	0x140041450
?ClearParser@DUIFactory@DirectUI@@AEAAXXZ	1049	0x140013a28
?Click@Button@DirectUI@@SA?AVUID@@XZ	1050	0x140006c88
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ	1051	0x140018134
?ClickDefaultButton@DialogElement@DirectUI@@UEAA_NXZ	1052	0x14000d538
?ClickDefaultButton@DialogElementCore@DirectUI@@QEAA_NXZ	1053	0x14001ceec
?ClickDefaultButton@XBaby@DirectUI@@UEAA_NXZ	1054	0x140013000
?ClickDefaultButton@XProvider@DirectUI@@UEAAHXZ	1055	0x14000ee90
?ClickablePointProperty@Schema@DirectUI@@2HA	1056	0x140018ff4
?Clipper@Expando@DirectUI@@KAGXZ	1057	0x140002cc4
?Clone@DuiAccessible@DirectUI@@UEAAJPEAPEAUIEnumVARIANT@@@Z	1058	0x14003eb68
?Clone@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAUIEnumVARIANT@@@Z	1059	0x1400100cc
?Close@ElementProviderManager@DirectUI@@SAXXZ	1060	0x140015e80
?Close@EventManager@DirectUI@@SAXXZ	1061	0x14000b53c
?Close@InvokeManager@DirectUI@@SAXXZ	1062	0x14001b4e4
?ClosePopup@TouchSelect@DirectUI@@QEAAXXZ	1063	0x1400345a0
?CloseThread@InvokeManager@DirectUI@@SAXXZ	1064	0x14001762c
?Collapse@ExpandCollapseProvider@DirectUI@@UEAAJXZ	1065	0x14003d434
?ColorFontPaletteIndexProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1066	0x140008014
?ComboBoxControlType@Schema@DirectUI@@2HA	1067	0x140034fdc
?CompositedTextProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1068	0x140022834
?CompositingQualityProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1069	0x14001e398
?CompositionChange@HWNDElement@DirectUI@@SA?AVUID@@XZ	1070	0x14002f22c
?ConnectProp@Bind@DirectUI@@SAPEBUPropertyInfo@2@XZ	1071	0x14000375c
?ConstrainLayoutProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1072	0x140013974
?ContentAlignProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1073	0x140012834
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1074	0x1400147c0
?Context@Button@DirectUI@@SA?AVUID@@XZ	1075	0x14002a814
?ContextMenuHintShowing@ContextMenuBehavior@DirectUI@@SA?AVUID@@XZ	1076	0x140031e84
?ContextMenuRequested@ContextMenuBehavior@DirectUI@@SA?AVUID@@XZ	1077	0x140001cd8
?ContextMenuRequested@TouchEdit2@DirectUI@@SA?AVUID@@XZ	1078	0x14000fed0
?ContextSensitiveHelp@DuiAccessible@DirectUI@@UEAAJH@Z	1079	0x140039f3c
?ContextSensitiveHelp@HWNDHostAccessible@DirectUI@@UEAAJH@Z	1080	0x140011e9c
?ControlTypeProperty@Schema@DirectUI@@2HA	1081	0x14000e720
?CopySheets@DUIXmlParser@DirectUI@@QEAAJPEAPEAV?$DynamicArray@PEAVValue@DirectUI@@$0A@@2@@Z	1082	0x140031bf4
?Count@?$SafeArrayAccessor@H@DirectUI@@QEAAHXZ	1083	0x14000d4b4
?Create@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1084	0x14002dca8
?Create@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1085	0x14003f644
?Create@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1086	0x14002260c
?Create@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1087	0x14002e6b8
?Create@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1088	0x140037408
?Create@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1089	0x14002acbc
?Create@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1090	0x14000aa28
?Create@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1091	0x140034718
?Create@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1092	0x14003b448
?Create@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1093	0x140004c28
?Create@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1094	0x14000c570
?Create@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1095	0x140039608
?Create@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1096	0x1400322f8
?Create@AcceleratorBehavior@@SAJPEAPEAUIDuiBehavior@@@Z	1097	0x140028f88
?Create@AccessibleButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1098	0x1400044b0
?Create@AnimationStrip@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1099	0x140016f80
?Create@AutoButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1100	0x14001122c
?Create@Bind@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1101	0x140024094
?Create@BorderLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1102	0x1400215dc
?Create@BorderLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1103	0x14003257c
?Create@Browser@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1104	0x140011860
?Create@Button@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1105	0x140027b54
?Create@Button@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1106	0x1400353d0
?Create@CCAVI@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1107	0x140026840
?Create@CCAVI@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1108	0x140032828
?Create@CCBase@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1109	0x140005cc4
?Create@CCBase@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1110	0x1400048fc
?Create@CCCheckBox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1111	0x140031efc
?Create@CCCheckBox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1112	0x140026430
?Create@CCCommandLink@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1113	0x140040028
?Create@CCCommandLink@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1114	0x1400356f0
?Create@CCHScrollBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1115	0x1400342a4
?Create@CCHScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1116	0x140033e88
?Create@CCListBox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1117	0x14003c784
?Create@CCListBox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1118	0x1400326d4
?Create@CCListView@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1119	0x14001dc64
?Create@CCListView@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1120	0x14002b41c
?Create@CCProgressBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1121	0x14001fcd8
?Create@CCProgressBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1122	0x14002aabc
?Create@CCPushButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1123	0x140012c24
?Create@CCPushButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1124	0x1400377f0
?Create@CCRadioButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1125	0x14002abbc
?Create@CCRadioButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1126	0x14002f314
?Create@CCSysLink@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1127	0x140023e0c
?Create@CCSysLink@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1128	0x140024328
?Create@CCTrackBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1129	0x1400018c8
?Create@CCTrackBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1130	0x14000821c
?Create@CCTreeView@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1131	0x14000cc1c
?Create@CCTreeView@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1132	0x14003dfe8
?Create@CCVScrollBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1133	0x1400140e4
?Create@CCVScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1134	0x140018ee8
?Create@CheckBoxGlyph@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1135	0x14002bd70
?Create@CheckBoxGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1136	0x14001263c
?Create@Clipper@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1137	0x140029c10
?Create@Combobox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1138	0x140012120
?Create@Combobox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1139	0x14003bba0
?Create@ContextMenuBehavior@DirectUI@@SAJPEAPEAUIDuiBehavior@@@Z	1140	0x14000d14c
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z	1141	0x140019330
?Create@DialogElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z	1142	0x140014ca0
?Create@DuiAccessible@DirectUI@@SAJPEAVElement@2@PEAPEAV12@@Z	1143	0x140011650
?Create@Edit@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1144	0x140017c44
?Create@Edit@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1145	0x14000fe04
?Create@Element@DirectUI@@SAJIPEAV12@PEAKPEAPEAV12@@Z	1146	0x140006e5c
?Create@ElementProvider@DirectUI@@SAJPEAVElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z	1147	0x140017f90
?Create@ElementProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1148	0x140029a98
?Create@ElementWithHWND@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1149	0x14000e608
?Create@ExpandCollapseProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1150	0x140031f94
?Create@Expandable@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1151	0x14001a078
?Create@Expando@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1152	0x140002ae8
?Create@ExpandoButtonGlyph@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1153	0x1400120f8
?Create@ExpandoButtonGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1154	0x14000d19c
?Create@FillLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1155	0x140034050
?Create@FillLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1156	0x140009504
?Create@FlowLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1157	0x14000e42c
?Create@FlowLayout@DirectUI@@SAJ_NIIIPEAPEAVLayout@2@@Z	1158	0x14003af0c
?Create@GridItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1159	0x140034c68
?Create@GridLayout@DirectUI@@SAJHHPEAPEAVLayout@2@@Z	1160	0x14000af84
?Create@GridLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1161	0x14002f51c
?Create@GridProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1162	0x14001b7fc
?Create@HWNDElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z	1163	0x140011d40
?Create@HWNDElementAccessible@DirectUI@@SAJPEAVHWNDElement@2@PEAPEAVDuiAccessible@2@@Z	1164	0x140038130
?Create@HWNDElementProvider@DirectUI@@SAJPEAVHWNDElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z	1165	0x140033b08
?Create@HWNDElementProxy@DirectUI@@SAPEAV12@PEAVHWNDElement@2@@Z	1166	0x14002ee58
?Create@HWNDHost@DirectUI@@SAJIIPEAVElement@2@PEAKPEAPEAV32@@Z	1167	0x14003382c
?Create@HWNDHost@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1168	0x140013b78
?Create@HWNDHostAccessible@DirectUI@@SAJPEAVElement@2@PEAUIAccessible@@PEAPEAVDuiAccessible@2@@Z	1169	0x140005140
?Create@HWNDHostClientAccessible@DirectUI@@SAJPEAVElement@2@PEAUIAccessible@@PEAPEAVDuiAccessible@2@@Z	1170	0x140010e1c
?Create@InvokeProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1171	0x14001c244
?Create@ItemList@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1172	0x140031930
?Create@Layout@DirectUI@@SAJPEAPEAV12@@Z	1173	0x14001f5b4
?Create@Macro@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1174	0x140031e30
?Create@ModernProgressBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1175	0x14003be48
?Create@ModernProgressRing@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1176	0x14003c0d0
?Create@Movie@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1177	0x140027044
?Create@Movie@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1178	0x140014064
?Create@NativeHWNDHost@DirectUI@@SAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@IPEAPEAV12@@Z	1179	0x14003c6c0
?Create@NativeHWNDHost@DirectUI@@SAJPEBGPEAUHWND__@@PEAUHICON__@@HHHHHHIPEAPEAV12@@Z	1180	0x14002f2c8
?Create@Navigator@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1181	0x140018848
?Create@NineGridLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1182	0x140005154
?Create@NineGridLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1183	0x140032534
?Create@PText@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1184	0x14002666c
?Create@Page@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1185	0x1400315b4
?Create@Pages@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1186	0x14002d13c
?Create@Progress@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1187	0x140022088
?Create@PushButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1188	0x14003725c
?Create@RadioButtonGlyph@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1189	0x140040b8c
?Create@RadioButtonGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1190	0x1400290c8
?Create@RangeValueProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1191	0x140023f60
?Create@RefPointElement@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1192	0x14003a9b0
?Create@RefPointElement@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1193	0x1400391a8
?Create@RepeatButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1194	0x140018f3c
?Create@RepeatButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1195	0x140006210
?Create@Repeater@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1196	0x1400141b8
?Create@RichText@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1197	0x140002d94
?Create@RowLayout@DirectUI@@SAJHIIPEAPEAVLayout@2@@Z	1198	0x14001e3b8
?Create@RowLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1199	0x14002b6b0
?Create@RowLayout@DirectUI@@SAJIIPEAPEAVLayout@2@@Z	1200	0x14002f5c8
?Create@ScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1201	0x140029dc0
?Create@ScrollBar@DirectUI@@SAJ_NPEAVElement@2@PEAKPEAPEAV32@@Z	1202	0x14003deb0
?Create@ScrollItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1203	0x140021594
?Create@ScrollProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1204	0x14001d594
?Create@ScrollViewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1205	0x1400097f0
?Create@ScrubBehavior@@SAJPEAPEAUIDuiBehavior@@@Z	1206	0x14001023c
?Create@SelectionItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1207	0x14002ac90
?Create@SelectionProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1208	0x14003dc28
?Create@Selector@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1209	0x1400294c0
?Create@SelectorNoDefault@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1210	0x14003532c
?Create@SemanticZoomToggle@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1211	0x140019b58
?Create@ShellBorderLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1212	0x14003d0bc
?Create@ShellBorderLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1213	0x14003d7f4
?Create@StyleSheet@DirectUI@@SAJPEAPEAV12@@Z	1214	0x14001f8f0
?Create@StyledScrollViewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1215	0x1400106a4
?Create@TableItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1216	0x140014454
?Create@TableLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1217	0x1400174e8
?Create@TableProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1218	0x140028440
?Create@TextGraphic@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1219	0x14002e094
?Create@Thumb@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1220	0x140017ab8
?Create@Thumb@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1221	0x140012e78
?Create@ToggleProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1222	0x14002ac60
?Create@TouchButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1223	0x14002b664
?Create@TouchButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1224	0x140039cac
?Create@TouchCheckBox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1225	0x14003ad14
?Create@TouchCheckBox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1226	0x140011104
?Create@TouchCheckBoxGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1227	0x14000ad14
?Create@TouchCommandButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1228	0x14001b130
?Create@TouchCommandButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1229	0x14001a77c
?Create@TouchEdit2@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1230	0x140010c84
?Create@TouchEditBase@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1231	0x14000f5d8
?Create@TouchHWNDElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z	1232	0x14003ebe8
?Create@TouchHyperLink@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1233	0x14001dd40
?Create@TouchHyperLink@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1234	0x140025878
?Create@TouchRepeatButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1235	0x140039b9c
?Create@TouchRepeatButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1236	0x140039af8
?Create@TouchScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1237	0x140006c58
?Create@TouchScrollViewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1238	0x14002e028
?Create@TouchSelect@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1239	0x140034818
?Create@TouchSelectItem@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1240	0x140003fd8
?Create@TouchSlider@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1241	0x14000d5c0
?Create@TouchSwitch@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1242	0x140029224
?Create@UnknownElement@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1243	0x140017dd8
?Create@UnknownElement@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1244	0x1400072e8
?Create@ValueProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1245	0x140024690
?Create@VerticalFlowLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1246	0x14000bd2c
?Create@VerticalFlowLayout@DirectUI@@SAJ_NIIIPEAPEAVLayout@2@@Z	1247	0x14001717c
?Create@Viewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1248	0x14003d228
?Create@XBaby@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1249	0x14003bc74
?Create@XBaby@DirectUI@@SAJPEAVIXElementCP@2@PEAVXProvider@2@PEAUHWND__@@PEAVElement@2@PEAKPEAPEAV62@@Z	1250	0x14003677c
?Create@XElement@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1251	0x14003fef8
?Create@XElement@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1252	0x14001fe78
?Create@XHost@DirectUI@@SAJPEAVIXElementCP@2@PEAPEAV12@@Z	1253	0x14001c290
?Create@XProvider@DirectUI@@SAJPEAVElement@2@PEAVIXProviderCP@2@PEAPEAV12@@Z	1254	0x1400243a4
?Create@XResourceProvider@DirectUI@@SAJPEAPEAV12@@Z	1255	0x140033ef4
?Create@XResourceProvider@DirectUI@@SAJPEAUHINSTANCE__@@PEBG11PEAPEAV12@@Z	1256	0x14000e574
?CreateAccNameLabel@HWNDHost@DirectUI@@IEAAPEAUHWND__@@PEAU3@@Z	1257	0x14001e190
?CreateAtom@Value@DirectUI@@SAPEAV12@G@Z	1258	0x14002fc34
?CreateAtom@Value@DirectUI@@SAPEAV12@PEBG@Z	1259	0x140021278
?CreateBool@Value@DirectUI@@SAPEAV12@_N@Z	1260	0x140015c8c
?CreateButtons@ScrollBar@DirectUI@@MEAAJXZ	1261	0x14003fff4
?CreateButtons@TouchScrollBar@DirectUI@@UEAAJXZ	1262	0x14002ab68
?CreateCache@RichText@DirectUI@@SAJIPEAPEAUIDUIRichTextCache@@@Z	1263	0x140026928
?CreateColor@Value@DirectUI@@SAPEAV12@K@Z	1264	0x14003bc98
?CreateColor@Value@DirectUI@@SAPEAV12@KKE@Z	1265	0x140022ce0
?CreateColor@Value@DirectUI@@SAPEAV12@KKKE@Z	1266	0x140011fc0
?CreateCursor@Value@DirectUI@@SAPEAV12@PEAUHICON__@@@Z	1267	0x140029ab4
?CreateCursor@Value@DirectUI@@SAPEAV12@PEBG@Z	1268	0x140031a38
?CreateDFCFill@Value@DirectUI@@SAPEAV12@II@Z	1269	0x140039d94
?CreateDTBFill@Value@DirectUI@@SAPEAV12@PEBGHH@Z	1270	0x14002e51c
?CreateDUI@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAPEAUHWND__@@@Z	1271	0x14002005c
?CreateDUICP@TaskPage@DirectUI@@EEAAJPEAVHWNDElement@2@PEAUHWND__@@1PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z	1272	0x140036990
?CreateDUICP@XResourceProvider@DirectUI@@UEAAJPEAVHWNDElement@2@PEAUHWND__@@1PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z	1273	0x140022f04
?CreateDoubleList@Value@DirectUI@@SAPEAV12@PEAV?$DynamicArray@N$0A@@2@@Z	1275	0x140010520
?CreateDoubleList@Value@DirectUI@@SAPEAV12@PEBNH@Z	1276	0x140039334
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z	1277	0x14000e784
?CreateElementList@Value@DirectUI@@SAPEAV12@PEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@@Z	1278	0x1400357ec
?CreateElementRef@Value@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1279	0x14001ab08
?CreateElementScaledValue@Value@DirectUI@@SAPEAV12@PEAVElement@2@PEAV12@@Z	1280	0x140028ce4
?CreateEncodedString@Value@DirectUI@@SAPEAV12@PEBG@Z	1281	0x140012170
?CreateExpression@Value@DirectUI@@SAPEAV12@PEAVExpression@2@@Z	1282	0x14000980c
?CreateFill@Value@DirectUI@@SAPEAV12@AEBUFill@2@@Z	1283	0x14001d29c
?CreateFloat@Value@DirectUI@@SAPEAV12@MW4DynamicScaleValue@@@Z	1284	0x1400412ec
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHBITMAP__@@EI_N11@Z	1285	0x1400292d0
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHENHMETAFILE__@@0@Z	1286	0x14000a280
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHICON__@@_N11@Z	1287	0x1400276a4
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUISharedBitmap@@EI@Z	1288	0x14002f534
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEBGEIGGPEAUHINSTANCE__@@_N2@Z	1289	0x14003b234
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEBGGGPEAUHINSTANCE__@@_N2@Z	1290	0x14000e5f0
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEBGUScaledSIZE@2@PEAUHINSTANCE__@@_N3@Z	1291	0x1400144a8
?CreateHWND@CCBase@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1292	0x14003f180
?CreateHWND@CCBaseScrollBar@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1293	0x14003d9ac
?CreateHWND@Combobox@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1294	0x140040a68
?CreateHWND@Edit@DirectUI@@MEAAPEAUHWND__@@PEAU3@@Z	1295	0x140034eb4
?CreateHWND@Edit@DirectUI@@MEAAPEAUHWND__@@PEAU3@_N@Z	1296	0x14000c9d0
?CreateHWND@HWNDHost@DirectUI@@MEAAPEAUHWND__@@PEAU3@@Z	1297	0x14003180c
?CreateHWND@XElement@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1298	0x140040534
?CreateHostWindow@NativeHWNDHost@DirectUI@@UEAAPEAUHWND__@@KPEBG0KHHHHPEAU3@PEAUHMENU__@@PEAUHINSTANCE__@@PEAX@Z	1299	0x1400235a0
?CreateIconGraphicHelper@Value@DirectUI@@CAPEAV12@PEAUHICON__@@_N11@Z	1300	0x14002973c
?CreateInstance@CSafeElementProxy@@SAJPEAVElement@DirectUI@@PEAPEAV1@@Z	1301	0x14001cbb0
?CreateInt@Value@DirectUI@@SAPEAV12@HW4DynamicScaleValue@@@Z	1302	0x140033de0
?CreateLayout@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@P6AJHPEAHPEAPEAVValue@2@@Z@Z	1303	0x14001b7b8
?CreateLayout@Value@DirectUI@@SAPEAV12@PEAVLayout@2@@Z	1304	0x14001b830
?CreateParser@DUIFactory@DirectUI@@QEAAJXZ	1305	0x14002b0f0
?CreateParser@XProvider@DirectUI@@QEAAJPEAPEAVDUIXmlParser@2@@Z	1306	0x140038e44
?CreateParserCP@TaskPage@DirectUI@@EEAAJPEAPEAVDUIXmlParser@2@@Z	1307	0x140023f44
?CreateParserCP@XResourceProvider@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z	1308	0x140019798
?CreatePatternProvider@Schema@DirectUI@@SAJW4Pattern@12@PEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1309	0x140034b54
?CreatePoint@Value@DirectUI@@SAPEAV12@HHW4DynamicScaleValue@@@Z	1310	0x14003d64c
?CreateRect@Value@DirectUI@@SAPEAV12@HHHHW4DynamicScaleValue@@@Z	1311	0x140007fa0
?CreateScaledValue@Value@DirectUI@@SAPEAV12@MPEAV12@@Z	1312	0x14000f9e0
?CreateScrollBars@ScrollViewer@DirectUI@@MEAAJXZ	1313	0x1400243ec
?CreateScrollBars@StyledScrollViewer@DirectUI@@MEAAJXZ	1314	0x14003730c
?CreateSize@Value@DirectUI@@SAPEAV12@HHW4DynamicScaleValue@@@Z	1315	0x14003813c
?CreateString@Value@DirectUI@@SAPEAV12@PEBGPEAUHINSTANCE__@@@Z	1316	0x140031c4c
?CreateStringRP@Value@DirectUI@@SAPEAV12@PEBGPEAUHINSTANCE__@@@Z	1317	0x140002bdc
?CreateStyleParser@HWNDElement@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z	1318	0x1400178e8
?CreateStyleParser@XBaby@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z	1319	0x1400396f8
?CreateStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBGPEAPEAVStyleSheet@2@@Z	1320	0x14000930c
?CreateStyleSheet@Value@DirectUI@@SAPEAV12@PEAVStyleSheet@2@@Z	1321	0x140008664
?CreateValueList@Value@DirectUI@@SAPEAV12@PEAV12@@Z	1322	0x14000fddc
?CreateValueList@Value@DirectUI@@SAPEAV12@PEAV?$DynamicArray@PEAVValue@DirectUI@@$0A@@2@@Z	1323	0x14002490c
?CreateXBaby@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAUHWND__@@PEAVElement@2@PEAKPEAPEAUIXBaby@2@@Z	1324	0x14003e5f0
?CreateXmlReader@DUIXmlParser@DirectUI@@IEAAJPEAPEAUIXmlReader@@@Z	1325	0x140005f38
?CreateXmlReaderFromHGLOBAL@DUIXmlParser@DirectUI@@IEAAJPEAXPEAPEAUIXmlReader@@@Z	1326	0x140019c24
?CreateXmlReaderInputWithEncodingName@DUIXmlParser@DirectUI@@IEAAJPEAUIStream@@PEBGPEAPEAUIUnknown@@@Z	1327	0x140036fc4
?CtrlSubclassProc@HWNDHost@DirectUI@@KA_JPEAUHWND__@@I_K_J@Z	1328	0x140021ae4
?CultureProperty@Schema@DirectUI@@2HA	1329	0x140026d10
?CursorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1330	0x14000522c
?CustomControlType@Schema@DirectUI@@2HA	1331	0x14000af34
?CustomDragDropScalingHint@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1332	0x140033d84
?CustomProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1333	0x14002bac8
?CustomReflowHint@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1334	0x14003c64c
?CustomTapHint@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1335	0x1400338d4
?Cut@TouchEditBase@DirectUI@@SA?AVUID@@XZ	1336	0x140019b10
?DCompDeviceRebuilt@Element@DirectUI@@SA?AVUID@@XZ	1337	0x140013ee4
?DPIProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1338	0x140010958
?DUICreatePropertySheetPage@TaskPage@DirectUI@@QEAAJPEAUHINSTANCE__@@@Z	1339	0x140024a44
?DataGridControlType@Schema@DirectUI@@2HA	1340	0x140024d64
?DataItemControlType@Schema@DirectUI@@2HA	1341	0x14001125c
?DefaultAction@Button@DirectUI@@UEAAJXZ	1342	0x1400217c0
?DefaultAction@CCBase@DirectUI@@UEAAJXZ	1343	0x140009b3c
?DefaultAction@CCPushButton@DirectUI@@UEAAJXZ	1344	0x14001d678
?DefaultAction@Element@DirectUI@@UEAAJXZ	1345	0x140033694
?DefaultAction@SemanticZoomToggle@DirectUI@@UEAAJXZ	1346	0x140020294
?DefaultAction@TouchButton@DirectUI@@UEAAJXZ	1347	0x14001c7bc
?DefaultAction@TouchRepeatButton@DirectUI@@UEAAJXZ	1348	0x140039384
?DefaultButtonTrackingProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	1349	0x14001709c
?DelayActivateTooltip@HWNDElement@DirectUI@@QEAAXXZ	1350	0x14003b048
?DeleteString@CCListBox@DirectUI@@QEAAHH@Z	1351	0x14001dc24
?DesiredSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1352	0x140033818
?Destroy@ClassInfoBase@DirectUI@@UEAAXXZ	1353	0x140040630
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ	1354	0x14002366c
?Destroy@Element@DirectUI@@QEAAJ_N@Z	1355	0x14002a3c0
?Destroy@Expression@DirectUI@@QEAAXXZ	1356	0x140024b04
?Destroy@Layout@DirectUI@@QEAAXXZ	1357	0x14001e99c
?Destroy@NativeHWNDHost@DirectUI@@QEAAXXZ	1358	0x140022a04
?Destroy@XHost@DirectUI@@QEAAXXZ	1359	0x140026cf0
?DestroyAll@Element@DirectUI@@QEAAJ_N@Z	1360	0x14002586c
?DestroyCP@TaskPage@DirectUI@@EEAAXXZ	1361	0x14003fdd4
?DestroyCP@XResourceProvider@DirectUI@@UEAAXXZ	1362	0x1400221c0
?DestroyListener@EventManager@DirectUI@@SAXPEAVElement@2@@Z	1363	0x140001b14
?DestroyMsg@NativeHWNDHost@DirectUI@@SAIXZ	1364	0x140010690
?DestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ	1365	0x14003c448
?DestroyWindow@XHost@DirectUI@@QEAAXXZ	1366	0x1400036ac
?Detach@CSafeElementProxy@@QEAAXXZ	1367	0x14000390c
?Detach@Element@DirectUI@@QEAAXPEAVDeferCycle@2@@Z	1368	0x14000ef54
?Detach@HWNDHost@DirectUI@@QEAAXXZ	1369	0x140037008
?Detach@Layout@DirectUI@@UEAAXPEAVElement@2@@Z	1370	0x14002a25c
?DetachParser@DUIFactory@DirectUI@@QEAAPEAVDUIXmlParser@2@XZ	1371	0x1400075d0
?DeterminateProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	1372	0x140023d70
?DirectionProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1373	0x14003c3c0
?DirtyProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	1374	0x140015d0c
?DisableAccTextExtendProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1375	0x14000bfec
?DisableMouseInRectCheckProp@TouchRepeatButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1376	0x14000d48c
?DisableSelectionHandlesOnEmptyContent@TouchEdit2@DirectUI@@QEAAXXZ	1377	0x14000b8a8
?Disconnect@DuiAccessible@DirectUI@@UEAAJXZ	1378	0x1400308a0
?Disconnect@HWNDElementAccessible@DirectUI@@UEAAJXZ	1379	0x140029ea4
?Disconnect@HWNDHostAccessible@DirectUI@@UEAAJXZ	1380	0x14000cac0
?DismissIHMAsync@TouchHWNDElement@DirectUI@@QEAAJXZ	1381	0x140035ba8
?DllsLoaded@CallstackTracker@DirectUI@@CAHXZ	1382	0x140035b4c
?DoInvoke@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@IEAAJHZZ	1383	0x14002da50
?DoInvoke@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@IEAAJHZZ	1384	0x14003a11c
?DoInvoke@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@IEAAJHZZ	1385	0x1400263f4
?DoInvoke@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@IEAAJHZZ	1386	0x14000e1c0
?DoInvoke@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@IEAAJHZZ	1387	0x14002db30
?DoInvoke@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@IEAAJHZZ	1388	0x1400084d4
?DoInvoke@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@IEAAJHZZ	1389	0x140032c10
?DoInvoke@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@IEAAJHZZ	1390	0x140023844
?DoInvoke@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@IEAAJHZZ	1391	0x14000ca44
?DoInvoke@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@IEAAJHZZ	1392	0x140037920
?DoInvoke@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@IEAAJHZZ	1393	0x14000d3b4
?DoInvoke@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@IEAAJHZZ	1394	0x1400054a0
?DoInvoke@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@IEAAJHZZ	1395	0x140015830
?DoInvoke@ElementProvider@DirectUI@@IEAAJHZZ	1396	0x140018f88
?DoInvoke@InvokeHelper@DirectUI@@QEAAJHPEAVElementProvider@2@P6APEAVProviderProxy@2@PEAVElement@2@@ZPEAD@Z	1397	0x140012d6c
?DoInvokeArgs@ElementProvider@DirectUI@@QEAAJHP6APEAVProviderProxy@2@PEAVElement@2@@ZPEAD@Z	1398	0x14001f838
?DoLayout@BorderLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1399	0x140012bbc
?DoLayout@FillLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1400	0x14003f110
?DoLayout@FlowLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1401	0x1400058b8
?DoLayout@GridLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1402	0x1400057b4
?DoLayout@Layout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1403	0x140002ce4
?DoLayout@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1404	0x14003f658
?DoLayout@RowLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1405	0x14000b070
?DoLayout@TableLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1406	0x140026fcc
?DoLayout@VerticalFlowLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1407	0x140009f7c
?DoMethod@BrowserSelectionProxy@DirectUI@@UEAAJHPEAD@Z	1408	0x140009d30
?DoMethod@ElementProxy@DirectUI@@UEAAJHPEAD@Z	1409	0x14003965c
?DoMethod@ExpandCollapseProxy@DirectUI@@UEAAJHPEAD@Z	1410	0x140001ee0
?DoMethod@GridItemProxy@DirectUI@@UEAAJHPEAD@Z	1411	0x140015560
?DoMethod@GridProxy@DirectUI@@UEAAJHPEAD@Z	1412	0x140003dd8
?DoMethod@HWNDElementProxy@DirectUI@@UEAAJHPEAD@Z	1413	0x14000eda4
?DoMethod@InvokeProxy@DirectUI@@UEAAJHPEAD@Z	1414	0x14000a874
?DoMethod@ModernProgressBarRangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1415	0x140022fd8
?DoMethod@NavigatorSelectionItemProxy@DirectUI@@UEAAJHPEAD@Z	1416	0x140004788
?DoMethod@ProgressRangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1417	0x140033160
?DoMethod@RangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1418	0x14000981c
?DoMethod@ScrollBarRangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1419	0x14002fcc4
?DoMethod@ScrollItemProxy@DirectUI@@UEAAJHPEAD@Z	1420	0x14000bd88
?DoMethod@ScrollProxy@DirectUI@@UEAAJHPEAD@Z	1421	0x140032144
?DoMethod@SelectionItemProxy@DirectUI@@UEAAJHPEAD@Z	1422	0x1400253e0
?DoMethod@SelectionProxy@DirectUI@@UEAAJHPEAD@Z	1423	0x140039ff0
?DoMethod@SelectorSelectionItemProxy@DirectUI@@UEAAJHPEAD@Z	1424	0x1400168cc
?DoMethod@SelectorSelectionProxy@DirectUI@@UEAAJHPEAD@Z	1425	0x1400021cc
?DoMethod@TableItemProxy@DirectUI@@UEAAJHPEAD@Z	1426	0x140008518
?DoMethod@TableProxy@DirectUI@@UEAAJHPEAD@Z	1427	0x140024448
?DoMethod@ToggleProxy@DirectUI@@UEAAJHPEAD@Z	1428	0x140040374
?DoMethod@ValueProxy@DirectUI@@UEAAJHPEAD@Z	1429	0x1400070d0
?DockPattern@Schema@DirectUI@@2HA	1430	0x14003bf94
?DocumentControlType@Schema@DirectUI@@2HA	1431	0x140011fe0
?DoubleBuffered@Element@DirectUI@@QEAAX_N@Z	1432	0x1400248f4
?Drag@Thumb@DirectUI@@SA?AVUID@@XZ	1433	0x14000b260
?DragDragCancelEvent@Schema@DirectUI@@2HA	1434	0x14003d600
?DragDragCompleteEvent@Schema@DirectUI@@2HA	1435	0x140031224
?DragDragStartEvent@Schema@DirectUI@@2HA	1436	0x14002260c
?DragPattern@Schema@DirectUI@@2HA	1437	0x140027540
?Drag_DropEffect_Property@Schema@DirectUI@@2HA	1438	0x14000cc34
?Drag_DropEffects_Property@Schema@DirectUI@@2HA	1439	0x1400333a4
?Drag_IsGrabbed_Property@Schema@DirectUI@@2HA	1440	0x1400184b0
?DrawOutlinesProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1441	0x14000d9f8
?DumpDuiProperties@@YAXPEAVElement@DirectUI@@@Z	1443	0x14001b9d4
?DumpDuiTree@@YAXPEAVElement@DirectUI@@H@Z	1444	0x14000d22c
?EdgeHighlightColorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1445	0x14001f460
?EdgeHighlightThicknessProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1446	0x1400200b8
?EditControlType@Schema@DirectUI@@2HA	1447	0x140007c14
?ElementFromPoint@HWNDElement@DirectUI@@QEAAPEAVElement@2@PEAUtagPOINT@@@Z	1448	0x14001cd54
?ElementFromPoint@HWNDElementProxy@DirectUI@@IEAAJNNPEAPEAUIRawElementProviderFragment@@@Z	1449	0x140020750
?ElementMovesOnIHMNotifyProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	1450	0x14001ae60
?ElementProviderFromPoint@HWNDElementProvider@DirectUI@@UEAAJNNPEAPEAUIRawElementProviderFragment@@@Z	1451	0x140038f6c
?EnableDesignMode@DUIXmlParser@DirectUI@@QEAAXXZ	1452	0x1400050a8
?EnableUiaEvents@Element@DirectUI@@QEAAX_N@Z	1453	0x140021088
?EnabledProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1454	0x14000f29c
?End@BaseScrollBar@DirectUI@@UEAAXXZ	1455	0x14002df90
?EndDefer@Element@DirectUI@@QEAAXK@Z	1456	0x140016098
?EndDefer@EventManager@DirectUI@@SAJPEAVElement@2@@Z	1457	0x14003cfe4
?EnforceSizeProp@PushButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1458	0x140009144
?EnsureVisible@Element@DirectUI@@QEAA_NI@Z	1459	0x14003ae70
?EnsureVisible@Element@DirectUI@@QEAA_NXZ	1460	0x14001f668
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z	1461	0x1400287c0
?EnsureVisible@Viewer@DirectUI@@UEAA_NHHHH@Z	1462	0x14001f588
?Enter@Edit@DirectUI@@SA?AVUID@@XZ	1463	0x14000ad90
?Enter@TouchEditBase@DirectUI@@SA?AVUID@@XZ	1464	0x1400132b8
?Entered@Browser@DirectUI@@SA?AVUID@@XZ	1465	0x140004584
?EnumCallstackFrames@CallstackTracker@DirectUI@@QEAAHP6AXPEBD0KK@Z@Z	1466	0x14001dd40
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z	1467	0x14002a2d0
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z	1468	0x14002ad1c
?EraseFeedback@TouchSlider@DirectUI@@QEAAXXZ	1469	0x140027f1c
?EstimateContentSize@CCPushButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1470	0x140022bdc
?EventFromEventId@Schema@DirectUI@@SA?AW4Event@12@H@Z	1471	0x14001ad00
?EventListener@EventManager@DirectUI@@SAJPEAVElement@2@PEAUEvent@2@@Z	1472	0x14001fc80
?ExecuteManualSwapDeferredZoomToRect@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	1473	0x140008248
?Expand@ExpandCollapseProvider@DirectUI@@UEAAJXZ	1474	0x140009090
?ExpandCollapsePattern@Schema@DirectUI@@2HA	1475	0x1400085f0
?ExpandCollapse_ExpandCollapseState_Property@Schema@DirectUI@@2HA	1476	0x14002d3cc
?ExpandProp@Macro@DirectUI@@SAPEBUPropertyInfo@2@XZ	1477	0x1400114c8
?ExpandedProp@Expandable@DirectUI@@SAPEBUPropertyInfo@2@XZ	1478	0x1400018c4
?ExtentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1479	0x140032cdc
?FWantAnyEvent@EventManager@DirectUI@@SA_NPEAVElement@2@@Z	1480	0x14002ed00
?FillSymbolInfo@CallstackTracker@DirectUI@@AEAAXPEAUSTACK_SYMBOL_INFO@12@_K@Z	1481	0x14002ed10
?FilterOnPasteProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	1482	0x140041574
?FinalizeCurrentIMEComposition@TouchEdit2@DirectUI@@UEAAJXZ	1483	0x140011698
?FinalizeCurrentIMEComposition@TouchEditBase@DirectUI@@UEAAJXZ	1484	0x140022854
?Find@ElementProviderManager@DirectUI@@SAPEAVElementProvider@2@PEAVElement@2@@Z	1485	0x14000d6cc
?FindAccessibleRole@AccessibleButton@DirectUI@@CAPEBUACCESSIBLEROLE@12@H@Z	1486	0x140013124
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z	1487	0x14000eda4
?FindDescendentWorker@Element@DirectUI@@AEAAPEAV12@G@Z	1488	0x1400028c4
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UEAAHGH@Z	1489	0x140017d84
?FindInvokeHelper@InvokeManager@DirectUI@@CAPEAVInvokeHelper@2@PEAI@Z	1490	0x14003c8a4
?FindProviderCallback@ElementProviderManager@DirectUI@@CA_NPEAVElementProvider@2@PEAX@Z	1491	0x140010f40
?FindRefPoint@RefPointElement@DirectUI@@SAPEAVElement@2@PEAV32@PEAUtagPOINT@@@Z	1492	0x14003403c
?FindShortcut@HWNDElement@DirectUI@@SA_NGPEAVElement@2@PEAPEAV32@PEAH2H@Z	1493	0x14000b94c
?FindShortcutRecursive@HWNDElement@DirectUI@@KA_NGPEAVElement@2@PEAPEAV32@PEAH2H@Z	1494	0x140037bd4
?FireAnimationChangeEvent@BaseScrollViewer@DirectUI@@IEAAX_N@Z	1495	0x140015294
?FireClickEvent@TouchButton@DirectUI@@UEAAXIIW4ClickDevice@12@PEAUtagPOINT@@@Z	1496	0x14002b998
?FireClickEvent@TouchRepeatButton@DirectUI@@UEAAXIIW4ClickDevice@TouchButton@2@PEAUtagPOINT@@@Z	1497	0x140015770
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z	1498	0x140033f70
?FireEventOnMouseOrPointerRelease@TouchSlider@DirectUI@@QEAAXXZ	1499	0x140040f1c
?FireHostEvent@PushButton@DirectUI@@AEAAXPEAVElement@2@_N@Z	1500	0x140002428
?FireNavigate@Browser@DirectUI@@AEAAHG@Z	1501	0x140026624
?FireNavigationEvent@Navigator@DirectUI@@AEAAXXZ	1502	0x14000e5b8
?FireRightClickEvent@TouchButton@DirectUI@@UEAAXIPEAUtagPOINT@@@Z	1503	0x140008bb0
?FireRightClickEvent@TouchRepeatButton@DirectUI@@UEAAXIPEAUtagPOINT@@@Z	1504	0x140007510
?FireStructureChangedEvent@EventManager@DirectUI@@SAJPEAVElement@2@W4StructureChangeType@@@Z	1505	0x14000dc8c
?FlagsProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	1506	0x14001594c
?FlushWorkingSet@HWNDElement@DirectUI@@QEAAXXZ	1507	0x14002a77c
?FontColorRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1508	0x1400343a8
?FontFaceProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1509	0x1400087a4
?FontProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1510	0x14001a828
?FontQualityProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1511	0x1400302a4
?FontSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1512	0x1400333a0
?FontSizeRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1513	0x14001b600
?FontStyleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1514	0x1400394bc
?FontWeightProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1515	0x140005080
?FontWeightRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1516	0x1400335e0
?ForceEditTextToLTRProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	1517	0x140024fd8
?ForceThemeChange@XBaby@DirectUI@@UEAAX_K_J@Z	1518	0x140021ed8
?ForceThemeChange@XProvider@DirectUI@@UEAAJ_K_J@Z	1519	0x140038a30
?ForegroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1520	0x140007568
?Forward@Movie@DirectUI@@QEAAXXZ	1521	0x140040224
?ForwardingWindowMessage@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	1522	0x140031e0c
?FrameDurationProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	1523	0x140001560
?FrameIndexProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	1524	0x140023f9c
?FrameWidthProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	1525	0x140018958
?FrameworkId@Schema@DirectUI@@2HA	1526	0x14003afe0
?FreeComCtl32@TaskPage@DirectUI@@AEAAXXZ	1527	0x140040c08
?FreeProvider@XElement@DirectUI@@QEAAXXZ	1528	0x14002fcec
?GetAbsorbsShortcut@Element@DirectUI@@QEAA_NXZ	1529	0x14002290c
?GetAccDefAction@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1530	0x140020788
?GetAccDesc@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1531	0x14002cfdc
?GetAccHelp@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1532	0x140033e74
?GetAccItemStatus@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1533	0x140022018
?GetAccItemType@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1534	0x1400336f4
?GetAccName@DuiAccessible@DirectUI@@IEAAJUtagVARIANT@@HPEAPEAG@Z	1535	0x140010070
?GetAccName@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1536	0x14000d580
?GetAccNameAsDisplayed@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1537	0x1400118d4
?GetAccNameFromContent@DuiAccessible@DirectUI@@IEAAJPEAPEAG@Z	1538	0x140003a5c
?GetAccRole@Element@DirectUI@@QEAAHXZ	1539	0x140012f84
?GetAccState@Element@DirectUI@@QEAAHXZ	1540	0x1400089f8
?GetAccValue@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1541	0x14003453c
?GetAccessible@Element@DirectUI@@QEAA_NXZ	1542	0x1400065b0
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1543	0x1400323fc
?GetAccessibleImpl@HWNDElement@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1544	0x14003f09c
?GetAccessibleImpl@HWNDHost@DirectUI@@AEAAJPEAPEAUIAccessible@@_N@Z	1545	0x14000a88c
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1546	0x140023c50
?GetAccessibleImpl@TouchEdit2@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1547	0x140034370
?GetAccessibleParent@DuiAccessible@DirectUI@@SAPEAVElement@2@PEAV32@@Z	1548	0x1400197a0
?GetActive@Element@DirectUI@@QEAAHXZ	1549	0x140033ef0
?GetActiveState@TouchScrollBar@DirectUI@@QEAA?AW4ActiveState@2@XZ	1550	0x140021898
?GetActualReferencePoint@RefPointElement@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z	1551	0x140024148
?GetAdjacent@BorderLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1552	0x14003cf30
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z	1553	0x14003b7b0
?GetAdjacent@FillLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1554	0x1400167e0
?GetAdjacent@FlowLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1555	0x14001364c
?GetAdjacent@GridLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1556	0x14002e168
?GetAdjacent@ItemList@DirectUI@@UEAAPEAVElement@2@PEAV32@HPEBUNavReference@2@K@Z	1557	0x140013154
?GetAdjacent@Layout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1558	0x1400378b4
?GetAdjacent@NineGridLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1559	0x140022694
?GetAdjacent@RowLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1560	0x14003be14
?GetAdjacent@Selector@DirectUI@@UEAAPEAVElement@2@PEAV32@HPEBUNavReference@2@K@Z	1561	0x1400069b8
?GetAdjacent@ShellBorderLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1562	0x14001a520
?GetAdjacent@TableLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1563	0x140015820
?GetAdjacent@VerticalFlowLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1564	0x14000a6b8
?GetAdjacent@XBaby@DirectUI@@UEAAPEAVElement@2@PEAV32@HPEBUNavReference@2@K@Z	1565	0x14001f24c
?GetAllowArrowOut@TouchScrollViewer@DirectUI@@QEAA_NXZ	1566	0x140018a90
?GetAlpha@Element@DirectUI@@QEAAHXZ	1567	0x14000e7a8
?GetAnimatePopupOnDismiss@TouchSelect@DirectUI@@QEAA_NXZ	1568	0x140013658
?GetAnimation@Element@DirectUI@@QEAAHXZ	1569	0x14003b308
?GetAtom@Value@DirectUI@@QEAAGXZ	1570	0x14002a5c0
?GetAtomZero@Value@DirectUI@@SAPEAV12@XZ	1571	0x14002b4b8
?GetAutoGrouping@CCRadioButton@DirectUI@@QEAA_NXZ	1572	0x14000c97c
?GetAutoStart@Movie@DirectUI@@QEAA_NXZ	1573	0x14001ccc0
?GetAutoStop@Movie@DirectUI@@QEAA_NXZ	1574	0x14001b0e8
?GetAutomationId@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@@Z	1575	0x140017d08
?GetBackgroundColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1576	0x140034f00
?GetBackgroundOwner@HWNDHost@DirectUI@@IEAAPEAVElement@2@XZ	1577	0x14003d9d0
?GetBackgroundOwnerID@HWNDHost@DirectUI@@QEAAGXZ	1578	0x140016624
?GetBackgroundStdColor@Element@DirectUI@@QEAAHXZ	1579	0x14002dd60
?GetBool@EventManager@DirectUI@@CAJPEAUtagVARIANT@@PEAVValue@2@@Z	1580	0x140013d14
?GetBool@Value@DirectUI@@QEAA_NXZ	1581	0x14001241c
?GetBoolFalse@Value@DirectUI@@SAPEAV12@XZ	1582	0x140009cd8
?GetBoolTrue@Value@DirectUI@@SAPEAV12@XZ	1583	0x140035804
?GetBorderColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1584	0x140028b64
?GetBorderStdColor@Element@DirectUI@@QEAAHXZ	1585	0x140006358
?GetBorderStyle@Element@DirectUI@@QEAAHXZ	1586	0x140021824
?GetBorderThickness@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1587	0x14000f664
?GetBoundingRect@ElementProxy@DirectUI@@IEAAJPEAUUiaRect@@@Z	1588	0x14003f848
?GetBrowser@Navigator@DirectUI@@QEAAPEAVBrowser@2@XZ	1589	0x1400213dc
?GetBuffering@TouchSlider@DirectUI@@QEAAHXZ	1590	0x14002712c
?GetButtonClassAcceptsEnterKey@DialogElement@DirectUI@@UEAA_NXZ	1591	0x1400044a8
?GetButtonColor@CCPushButton@DirectUI@@UEAA_NPEAUHDC__@@PEAPEAUHBRUSH__@@@Z	1592	0x140018170
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z	1593	0x140040744
?GetCaptured@Button@DirectUI@@QEAA_NXZ	1594	0x140013758
?GetCaptured@TouchButton@DirectUI@@QEAA_NXZ	1595	0x14002bf68
?GetCellInfo@TableLayout@DirectUI@@QEAAPEAUCellInfo@2@H@Z	1596	0x1400227a8
?GetCheckedState@TouchCheckBox@DirectUI@@QEAA?AW4CheckedStateFlags@2@XZ	1597	0x140036180
?GetChildFromLayoutIndex@Layout@DirectUI@@QEAAPEAVElement@2@PEAV32@HPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@@Z	1598	0x1400128e8
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ	1599	0x1400072a4
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z	1600	0x1400387ec
?GetClass@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1601	0x1400218d4
?GetClassInfoPtr@AccessibleButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1602	0x140035e0c
?GetClassInfoPtr@AnimationStrip@DirectUI@@SAPEAUIClassInfo@2@XZ	1603	0x14000c77c
?GetClassInfoPtr@AutoButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1604	0x14001f4bc
?GetClassInfoPtr@BaseScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1605	0x14001a4c8
?GetClassInfoPtr@Bind@DirectUI@@SAPEAUIClassInfo@2@XZ	1606	0x140011728
?GetClassInfoPtr@Browser@DirectUI@@SAPEAUIClassInfo@2@XZ	1607	0x1400070f0
?GetClassInfoPtr@Button@DirectUI@@SAPEAUIClassInfo@2@XZ	1608	0x14002f930
?GetClassInfoPtr@CCAVI@DirectUI@@SAPEAUIClassInfo@2@XZ	1609	0x14000ba8c
?GetClassInfoPtr@CCBase@DirectUI@@SAPEAUIClassInfo@2@XZ	1610	0x140038c2c
?GetClassInfoPtr@CCBaseCheckRadioButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1611	0x140012b18
?GetClassInfoPtr@CCBaseScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1612	0x140025d48
?GetClassInfoPtr@CCCheckBox@DirectUI@@SAPEAUIClassInfo@2@XZ	1613	0x14002ca0c
?GetClassInfoPtr@CCCommandLink@DirectUI@@SAPEAUIClassInfo@2@XZ	1614	0x14003110c
?GetClassInfoPtr@CCHScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1615	0x14000fdc4
?GetClassInfoPtr@CCListBox@DirectUI@@SAPEAUIClassInfo@2@XZ	1616	0x14002d830
?GetClassInfoPtr@CCListView@DirectUI@@SAPEAUIClassInfo@2@XZ	1617	0x140001a94
?GetClassInfoPtr@CCProgressBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1618	0x14001b140
?GetClassInfoPtr@CCPushButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1619	0x14001b5ac
?GetClassInfoPtr@CCRadioButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1620	0x14000de3c
?GetClassInfoPtr@CCSysLink@DirectUI@@SAPEAUIClassInfo@2@XZ	1621	0x140013600
?GetClassInfoPtr@CCTrackBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1622	0x140008d0c
?GetClassInfoPtr@CCTreeView@DirectUI@@SAPEAUIClassInfo@2@XZ	1623	0x140016c6c
?GetClassInfoPtr@CCVScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1624	0x140003808
?GetClassInfoPtr@CheckBoxGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1625	0x140028550
?GetClassInfoPtr@Clipper@DirectUI@@SAPEAUIClassInfo@2@XZ	1626	0x14000b084
?GetClassInfoPtr@Combobox@DirectUI@@SAPEAUIClassInfo@2@XZ	1627	0x14003ea98
?GetClassInfoPtr@DialogElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1628	0x140026558
?GetClassInfoPtr@Edit@DirectUI@@SAPEAUIClassInfo@2@XZ	1629	0x14002b398
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ	1630	0x140025868
?GetClassInfoPtr@ElementWithHWND@DirectUI@@SAPEAUIClassInfo@2@XZ	1631	0x140029664
?GetClassInfoPtr@Expandable@DirectUI@@SAPEAUIClassInfo@2@XZ	1632	0x1400359b0
?GetClassInfoPtr@Expando@DirectUI@@SAPEAUIClassInfo@2@XZ	1633	0x1400187dc
?GetClassInfoPtr@ExpandoButtonGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1634	0x140023c1c
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1635	0x14000c270
?GetClassInfoPtr@HWNDHost@DirectUI@@SAPEAUIClassInfo@2@XZ	1636	0x140036170
?GetClassInfoPtr@ItemList@DirectUI@@SAPEAUIClassInfo@2@XZ	1637	0x140009ed8
?GetClassInfoPtr@Macro@DirectUI@@SAPEAUIClassInfo@2@XZ	1638	0x140039770
?GetClassInfoPtr@ModernProgressBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1639	0x14000e440
?GetClassInfoPtr@ModernProgressRing@DirectUI@@SAPEAUIClassInfo@2@XZ	1640	0x14001ce8c
?GetClassInfoPtr@Movie@DirectUI@@SAPEAUIClassInfo@2@XZ	1641	0x14000e01c
?GetClassInfoPtr@Navigator@DirectUI@@SAPEAUIClassInfo@2@XZ	1642	0x14003c6a8
?GetClassInfoPtr@PText@DirectUI@@SAPEAUIClassInfo@2@XZ	1643	0x140016594
?GetClassInfoPtr@Page@DirectUI@@SAPEAUIClassInfo@2@XZ	1644	0x14000b8ac
?GetClassInfoPtr@Pages@DirectUI@@SAPEAUIClassInfo@2@XZ	1645	0x1400030a4
?GetClassInfoPtr@Progress@DirectUI@@SAPEAUIClassInfo@2@XZ	1646	0x1400220b0
?GetClassInfoPtr@PushButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1647	0x140024054
?GetClassInfoPtr@RadioButtonGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1648	0x14003ade0
?GetClassInfoPtr@RefPointElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1649	0x140021af0
?GetClassInfoPtr@RepeatButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1650	0x140034a38
?GetClassInfoPtr@Repeater@DirectUI@@SAPEAUIClassInfo@2@XZ	1651	0x14003f3a8
?GetClassInfoPtr@RichText@DirectUI@@SAPEAUIClassInfo@2@XZ	1652	0x140022fcc
?GetClassInfoPtr@ScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1653	0x14000112c
?GetClassInfoPtr@ScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1654	0x14002d3ac
?GetClassInfoPtr@Selector@DirectUI@@SAPEAUIClassInfo@2@XZ	1655	0x140029c10
?GetClassInfoPtr@SelectorNoDefault@DirectUI@@SAPEAUIClassInfo@2@XZ	1656	0x14001703c
?GetClassInfoPtr@SemanticZoomToggle@DirectUI@@SAPEAUIClassInfo@2@XZ	1657	0x140013f3c
?GetClassInfoPtr@StyledScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1658	0x14000a204
?GetClassInfoPtr@TextGraphic@DirectUI@@SAPEAUIClassInfo@2@XZ	1659	0x140021918
?GetClassInfoPtr@Thumb@DirectUI@@SAPEAUIClassInfo@2@XZ	1660	0x1400244b4
?GetClassInfoPtr@TouchButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1661	0x140026554
?GetClassInfoPtr@TouchCheckBox@DirectUI@@SAPEAUIClassInfo@2@XZ	1662	0x14000e810
?GetClassInfoPtr@TouchCheckBoxGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1663	0x14002f298
?GetClassInfoPtr@TouchCommandButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1664	0x140035cd0
?GetClassInfoPtr@TouchEdit2@DirectUI@@SAPEAUIClassInfo@2@XZ	1665	0x14002f82c
?GetClassInfoPtr@TouchEditBase@DirectUI@@SAPEAUIClassInfo@2@XZ	1666	0x140040448
?GetClassInfoPtr@TouchHWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1667	0x14002fe1c
?GetClassInfoPtr@TouchHyperLink@DirectUI@@SAPEAUIClassInfo@2@XZ	1668	0x14000b328
?GetClassInfoPtr@TouchRepeatButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1669	0x140035b10
?GetClassInfoPtr@TouchScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1670	0x1400027dc
?GetClassInfoPtr@TouchScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1671	0x14003d6a0
?GetClassInfoPtr@TouchSelect@DirectUI@@SAPEAUIClassInfo@2@XZ	1672	0x14001f97c
?GetClassInfoPtr@TouchSelectItem@DirectUI@@SAPEAUIClassInfo@2@XZ	1673	0x140025684
?GetClassInfoPtr@TouchSlider@DirectUI@@SAPEAUIClassInfo@2@XZ	1674	0x140027c18
?GetClassInfoPtr@TouchSwitch@DirectUI@@SAPEAUIClassInfo@2@XZ	1675	0x140041604
?GetClassInfoPtr@UnknownElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1676	0x140022484
?GetClassInfoPtr@Viewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1677	0x14003928c
?GetClassInfoPtr@XBaby@DirectUI@@SAPEAUIClassInfo@2@XZ	1678	0x14002ac54
?GetClassInfoPtr@XElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1679	0x140012024
?GetClassInfoW@AccessibleButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1680	0x14001483c
?GetClassInfoW@AnimationStrip@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1681	0x140031f74
?GetClassInfoW@AutoButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1682	0x14002061c
?GetClassInfoW@BaseScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1683	0x140022144
?GetClassInfoW@Bind@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1684	0x140012d30
?GetClassInfoW@Browser@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1685	0x14002592c
?GetClassInfoW@Button@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1686	0x140033620
?GetClassInfoW@CCAVI@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1687	0x14002f9f4
?GetClassInfoW@CCBase@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1688	0x140012ff4
?GetClassInfoW@CCBaseCheckRadioButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1689	0x14001aaa8
?GetClassInfoW@CCBaseScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1690	0x14003b7c4
?GetClassInfoW@CCCheckBox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1691	0x140013af4
?GetClassInfoW@CCCommandLink@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1692	0x140038394
?GetClassInfoW@CCHScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1693	0x14000e1f4
?GetClassInfoW@CCListBox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1694	0x140011d84
?GetClassInfoW@CCListView@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1695	0x140033334
?GetClassInfoW@CCProgressBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1696	0x140007554
?GetClassInfoW@CCPushButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1697	0x140035fb8
?GetClassInfoW@CCRadioButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1698	0x14003af1c
?GetClassInfoW@CCSysLink@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1699	0x14002f90c
?GetClassInfoW@CCTrackBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1700	0x14000dedc
?GetClassInfoW@CCTreeView@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1701	0x14001b6ac
?GetClassInfoW@CCVScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1702	0x14002e91c
?GetClassInfoW@CheckBoxGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1703	0x14002af28
?GetClassInfoW@Clipper@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1704	0x14000cee4
?GetClassInfoW@Combobox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1705	0x140036afc
?GetClassInfoW@DialogElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1706	0x14003c4e4
?GetClassInfoW@Edit@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1707	0x14002e820
?GetClassInfoW@Element@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1708	0x1400042e4
?GetClassInfoW@ElementWithHWND@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1709	0x140013ea4
?GetClassInfoW@Expandable@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1710	0x140036d48
?GetClassInfoW@Expando@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1711	0x1400240f4
?GetClassInfoW@ExpandoButtonGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1712	0x1400338c4
?GetClassInfoW@HWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1713	0x14001771c
?GetClassInfoW@HWNDHost@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1714	0x1400259a0
?GetClassInfoW@ItemList@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1715	0x1400126fc
?GetClassInfoW@Macro@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1716	0x14001eaa8
?GetClassInfoW@ModernProgressBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1717	0x14000707c
?GetClassInfoW@ModernProgressRing@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1718	0x140024f34
?GetClassInfoW@Movie@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1719	0x14003b478
?GetClassInfoW@Navigator@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1720	0x14002e930
?GetClassInfoW@PText@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1721	0x1400344bc
?GetClassInfoW@Page@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1722	0x14000a734
?GetClassInfoW@Pages@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1723	0x14002e104
?GetClassInfoW@Progress@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1724	0x14003f1ac
?GetClassInfoW@PushButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1725	0x14000ca80
?GetClassInfoW@RadioButtonGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1726	0x14001ba44
?GetClassInfoW@RefPointElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1727	0x14000eb38
?GetClassInfoW@RepeatButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1728	0x1400342c4
?GetClassInfoW@Repeater@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1729	0x14000876c
?GetClassInfoW@RichText@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1730	0x14001303c
?GetClassInfoW@ScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1731	0x1400217bc
?GetClassInfoW@ScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1732	0x140008e88
?GetClassInfoW@Selector@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1733	0x140016630
?GetClassInfoW@SelectorNoDefault@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1734	0x14000cfec
?GetClassInfoW@SemanticZoomToggle@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1735	0x14002287c
?GetClassInfoW@StyledScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1736	0x1400053a8
?GetClassInfoW@TextGraphic@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1737	0x140003fd0
?GetClassInfoW@Thumb@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1738	0x14000e238
?GetClassInfoW@TouchButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1739	0x14003fdb8
?GetClassInfoW@TouchCheckBox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1740	0x14000c424
?GetClassInfoW@TouchCheckBoxGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1741	0x140010424
?GetClassInfoW@TouchCommandButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1742	0x14002f76c
?GetClassInfoW@TouchEdit2@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1743	0x14001c90c
?GetClassInfoW@TouchEditBase@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1744	0x140004b18
?GetClassInfoW@TouchHWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1745	0x1400379c0
?GetClassInfoW@TouchHyperLink@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1746	0x140005e4c
?GetClassInfoW@TouchRepeatButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1747	0x14002730c
?GetClassInfoW@TouchScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1748	0x14002d95c
?GetClassInfoW@TouchScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1749	0x140014ecc
?GetClassInfoW@TouchSelect@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1750	0x14003ad88
?GetClassInfoW@TouchSelectItem@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1751	0x14003f1f0
?GetClassInfoW@TouchSlider@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1752	0x1400398f4
?GetClassInfoW@TouchSwitch@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1753	0x140019434
?GetClassInfoW@UnknownElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1754	0x140036020
?GetClassInfoW@Viewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1755	0x140006e3c
?GetClassInfoW@XBaby@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1756	0x140015490
?GetClassInfoW@XElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1757	0x14003461c
?GetClickDevice@TouchButton@DirectUI@@QEAA?AW4ClickDevice@12@XZ	1758	0x14002c9b4
?GetClickablePoint@Element@DirectUI@@QEAA_NPEAUtagPOINT@@@Z	1759	0x14001e9a8
?GetClientAccessibleImpl@HWNDHost@DirectUI@@QEAAJPEAPEAUIAccessible@@@Z	1760	0x140017538
?GetColorFromProperty@DirectUI@@YAJPEAVElement@1@PEBUPropertyInfo@1@HPEAK@Z	1761	0x140040c1c
?GetColorFromValue@DirectUI@@YAJPEAVElement@1@PEAVValue@1@PEAK@Z	1762	0x14003dfcc
?GetColorTrans@Value@DirectUI@@SAPEAV12@XZ	1763	0x14002de54
?GetColorize@Element@DirectUI@@QEAAHXZ	1764	0x14000fbd0
?GetColumn@GridItemProxy@DirectUI@@AEAAJPEAH@Z	1765	0x14000a5b4
?GetColumnCount@GridProxy@DirectUI@@AEAAJPEAH@Z	1766	0x140003570
?GetColumnHeaderItems@TableItemProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	1767	0x1400140d0
?GetColumnHeaders@TableProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	1768	0x1400187dc
?GetCommonDrawTextFlags@Element@DirectUI@@AEAAIH@Z	1769	0x140013b18
?GetCompositingQuality@Movie@DirectUI@@QEAAHXZ	1770	0x140032e18
?GetConnect@Bind@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1771	0x14001b7bc
?GetContainingGrid@GridItemProxy@DirectUI@@AEAAJPEAPEAUIRawElementProviderSimple@@@Z	1772	0x140028d20
?GetContent@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@PEAUIAccessible@@@Z	1773	0x140013ef4
?GetContentAlign@Element@DirectUI@@QEAAHXZ	1774	0x14002d920
?GetContentCrossfadeOpacity@TouchScrollViewer@DirectUI@@QEAAMXZ	1775	0x140019d10
?GetContentDesiredSize@XBaby@DirectUI@@UEAA?AUtagSIZE@@HH@Z	1776	0x1400197a4
?GetContentSize@CCBase@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1777	0x14003be34
?GetContentSize@CCBaseCheckRadioButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1778	0x14002e200
?GetContentSize@CCCommandLink@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1779	0x14002b7ec
?GetContentSize@CCHScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1780	0x14002bd20
?GetContentSize@CCListBox@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1781	0x140011300
?GetContentSize@CCListView@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1782	0x140030fd0
?GetContentSize@CCPushButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1783	0x140032140
?GetContentSize@CCSysLink@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1784	0x14003cdec
?GetContentSize@CCTreeView@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1785	0x14000429c
?GetContentSize@CCVScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1786	0x1400099f0
?GetContentSize@Combobox@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1787	0x140009f08
?GetContentSize@Edit@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1788	0x14003538c
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1789	0x140024728
?GetContentSize@Progress@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1790	0x140039b04
?GetContentSize@PushButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1791	0x140038850
?GetContentSize@RichText@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1792	0x140040378
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1793	0x140023240
?GetContentStringAsDisplayed@Edit@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1794	0x140037a0c
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1795	0x140040e80
?GetContentStringAsDisplayed@TextGraphic@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1796	0x14001f82c
?GetContentStringAsDisplayed@TouchEditBase@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1797	0x140012dd0
?GetControlType@ElementProxy@DirectUI@@IEAAXPEAUtagVARIANT@@PEAUIAccessible@@@Z	1798	0x14002a424
?GetControllerFor@TouchEditBase@DirectUI@@UEAAJPEAPEAUIUnknown@@@Z	1799	0x1400171d8
?GetCount@CCListBox@DirectUI@@QEAAHXZ	1800	0x14003b5b8
?GetCount@Pages@DirectUI@@QEAAIXZ	1801	0x14001971c
?GetCreationFlags@XElement@DirectUI@@UEAAIXZ	1802	0x14001d67c
?GetCurrentCols@GridLayout@DirectUI@@IEAAIH@Z	1803	0x140033c78
?GetCurrentCols@GridLayout@DirectUI@@IEAAIPEAVElement@2@@Z	1804	0x14002fbb0
?GetCurrentPage@Browser@DirectUI@@QEAAPEAVElement@2@XZ	1805	0x14002e4b4
?GetCurrentPageID@Browser@DirectUI@@QEAAGXZ	1806	0x14003d910
?GetCurrentRows@GridLayout@DirectUI@@IEAAIH@Z	1807	0x14002ec4c
?GetCurrentRows@GridLayout@DirectUI@@IEAAIPEAVElement@2@@Z	1808	0x1400363a8
?GetCursor@Value@DirectUI@@QEAAPEAUCursor@2@XZ	1809	0x1400090a8
?GetCursorNull@Value@DirectUI@@SAPEAV12@XZ	1810	0x140023e58
?GetDPI@Element@DirectUI@@QEAAHXZ	1811	0x14003d488
?GetDataEntry@Macro@DirectUI@@QEAAPEAUIDataEntry@2@XZ	1812	0x140011298
?GetDblListEmpty@Value@DirectUI@@SAPEAV12@XZ	1813	0x140010864
?GetDefaultButton@DialogElement@DirectUI@@UEAAPEAVElement@2@XZ	1814	0x140017fe0
?GetDefaultButton@DialogElementCore@DirectUI@@QEAAPEAVElement@2@XZ	1815	0x140008b34
?GetDefaultButtonTracking@DialogElement@DirectUI@@UEAA_NXZ	1816	0x140036b68
?GetDefaultButtonTracking@XBaby@DirectUI@@UEAA_NXZ	1817	0x14002cb6c
?GetDeferObject@Element@DirectUI@@QEAAPEAVDeferCycle@2@XZ	1818	0x140002614
?GetDesiredSize@Element@DirectUI@@QEAAPEBUtagSIZE@@XZ	1819	0x14000d304
?GetDesiredSize@XProvider@DirectUI@@UEAAJHHPEAUtagSIZE@@@Z	1820	0x140039084
?GetDirection@Element@DirectUI@@QEAAHXZ	1821	0x1400114c0
?GetDirty@Edit@DirectUI@@QEAA_NXZ	1822	0x140016200
?GetDisableMouseInRectCheck@TouchRepeatButton@DirectUI@@QEAA_NXZ	1823	0x1400189fc
?GetDispatchFromElement@DuiAccessible@DirectUI@@IEAAJPEAVElement@2@PEAPEAUIDispatch@@@Z	1824	0x14002db0c
?GetDisplayNode@Element@DirectUI@@QEAAPEAUHGADGET__@@XZ	1825	0x140034fbc
?GetDoubleList@Value@DirectUI@@QEAAPEAV?$DynamicArray@N$0A@@2@XZ	1826	0x140027e04
?GetDrawOutlines@Movie@DirectUI@@QEAA_NXZ	1827	0x14000718c
?GetEdgeHighlightColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1828	0x14000f29c
?GetEdgeHighlightThickness@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1829	0x14000a50c
?GetElListNull@Value@DirectUI@@SAPEAV12@XZ	1830	0x140010f5c
?GetElement@CCBaseScrollBar@DirectUI@@UEAAPEAVElement@2@XZ	1831	0x14003ae80
?GetElement@ElementProvider@DirectUI@@UEAAPEDVElement@2@XZ	1832	0x140010a5c
?GetElement@NativeHWNDHost@DirectUI@@QEAAPEAVElement@2@XZ	1833	0x14002f114
?GetElement@ScrollBar@DirectUI@@UEAAPEAVElement@2@XZ	1834	0x140018688
?GetElement@TaskPage@DirectUI@@IEAAPEAVElement@2@XZ	1835	0x140022854
?GetElement@Value@DirectUI@@QEAAPEAVElement@2@XZ	1836	0x140010f74
?GetElement@XHost@DirectUI@@QEAAPEAVElement@2@XZ	1837	0x14001d93c
?GetElementKey@ElementProvider@DirectUI@@QEAAPEBVElement@2@XZ	1838	0x140005a84
?GetElementList@Value@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@XZ	1839	0x1400397d4
?GetElementMovesOnIHMNotify@TouchEditBase@DirectUI@@QEAA_NXZ	1840	0x140005bfc
?GetElementNull@Value@DirectUI@@SAPEAV12@XZ	1841	0x140028ae4
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z	1842	0x1400183b4
?GetElementProviderImpl@TouchSelect@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z	1843	0x140007208
?GetElementProviderImpl@XBaby@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z	1844	0x1400038ac
?GetElementScaleFactor@Element@DirectUI@@QEAAMXZ	1845	0x140017428
?GetElementScaledFloat@Value@DirectUI@@QEAAMPEAVElement@2@@Z	1846	0x14000da08
?GetElementScaledInt@Value@DirectUI@@QEAAHPEAVElement@2@@Z	1847	0x14001a154
?GetElementScaledPoint@Value@DirectUI@@QEAAXPEAVElement@2@PEAUtagPOINT@@@Z	1848	0x14002ed9c
?GetElementScaledRect@Value@DirectUI@@QEAAXPEAVElement@2@PEAUtagRECT@@@Z	1849	0x140005014
?GetElementScaledSize@Value@DirectUI@@QEAAXPEAVElement@2@PEAUtagSIZE@@@Z	1850	0x1400191b0
?GetEmbeddedFragmentRoots@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	1851	0x140008ec4
?GetEnabled@Element@DirectUI@@QEAA_NXZ	1852	0x140009a3c
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z	1853	0x14001e964
?GetEncodedContentStringLength@Element@DirectUI@@QEAA_KXZ	1854	0x140010280
?GetEncodedString@Value@DirectUI@@QEAAJPEAG_K@Z	1855	0x14000dfd8
?GetEncodedStringLength@Value@DirectUI@@QEAA_KXZ	1856	0x14003c094
?GetEnforceSize@PushButton@DirectUI@@QEAA_NXZ	1857	0x14000230c
?GetExpand@Macro@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1858	0x140008a8c
?GetExpandCollapseState@EventManager@DirectUI@@CAXPEAUtagVARIANT@@@Z	1859	0x14003dc88
?GetExpanded@Expandable@DirectUI@@QEAA_NXZ	1860	0x140005100
?GetExprNull@Value@DirectUI@@SAPEAV12@XZ	1861	0x14003140c
?GetExpression@Value@DirectUI@@QEAAPEAVExpression@2@XZ	1862	0x1400265c0
?GetExtent@Element@DirectUI@@QEAAPEBUtagSIZE@@PEAPEAVValue@2@@Z	1863	0x14001fed8
?GetFactory@RichText@DirectUI@@QEAAPEAUIDWriteFactory@@XZ	1864	0x1400255b4
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ	1865	0x1400378f8
?GetFill@Value@DirectUI@@QEAAPEBUFill@2@XZ	1866	0x140005bc4
?GetFillpartElement@TouchSlider@DirectUI@@QEAAPEAVElement@2@XZ	1867	0x1400054d0
?GetFilterOnPaste@TouchEditBase@DirectUI@@QEAA_NXZ	1868	0x140028b1c
?GetFlags@TouchHWNDElement@DirectUI@@QEAA?AW4TouchHWNDElementFlags@2@XZ	1869	0x14000c9d0
?GetFloat@Value@DirectUI@@QEAAMXZ	1870	0x1400387d4
?GetFloatOne@Value@DirectUI@@SAPEAV12@XZ	1871	0x140033b6c
?GetFloatZero@Value@DirectUI@@SAPEAV12@XZ	1872	0x140006bb0
?GetFocus@HWNDElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderFragment@@@Z	1873	0x14000d7c4
?GetFocus@HWNDElementProxy@DirectUI@@IEAAJPEAPEAUIRawElementProviderFragment@@@Z	1874	0x140003d38
?GetFocusableElement@XBaby@DirectUI@@UEAAPEAVElement@2@XZ	1875	0x14001f1ec
?GetFocusedHWNDElement@HWNDElement@DirectUI@@SAPEAV12@XZ	1876	0x14003b0d8
?GetFont@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1877	0x140020cac
?GetFont@HWNDHost@DirectUI@@IEAAPEAUHFONT__@@XZ	1878	0x140003c10
?GetFontFace@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1879	0x14003c0c8
?GetFontQuality@Element@DirectUI@@QEAAHXZ	1880	0x14000817c
?GetFontSize@Element@DirectUI@@QEAAHXZ	1881	0x14002ede8
?GetFontStyle@Element@DirectUI@@QEAAHXZ	1882	0x14003bb94
?GetFontWeight@Element@DirectUI@@QEAAHXZ	1883	0x140024ea4
?GetForceEditTextToLTR@TouchEditBase@DirectUI@@QEAA_NXZ	1884	0x14000c54c
?GetForegroundColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1885	0x140028744
?GetForegroundColorRef@RichText@DirectUI@@UEAAJPEAK@Z	1886	0x140003230
?GetForegroundColorRef@TouchButton@DirectUI@@UEAAJPEAK@Z	1887	0x140022d8c
?GetForegroundStdColor@Element@DirectUI@@QEAAHXZ	1888	0x14002ea6c
?GetFragmentRoot@ElementProxy@DirectUI@@IEAAJPEAPEAUIRawElementProviderFragmentRoot@@@Z	1889	0x140035d48
?GetFrameDuration@AnimationStrip@DirectUI@@QEAAHXZ	1890	0x140001168
?GetFrameIndex@AnimationStrip@DirectUI@@QEAAHXZ	1891	0x14003521c
?GetFrameWidth@AnimationStrip@DirectUI@@QEAAHXZ	1892	0x14002807c
?GetGetSheetCallback@DUIXmlParser@DirectUI@@QEAAP6APEAVValue@2@PEBGPEAX@ZXZ	1893	0x14000299c
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ	1894	0x14001f9a4
?GetGraphic@Value@DirectUI@@QEAAPEAUGraphic@2@XZ	1895	0x140017b44
?GetHDC@DCSurface@DirectUI@@QEAAPEAUHDC__@@XZ	1896	0x14000db64
?GetHInstance@DUIXmlParser@DirectUI@@QEAAPEAUHINSTANCE__@@XZ	1897	0x14002632c
?GetHScroll@ScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	1898	0x1400324e8
?GetHScroll@StyledScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	1899	0x140004950
?GetHScrollbar@TouchScrollViewer@DirectUI@@QEAAJPEAPEAVElement@2@@Z	1900	0x14001c784
?GetHWND@HWNDElement@DirectUI@@UEAAPEAUHWND__@@XZ	1901	0x140010004
?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ	1902	0x1400401b4
?GetHWND@NativeHWNDHost@DirectUI@@QEAAPEAUHWND__@@XZ	1903	0x14001f21c
?GetHWND@XHost@DirectUI@@QEAAPEAUHWND__@@XZ	1904	0x140008f64
?GetHWNDParent@HWNDHost@DirectUI@@QEAAPEAUHWND__@@XZ	1905	0x140027e1c
?GetHandle@ResourceModuleHandles@DirectUI@@QEAAJPEBGPEAPEAUHINSTANCE__@@@Z	1906	0x140019e14
?GetHandleEnter@TouchButton@DirectUI@@QEAA_NXZ	1907	0x14002e4c0
?GetHandleEnterKey@DialogElement@DirectUI@@UEAA_NXZ	1908	0x140011d04
?GetHandleGlobalEnter@TouchButton@DirectUI@@QEAA_NXZ	1909	0x14000a76c
?GetHasShield@CCPushButton@DirectUI@@QEAA_NXZ	1910	0x140038c04
?GetHeight@Element@DirectUI@@QEAAHXZ	1911	0x1400218cc
?GetHighDPI@Element@DirectUI@@QEAA_NXZ	1912	0x1400401ec
?GetHostedElementID@XBaby@DirectUI@@UEAAJPEAG@Z	1913	0x1400302fc
?GetHostedElementID@XProvider@DirectUI@@UEAAJPEAG@Z	1914	0x140004c14
?GetHwnd@ElementProxy@DirectUI@@IEAAJPEAPEAUHWND__@@@Z	1915	0x14001b734
?GetID@Element@DirectUI@@QEAAGXZ	1916	0x14001f44c
?GetIDsOfNames@DuiAccessible@DirectUI@@UEAAJAEBU_GUID@@PEAPEAGIKPEAJ@Z	1917	0x140008a90
?GetIHMRect@TouchHWNDElement@DirectUI@@QEAAJPEAUtagRECT@@@Z	1918	0x14003b060
?GetIHMState@TouchHWNDElement@DirectUI@@QEAA?AW4IHMState@2@XZ	1919	0x14000d500
?GetIMEComposing@TouchEditBase@DirectUI@@QEAA_NXZ	1920	0x140011cb8
?GetIdentityString@DuiAccessible@DirectUI@@UEAAJKPEAPEAEPEAK@Z	1921	0x14002e0b4
?GetIdentityString@HWNDHostAccessible@DirectUI@@UEAAJKPEAPEAEPEAK@Z	1922	0x14001cd88
?GetIgnoredKeyCombos@TouchEditBase@DirectUI@@QEAA?AW4TouchEditFilteredKeyComboFlags@2@XZ	1923	0x14001dca8
?GetImage@Value@DirectUI@@QEAAPEAX_NM@Z	1924	0x14001ae0c
?GetImmediateChild@Element@DirectUI@@QEAAPEAV12@PEAV12@@Z	1925	0x1400118e4
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z	1926	0x140012f20
?GetImmersiveFocusRectOffsets@TouchButton@DirectUI@@UEAAXPEAUtagRECT@@@Z	1927	0x14001a378
?GetImmersiveFocusRectOffsets@TouchCheckBox@DirectUI@@UEAAXPEAUtagRECT@@@Z	1928	0x14000abf4
?GetImmersiveFocusRectOffsets@TouchHyperLink@DirectUI@@UEAAXPEAUtagRECT@@@Z	1929	0x14003efac
?GetIndex@Element@DirectUI@@QEAAHXZ	1930	0x140011404
?GetInertiaEndpointVisibleRect@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@@Z	1931	0x140032dfc
?GetInertiaEndpointZoomLevel@TouchScrollViewer@DirectUI@@QEAAMM@Z	1932	0x140013f10
?GetInnerBorderThickness@TouchEdit2@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1933	0x1400193cc
?GetInnerHWND@XElement@DirectUI@@QEAAPEAUHWND__@@XZ	1934	0x14000f290
?GetInputScope@TouchEdit2@DirectUI@@QEAA?AW4__MIDL___MIDL_itf_inputscope_0000_0000_0001@@XZ	1935	0x140029ba8
?GetInt@EventManager@DirectUI@@CAJPEAUtagVARIANT@@PEAVValue@2@@Z	1936	0x14001d298
?GetInt@Value@DirectUI@@QEAAHXZ	1937	0x14000505c
?GetIntMinusOne@Value@DirectUI@@SAPEAV12@XZ	1938	0x14000d168
?GetIntZero@Value@DirectUI@@SAPEAV12@XZ	1939	0x14001f7fc
?GetIntegrateIMECandidateList@TouchEditBase@DirectUI@@QEAA_NXZ	1940	0x14002e318
?GetInteractionMode@TouchScrollViewer@DirectUI@@QEAAHXZ	1941	0x14000e404
?GetInterpolationMode@Movie@DirectUI@@QEAAHXZ	1942	0x14003036c
?GetInvokeHelper@InvokeManager@DirectUI@@SAJPEAPEAVInvokeHelper@2@@Z	1943	0x140018b98
?GetIsContinuous@TouchSlider@DirectUI@@QEAA_NXZ	1944	0x140032118
?GetIsPressed@TouchSlider@DirectUI@@QEAA_NXZ	1945	0x14001b0cc
?GetIsReadOnly@ValueProxy@DirectUI@@AEAAJPEAH@Z	1946	0x14002f7dc
?GetIsSelected@NavigatorSelectionItemProxy@DirectUI@@AEAAJPEAVBrowser@2@PEAH@Z	1947	0x14003053c
?GetIsSelectionRequired@BrowserSelectionProxy@DirectUI@@AEAAJPEAH@Z	1948	0x14001bb8c
?GetIsSelectionRequired@SelectorSelectionProxy@DirectUI@@AEAAJPEAH@Z	1949	0x140017fb8
?GetIsShowOnOffFeedback@TouchSlider@DirectUI@@QEAA_NXZ	1950	0x14002c9d0
?GetIsVertical@TouchSlider@DirectUI@@QEAA_NXZ	1951	0x1400255b4
?GetItem@GridProvider@DirectUI@@UEAAJHHPEAPEAUIRawElementProviderSimple@@@Z	1952	0x14003cafc
?GetItem@GridProxy@DirectUI@@AEAAJIIPEAPEAUIRawElementProviderSimple@@@Z	1953	0x14000f09c
?GetItemCount@TouchSelect@DirectUI@@QEAAKXZ	1954	0x140021604
?GetItemData@TouchSelect@DirectUI@@QEAAJHPEAPEAUIUnknown@@@Z	1955	0x140023884
?GetItemData@TouchSelectItem@DirectUI@@QEAAJPEAPEAUIUnknown@@@Z	1956	0x140037df4
?GetItemHeightInPopup@TouchSelect@DirectUI@@QEAAHXZ	1957	0x140026db0
?GetItemState@CCTreeView@DirectUI@@QEAAIQEAU_TREEITEM@@@Z	1958	0x140011f64
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ	1959	0x1400186b4
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ	1960	0x1400227ac
?GetKeyFocusedElement@DialogElement@DirectUI@@UEAAPEAVElement@2@XZ	1961	0x140008c88
?GetKeyFocusedElement@HWNDElement@DirectUI@@SAPEAVElement@2@XZ	1962	0x140036798
?GetKeyWithin@Element@DirectUI@@QEAA_NXZ	1963	0x14000ab50
?GetKeyWithinChild@Element@DirectUI@@QEAAPEAV12@XZ	1964	0x140034a88
?GetKeyboardNavigationCapture@TouchEditBase@DirectUI@@QEAA?AW4TouchEditKeyboardNavigationCapture@2@XZ	1965	0x140016b58
?GetLabel@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@@Z	1966	0x140017e9c
?GetLayout@Element@DirectUI@@QEAAPEAVLayout@2@PEAPEAVValue@2@@Z	1967	0x140032aa0
?GetLayout@Value@DirectUI@@QEAAPEAVLayout@2@XZ	1968	0x1400144a4
?GetLayoutChildCount@Layout@DirectUI@@QEAAIPEAVElement@2@@Z	1969	0x14001c518
?GetLayoutIndexFromChild@Layout@DirectUI@@QEAAHPEAVElement@2@0@Z	1970	0x14003fa18
?GetLayoutNull@Value@DirectUI@@SAPEAV12@XZ	1971	0x140006600
?GetLayoutPos@Element@DirectUI@@QEAAHXZ	1972	0x14002cae0
?GetLightDismissIHM@TouchHWNDElement@DirectUI@@QEAA_NXZ	1973	0x14003c60c
?GetLine@CCBaseScrollBar@DirectUI@@UEAAHXZ	1974	0x140020320
?GetLine@FlowLayout@DirectUI@@QEAAHPEAVElement@2@0@Z	1975	0x14002a318
?GetLine@ScrollBar@DirectUI@@UEAAHXZ	1976	0x140005ca0
?GetLine@VerticalFlowLayout@DirectUI@@QEAAHPEAVElement@2@0@Z	1977	0x14001537c
?GetLineCount@RichText@DirectUI@@QEAAKXZ	1978	0x14002e748
?GetLineSize@CCTrackBar@DirectUI@@QEAAHXZ	1979	0x14002e30c
?GetLinkIndicatorsToContent@TouchScrollViewer@DirectUI@@QEAA_NXZ	1980	0x1400023c0
?GetLocation@Element@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z	1981	0x140016c18
?GetManipulationCompositor@TouchScrollViewer@DirectUI@@QEAAPEAUIDirectManipulationCompositor@@XZ	1982	0x14000f56c
?GetManipulationHorizontalAlignment@TouchScrollViewer@DirectUI@@QEAAHXZ	1983	0x140015278
?GetManipulationManager@TouchScrollViewer@DirectUI@@QEAAPEAUIDirectManipulationManager@@XZ	1984	0x1400407dc
?GetManipulationVerticalAlignment@TouchScrollViewer@DirectUI@@QEAAHXZ	1985	0x14001e90c
?GetManipulationViewport@TouchScrollViewer@DirectUI@@QEAAPEAUIDirectManipulationViewport@@_N@Z	1986	0x14000c838
?GetMargin@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1987	0x1400213d4
?GetMaxLength@Edit@DirectUI@@QEAAHXZ	1988	0x1400296b4
?GetMaxLength@TouchEditBase@DirectUI@@QEAAHXZ	1989	0x14000ff80
?GetMaximum@CCBaseScrollBar@DirectUI@@UEAAHXZ	1990	0x140001a0c
?GetMaximum@ModernProgressBar@DirectUI@@QEAAHXZ	1991	0x14003dcf4
?GetMaximum@Progress@DirectUI@@QEAAHXZ	1992	0x14001a5dc
?GetMaximum@ScrollBar@DirectUI@@UEAAHXZ	1993	0x14000e25c
?GetMetering@TouchSlider@DirectUI@@QEAAHXZ	1994	0x14003d680
?GetMinSize@Element@DirectUI@@QEAAPEBUtagSIZE@@PEAPEAVValue@2@@Z	1995	0x140004ca4
?GetMinimum@CCBaseScrollBar@DirectUI@@UEAAHXZ	1996	0x14000c3e4
?GetMinimum@ModernProgressBar@DirectUI@@QEAAHXZ	1997	0x1400158f4
?GetMinimum@Progress@DirectUI@@QEAAHXZ	1998	0x14001a378
?GetMinimum@ScrollBar@DirectUI@@UEAAHXZ	1999	0x14001a6fc
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ	2000	0x140016ec8
?GetModuleBase@CallstackTracker@DirectUI@@AEAA_KPEAX_K@Z	2001	0x140009170
?GetMouseFocused@Element@DirectUI@@QEAA_NXZ	2002	0x1400404cc
?GetMouseWithin@Element@DirectUI@@QEAA_NXZ	2003	0x140005448
?GetMouseWithinChild@Element@DirectUI@@QEAAPEAV12@XZ	2004	0x140036598
?GetMouseWithinHorizontalScrollRegion@TouchScrollViewer@DirectUI@@QEAA_NXZ	2005	0x140037468
?GetMoveCaretToEndOnSyncContent@TouchEditBase@DirectUI@@QEAA_NXZ	2006	0x140015374
?GetMultiline@Edit@DirectUI@@QEAA_NXZ	2007	0x14000ea00
?GetMultiline@TouchEditBase@DirectUI@@QEAA_NXZ	2008	0x14001ec18
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ	2009	0x14002a9f8
?GetNote@CCCommandLink@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2010	0x140027848
?GetNotificationSinkHWND@XElement@DirectUI@@UEAAPEAUHWND__@@XZ	2011	0x14001783c
?GetNull@Value@DirectUI@@SAPEAV12@XZ	2012	0x14001039c
?GetOffText@TouchSwitch@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2013	0x14000d144
?GetOnText@TouchSwitch@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2014	0x14003de4c
?GetOptimizeMove@HWNDHost@DirectUI@@QEAA_NXZ	2015	0x14000ee10
?GetOrder@ScrollBar@DirectUI@@QEAAHXZ	2016	0x1400046c8
?GetOverhang@Element@DirectUI@@QEAA_NXZ	2017	0x14002616c
?GetOverrideButtonBackground@CCPushButton@DirectUI@@QEAA_NXZ	2018	0x140021adc
?GetOverrideScaleFactor@DUIXmlParser@DirectUI@@QEBA_NPEAM@Z	2019	0x14001b27c
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ	2020	0x140039904
?GetPVLAnimationState@Element@DirectUI@@QEAAHXZ	2021	0x140035ab8
?GetPadding@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	2022	0x140032f48
?GetPage@CCBaseScrollBar@DirectUI@@UEAAHXZ	2023	0x1400106a4
?GetPage@Pages@DirectUI@@QEAAPEAVElement@2@I@Z	2024	0x14000d298
?GetPage@Pages@DirectUI@@QEAAPEAVElement@2@PEBG@Z	2025	0x140008528
?GetPage@ScrollBar@DirectUI@@UEAAHXZ	2026	0x14001c194
?GetPageInc@BaseScrollBar@DirectUI@@QEAAHXZ	2027	0x14001f1cc
?GetPageRCID@TaskPage@DirectUI@@MEAAIXZ	2028	0x14000709c
?GetPageResID@TaskPage@DirectUI@@MEAAPEBGXZ	2029	0x140018b88
?GetPages@Browser@DirectUI@@QEAAPEAVPages@2@XZ	2030	0x140028ee0
?GetParent@Element@DirectUI@@QEAAPEAV12@XZ	2031	0x1400125dc
?GetParentHWND@TaskPage@DirectUI@@QEAAPEAUHWND__@@XZ	2032	0x1400246b0
?GetParser@DUIFactory@DirectUI@@QEAAPEAVDUIXmlParser@2@XZ	2033	0x140012c10
?GetParserCommon@DUIXmlParser@DirectUI@@IEAAJPEAPEAV12@@Z	2034	0x140034f18
?GetPasswordCharacter@Edit@DirectUI@@QEAAHXZ	2035	0x14000d210
?GetPasswordCharacter@TouchEditBase@DirectUI@@QEAAHXZ	2036	0x14001e828
?GetPasswordRevealMode@TouchEdit2@DirectUI@@QEAA?AW4TouchEditPasswordRevealMode@2@XZ	2037	0x14003cb84
?GetPath@Movie@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2038	0x140002e28
?GetPatternProvider@ElementProvider@DirectUI@@UEAAJHPEAPEAUIUnknown@@@Z	2039	0x14001ef5c
?GetPinning@BaseScrollViewer@DirectUI@@QEAAHXZ	2040	0x140009c40
?GetPixelOffsetMode@Movie@DirectUI@@QEAAHXZ	2041	0x140027480
?GetPlay@AnimationStrip@DirectUI@@QEAA_NXZ	2042	0x140040a34
?GetPlayAllFramesMode@Movie@DirectUI@@QEAA_NXZ	2043	0x140040b2c
?GetPoint@Value@DirectUI@@QEAAPEBUtagPOINT@@XZ	2044	0x1400368dc
?GetPointZero@Value@DirectUI@@SAPEAV12@XZ	2045	0x14002b4e4
?GetPopupBounds@TouchSelect@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	2046	0x140002800
?GetPosition@CCBaseScrollBar@DirectUI@@UEAAHXZ	2047	0x14003384c
?GetPosition@ModernProgressBar@DirectUI@@QEAAHXZ	2048	0x14000e1f0
?GetPosition@Progress@DirectUI@@QEAAHXZ	2049	0x140030b24
?GetPosition@ScrollBar@DirectUI@@UEAAHXZ	2050	0x14002cf2c
?GetPredictedVisibleRect@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@@Z	2051	0x140022e80
?GetPreserveAlphaChannel@Element@DirectUI@@QEBA_NXZ	2052	0x14000990c
?GetPressed@Button@DirectUI@@QEAA_NXZ	2053	0x14001fc78
?GetPressed@TouchButton@DirectUI@@QEAA_NXZ	2054	0x140025cf0
?GetPreventFormatChangeUpdatingModifiedState@TouchEditBase@DirectUI@@QEAA_NXZ	2055	0x140004430
?GetProcs@Schema@DirectUI@@CAJXZ	2056	0x140022288
?GetPromptText@TouchEdit2@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2057	0x14002e870
?GetPromptWithCaret@TouchEdit2@DirectUI@@QEAA_NXZ	2058	0x140025d48
?GetPropValPairInfo@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUIClassInfo@2@PEBG2PEAPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	2059	0x14000700c
?GetPropValPairInfo@DUIXmlParser@DirectUI@@IEAAJULINEINFO@2@PEAUIClassInfo@2@PEBG2PEAPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	2060	0x14000cb10
?GetProperty@Bind@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2061	0x140025048
?GetProperty@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@H@Z	2062	0x14001e044
?GetPropertyValue@ElementProvider@DirectUI@@UEAAJHPEAUtagVARIANT@@@Z	2063	0x14001d624
?GetProportional@CCBaseScrollBar@DirectUI@@UEAA_NXZ	2064	0x14003b270
?GetProportional@ScrollBar@DirectUI@@UEAA_NXZ	2065	0x14000aaec
?GetProvider@XElement@DirectUI@@QEAAPEAUIXProvider@2@XZ	2066	0x14001b50c
?GetProviderOptions@ElementProxy@DirectUI@@IEAAJPEAW4ProviderOptions@@@Z	2067	0x14001468c
?GetProxyCreator@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2068	0x14000467c
?GetProxyCreator@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2069	0x14000f728
?GetProxyCreator@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2070	0x14001df94
?GetProxyCreator@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2071	0x140039d2c
?GetProxyCreator@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2072	0x140010624
?GetProxyCreator@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2073	0x140032150
?GetProxyCreator@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2074	0x140010538
?GetProxyCreator@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2075	0x140016518
?GetProxyCreator@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2076	0x140021b68
?GetProxyCreator@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2077	0x14003adb8
?GetProxyCreator@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2078	0x140018d14
?GetProxyCreator@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2079	0x140027a5c
?GetProxyCreator@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2080	0x14001e9c4
?GetProxyCreator@ElementProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2081	0x14002c3dc
?GetProxyCreator@ExpandCollapseProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2082	0x140027e9c
?GetProxyCreator@GridItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2083	0x1400293e0
?GetProxyCreator@GridProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2084	0x14001aa10
?GetProxyCreator@HWNDElementProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2085	0x140021dd8
?GetProxyCreator@InvokeProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2086	0x140026b18
?GetProxyCreator@RangeValueProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2087	0x14000e23c
?GetProxyCreator@ScrollItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2088	0x140017de8
?GetProxyCreator@ScrollProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2089	0x1400146d8
?GetProxyCreator@SelectionItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2090	0x14000fc40
?GetProxyCreator@SelectionProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2091	0x140027564
?GetProxyCreator@TableItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2092	0x140026950
?GetProxyCreator@TableProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2093	0x140034208
?GetProxyCreator@ToggleProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2094	0x140007110
?GetProxyCreator@ValueProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2095	0x14003a438
?GetRangeMax@CCTrackBar@DirectUI@@QEAAHXZ	2096	0x14001e484
?GetRangeMax@TouchSlider@DirectUI@@QEAAHXZ	2097	0x14000a3a4
?GetRangeMin@CCTrackBar@DirectUI@@QEAAHXZ	2098	0x140001fbc
?GetRangeMin@TouchSlider@DirectUI@@QEAAHXZ	2099	0x140029b6c
?GetRawValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z	2100	0x14001ae54
?GetReadOnly@TouchEditBase@DirectUI@@QEAA_NXZ	2101	0x140005964
?GetRect@Value@DirectUI@@QEAAPEBUtagRECT@@XZ	2102	0x14000b748
?GetRectZero@Value@DirectUI@@SAPEAV12@XZ	2103	0x140039004
?GetRefCount@Value@DirectUI@@QEBAHXZ	2104	0x140023448
?GetReferencePoint@RefPointElement@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z	2105	0x14001a57c
?GetRegisteredDefaultButton@DialogElement@DirectUI@@UEAAPEAVElement@2@XZ	2106	0x14003c9b0
?GetRenderBorderThickness@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2107	0x140003bb4
?GetRenderEdgeHighlightThickness@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2108	0x140031238
?GetRenderMargin@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2109	0x14003eb60
?GetRenderMinSize@Element@DirectUI@@QEAAXPEAUtagSIZE@@@Z	2110	0x1400088fc
?GetRenderPadding@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2111	0x140002a74
?GetRepeat@Movie@DirectUI@@QEAA_NXZ	2112	0x14000abc4
?GetResourceHInstance@DUIXmlParser@DirectUI@@QEAAPEAUHINSTANCE__@@XZ	2113	0x14001c7d0
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ	2114	0x140001900
?GetRoot@XProvider@DirectUI@@IEAAPEAVElement@2@XZ	2115	0x140004768
?GetRootRelativeBounds@Element@DirectUI@@QEAAJPEAUtagRECT@@@Z	2116	0x1400336dc
?GetRow@GridItemProxy@DirectUI@@AEAAJPEAH@Z	2117	0x14003f01c
?GetRowCount@GridProxy@DirectUI@@AEAAJPEAH@Z	2118	0x14003fbf8
?GetRowHeaderItems@TableItemProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2119	0x140010dcc
?GetRowHeaders@TableProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2120	0x1400286d4
?GetRuntimeId@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2121	0x140003ef0
?GetRuntimeId@ElementProxy@DirectUI@@IEAAJPEAPEAUtagSAFEARRAY@@@Z	2122	0x1400178c0
?GetScaledFloat@Value@DirectUI@@QEAAMM@Z	2123	0x14001fde4
?GetScaledInt@Value@DirectUI@@QEAAHM@Z	2124	0x140018c10
?GetScaledInt@Value@DirectUI@@QEAAPEBUScaledInt@2@XZ	2125	0x140019e14
?GetScaledPoint@Value@DirectUI@@QEAAXMPEAUtagPOINT@@@Z	2126	0x14002443c
?GetScaledRect@Value@DirectUI@@QEAAXMPEAUtagRECT@@@Z	2127	0x140026cac
?GetScaledSize@Value@DirectUI@@QEAAXMPEAUtagSIZE@@@Z	2128	0x1400033e4
?GetScrollBar@ScrollProxy@DirectUI@@AEAAPEAVBaseScrollBar@2@_N@Z	2129	0x1400317c0
?GetScrollBarHelper@ScrollProxy@DirectUI@@AEAAPEAVBaseScrollBar@2@PEAVElement@2@_N@Z	2130	0x140038fc8
?GetScrollPadding@TouchScrollViewer@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	2131	0x140024f5c
?GetScrollPercent@ScrollProxy@DirectUI@@AEAAJ_NPEAN@Z	2132	0x140017978
?GetScrollable@ScrollProxy@DirectUI@@AEAAJ_NPEAH@Z	2133	0x14003c5fc
?GetSelected@Element@DirectUI@@QEAA_NXZ	2134	0x1400327bc
?GetSelection@BrowserSelectionProxy@DirectUI@@AEAAJPEAPEAUtagSAFEARRAY@@@Z	2135	0x1400300dc
?GetSelection@Combobox@DirectUI@@QEAAHXZ	2136	0x14002896c
?GetSelection@SelectionProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2137	0x1400325e8
?GetSelection@Selector@DirectUI@@QEAAPEAVElement@2@XZ	2138	0x140009fd0
?GetSelection@TouchEdit2@DirectUI@@QEAAJPEAJ0@Z	2139	0x140006884
?GetSelection@TouchSelect@DirectUI@@QEAAPEAVElement@2@XZ	2140	0x1400232d8
?GetSelectionBackgroundColor@TouchEditBase@DirectUI@@QEAAPEAVValue@2@XZ	2141	0x14000873c
?GetSelectionContainer@SelectorSelectionItemProxy@DirectUI@@AEAAJPEAPEAUIRawElementProviderSimple@@@Z	2142	0x140027dc4
?GetSelectionForegroundColor@TouchEditBase@DirectUI@@QEAAPEAVValue@2@XZ	2143	0x14001f004
?GetSelectionIndex@TouchSelect@DirectUI@@QEAAHXZ	2144	0x14000f44c
?GetShadowIntensity@Element@DirectUI@@QEAAHXZ	2145	0x14001e004
?GetSheet@DUIXmlParser@DirectUI@@QEAAJPEBGPEAPEAVValue@2@@Z	2146	0x140005114
?GetSheet@Element@DirectUI@@QEAAPEAVStyleSheet@2@XZ	2147	0x140014e00
?GetSheetContext@DUIXmlParser@DirectUI@@QEAAPEAXXZ	2148	0x140028e84
?GetSheetNull@Value@DirectUI@@SAPEAV12@XZ	2149	0x140031284
?GetShortcut@Element@DirectUI@@QEAAHXZ	2150	0x140034418
?GetShortcutChar@Element@DirectUI@@QEAAGXZ	2151	0x140011864
?GetShortcutChar@RichText@DirectUI@@QEAAGXZ	2152	0x140014298
?GetShowClearButtonMinWidth@TouchEdit2@DirectUI@@QEAAHXZ	2153	0x140024e90
?GetShowKeyFocus@TouchButton@DirectUI@@QEAA_NXZ	2154	0x140037114
?GetShowTick@TouchSlider@DirectUI@@QEAA_NXZ	2155	0x14001ecd0
?GetSinkRect@HWNDHost@DirectUI@@AEAAXPEBUtagRECT@@PEAU3@@Z	2156	0x140028d14
?GetSize@Value@DirectUI@@QEAAPEBUtagSIZE@@XZ	2157	0x140034838
?GetSizeZero@Value@DirectUI@@SAPEAV12@XZ	2158	0x14000b8e4
?GetSmoothingMode@Movie@DirectUI@@QEAAHXZ	2159	0x140011834
?GetSnapIntervalX@TouchScrollViewer@DirectUI@@QEAAMXZ	2160	0x140002c8c
?GetSnapIntervalY@TouchScrollViewer@DirectUI@@QEAAMXZ	2161	0x14001a7b8
?GetSnapMode@TouchScrollViewer@DirectUI@@QEAAHXZ	2162	0x140037c18
?GetSnapOffsetX@TouchScrollViewer@DirectUI@@QEAAMXZ	2163	0x140015824
?GetSnapOffsetY@TouchScrollViewer@DirectUI@@QEAAMXZ	2164	0x140002b38
?GetSnapPointCollectionX@TouchScrollViewer@DirectUI@@QEAAPEAV?$DynamicArray@N$0A@@2@PEAPEAVValue@2@@Z	2165	0x140005aa8
?GetSnapPointCollectionY@TouchScrollViewer@DirectUI@@QEAAPEAV?$DynamicArray@N$0A@@2@PEAPEAVValue@2@@Z	2166	0x140006834
?GetState@ModernProgressBar@DirectUI@@QEAAHXZ	2167	0x140036078
?GetStaticColor@HWNDHost@DirectUI@@IEAA_NPEAUHDC__@@PEAPEAUHBRUSH__@@@Z	2168	0x14001787c
?GetStepCount@TouchSlider@DirectUI@@QEAAHXZ	2169	0x14002a254
?GetString@EventManager@DirectUI@@CAJPEAUtagVARIANT@@PEAVValue@2@@Z	2170	0x14002fd08
?GetString@Value@DirectUI@@QEAAPEBGXZ	2171	0x14001fd20
?GetStringDynamicScaling@Value@DirectUI@@QEAAPEBGXZ	2172	0x14003d7a0
?GetStringNull@Value@DirectUI@@SAPEAV12@XZ	2173	0x14003ae50
?GetStringRPNull@Value@DirectUI@@SAPEAV12@XZ	2174	0x14000e9cc
?GetStyle@CCTreeView@DirectUI@@QEAAKXZ	2175	0x140039274
?GetStyleSheet@Value@DirectUI@@QEAAPEAVStyleSheet@2@XZ	2176	0x140001844
?GetSubContent@TouchCommandButton@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2177	0x14003d064
?GetSuppressClearButton@TouchEdit2@DirectUI@@QEAA_NXZ	2178	0x140003b00
?GetSurfaceType@Surface@DirectUI@@SA?AW4EType@12@I@Z	2179	0x1400180f8
?GetSurfaceType@Surface@DirectUI@@SAIW4EType@12@@Z	2180	0x14003c0e4
?GetSyncContentWhileIMEComposing@TouchEditBase@DirectUI@@QEAA_NXZ	2181	0x14000f858
?GetTargetPage@Navigator@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2182	0x14000bc40
?GetTextContentOverride@TouchSelectItem@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2183	0x140014954
?GetTextDocument@TouchEdit2@DirectUI@@UEAAJPEAPEAUITextDocument@@@Z	2184	0x140017664
?GetTextDocument@TouchEditBase@DirectUI@@UEAAJPEAPEAUITextDocument@@@Z	2185	0x14000bfc8
?GetTextGlowSize@Element@DirectUI@@QEAAHXZ	2186	0x14001f464
?GetTextHeight@Edit@DirectUI@@AEAAIXZ	2187	0x140025404
?GetTextHost@TouchEdit2@DirectUI@@QEAAJPEAPEAVITextHost@@@Z	2188	0x14001393c
?GetTextMode@TouchEditBase@DirectUI@@QEAA?AW4TouchEditTextMode@2@XZ	2189	0x140023470
?GetTextSelection@TouchEdit2@DirectUI@@QEAAJPEAPEAUITextSelection@@@Z	2190	0x14001003c
?GetTextServices@TouchEdit2@DirectUI@@UEAAJPEAPEAVITextServices@@@Z	2191	0x140013b34
?GetTextServices@TouchEditBase@DirectUI@@UEAAJPEAPEAVITextServices@@@Z	2192	0x14001d82c
?GetTheme@Element@DirectUI@@AEAAJPEBGPEAPEAX@Z	2193	0x140027fd0
?GetThemeChanged@HWNDHost@DirectUI@@IEAAHXZ	2194	0x14001028c
?GetThemedBorder@Edit@DirectUI@@QEAA_NXZ	2195	0x1400374e8
?GetThumb@TouchScrollBar@DirectUI@@QEAAPEAVElement@2@XZ	2196	0x140023030
?GetThumbElement@TouchSlider@DirectUI@@QEAAPEAVButton@2@XZ	2197	0x1400015d8
?GetThumbPosition@CCTrackBar@DirectUI@@QEAAHXZ	2198	0x14000297c
?GetThumbValue@TouchSlider@DirectUI@@QEAAHXZ	2199	0x1400172b4
?GetTickCount@TouchSlider@DirectUI@@QEAAHXZ	2200	0x140032758
?GetTitleText@TouchSwitch@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2201	0x140034134
?GetToggleOnClick@TouchCheckBox@DirectUI@@QEAA_NXZ	2202	0x140032958
?GetToggleState@EventManager@DirectUI@@CAXPEAUtagVARIANT@@@Z	2203	0x14001b568
?GetToggleState@ToggleProxy@DirectUI@@AEAAJPEAW4ToggleState@@@Z	2204	0x14002bff4
?GetToggleValue@TouchSwitch@DirectUI@@QEAAHXZ	2205	0x1400089cc
?GetTooltip@Element@DirectUI@@QEAA_NXZ	2206	0x14002ad70
?GetTooltipMaxWidth@Element@DirectUI@@QEAAHXZ	2207	0x140040ae8
?GetTooltipMaximumLineCount@TouchHWNDElement@DirectUI@@QEAAHXZ	2208	0x14002ca88
?GetTopLevel@Element@DirectUI@@QEAAPEAV12@XZ	2209	0x14001da10
?GetTrackElement@TouchSlider@DirectUI@@QEAAPEAVElement@2@XZ	2210	0x1400227ac
?GetTracking@CCBaseScrollBar@DirectUI@@QEAA_NXZ	2211	0x14003d0ac
?GetTranslatedTileRects@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@PEAII@Z	2212	0x14002c930
?GetTransparent@HWNDHost@DirectUI@@QEAA_NXZ	2213	0x14000b308
?GetTreatRightMouseButtonAsLeft@TouchButton@DirectUI@@QEAA_NXZ	2214	0x14000b668
?GetTreeAlphaLevel@Element@DirectUI@@QEAAMXZ	2215	0x14002e118
?GetTrimmedLineCount@RichText@DirectUI@@QEAAKXZ	2216	0x1400154f4
?GetType@DCSurface@DirectUI@@UEBA?AW4EType@Surface@2@XZ	2217	0x140001d50
?GetType@Value@DirectUI@@QEBAHXZ	2218	0x1400048bc
?GetTypeInfo@DuiAccessible@DirectUI@@UEAAJIKPEAPEAUITypeInfo@@@Z	2219	0x14000cfac
?GetTypeInfoCount@DuiAccessible@DirectUI@@UEAAJPEAI@Z	2220	0x140008450
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	2221	0x14002098c
?GetUIState@HWNDElement@DirectUI@@QEAAGXZ	2222	0x140039f28
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ	2223	0x140022dbc
?GetUiaFocusDelegate@TouchEdit2@DirectUI@@UEAAPEAVElement@2@XZ	2224	0x14000cce4
?GetUnavailable@Value@DirectUI@@SAPEAV12@XZ	2225	0x14001799c
?GetUnset@Value@DirectUI@@SAPEAV12@XZ	2226	0x1400087ec
?GetVScroll@ScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	2227	0x140006c94
?GetVScroll@StyledScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	2228	0x14001be8c
?GetVScrollbar@TouchScrollViewer@DirectUI@@QEAAJPEAPEAVElement@2@@Z	2229	0x14003938c
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@P6APEBUPropertyInfo@2@XZHPEAUUpdateCache@2@@Z	2230	0x14003baec
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z	2231	0x14001c5e4
?GetValue@ValueProxy@DirectUI@@AEAAJPEAPEAG@Z	2232	0x14003d778
?GetValueList@Value@DirectUI@@QEAAPEAV?$DynamicArray@PEAVValue@DirectUI@@$0A@@2@XZ	2233	0x1400245a4
?GetValueParser@DUIXmlParser@DirectUI@@IEAAJPEAPEAVValueParser@ParserTools@2@@Z	2234	0x140019cc8
?GetVertical@ScrollBar@DirectUI@@QEAA_NXZ	2235	0x14002e504
?GetViewSize@ScrollProxy@DirectUI@@AEAAJ_NPEAN@Z	2236	0x14003ac80
?GetViewer@ScrollProxy@DirectUI@@AEAAJPEAPEAVViewer@2@@Z	2237	0x14000de90
?GetVisible@Element@DirectUI@@QEAA_NXZ	2238	0x14003fdcc
?GetVisibleRect@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@@Z	2239	0x140024d2c
?GetVisited@TouchHyperLink@DirectUI@@QEAA_NXZ	2240	0x140012d30
?GetVisualState@TouchSlider@DirectUI@@QEAAHXZ	2241	0x1400348e4
?GetWantTabs@Edit@DirectUI@@QEAA_NXZ	2242	0x140016704
?GetWidth@Element@DirectUI@@QEAAHXZ	2243	0x14001bc38
?GetWinStyle@CCBase@DirectUI@@QEAAHXZ	2244	0x140014550
?GetWindow@DuiAccessible@DirectUI@@UEAAJPEAPEAUHWND__@@@Z	2245	0x140018624
?GetWindow@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAUHWND__@@@Z	2246	0x14002df74
?GetWindowAccessGradientColor@TouchHWNDElement@DirectUI@@QEAAPEAVValue@2@XZ	2247	0x14002fc88
?GetWindowActive@Element@DirectUI@@QEAA_NXZ	2248	0x14002f624
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UEAAXPEAPEBGPEAI@Z	2249	0x140010370
?GetWrapKeyboardNavigate@HWNDElement@DirectUI@@QEAA_NXZ	2250	0x140002540
?GetX@Element@DirectUI@@QEAAHXZ	2251	0x140037768
?GetXBabyElement@XBaby@DirectUI@@UEAAPEAVHWNDElement@2@XZ	2252	0x140002500
?GetXBarVisibility@BaseScrollViewer@DirectUI@@QEAAHXZ	2253	0x140024b64
?GetXOffset@BaseScrollViewer@DirectUI@@QEAAHXZ	2254	0x1400325ec
?GetXOffset@Viewer@DirectUI@@QEAAHXZ	2255	0x140011830
?GetXScrollHeight@BaseScrollViewer@DirectUI@@QEAAHXZ	2256	0x14003741c
?GetXScrollable@BaseScrollViewer@DirectUI@@QEAA_NXZ	2257	0x140024df0
?GetXScrollable@Viewer@DirectUI@@QEAA_NXZ	2258	0x140012fa4
?GetXmlLiteDll@DUIXmlParser@DirectUI@@KAJPEAPEAUHINSTANCE__@@@Z	2259	0x14002854c
?GetY@Element@DirectUI@@QEAAHXZ	2260	0x140022018
?GetYBarVisibility@BaseScrollViewer@DirectUI@@QEAAHXZ	2261	0x140038a38
?GetYOffset@BaseScrollViewer@DirectUI@@QEAAHXZ	2262	0x14002a7c8
?GetYOffset@Viewer@DirectUI@@QEAAHXZ	2263	0x140020234
?GetYScrollWidth@BaseScrollViewer@DirectUI@@QEAAHXZ	2264	0x140017084
?GetYScrollable@BaseScrollViewer@DirectUI@@QEAA_NXZ	2265	0x14003b8d8
?GetYScrollable@Viewer@DirectUI@@QEAA_NXZ	2266	0x140032be8
?GetZoomMaximum@TouchScrollViewer@DirectUI@@QEAAMXZ	2267	0x140033cfc
?GetZoomMinimum@TouchScrollViewer@DirectUI@@QEAAMXZ	2268	0x14003bc68
?GridItemPattern@Schema@DirectUI@@2HA	2269	0x14000452c
?GridItem_ColumnSpan_Property@Schema@DirectUI@@2HA	2270	0x140033748
?GridItem_Column_Property@Schema@DirectUI@@2HA	2271	0x140015230
?GridItem_Parent_Property@Schema@DirectUI@@2HA	2272	0x14003ba10
?GridItem_RowSpan_Property@Schema@DirectUI@@2HA	2273	0x14001aa70
?GridItem_Row_Property@Schema@DirectUI@@2HA	2274	0x140025b98
?GridPattern@Schema@DirectUI@@2HA	2275	0x140018f5c
?Grid_ColumnCount_Property@Schema@DirectUI@@2HA	2276	0x1400015d0
?Grid_RowCount_Property@Schema@DirectUI@@2HA	2277	0x14000d11c
?GroupControlType@Schema@DirectUI@@2HA	2278	0x14002de90
?HandleAccChange@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2279	0x140016988
?HandleAccDesc@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2280	0x1400020b0
?HandleAccPatternChange@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@IIHPEAUtagVARIANT@@2P6AX2@Z@Z	2281	0x1400088f4
?HandleAccRoleEvent@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@PEAVValue@2@1@Z	2282	0x14003acd4
?HandleAccStateChange@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@IIHPEAUtagVARIANT@@1_N@Z	2283	0x14002cba8
?HandleBoolProp@EventManager@DirectUI@@CAJPEAVElement@2@P6A_N0@ZPEAUIRawElementProviderSimple@@HPEAVValue@2@3@Z	2284	0x14002713c
?HandleChildrenEvent@EventManager@DirectUI@@CAJPEAVElement@2@PEAVValue@2@1@Z	2285	0x140005618
?HandleEnterKeyProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	2286	0x14000a4d0
?HandleEnterProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2287	0x14003090c
?HandleGlobalEnterProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2288	0x140022f14
?HandleRangeValue@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2289	0x14001ea1c
?HandleScrollPos@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2290	0x140020358
?HandleSelectedChange@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@PEAVValue@2@@Z	2291	0x14003cdc4
?HandleStringProp@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@HPEAVValue@2@1@Z	2292	0x1400131ec
?HandleToggleValue@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2293	0x140040490
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ	2294	0x14000a2fc
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z	2295	0x140018370
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z	2296	0x14001bcb4
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2297	0x14003c268
?HandleVisibilityChange@EventManager@DirectUI@@CAJPEAVElement@2@I@Z	2298	0x140012964
?HasAnimation@Element@DirectUI@@QEAA_NXZ	2299	0x1400185c0
?HasBorder@Element@DirectUI@@QEAA_NXZ	2300	0x140031500
?HasChildren@Element@DirectUI@@QEAA_NXZ	2301	0x1400199d4
?HasContent@Element@DirectUI@@QEAA_NXZ	2302	0x140029628
?HasEdgeHighlight@Element@DirectUI@@QEAA_NXZ	2303	0x14003a584
?HasKeyboardFocusProperty@Schema@DirectUI@@2HA	2304	0x14000f788
?HasLayout@Element@DirectUI@@QEAA_NXZ	2305	0x14000af28
?HasMargin@Element@DirectUI@@QEAA_NXZ	2306	0x14001c568
?HasPVLAnimationState@Element@DirectUI@@QEAA_NI@Z	2307	0x14002a6d8
?HasPadding@Element@DirectUI@@QEAA_NXZ	2308	0x1400354a4
?HasSelection@TouchEdit2@DirectUI@@QEAA_NXZ	2309	0x1400296e0
?HasShieldProp@CCPushButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2310	0x1400249fc
?HaveWin32Focus@HWNDHost@DirectUI@@AEAA_NXZ	2311	0x1400213dc
?HeaderControlType@Schema@DirectUI@@2HA	2312	0x14003fd48
?HeaderItemControlType@Schema@DirectUI@@2HA	2313	0x140024c14
?HeightProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2314	0x140036798
?HelpTextProperty@Schema@DirectUI@@2HA	2315	0x14003ce24
?HideTouchTooltip@TouchHWNDElement@DirectUI@@QEAAJXZ	2316	0x14001c264
?HideWindow@NativeHWNDHost@DirectUI@@QEAAXXZ	2317	0x140009f2c
?HideWindow@XHost@DirectUI@@QEAAXXZ	2318	0x14003bd1c
?HighDPIProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2319	0x14002e530
?Home@BaseScrollBar@DirectUI@@UEAAXXZ	2320	0x140011348
?Host@NativeHWNDHost@DirectUI@@QEAAXPEAVElement@2@@Z	2321	0x14003bb54
?Host@XHost@DirectUI@@QEAAXPEAVElement@2@@Z	2322	0x140029da4
?Hosted@PushButton@DirectUI@@SA?AVUID@@XZ	2323	0x14003b8c0
?HyperlinkControlType@Schema@DirectUI@@2HA	2324	0x140002b7c
?IDProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2325	0x1400049f0
?IHMNotify@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	2326	0x14000ecac
?IMEComposingProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2327	0x14000f8a8
?INITIALSTACKSKIP@CallstackTracker@DirectUI@@0HB	2328	0x14002d9f4
?IgnoredKeyCombosProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2329	0x140036450
?ImageControlType@Schema@DirectUI@@2HA	2330	0x1400140ec
?ImmersiveColorSchemeChange@HWNDElement@DirectUI@@SA?AVUID@@XZ	2331	0x14002b110
?Init@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2332	0x140038dec
?Init@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2333	0x14001ccac
?Init@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2334	0x140019c8c
?Init@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2335	0x1400292a4
?Init@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2336	0x140007f40
?Init@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2337	0x140024200
?Init@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2338	0x14000fb88
?Init@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2339	0x1400260f0
?Init@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2340	0x14001b5e4
?Init@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2341	0x140009004
?Init@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2342	0x14000b288
?Init@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2343	0x140002234
?Init@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2344	0x1400268fc
?Init@AutoThread@DirectUI@@QEAAJXZ	2345	0x14000910c
?Init@BrowserSelectionProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2346	0x140001c14
?Init@CallstackTracker@DirectUI@@SAHXZ	2347	0x140008cc4
?Init@ElementProvider@DirectUI@@MEAAJPEAVElement@2@PEAVInvokeHelper@2@@Z	2348	0x1400047cc
?Init@ElementProviderManager@DirectUI@@SAJXZ	2349	0x14001a28c
?Init@ElementProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2350	0x14003e0d8
?Init@EventManager@DirectUI@@SAJXZ	2351	0x14001c08c
?Init@ExpandCollapseProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2352	0x1400207c8
?Init@GridItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2353	0x140032cec
?Init@GridProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2354	0x14002b0e4
?Init@HWNDElementProvider@DirectUI@@MEAAJPEAVHWNDElement@2@PEAVInvokeHelper@2@@Z	2355	0x140004348
?Init@HWNDElementProxy@DirectUI@@UEAAXPEAVHWNDElement@2@@Z	2356	0x1400041ac
?Init@InvokeHelper@DirectUI@@QEAAHK@Z	2357	0x14001806c
?Init@InvokeManager@DirectUI@@SAJXZ	2358	0x1400014c0
?Init@InvokeProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2359	0x140039c4c
?Init@ModernProgressBarRangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2360	0x140019a4c
?Init@NavReference@DirectUI@@QEAAXPEAVElement@2@PEAUtagRECT@@@Z	2361	0x140026d50
?Init@NavScoring@DirectUI@@QEAAXPEAVElement@2@HPEBUNavReference@2@@Z	2362	0x1400344e8
?Init@NavigatorSelectionItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2363	0x140016e60
?Init@ProgressRangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2364	0x140041018
?Init@ProviderProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2365	0x140015400
?Init@RangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2366	0x140002918
?Init@Schema@DirectUI@@SAJXZ	2367	0x140018200
?Init@ScrollBarRangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2368	0x1400073e4
?Init@ScrollItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2369	0x14001d0c8
?Init@ScrollProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2370	0x14003de00
?Init@SelectionItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2371	0x140021174
?Init@SelectionProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2372	0x1400152f0
?Init@SelectorSelectionItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2373	0x1400324ac
?Init@SelectorSelectionProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2374	0x14001297c
?Init@TableItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2375	0x140038598
?Init@TableProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2376	0x140041504
?Init@ToggleProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2377	0x14000deb0
?Init@ValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2378	0x140024e48
?InitOnceCallback@CallstackTracker@DirectUI@@CAHPEAT_RTL_RUN_ONCE@@PEAXPEAPEAX@Z	2379	0x14000ab5c
?InitProcess@FontCache@DirectUI@@SAJXZ	2380	0x140041170
?InitPropSheetPage@TaskPage@DirectUI@@MEAAXPEAU_PROPSHEETPAGEW@@@Z	2381	0x140030b1c
?InitThread@FontCache@DirectUI@@SAJXZ	2382	0x140025d64
?Initialize@AccessibleButton@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2383	0x14003c710
?Initialize@AnimationStrip@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2384	0x14001dfd4
?Initialize@AutoButton@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2385	0x140024980
?Initialize@BaseScrollViewer@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2386	0x14000d434
?Initialize@Bind@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2387	0x1400064c8
?Initialize@BorderLayout@DirectUI@@QEAAXXZ	2388	0x140034ea8
?Initialize@Browser@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2389	0x1400411e4
?Initialize@Button@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2390	0x140028f9c
?Initialize@CCBase@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2391	0x140002c54
?Initialize@CCBaseScrollBar@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2392	0x140004d14
?Initialize@CCListView@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2393	0x140026224
?Initialize@CCProgressBar@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2394	0x14000c5ec
?Initialize@CSafeElementProxy@@IEAAJPEAVElement@DirectUI@@@Z	2395	0x1400079e0
?Initialize@CheckBoxGlyph@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2396	0x1400142b0
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z	2397	0x140012fe0
?Initialize@Clipper@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2398	0x140028300
?Initialize@Combobox@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2399	0x14002f2c0
?Initialize@DUIXmlParser@DirectUI@@IEAAJXZ	2400	0x14003c2f8
?Initialize@DialogElementCore@DirectUI@@QEAAXPEAUIDialogElement@2@PEAUIElementListener@2@@Z	2401	0x140008570
?Initialize@DuiAccessible@DirectUI@@QEAAXPEAVElement@2@@Z	2402	0x140010f34
?Initialize@Edit@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2403	0x1400318e0
?Initialize@Element@DirectUI@@QEAAJIPEAV12@PEAK@Z	2404	0x140006ea4
?Initialize@Expando@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2405	0x140019b34
?Initialize@ExpandoButtonGlyph@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2406	0x140029a34
?Initialize@FillLayout@DirectUI@@QEAAXXZ	2407	0x14001a6f4
?Initialize@FlowLayout@DirectUI@@QEAAX_NIII@Z	2408	0x140035a60
?Initialize@GridLayout@DirectUI@@QEAAXHH@Z	2409	0x14001fb2c
?Initialize@HWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z	2410	0x140029e44
?Initialize@HWNDElementAccessible@DirectUI@@QEAAJPEAVHWNDElement@2@@Z	2411	0x1400367d4
?Initialize@HWNDHost@DirectUI@@QEAAJIIPEAVElement@2@PEAK@Z	2412	0x14003971c
?Initialize@HWNDHostAccessible@DirectUI@@QEAAJPEAVElement@2@PEAUIAccessible@@@Z	2413	0x1400279d8
?Initialize@Layout@DirectUI@@QEAAXXZ	2414	0x140024998
?Initialize@Macro@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2415	0x140007778
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@I@Z	2416	0x140012a88
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBGPEAUHWND__@@PEAUHICON__@@HHHHHHI@Z	2417	0x1400403b8
?Initialize@Navigator@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2418	0x14000bae8
?Initialize@NineGridLayout@DirectUI@@QEAAXXZ	2419	0x14002d3d8
?Initialize@PText@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2420	0x140038fa4
?Initialize@Page@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2421	0x140038bb4
?Initialize@Pages@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2422	0x14001ba14
?Initialize@Progress@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2423	0x14000ec68
?Initialize@RadioButtonGlyph@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2424	0x14001b390
?Initialize@RefPointElement@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2425	0x140017c8c
?Initialize@RepeatButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2426	0x14000206c
?Initialize@Repeater@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2427	0x14000302c
?Initialize@RichText@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2428	0x14002093c
?Initialize@RowLayout@DirectUI@@QEAAJHII@Z	2429	0x140013dd8
?Initialize@ScrollBar@DirectUI@@QEAAJ_NPEAVElement@2@PEAK@Z	2430	0x1400246bc
?Initialize@Selector@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2431	0x14000be3c
?Initialize@SelectorNoDefault@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2432	0x140015024
?Initialize@SemanticZoomToggle@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2433	0x14002b530
?Initialize@TableLayout@DirectUI@@QEAAXHHHPEAH@Z	2434	0x14001a728
?Initialize@TextGraphic@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2435	0x14003b450
?Initialize@Thumb@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2436	0x14000df74
?Initialize@TouchButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2437	0x140005280
?Initialize@TouchCheckBox@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2438	0x14000a7b0
?Initialize@TouchCheckBoxGlyph@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2439	0x140027314
?Initialize@TouchCommandButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2440	0x140009cf0
?Initialize@TouchEdit2@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2441	0x1400226f0
?Initialize@TouchHWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z	2442	0x1400096d0
?Initialize@TouchRepeatButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2443	0x14003d4a0
?Initialize@TouchScrollBar@DirectUI@@QEAAJ_NPEAVElement@2@PEAK@Z	2444	0x1400097b4
?Initialize@TouchSelect@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2445	0x14002baf0
?Initialize@TouchSlider@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2446	0x1400383c8
?Initialize@TouchSwitch@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2447	0x140014bc0
?Initialize@UnknownElement@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2448	0x140009cac
?Initialize@VerticalFlowLayout@DirectUI@@QEAAX_NIII@Z	2449	0x140028bd4
?Initialize@Viewer@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2450	0x140036160
?Initialize@XBaby@DirectUI@@IEAAJPEAVIXElementCP@2@PEAVXProvider@2@PEAUHWND__@@PEAVElement@2@PEAK@Z	2451	0x1400339b0
?Initialize@XElement@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2452	0x1400227a8
?Initialize@XHost@DirectUI@@QEAAJPEAVIXElementCP@2@@Z	2453	0x140040fb8
?Initialize@XProvider@DirectUI@@QEAAJPEAVElement@2@PEAVIXProviderCP@2@@Z	2454	0x14002d028
?Initialize@XResourceProvider@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG11@Z	2455	0x140041400
?InitializeDllInfo@CallstackTracker@DirectUI@@CAHXZ	2456	0x140011250
?InitializeParserFromXmlReader@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUHINSTANCE__@@1@Z	2457	0x140002618
?InitializeSymbols@CallstackTracker@DirectUI@@CAHXZ	2458	0x14002ff94
?InnerBorderThicknessProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	2459	0x14001f59c
?Insert@Element@DirectUI@@QEAAJPEAV12@I@Z	2460	0x14003ee98
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z	2461	0x14000c214
?Insert@TouchCheckBox@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2462	0x14002e8cc
?Insert@TouchCheckBoxGlyph@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2463	0x140036860
?Insert@TouchCommandButton@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2464	0x14002ffd0
?Insert@TouchEditBase@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2465	0x14001a26c
?Insert@TouchSelect@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2466	0x140028ca4
?InsertItem@CCTreeView@DirectUI@@QEAAPEAU_TREEITEM@@PEAGIQEAU3@1@Z	2467	0x14003b348
?InsertItem@CCTreeView@DirectUI@@QEAAPEAU_TREEITEM@@PEBUtagTVINSERTSTRUCTW@@@Z	2468	0x1400087e4
?IntegrateIMECandidateListProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2469	0x14002ebac
?InteractionEnd@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	2470	0x140005a34
?InteractionStart@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	2471	0x14003b744
?InternalCreate@TableLayout@DirectUI@@SAJHHHPEAHPEAPEAVLayout@2@@Z	2472	0x14003ad40
?InterpolationModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	2473	0x140006444
?Invoke@DuiAccessible@DirectUI@@UEAAJJAEBU_GUID@@KGPEAUtagDISPPARAMS@@PEAUtagVARIANT@@PEAUtagEXCEPINFO@@PEAI@Z	2474	0x14000cef0
?Invoke@InvokeProvider@DirectUI@@UEAAJXZ	2475	0x140014b14
?Invoke@Proxy@DirectUI@@IEAAXIPEAX@Z	2476	0x140040fc0
?InvokeAnimation@Element@DirectUI@@QEAAXHI@Z	2477	0x14003bbe0
?InvokeAnimation@Element@DirectUI@@QEAAXIIMM_N@Z	2478	0x140038748
?InvokeInvokedEvent@Schema@DirectUI@@2HA	2479	0x1400346f4
?InvokePattern@Schema@DirectUI@@2HA	2480	0x140011950
?IsActivityOccuring@ModernProgressBar@DirectUI@@QEAA_NXZ	2481	0x140035f94
?IsActivityOccuring@ModernProgressRing@DirectUI@@QEAA_NXZ	2482	0x140031550
?IsAddLayeredRef@ModernProgressBar@DirectUI@@QEAA_NXZ	2483	0x14000173c
?IsAddLayeredRef@ModernProgressRing@DirectUI@@QEAA_NXZ	2484	0x14002e618
?IsAutoHeight@ModernProgressBar@DirectUI@@QEAA_NXZ	2485	0x1400163d8
?IsBehaviorLayout@Element@DirectUI@@QEBA_NXZ	2486	0x14001e2b0
?IsButtonEnabledAndVisible@DialogElementCore@DirectUI@@KA_NPEAVElement@2@@Z	2487	0x14002de60
?IsCacheDirty@Layout@DirectUI@@IEAA_NXZ	2488	0x14003fd04
?IsCompositedText@Element@DirectUI@@QEAA_NXZ	2489	0x14000cffc
?IsContentElementProperty@Schema@DirectUI@@2HA	2490	0x140023838
?IsContentProtected@Edit@DirectUI@@UEAA_NXZ	2491	0x14000cea4
?IsContentProtected@Element@DirectUI@@UEAA_NXZ	2492	0x140015864
?IsContentProtected@TouchEditBase@DirectUI@@UEAA_NXZ	2493	0x14002a164
?IsContinuousProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2494	0x1400396a0
?IsControlElementProperty@Schema@DirectUI@@2HA	2495	0x1400249c4
?IsCorrectImageHlpVersion@CallstackTracker@DirectUI@@CAHXZ	2496	0x140020af4
?IsCrossfadeInProgress@TouchScrollViewer@DirectUI@@QEAA_NXZ	2497	0x140003868
?IsDefaultCAlign@Element@DirectUI@@QEAA_NXZ	2498	0x14000fdd0
?IsDefaultCursor@Element@DirectUI@@QEAA_NXZ	2499	0x1400170a4
?IsDescendent@Element@DirectUI@@QEAA_NPEAV12@@Z	2500	0x14001b570
?IsDescendent@XElement@DirectUI@@QEAA_NPEAVElement@2@@Z	2501	0x14002bdc4
?IsDescendent@XProvider@DirectUI@@UEAAJPEAVElement@2@PEA_N@Z	2502	0x140005e28
?IsDestroyed@Element@DirectUI@@QEAA_NXZ	2503	0x1400232f4
?IsDeterminate@ModernProgressBar@DirectUI@@QEAA_NXZ	2504	0x140024c9c
?IsDynamicScaled@Value@DirectUI@@QEAA_NXZ	2505	0x1400201e8
?IsDynamicScaling@DUIXmlParser@DirectUI@@QEAA_NXZ	2506	0x140022a60
?IsEnabledProperty@Schema@DirectUI@@2HA	2507	0x140027c24
?IsEqual@Value@DirectUI@@QEAA_NPEAV12@@Z	2508	0x14000e340
?IsFirstElement@HWNDElement@DirectUI@@QEAA_NPEAVElement@2@@Z	2509	0x140026b6c
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ	2510	0x14001ee18
?IsHosted@Element@DirectUI@@QEAA_NXZ	2511	0x140039ac8
?IsIndependentAnimations@ModernProgressBar@DirectUI@@QEAA_NXZ	2512	0x140007148
?IsKeyboardFocusableProperty@Schema@DirectUI@@2HA	2513	0x14003963c
?IsLastElement@HWNDElement@DirectUI@@QEAA_NPEAVElement@2@@Z	2514	0x14002366c
?IsMSAAEnabled@HWNDElement@DirectUI@@UEAA_NXZ	2515	0x1400118ec
?IsMSAAEnabled@TouchHWNDElement@DirectUI@@UEAA_NXZ	2516	0x14002b078
?IsManualVisualSwapInProgress@TouchScrollViewer@DirectUI@@QEAA_NXZ	2517	0x14002f314
?IsMoveDeferred@HWNDHost@DirectUI@@IEAA_NXZ	2518	0x140025004
?IsOffscreen@Schema@DirectUI@@2HA	2519	0x14002c544
?IsPasswordProperty@Schema@DirectUI@@2HA	2520	0x140021900
?IsPatternSupported@ElementProxy@DirectUI@@IEAAJW4Pattern@Schema@2@PEA_N@Z	2521	0x140026ba8
?IsPatternSupported@ExpandCollapseProxy@DirectUI@@SA_NPEAVElement@2@@Z	2522	0x140020158
?IsPatternSupported@GridItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2523	0x1400038d0
?IsPatternSupported@GridProxy@DirectUI@@SA_NPEAVElement@2@@Z	2524	0x14003db2c
?IsPatternSupported@InvokeProxy@DirectUI@@SA_NPEAVElement@2@@Z	2525	0x140038c64
?IsPatternSupported@RangeValueProxy@DirectUI@@SA_NPEAVElement@2@@Z	2526	0x14000fc04
?IsPatternSupported@ScrollItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2527	0x14003b694
?IsPatternSupported@ScrollProxy@DirectUI@@SA_NPEAVElement@2@@Z	2528	0x14000c4e4
?IsPatternSupported@SelectionItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2529	0x140032b08
?IsPatternSupported@SelectionProxy@DirectUI@@SA_NPEAVElement@2@@Z	2530	0x140019e68
?IsPatternSupported@TableItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2531	0x14002fc58
?IsPatternSupported@TableProxy@DirectUI@@SA_NPEAVElement@2@@Z	2532	0x14001ceb0
?IsPatternSupported@ToggleProxy@DirectUI@@SA_NPEAVElement@2@@Z	2533	0x14000d3b4
?IsPatternSupported@ValueProxy@DirectUI@@SA_NPEAVElement@2@@Z	2534	0x14000df64
?IsPeripheral@Schema@DirectUI@@2HA	2535	0x14000a390
?IsPinned@BaseScrollBar@DirectUI@@QEAA_NXZ	2536	0x140030bf8
?IsPointValid@Element@DirectUI@@AEAA_NNN@Z	2537	0x14000ff7c
?IsPopupOpen@TouchSelect@DirectUI@@QEAA_NXZ	2538	0x14002ee60
?IsPressedProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2539	0x14001c678
?IsRTL@Element@DirectUI@@QEAA_NXZ	2540	0x14000cba8
?IsRTLReading@Element@DirectUI@@UEAA_NXZ	2541	0x14001290c
?IsRegisteredForAnimationStatusChanges@TouchHWNDElement@DirectUI@@QEAA_NXZ	2542	0x14002afbc
?IsReorderable@ItemList@DirectUI@@QEAA_NXZ	2543	0x14000eb74
?IsRoot@Element@DirectUI@@QEAAHXZ	2544	0x14001fcbc
?IsScrollable@BaseScrollBar@DirectUI@@QEAA_NXZ	2545	0x140001348
?IsSelfLayout@Element@DirectUI@@QEAA_NXZ	2546	0x14003d5c4
?IsShowOnOffFeedbackProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2547	0x14001f5f4
?IsSmoothFillAnimation@ModernProgressBar@DirectUI@@QEAA_NXZ	2548	0x140037f0c
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z	2549	0x140027640
?IsThemeClassName@DUIXmlParser@DirectUI@@KA_NPEBUExprNode@ParserTools@2@@Z	2550	0x140018e3c
?IsThumbActive@TouchScrollBar@DirectUI@@QEAA_NXZ	2551	0x1400301f8
?IsTileMember@TouchScrollViewer@DirectUI@@QEAA_NIPEAVElement@2@@Z	2552	0x14001620c
?IsValidAccessor@Element@DirectUI@@QEAA_NPEBUPropertyInfo@2@H_N@Z	2553	0x14003786c
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z	2554	0x14003ed44
?IsValidValue@Element@DirectUI@@SA_NPEBUPropertyInfo@2@PEAVValue@2@@Z	2555	0x14001f388
?IsVerticalProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2556	0x140014aac
?IsWordWrap@Element@DirectUI@@QEAA_NXZ	2557	0x140029bb8
?ItemContainerPattern@Schema@DirectUI@@2HA	2558	0x14001316c
?ItemHeightInPopupProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	2559	0x140015548
?ItemStatusProperty@Schema@DirectUI@@2HA	2560	0x14003f8d4
?ItemTypeProperty@Schema@DirectUI@@2HA	2561	0x140011d8c
?KeyFocusedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2562	0x140017e24
?KeyWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2563	0x140039eb8
?KeyboardNavigate@Element@DirectUI@@SA?AVUID@@XZ	2564	0x1400222d4
?KeyboardNavigationCaptureProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2565	0x1400145b4
?LabeledByProperty@Schema@DirectUI@@2HA	2566	0x140009c74
?LastDSConstProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2567	0x140032fe8
?LayoutInvalidatedEvent@Schema@DirectUI@@2HA	2568	0x1400243bc
?LayoutPosProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2569	0x14000dba8
?LayoutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2570	0x14003b914
?Leaving@Browser@DirectUI@@SA?AVUID@@XZ	2571	0x14003b458
?LightDismissIHMProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	2572	0x140032720
?LineDown@BaseScrollBar@DirectUI@@UEAAXI@Z	2573	0x140022b74
?LineDown@TouchScrollBar@DirectUI@@UEAAXI@Z	2574	0x1400103f0
?LineProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2575	0x140009140
?LineProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2576	0x140015624
?LineSizeProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2577	0x140039a28
?LineSpacingProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2578	0x140006c1c
?LineUp@BaseScrollBar@DirectUI@@UEAAXI@Z	2579	0x140038230
?LineUp@TouchScrollBar@DirectUI@@UEAAXI@Z	2580	0x14002e3d0
?ListControlType@Schema@DirectUI@@2HA	2581	0x14003f544
?ListItemControlType@Schema@DirectUI@@2HA	2582	0x14002ad20
?LoadComCtl32@TaskPage@DirectUI@@AEAAJXZ	2583	0x14003fa7c
?LoadCommonControlExports@AnimationStrip@DirectUI@@AEAAJXZ	2584	0x14000a948
?LoadFromBuffer@DUIFactory@DirectUI@@QEAAJPEBG_K0PEAVElement@2@PEAKPEAPEAV32@@Z	2585	0x140024a8c
?LoadFromFile@DUIFactory@DirectUI@@QEAAJPEBG0PEAVElement@2@PEAKPEAPEAV32@@Z	2586	0x140014314
?LoadFromPath@Movie@DirectUI@@QEAAJPEBG@Z	2587	0x140024bd8
?LoadFromResource@DUIFactory@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG1PEAVElement@2@PEAKPEAPEAV42@1@Z	2588	0x140014908
?LoadFromResource@Movie@DirectUI@@QEAAJPEAUHINSTANCE__@@H@Z	2589	0x1400284c0
?LoadImagesIntoAnimationStrip@AnimationStrip@DirectUI@@IEAAJXZ	2590	0x140036f44
?LoadPage@TaskPage@DirectUI@@AEAAJPEAPEAVElement@2@PEAV32@PEAPEAVDUIXmlParser@2@@Z	2591	0x14003ec28
?LoadPage@TaskPage@DirectUI@@MEAAJPEAVHWNDElement@2@PEAUHINSTANCE__@@PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z	2592	0x140024d30
?LoadParser@TaskPage@DirectUI@@MEAAJPEAPEAVDUIXmlParser@2@@Z	2593	0x14001b4a8
?LocaleProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2594	0x1400108fc
?LocalizedControlTypeProperty@Schema@DirectUI@@2HA	2595	0x140010aac
?Locate@RefPointElement@DirectUI@@SAPEAV12@PEAVElement@2@@Z	2596	0x140005af8
?LocationProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2597	0x14003cb10
?LookupAccessibleRole@Schema@DirectUI@@SAHHPEA_N@Z	2598	0x14002ab84
?LookupControlInfos@Schema@DirectUI@@CAJXZ	2599	0x14002863c
?LookupElement@DUIXmlParser@DirectUI@@QEAAJPEAUIXmlReader@@PEBGPEAUHINSTANCE__@@PEAPEAUIClassInfo@2@@Z	2600	0x14000f7d4
?LookupElement@DUIXmlParser@DirectUI@@QEAAJULINEINFO@2@PEBGPEAUHINSTANCE__@@PEAPEAUIClassInfo@2@@Z	2601	0x140037d24
?LookupEventInfos@Schema@DirectUI@@CAJXZ	2602	0x14002a8fc
?LookupPatternInfos@Schema@DirectUI@@CAJXZ	2603	0x1400045a4
?LookupPropertyInfos@Schema@DirectUI@@CAJXZ	2604	0x14002d85c
?ManipulationCompleted@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2605	0x14003f534
?ManipulationDelta@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2606	0x14000a514
?ManipulationHorizontalAlignmentProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	2607	0x140008598
?ManipulationStarted@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2608	0x14003530c
?ManipulationStarting@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2609	0x1400228dc
?ManipulationVerticalAlignmentProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	2610	0x140039708
?ManualStoryboardVerify@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2611	0x14003f2c8
?MapContentVisuals@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2612	0x1400077f0
?MapElementPoint@Element@DirectUI@@QEAAXPEAV12@PEBUtagPOINT@@PEAU3@@Z	2613	0x14003a30c
?MapPropertyEnumValue@DUIXmlParser@DirectUI@@IEAAJPEBUEnumMap@2@PEBGPEAH@Z	2614	0x14002b5cc
?MapPropertyNameToPropertyInfo@DUIXmlParser@DirectUI@@IEAAJULINEINFO@2@PEAUIClassInfo@2@PEBGPEAPEBUPropertyInfo@2@@Z	2615	0x14000fecc
?MapRunsToClustersProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2616	0x1400250dc
?MarginProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2617	0x14000dcc4
?MarkHosted@Element@DirectUI@@IEAAXXZ	2618	0x14000f9cc
?MarkNeedsDSUpdate@Element@DirectUI@@QEAAXXZ	2619	0x14001d5ec
?MarkSelfLayout@Element@DirectUI@@IEAAXXZ	2620	0x140035428
?MaxLengthProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	2621	0x140035480
?MaxLengthProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2622	0x14001d780
?MaximumProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2623	0x140023f4c
?MaximumProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2624	0x140030f24
?MaximumProp@Progress@DirectUI@@SAPEBUPropertyInfo@2@XZ	2625	0x14001e6d0
?MaximumProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2626	0x14001455c
?MenuBarControlType@Schema@DirectUI@@2HA	2627	0x1400116a8
?MenuClosedEvent@Schema@DirectUI@@2HA	2628	0x14003a5bc
?MenuControlType@Schema@DirectUI@@2HA	2629	0x1400171a0
?MenuItemControlType@Schema@DirectUI@@2HA	2630	0x140002794
?MenuOpenedEvent@Schema@DirectUI@@2HA	2631	0x1400303dc
?MessageCallback@Edit@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2632	0x140003e8c
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2633	0x1400303ac
?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2634	0x140028054
?MessageCallback@TouchHWNDElement@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2635	0x140027330
?MeteringProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2636	0x140008144
?MinSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2637	0x140016670
?MinimumProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2638	0x140034e70
?MinimumProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2639	0x14003e878
?MinimumProp@Progress@DirectUI@@SAPEBUPropertyInfo@2@XZ	2640	0x1400059ac
?MinimumProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2641	0x14003fc2c
?MonitorPowerSettingsChange@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	2642	0x14001e7d8
?MouseFocusedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2643	0x140041224
?MouseOrPointerReleased@TouchSlider@DirectUI@@SA?AVUID@@XZ	2644	0x140018678
?MouseWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2645	0x140035478
?MoveCaretToEndOnSyncContentProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2646	0x1400384a4
?MultilineProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	2647	0x1400117c4
?MultilineProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2648	0x14000f018
?MultipleClick@TouchButton@DirectUI@@SA?AVUID@@XZ	2649	0x14003e4e4
?MultipleViewPattern@Schema@DirectUI@@2HA	2650	0x14002d318
?NameProperty@Schema@DirectUI@@2HA	2651	0x140015038
?Navigate@DuiNavigate@DirectUI@@SAPEAVElement@2@PEAV32@PEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@H@Z	2652	0x1400229d0
?Navigate@ElementProvider@DirectUI@@UEAAJW4NavigateDirection@@PEAPEAUIRawElementProviderFragment@@@Z	2653	0x14001bd58
?Navigate@ElementProxy@DirectUI@@IEAAJW4NavigateDirection@@PEAPEAUIRawElementProviderFragment@@@Z	2654	0x140026a98
?Navigate@XProvider@DirectUI@@UEAAJHPEA_N@Z	2655	0x14000ce60
?NeedsDSUpdate@Element@DirectUI@@QEAA_NXZ	2656	0x14003e98c
?NewChildElementsAdded@TouchScrollViewer@DirectUI@@QEAAXXZ	2657	0x14001b2d4
?NewNativeWindowHandleProperty@Schema@DirectUI@@2HA	2658	0x14002c91c
?Next@DuiAccessible@DirectUI@@UEAAJKPEAUtagVARIANT@@PEAK@Z	2659	0x140004f78
?Next@HWNDHostAccessible@DirectUI@@UEAAJKPEAUtagVARIANT@@PEAK@Z	2660	0x14002f950
?NoteProp@CCCommandLink@DirectUI@@SAPEBUPropertyInfo@2@XZ	2661	0x14003da4c
?NotifyComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2662	0x140031694
?NotifyImplicit@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2663	0x140026050
?NotifyStart@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2664	0x1400267b8
?NotifyStoryboardComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2665	0x140005364
?NullControlType@Schema@DirectUI@@2HA	2666	0x14000b908
?OffTextProp@TouchSwitch@DirectUI@@SAPEBUPropertyInfo@2@XZ	2667	0x140035658
?OnAction@AnimationStrip@DirectUI@@IEAAXPEAUGMA_ACTIONINFO@@@Z	2668	0x140010944
?OnAdd@BorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2669	0x140024030
?OnAdd@Layout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2670	0x140007e24
?OnAdd@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2671	0x14003d430
?OnAdd@ShellBorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2672	0x140023634
?OnAdjustWindowSize@Combobox@DirectUI@@UEAAHHHI@Z	2673	0x140019d4c
?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z	2674	0x140001628
?OnChildLostFocus@DialogElement@DirectUI@@UEAA_NPEAVElement@2@@Z	2675	0x140019a74
?OnChildLostFocus@DialogElementCore@DirectUI@@QEAA_NPEAVElement@2@@Z	2676	0x14001b4e4
?OnChildLostFocus@XBaby@DirectUI@@UEAA_NPEAVElement@2@@Z	2677	0x14000aa58
?OnChildReceivedFocus@DialogElement@DirectUI@@UEAA_NPEAVElement@2@@Z	2678	0x1400110e4
?OnChildReceivedFocus@DialogElementCore@DirectUI@@QEAA_NPEAVElement@2@@Z	2679	0x140037768
?OnChildReceivedFocus@XBaby@DirectUI@@UEAA_NPEAVElement@2@@Z	2680	0x14003f32c
?OnCompositionChanged@HWNDElement@DirectUI@@UEAAXXZ	2681	0x140006020
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2682	0x140029324
?OnCustomDraw@CCBase@DirectUI@@UEAA_NPEAUtagNMCUSTOMDRAWINFO@@PEA_J@Z	2683	0x1400261f0
?OnDefaultButtonTrackingChanged@DialogElementCore@DirectUI@@QEAAXPEAVValue@2@@Z	2684	0x14002d9d8
?OnDestroy@AnimationStrip@DirectUI@@MEAAXXZ	2685	0x1400368e0
?OnDestroy@DialogElement@DirectUI@@UEAAXXZ	2686	0x14002cff4
?OnDestroy@DialogElementCore@DirectUI@@QEAAXXZ	2687	0x14003bd44
?OnDestroy@Element@DirectUI@@UEAAXXZ	2688	0x140020f60
?OnDestroy@HWNDElement@DirectUI@@UEAAXXZ	2689	0x140025cdc
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ	2690	0x14000ec98
?OnDestroy@ModernProgressBar@DirectUI@@MEAAXXZ	2691	0x14001bdb4
?OnDestroy@ModernProgressRing@DirectUI@@MEAAXXZ	2692	0x14001e9f4
?OnDestroy@Movie@DirectUI@@UEAAXXZ	2693	0x1400133e4
?OnDestroy@TouchHWNDElement@DirectUI@@UEAAXXZ	2694	0x14002a8a4
?OnEvent@AutoButton@DirectUI@@UEAAXPEAUEvent@2@@Z	2695	0x14001c064
?OnEvent@BaseScrollViewer@DirectUI@@UEAAXPEAUEvent@2@@Z	2696	0x14002b1fc
?OnEvent@Browser@DirectUI@@UEAAXPEAUEvent@2@@Z	2697	0x14003b8f0
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z	2698	0x1400412cc
?OnEvent@Expando@DirectUI@@UEAAXPEAUEvent@2@@Z	2699	0x14003d4d4
?OnEvent@HWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z	2700	0x1400143ac
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z	2701	0x140018428
?OnEvent@Movie@DirectUI@@UEAAXPEAUEvent@2@@Z	2702	0x14000ef2c
?OnEvent@Navigator@DirectUI@@UEAAXPEAUEvent@2@@Z	2703	0x140016da8
?OnEvent@RichText@DirectUI@@UEAAXPEAUEvent@2@@Z	2704	0x140040e04
?OnEvent@ScrollBar@DirectUI@@UEAAXPEAUEvent@2@@Z	2705	0x14003917c
?OnEvent@Selector@DirectUI@@UEAAXPEAUEvent@2@@Z	2706	0x1400094fc
?OnEvent@SelectorNoDefault@DirectUI@@UEAAXPEAUEvent@2@@Z	2707	0x1400301d0
?OnEvent@TouchButton@DirectUI@@UEAAXPEAUEvent@2@@Z	2708	0x140041108
?OnEvent@TouchCheckBox@DirectUI@@UEAAXPEAUEvent@2@@Z	2709	0x140022db4
?OnEvent@TouchEdit2@DirectUI@@UEAAXPEAUEvent@2@@Z	2710	0x14000c300
?OnEvent@TouchHWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z	2711	0x140016318
?OnEvent@TouchScrollBar@DirectUI@@UEAAXPEAUEvent@2@@Z	2712	0x140039e7c
?OnEvent@TouchSelect@DirectUI@@UEAAXPEAUEvent@2@@Z	2713	0x140019700
?OnEvent@Viewer@DirectUI@@UEAAXPEAUEvent@2@@Z	2714	0x14002e804
?OnEvent@XBaby@DirectUI@@UEAAXPEAUEvent@2@@Z	2715	0x14003679c
?OnEvent@XElement@DirectUI@@UEAAXPEAUEvent@2@@Z	2716	0x14001b2cc
?OnGetDlgCode@DialogElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z	2717	0x140025868
?OnGetDlgCode@DialogElementCore@DirectUI@@QEAAXPEAUtagMSG@@PEA_J@Z	2718	0x14001dadc
?OnGetDlgCode@HWNDElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z	2719	0x140024278
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z	2720	0x14001da20
?OnGroupChanged@HWNDElement@DirectUI@@UEAAXH_N@Z	2721	0x14000d420
?OnHosted@Combobox@DirectUI@@UEAAXPEAVElement@2@@Z	2722	0x140022d24
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z	2723	0x14001faec
?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z	2724	0x140023968
?OnHosted@ModernProgressBar@DirectUI@@MEAAXPEAVElement@2@@Z	2725	0x1400148d4
?OnHosted@ModernProgressRing@DirectUI@@MEAAXPEAVElement@2@@Z	2726	0x14001d6cc
?OnHosted@Movie@DirectUI@@UEAAXPEAVElement@2@@Z	2727	0x140039c68
?OnHosted@PushButton@DirectUI@@UEAAXPEAVElement@2@@Z	2728	0x14003a5a0
?OnHosted@RichText@DirectUI@@UEAAXPEAVElement@2@@Z	2729	0x14000a6e0
?OnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z	2730	0x14002d558
?OnHosted@TouchEdit2@DirectUI@@UEAAXPEAVElement@2@@Z	2731	0x140017f40
?OnHosted@TouchScrollBar@DirectUI@@UEAAXPEAVElement@2@@Z	2732	0x140029bb4
?OnHosted@TouchSelect@DirectUI@@UEAAXPEAVElement@2@@Z	2733	0x14000d100
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UEAAXXZ	2734	0x140032958
?OnInput@BaseScrollViewer@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2735	0x14002fc38
?OnInput@Button@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2736	0x14003e2f0
?OnInput@CCBase@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2737	0x14000abf0
?OnInput@CCCheckBox@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2738	0x140029ec8
?OnInput@CCProgressBar@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2739	0x140007da0
?OnInput@CCPushButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2740	0x140036d54
?OnInput@CCRadioButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2741	0x14001ce74
?OnInput@CCSysLink@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2742	0x14002d39c
?OnInput@Combobox@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2743	0x140035910
?OnInput@DialogElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2744	0x14001b66c
?OnInput@DialogElementCore@DirectUI@@QEAAXPEAUInputEvent@2@@Z	2745	0x140019b80
?OnInput@Edit@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2746	0x14003de84
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2747	0x140024cd8
?OnInput@HWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2748	0x14003f690
?OnInput@HWNDHost@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2749	0x140036518
?OnInput@RepeatButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2750	0x140036e8c
?OnInput@Selector@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2751	0x140023fe0
?OnInput@Thumb@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2752	0x140008a14
?OnInput@TouchButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2753	0x14001947c
?OnInput@TouchEdit2@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2754	0x140005990
?OnInput@TouchHWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2755	0x14002f8a8
?OnInput@TouchScrollBar@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2756	0x140039234
?OnInput@TouchSelect@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2757	0x140035838
?OnInput@Viewer@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2758	0x140023a50
?OnInput@XElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2759	0x140027424
?OnInvoke@InvokeHelper@DirectUI@@AEAAXPEAUInvokeArgs@12@@Z	2760	0x14003c4d0
?OnInvoke@Proxy@DirectUI@@MEAAXIPEAX@Z	2761	0x140019660
?OnKeyFocusMoved@DialogElement@DirectUI@@UEAAXPEAVElement@2@0@Z	2762	0x140026d40
?OnKeyFocusMoved@DialogElementCore@DirectUI@@QEAAXPEAVElement@2@0@Z	2763	0x14002019c
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z	2764	0x14003bf08
?OnKeyFocusMoved@Selector@DirectUI@@UEAAXPEAVElement@2@0@Z	2765	0x14001ff1c
?OnKeyFocusMoved@SelectorNoDefault@DirectUI@@UEAAXPEAVElement@2@0@Z	2766	0x1400258d8
?OnKeyFocusMoved@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@0@Z	2767	0x140040cb8
?OnKillActive@TaskPage@DirectUI@@MEAA_JXZ	2768	0x1400313fc
?OnLayoutPosChanged@BorderLayout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2769	0x140034b08
?OnLayoutPosChanged@Layout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2770	0x1400026a0
?OnLayoutPosChanged@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2771	0x14002bac0
?OnLayoutPosChanged@ShellBorderLayout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2772	0x14001bca8
?OnListenedEvent@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEAUEvent@2@@Z	2773	0x14003652c
?OnListenedEvent@DialogElement@DirectUI@@UEAAXPEAVElement@2@PEAUEvent@2@@Z	2774	0x14002ba24
?OnListenedEvent@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEAUEvent@2@@Z	2775	0x140031e64
?OnListenedInput@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEAUInputEvent@2@@Z	2776	0x14001b50c
?OnListenedInput@DialogElement@DirectUI@@UEAAXPEAVElement@2@PEAUInputEvent@2@@Z	2777	0x14002e66c
?OnListenedInput@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEAUInputEvent@2@@Z	2778	0x140029ef8
?OnListenedPropertyChanged@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2779	0x140011434
?OnListenedPropertyChanged@DialogElement@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2780	0x140005990
?OnListenedPropertyChanged@ScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2781	0x140012d64
?OnListenedPropertyChanged@StyledScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2782	0x14000a39c
?OnListenedPropertyChanged@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2783	0x140010760
?OnListenedPropertyChanged@TouchEdit2@DirectUI@@EEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2784	0x140040f50
?OnListenedPropertyChanging@BaseScrollViewer@DirectUI@@UEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2785	0x140002ce4
?OnListenedPropertyChanging@DialogElement@DirectUI@@UEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2786	0x14001d6fc
?OnListenedPropertyChanging@TaskPage@DirectUI@@MEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2787	0x140008c0c
?OnListenerAttach@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@@Z	2788	0x140015cdc
?OnListenerAttach@DialogElement@DirectUI@@UEAAXPEAVElement@2@@Z	2789	0x14001bb64
?OnListenerAttach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z	2790	0x1400104f8
?OnListenerDetach@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@@Z	2791	0x140005fb4
?OnListenerDetach@DialogElement@DirectUI@@UEAAXPEAVElement@2@@Z	2792	0x140030294
?OnListenerDetach@DialogElementCore@DirectUI@@QEAAXPEAVElement@2@@Z	2793	0x1400076cc
?OnListenerDetach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z	2794	0x1400334c0
?OnListenerDetach@TouchEdit2@DirectUI@@EEAAXPEAVElement@2@@Z	2795	0x140021948
?OnLostDialogFocus@Button@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2796	0x14002ab34
?OnLostDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2797	0x1400213f0
?OnLostDialogFocus@CCBaseCheckRadioButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2798	0x14000a3a4
?OnLostDialogFocus@CCPushButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2799	0x140004d84
?OnLostDialogFocus@CCSysLink@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2800	0x14003b9b4
?OnLostDialogFocus@CheckBoxGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2801	0x140006d78
?OnLostDialogFocus@ExpandoButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2802	0x140033644
?OnLostDialogFocus@RadioButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2803	0x1400309d8
?OnMaximumChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2804	0x140001c14
?OnMessage@CCBaseScrollBar@DirectUI@@UEAA_NI_K_JPEA_J@Z	2805	0x140012c70
?OnMessage@CCPushButton@DirectUI@@UEAA_NI_K_JPEA_J@Z	2806	0x140029990
?OnMessage@CCTrackBar@DirectUI@@UEAA_NI_K_JPEA_J@Z	2807	0x140033514
?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2808	0x140005e1c
?OnMessage@NativeHWNDHost@DirectUI@@UEAAJI_K_JPEA_J@Z	2809	0x140017d20
?OnMessage@TaskPage@DirectUI@@MEAA_NI_K_JPEA_J@Z	2810	0x140022ec4
?OnMessage@XElement@DirectUI@@UEAA_NI_K_JPEA_J@Z	2811	0x14002a710
?OnMinimumChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2812	0x1400129b0
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z	2813	0x1400114b4
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z	2814	0x140032e48
?OnNoChildWithShortcutFound@XBaby@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z	2815	0x14003af84
?OnNotify@CCBase@DirectUI@@UEAA_NI_K_JPEA_J@Z	2816	0x1400402a4
?OnNotify@CCCheckBox@DirectUI@@UEAA_NI_K_JPEA_J@Z	2817	0x14000a2bc
?OnNotify@CCPushButton@DirectUI@@UEAA_NI_K_JPEA_J@Z	2818	0x14001bf6c
?OnNotify@CCRadioButton@DirectUI@@UEAA_NI_K_JPEA_J@Z	2819	0x14000bfbc
?OnNotify@CCTreeView@DirectUI@@UEAA_NI_K_JPEA_J@Z	2820	0x14002f620
?OnNotify@Combobox@DirectUI@@UEAA_NI_K_JPEA_J@Z	2821	0x140004624
?OnNotify@Edit@DirectUI@@UEAA_NI_K_JPEA_J@Z	2822	0x1400015ac
?OnNotify@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2823	0x140007878
?OnPageChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2824	0x140007864
?OnPageChanging@BaseScrollBar@DirectUI@@QEAA_NPEAVValue@2@@Z	2825	0x1400223a4
?OnPositionChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2826	0x140018210
?OnPositionChanging@BaseScrollBar@DirectUI@@QEAA_NPEAVValue@2@@Z	2827	0x14000d2a0
?OnPropertyChanged@AccessibleButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2828	0x140033e5c
?OnPropertyChanged@AnimationStrip@DirectUI@@MEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2829	0x140013da4
?OnPropertyChanged@BaseScrollViewer@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2830	0x1400398bc
?OnPropertyChanged@Browser@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2831	0x140023a60
?OnPropertyChanged@Button@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2832	0x140037790
?OnPropertyChanged@CCBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2833	0x140003ec8
?OnPropertyChanged@CCBaseCheckRadioButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2834	0x140011294
?OnPropertyChanged@CCBaseScrollBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2835	0x14003efe0
?OnPropertyChanged@CCCommandLink@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2836	0x14000df4c
?OnPropertyChanged@CCPushButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2837	0x140014a34
?OnPropertyChanged@CCTrackBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2838	0x14002573c
?OnPropertyChanged@Combobox@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2839	0x140025a34
?OnPropertyChanged@DialogElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2840	0x14002149c
?OnPropertyChanged@Edit@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2841	0x14002e814
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z	2842	0x1400207cc
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2843	0x14001447c
?OnPropertyChanged@Expando@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2844	0x14000ba08
?OnPropertyChanged@HWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2845	0x14000cd7c
?OnPropertyChanged@HWNDHost@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2846	0x140038178
?OnPropertyChanged@ItemList@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2847	0x140033f20
?OnPropertyChanged@Macro@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2848	0x14000d6e4
?OnPropertyChanged@ModernProgressBar@DirectUI@@MEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2849	0x14001e160
?OnPropertyChanged@ModernProgressRing@DirectUI@@MEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2850	0x14003ead0
?OnPropertyChanged@RefPointElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2851	0x14003b274
?OnPropertyChanged@RichText@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2852	0x14003dc9c
?OnPropertyChanged@ScrollBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2853	0x14002ec20
?OnPropertyChanged@ScrollViewer@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2854	0x1400256d8
?OnPropertyChanged@Selector@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2855	0x14003add0
?OnPropertyChanged@TextGraphic@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2856	0x140023cf0
?OnPropertyChanged@TouchButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2857	0x140004c34
?OnPropertyChanged@TouchCheckBox@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2858	0x140040128
?OnPropertyChanged@TouchCommandButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2859	0x14003237c
?OnPropertyChanged@TouchEdit2@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2860	0x140038a0c
?OnPropertyChanged@TouchEditBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2861	0x140018a50
?OnPropertyChanged@TouchHWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2862	0x140021350
?OnPropertyChanged@TouchHyperLink@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2863	0x14001ea84
?OnPropertyChanged@TouchRepeatButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2864	0x14002922c
?OnPropertyChanged@TouchScrollBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2865	0x1400305fc
?OnPropertyChanged@TouchSelect@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2866	0x14000c644
?OnPropertyChanged@Viewer@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2867	0x14000a130
?OnPropertyChanging@BaseScrollViewer@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2868	0x1400275b0
?OnPropertyChanging@CCBaseScrollBar@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2869	0x140024f2c
?OnPropertyChanging@CCTrackBar@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2870	0x140035008
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z	2871	0x14003c670
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2872	0x14003ce3c
?OnPropertyChanging@PText@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2873	0x14000ba3c
?OnPropertyChanging@ScrollBar@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2874	0x14003e270
?OnPropertyChanging@TextGraphic@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2875	0x1400189a4
?OnPropertyChanging@TouchCheckBox@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2876	0x14000d6b8
?OnPropertyChanging@TouchCheckBoxGlyph@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2877	0x14003062c
?OnPropertyChanging@TouchCommandButton@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2878	0x140013e2c
?OnPropertyChanging@TouchEdit2@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2879	0x1400340b4
?OnPropertyChanging@TouchEditBase@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2880	0x14001fffc
?OnPropertyChanging@TouchSelect@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2881	0x140007164
?OnPropertyChanging@Viewer@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2882	0x14001ea98
?OnQueryCancel@TaskPage@DirectUI@@MEAA_JXZ	2883	0x1400398fc
?OnQueryInitialFocus@TaskPage@DirectUI@@MEAAPEAVElement@2@XZ	2884	0x140027778
?OnReceivedDialogFocus@Button@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2885	0x14000363c
?OnReceivedDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2886	0x14003376c
?OnReceivedDialogFocus@CCBaseCheckRadioButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2887	0x140002f74
?OnReceivedDialogFocus@CCPushButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2888	0x14000a24c
?OnReceivedDialogFocus@CCSysLink@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2889	0x14000fe30
?OnReceivedDialogFocus@CheckBoxGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2890	0x140038218
?OnReceivedDialogFocus@ExpandoButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2891	0x140007020
?OnReceivedDialogFocus@RadioButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2892	0x140019c88
?OnRegisteredDefaultButtonChanged@DialogElementCore@DirectUI@@QEAAXPEAVValue@2@0@Z	2893	0x140012640
?OnRemove@BorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2894	0x14003b974
?OnRemove@Layout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2895	0x14001b924
?OnRemove@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2896	0x14002e8b4
?OnRemove@ShellBorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2897	0x140005610
?OnReset@TaskPage@DirectUI@@MEAA_JXZ	2898	0x140031c14
?OnSelectedPropertyChanged@CCCommandLink@DirectUI@@UEAAXXZ	2899	0x14000e4e0
?OnSelectedPropertyChanged@CCPushButton@DirectUI@@UEAAXXZ	2900	0x140038284
?OnSetActive@TaskPage@DirectUI@@MEAA_JXZ	2901	0x140031560
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2902	0x14002bff4
?OnSinkThemeChanged@XElement@DirectUI@@UEAA_NI_K_JPEA_J@Z	2903	0x14002a088
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z	2904	0x140028030
?OnSysChar@XElement@DirectUI@@UEAA_NG@Z	2905	0x14002df4c
?OnTextProp@TouchSwitch@DirectUI@@SAPEBUPropertyInfo@2@XZ	2906	0x140023a40
?OnThemeChanged@HWNDElement@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z	2907	0x14002f278
?OnThemeChanged@XBaby@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z	2908	0x140036758
?OnToolTip@EventManager@DirectUI@@SAJPEAVElement@2@K@Z	2909	0x1400070dc
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z	2910	0x14002d110
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z	2911	0x140014350
?OnUnHosted@ModernProgressBar@DirectUI@@MEAAXPEAVElement@2@@Z	2912	0x140034fc4
?OnUnHosted@ModernProgressRing@DirectUI@@MEAAXPEAVElement@2@@Z	2913	0x14002bc28
?OnUnHosted@PushButton@DirectUI@@UEAAXPEAVElement@2@@Z	2914	0x14002e850
?OnUnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z	2915	0x140006c98
?OnUnHosted@TouchSelect@DirectUI@@UEAAXPEAVElement@2@@Z	2916	0x14003d3a0
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z	2917	0x14001c4c8
?OnWizBack@TaskPage@DirectUI@@MEAA_JXZ	2918	0x14001066c
?OnWizFinish@TaskPage@DirectUI@@MEAA_JXZ	2919	0x1400181fc
?OnWizNext@TaskPage@DirectUI@@MEAA_JXZ	2920	0x140023b88
?OnWmSettingChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z	2921	0x14003836c
?OnWmThemeChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z	2922	0x140004c3c
?OnWmThemeChanged@XBaby@DirectUI@@UEAAX_K_J@Z	2923	0x1400156f8
?OnWndMsg@TaskPage@DirectUI@@AEAAHI_K_JPEA_J@Z	2924	0x14003b790
?OpenAnimation@CCAVI@DirectUI@@AEAAXPEAUHWND__@@@Z	2925	0x140040c8c
?OpenPopup@TouchSelect@DirectUI@@QEAAJXZ	2926	0x14001ec54
?OptimizeMoveProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	2927	0x14000ac4c
?OrderProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2928	0x140007900
?Orientation@Schema@DirectUI@@2HA	2929	0x14000e410
?OverhangOffsetProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2930	0x14002a7f0
?OverhangProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2931	0x140015d1c
?OverrideButtonBackgroundProp@CCPushButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2932	0x14002e840
?OverrideZoomThreshold@TouchScrollViewer@DirectUI@@QEAAJMMH@Z	2933	0x140014788
?PaddingProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2934	0x14000d424
?PageDown@BaseScrollBar@DirectUI@@UEAAXI@Z	2935	0x14000bf2c
?PageDown@TouchScrollBar@DirectUI@@UEAAXI@Z	2936	0x140033fc8
?PageProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2937	0x140024738
?PageProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2938	0x140014980
?PageUp@BaseScrollBar@DirectUI@@UEAAXI@Z	2939	0x140036fa8
?PageUp@TouchScrollBar@DirectUI@@UEAAXI@Z	2940	0x1400087b4
?Paint@AnimationStrip@DirectUI@@MEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2941	0x14003c420
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2942	0x140009750
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2943	0x14003edcc
?Paint@ModernProgressBar@DirectUI@@MEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2944	0x14003ce48
?Paint@ModernProgressRing@DirectUI@@MEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2945	0x14000380c
?Paint@Movie@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2946	0x140006344
?Paint@Progress@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2947	0x14001a55c
?Paint@RichText@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2948	0x1400124f8
?Paint@TouchCheckBox@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2949	0x14001f42c
?Paint@TouchCheckBoxGlyph@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2950	0x14000de74
?Paint@TouchCommandButton@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2951	0x14001c498
?Paint@TouchEdit2@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2952	0x140004548
?PaintBackground@Element@DirectUI@@QEAAXPEAUHDC__@@PEAVValue@2@AEBUtagRECT@@222@Z	2953	0x1400134d4
?PaintBorder@Element@DirectUI@@QEAAXPEAUHDC__@@PEAVValue@2@PEAUtagRECT@@AEBU5@@Z	2954	0x14002ed98
?PaintContent@Element@DirectUI@@QEAAXPEAUHDC__@@PEBUtagRECT@@@Z	2955	0x1400129c4
?PaintEdgeHighlight@Element@DirectUI@@QEAAXPEAUHDC__@@AEBUtagRECT@@1@Z	2956	0x14001c3f4
?PaintFocusRect@Element@DirectUI@@QEAAXPEAUHDC__@@PEBUtagRECT@@1@Z	2957	0x1400071c8
?PaintStringContent@Element@DirectUI@@QEAAXPEAUHDC__@@PEBUtagRECT@@PEAVValue@2@H@Z	2958	0x14000f49c
?PaneControlType@Schema@DirectUI@@2HA	2959	0x140014770
?ParentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2960	0x14001159c
?ParseARGBColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAKPEA_N@Z	2961	0x14002420c
?ParseArgs@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEATParsedArg@12@IPEBD@Z	2962	0x140035e88
?ParseAtomValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2963	0x14001b298
?ParseBehavior@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@@Z	2964	0x140033a5c
?ParseBehaviorArgValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2965	0x14003e290
?ParseBoolValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2966	0x140036980
?ParseColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAK@Z	2967	0x140038158
?ParseDFCFill@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2968	0x140012814
?ParseDTBFill@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2969	0x140002904
?ParseDoubleListValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2970	0x14001cfa0
?ParseFillValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2971	0x140007170
?ParseFloat@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAMPEA_N@Z	2972	0x14002fabc
?ParseFloatValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2973	0x140036fe0
?ParseFunction@DUIXmlParser@DirectUI@@IEAAJPEBGPEBUExprNode@ParserTools@2@PEATParsedArg@12@IPEBD@Z	2974	0x14004099c
?ParseGTCColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAKPEA_N@Z	2975	0x140015678
?ParseGTFStr@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2976	0x14001f054
?ParseGTMarRect@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledRECT@2@PEA_N@Z	2977	0x140023bd8
?ParseGTMetInt@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAHPEA_N@Z	2978	0x14002c780
?ParseGTPartSize@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledSIZE@2@PEA_N@Z	2979	0x14002f5f4
?ParseGradientFill@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2980	0x140016694
?ParseGraphicGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2981	0x14002cfa4
?ParseGraphicHelper@DUIXmlParser@DirectUI@@IEAAJ_NPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2982	0x140030070
?ParseGraphicValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2983	0x14000bedc
?ParseIconGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2984	0x14000dd88
?ParseImageGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2985	0x140040b00
?ParseIntValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2986	0x140011790
?ParseLayoutValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@@Z	2987	0x14001c1d4
?ParseLibrary@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAUHINSTANCE__@@@Z	2988	0x14000f2cc
?ParseLiteral@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEBG@Z	2989	0x14001756c
?ParseLiteralColor@DUIXmlParser@DirectUI@@IEAAJPEBGPEAK@Z	2990	0x140036448
?ParseLiteralColorInt@DUIXmlParser@DirectUI@@IEAAJPEBGPEAH@Z	2991	0x14002e648
?ParseLiteralNumber@DUIXmlParser@DirectUI@@IEAAJPEBGPEAHPEA_N@Z	2992	0x140038bd0
?ParseMagnitude@DUIXmlParser@DirectUI@@IEAAJPEBGPEAHPEA_N@Z	2993	0x140018d28
?ParseMagnitudeFloat@DUIXmlParser@DirectUI@@IEAAJPEBGPEAMPEA_N@Z	2994	0x140001414
?ParseNumber@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAHPEA_N@Z	2995	0x140013fd8
?ParsePointValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2996	0x14001e1b4
?ParseQuotedString@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEBG@Z	2997	0x140039298
?ParseRGBColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAKPEA_N@Z	2998	0x140037e94
?ParseRect@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledRECT@2@@Z	2999	0x140010dac
?ParseRectRect@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledRECT@2@PEA_N@Z	3000	0x14003bee0
?ParseRectValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3001	0x140025238
?ParseResStr@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	3002	0x14002a19c
?ParseResid@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEBG@Z	3003	0x14003a560
?ParseSGraphicGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	3004	0x14002cd68
?ParseSGraphicHelper@DUIXmlParser@DirectUI@@IEAAJ_NPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3005	0x14001c388
?ParseSize@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledSIZE@2@@Z	3006	0x14002d594
?ParseSizeSize@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledSIZE@2@PEA_N@Z	3007	0x14003bd98
?ParseSizeValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3008	0x14002ed78
?ParseStringValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3009	0x14002c190
?ParseStyleSheets@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	3010	0x140014014
?ParseSysMetricInt@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAHPEA_N@Z	3011	0x140006bf4
?ParseSysMetricStr@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	3012	0x1400083ac
?ParseTheme@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@_NPEAPEAX@Z	3013	0x140039058
?PasswordCharacterProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	3014	0x140018144
?PasswordCharacterProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3015	0x140037e70
?PasswordRevealModeProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3016	0x140020c60
?Paste@TouchEditBase@DirectUI@@SA?AVUID@@XZ	3017	0x14000e234
?PasteText@TouchEdit2@DirectUI@@QEAAJPEBG@Z	3018	0x140002b70
?PathProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3019	0x1400023b0
?PatternFromPatternId@Schema@DirectUI@@SA?AW4Pattern@12@H@Z	3020	0x140025940
?Pause@Movie@DirectUI@@QEAAXXZ	3021	0x14002c940
?PfnIsSupportedFromPattern@Schema@DirectUI@@SAP6A_NPEAVElement@2@@ZW4Pattern@12@@Z	3022	0x14001a0b4
?PinningProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3023	0x14002a750
?PixelOffsetModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3024	0x140003140
?Play@CCAVI@DirectUI@@QEAAXPEAUHWND__@@@Z	3025	0x140006c28
?Play@Movie@DirectUI@@QEAAXXZ	3026	0x140022f84
?PlayAllFramesModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3027	0x1400364f8
?PlayProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	3028	0x14001258c
?PopupBoundsProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	3029	0x140007c68
?PopupChange@TouchSelect@DirectUI@@SA?AVUID@@XZ	3030	0x14003aa38
?PosInLayoutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3031	0x14002737c
?PositionProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3032	0x140001810
?PositionProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3033	0x140031954
?PositionProp@Progress@DirectUI@@SAPEBUPropertyInfo@2@XZ	3034	0x140039288
?PositionProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3035	0x140033cb0
?PostCreate@CCAVI@DirectUI@@MEAAXPEAUHWND__@@@Z	3036	0x140006468
?PostCreate@CCBase@DirectUI@@MEAAXPEAUHWND__@@@Z	3037	0x140023354
?PostCreate@CCBaseCheckRadioButton@DirectUI@@MEAAXPEAUHWND__@@@Z	3038	0x14002f224
?PostCreate@CCCommandLink@DirectUI@@MEAAXPEAUHWND__@@@Z	3039	0x1400010b0
?PostCreate@CCTrackBar@DirectUI@@MEAAXPEAUHWND__@@@Z	3040	0x140014d00
?PrepareManualSwapDeferredZoomToRect@TouchScrollViewer@DirectUI@@QEAAJPEBUtagRECT@@PEBM1PEAM2M@Z	3041	0x14003a534
?PressedProp@Button@DirectUI@@SAPEBUPropertyInfo@2@XZ	3042	0x140028d3c
?PressedProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3043	0x14003f63c
?PreventFormatChangeUpdatingModifiedStateProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3044	0x14003d6d4
?PrintRTLControl@HWNDHost@DirectUI@@IEAAXPEAUHDC__@@0AEBUtagRECT@@@Z	3045	0x14003ebe4
?ProcessIdProperty@Schema@DirectUI@@2HA	3046	0x14000a944
?ProcessingKeyboardNavigation@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3047	0x14001fc30
?ProgressBarControlType@Schema@DirectUI@@2HA	3048	0x140002f6c
?PromptTextProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3049	0x140013e1c
?PromptWithCaretProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3050	0x14004038c
?PropSheet_SendMessage@TaskPage@DirectUI@@IEAA_JI_K_J@Z	3051	0x140039448
?PropertyChangedCore@Edit@DirectUI@@AEAAXPEBUPropertyInfo@2@HPEAVValue@2@PEAUHWND__@@@Z	3052	0x140016110
?PropertyChangingListener@EventManager@DirectUI@@SAJPEAVElement@2@PEBUPropertyInfo@2@PEA_N@Z	3053	0x140010be4
?PropertyListener@EventManager@DirectUI@@SAJPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	3054	0x14002ac4c
?PropertyProp@Bind@DirectUI@@SAPEBUPropertyInfo@2@XZ	3055	0x14000d114
?ProportionalProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3056	0x140040a4c
?QueryInterface@DuiAccessible@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3057	0x14001f268
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3058	0x14003f924
?QueryInterface@ElementProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3059	0x14001fa98
?QueryInterface@ExpandCollapseProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3060	0x140037014
?QueryInterface@GridItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3061	0x140021868
?QueryInterface@GridProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3062	0x140007b10
?QueryInterface@HWNDElementProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3063	0x14001aed4
?QueryInterface@HWNDHostAccessible@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3064	0x140029f6c
?QueryInterface@InvokeProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3065	0x1400097a4
?QueryInterface@RangeValueProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3066	0x14001bca4
?QueryInterface@ScrollItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3067	0x14000ae3c
?QueryInterface@ScrollProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3068	0x14001fc30
?QueryInterface@SelectionItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3069	0x1400045f8
?QueryInterface@SelectionProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3070	0x14000179c
?QueryInterface@TableItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3071	0x1400176d8
?QueryInterface@TableProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3072	0x1400101d8
?QueryInterface@ToggleProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3073	0x140017e6c
?QueryInterface@ValueProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3074	0x140040920
?QueryInterface@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3075	0x140033904
?QueryService@DuiAccessible@DirectUI@@UEAAJAEBU_GUID@@0PEAPEAX@Z	3076	0x140023fa0
?QueryService@HWNDHostAccessible@DirectUI@@UEAAJAEBU_GUID@@0PEAPEAX@Z	3077	0x140006f94
?QuerySysMetric@DUIXmlParser@DirectUI@@IEAAHHPEA_N@Z	3078	0x140010c44
?QuerySysMetricStr@DUIXmlParser@DirectUI@@IEAAPEBGHPEAGI@Z	3079	0x14000e048
?QueueDefaultAction@Element@DirectUI@@QEAAJXZ	3080	0x14001b248
?RadioButtonControlType@Schema@DirectUI@@2HA	3081	0x140026690
?RaiseChildRemovedEvent@EventManager@DirectUI@@CAJAEBUElementRuntimeId@2@PEAVElement@2@@Z	3082	0x140008364
?RaiseGeometryEventWorker@EventManager@DirectUI@@CAJPEAURectangleChange@2@_N111@Z	3083	0x140014824
?RaiseGeometryEvents@EventManager@DirectUI@@CAJXZ	3084	0x140009448
?RaiseStructureChangedEvent@EventManager@DirectUI@@CAJPEAVElement@2@W4StructureChangeType@@@Z	3085	0x14002e1f4
?RaiseStructureEvents@EventManager@DirectUI@@CAJXZ	3086	0x14001764c
?RaiseVisibilityEvents@EventManager@DirectUI@@CAJXZ	3087	0x140018684
?RangeMaxProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3088	0x140022860
?RangeMinProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3089	0x14000bb80
?RangeValuePattern@Schema@DirectUI@@2HA	3090	0x14001c8e0
?RangeValue_IsReadOnly_Property@Schema@DirectUI@@2HA	3091	0x140035768
?RangeValue_LargeChange_Property@Schema@DirectUI@@2HA	3092	0x1400265dc
?RangeValue_Maximum_Property@Schema@DirectUI@@2HA	3093	0x14001d754
?RangeValue_Minimum_Property@Schema@DirectUI@@2HA	3094	0x14003266c
?RangeValue_SmallChange_Property@Schema@DirectUI@@2HA	3095	0x14001982c
?RangeValue_Value_Property@Schema@DirectUI@@2HA	3096	0x140025724
?RawActionProc@AnimationStrip@DirectUI@@KAXPEAUGMA_ACTIONINFO@@@Z	3097	0x14000e224
?RawActionProc@Movie@DirectUI@@SAXPEAUGMA_ACTIONINFO@@@Z	3098	0x14000f52c
?ReadOnlyProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3099	0x140015864
?Recalc@AccessibleButton@DirectUI@@QEAAXXZ	3100	0x140035028
?ReferencePointProp@RefPointElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3101	0x140019784
?ReflowStyle@PVLAnimation@DirectUI@@SA?AVUID@@XZ	3102	0x140002048
?RefreshContent@TouchEdit2@DirectUI@@UEAAJXZ	3103	0x140014b04
?RefreshContent@TouchEditBase@DirectUI@@UEAAJXZ	3104	0x140037ec8
?Register@AccessibleButton@DirectUI@@SAJXZ	3105	0x1400291a4
?Register@AnimationStrip@DirectUI@@SAJXZ	3106	0x1400304f4
?Register@AutoButton@DirectUI@@SAJXZ	3107	0x140014930
?Register@BaseScrollViewer@DirectUI@@SAJXZ	3108	0x14002d9a4
?Register@Bind@DirectUI@@SAJXZ	3109	0x140009994
?Register@Browser@DirectUI@@SAJXZ	3110	0x14002da94
?Register@Button@DirectUI@@SAJXZ	3111	0x140030238
?Register@CCAVI@DirectUI@@SAJXZ	3112	0x140007270
?Register@CCBase@DirectUI@@SAJXZ	3113	0x140033ab4
?Register@CCBaseCheckRadioButton@DirectUI@@SAJXZ	3114	0x1400401c4
?Register@CCBaseScrollBar@DirectUI@@SAJXZ	3115	0x14003185c
?Register@CCCheckBox@DirectUI@@SAJXZ	3116	0x14003cc64
?Register@CCCommandLink@DirectUI@@SAJXZ	3117	0x140035668
?Register@CCHScrollBar@DirectUI@@SAJXZ	3118	0x14000c8ac
?Register@CCListBox@DirectUI@@SAJXZ	3119	0x14003e980
?Register@CCListView@DirectUI@@SAJXZ	3120	0x140001e50
?Register@CCProgressBar@DirectUI@@SAJXZ	3121	0x140001fa0
?Register@CCPushButton@DirectUI@@SAJXZ	3122	0x14000f858
?Register@CCRadioButton@DirectUI@@SAJXZ	3123	0x140031a10
?Register@CCSysLink@DirectUI@@SAJXZ	3124	0x140039fb0
?Register@CCTrackBar@DirectUI@@SAJXZ	3125	0x14002c99c
?Register@CCTreeView@DirectUI@@SAJXZ	3126	0x14001f330
?Register@CCVScrollBar@DirectUI@@SAJXZ	3127	0x14002f49c
?Register@CheckBoxGlyph@DirectUI@@SAJXZ	3128	0x140018acc
?Register@ClassInfoBase@DirectUI@@QEAAJXZ	3129	0x140014320
?Register@Clipper@DirectUI@@SAJXZ	3130	0x140040268
?Register@Combobox@DirectUI@@SAJXZ	3131	0x140014bb0
?Register@DialogElement@DirectUI@@SAJXZ	3132	0x140038f14
?Register@Edit@DirectUI@@SAJXZ	3133	0x1400283e4
?Register@Element@DirectUI@@SAJXZ	3134	0x14002e550
?Register@ElementWithHWND@DirectUI@@SAJXZ	3135	0x1400165e8
?Register@Expandable@DirectUI@@SAJXZ	3136	0x140010e34
?Register@Expando@DirectUI@@SAJXZ	3137	0x14003aeb0
?Register@ExpandoButtonGlyph@DirectUI@@SAJXZ	3138	0x14001bbf8
?Register@HWNDElement@DirectUI@@SAJXZ	3139	0x14002b148
?Register@HWNDHost@DirectUI@@SAJXZ	3140	0x14000ab58
?Register@ItemList@DirectUI@@SAJXZ	3141	0x140008cb4
?Register@Macro@DirectUI@@SAJXZ	3142	0x140012974
?Register@ModernProgressBar@DirectUI@@SAJXZ	3143	0x14001c3dc
?Register@ModernProgressRing@DirectUI@@SAJXZ	3144	0x14003eac4
?Register@Movie@DirectUI@@SAJXZ	3145	0x140025f60
?Register@Navigator@DirectUI@@SAJXZ	3146	0x14001ac50
?Register@PText@DirectUI@@SAJXZ	3147	0x14002344c
?Register@Page@DirectUI@@SAJXZ	3148	0x14002a82c
?Register@Pages@DirectUI@@SAJXZ	3149	0x140026e1c
?Register@Progress@DirectUI@@SAJXZ	3150	0x14000bca4
?Register@PushButton@DirectUI@@SAJXZ	3151	0x14003db10
?Register@RadioButtonGlyph@DirectUI@@SAJXZ	3152	0x140001f1c
?Register@RefPointElement@DirectUI@@SAJXZ	3153	0x14001fbf4
?Register@RepeatButton@DirectUI@@SAJXZ	3154	0x1400383b0
?Register@Repeater@DirectUI@@SAJXZ	3155	0x14001e870
?Register@RichText@DirectUI@@SAJXZ	3156	0x14003717c
?Register@ScrollBar@DirectUI@@SAJXZ	3157	0x140008aa0
?Register@ScrollViewer@DirectUI@@SAJXZ	3158	0x140026cd0
?Register@Selector@DirectUI@@SAJXZ	3159	0x140030790
?Register@SelectorNoDefault@DirectUI@@SAJXZ	3160	0x140031f20
?Register@SemanticZoomToggle@DirectUI@@SAJXZ	3161	0x14003a3cc
?Register@StyledScrollViewer@DirectUI@@SAJXZ	3162	0x1400245e0
?Register@TextGraphic@DirectUI@@SAJXZ	3163	0x14003bd54
?Register@Thumb@DirectUI@@SAJXZ	3164	0x14002546c
?Register@TouchButton@DirectUI@@SAJXZ	3165	0x140002f60
?Register@TouchCheckBox@DirectUI@@SAJXZ	3166	0x14000a3a0
?Register@TouchCheckBoxGlyph@DirectUI@@SAJXZ	3167	0x14003b648
?Register@TouchCommandButton@DirectUI@@SAJXZ	3168	0x14002cbe0
?Register@TouchEdit2@DirectUI@@SAJXZ	3169	0x140001af4
?Register@TouchEditBase@DirectUI@@SAJXZ	3170	0x140031ed4
?Register@TouchHWNDElement@DirectUI@@SAJXZ	3171	0x14001cac0
?Register@TouchHyperLink@DirectUI@@SAJXZ	3172	0x140014b38
?Register@TouchRepeatButton@DirectUI@@SAJXZ	3173	0x14001c83c
?Register@TouchScrollBar@DirectUI@@SAJXZ	3174	0x140040824
?Register@TouchSelect@DirectUI@@SAJXZ	3175	0x14003ac44
?Register@TouchSelectItem@DirectUI@@SAJXZ	3176	0x140026b48
?Register@TouchSlider@DirectUI@@SAJXZ	3177	0x14002b7c4
?Register@TouchSwitch@DirectUI@@SAJXZ	3178	0x1400294f0
?Register@UnknownElement@DirectUI@@SAJXZ	3179	0x140030fc4
?Register@Viewer@DirectUI@@SAJXZ	3180	0x14001049c
?Register@XBaby@DirectUI@@SAJXZ	3181	0x1400186d0
?Register@XElement@DirectUI@@SAJXZ	3182	0x14002d828
?RegisterForAnimationStatusChanges@TouchHWNDElement@DirectUI@@QEAAXXZ	3183	0x14002492c
?RegisterForIHMChanges@TouchHWNDElement@DirectUI@@QEAAJXZ	3184	0x14003ce04
?RegisterForMonitorPowerChanges@TouchHWNDElement@DirectUI@@QEAAJXZ	3185	0x1400221a4
?RegisteredDefaultButtonProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3186	0x14002edf8
?Release@ClassInfoBase@DirectUI@@UEAAHXZ	3187	0x14002d134
?Release@DuiAccessible@DirectUI@@UEAAKXZ	3188	0x14000d360
?Release@Element@DirectUI@@QEAAKXZ	3189	0x140038420
?Release@ElementProvider@DirectUI@@UEAAKXZ	3190	0x140026dcc
?Release@ExpandCollapseProvider@DirectUI@@UEAAKXZ	3191	0x1400198f8
?Release@GridItemProvider@DirectUI@@UEAAKXZ	3192	0x1400365d0
?Release@GridProvider@DirectUI@@UEAAKXZ	3193	0x140015630
?Release@HWNDElementProvider@DirectUI@@UEAAKXZ	3194	0x14001c980
?Release@InvokeProvider@DirectUI@@UEAAKXZ	3195	0x1400411f4
?Release@RangeValueProvider@DirectUI@@UEAAKXZ	3196	0x1400259d8
?Release@RefcountBase@DirectUI@@QEAAJXZ	3197	0x140024acc
?Release@ScrollItemProvider@DirectUI@@UEAAKXZ	3198	0x140035184
?Release@ScrollProvider@DirectUI@@UEAAKXZ	3199	0x140030ae0
?Release@SelectionItemProvider@DirectUI@@UEAAKXZ	3200	0x140033bfc
?Release@SelectionProvider@DirectUI@@UEAAKXZ	3201	0x1400047e0
?Release@TableItemProvider@DirectUI@@UEAAKXZ	3202	0x140033b90
?Release@TableProvider@DirectUI@@UEAAKXZ	3203	0x14001205c
?Release@ToggleProvider@DirectUI@@UEAAKXZ	3204	0x140016550
?Release@Value@DirectUI@@QEAAXXZ	3205	0x14003a068
?Release@ValueProvider@DirectUI@@UEAAKXZ	3206	0x140004a30
?Release@XProvider@DirectUI@@UEAAKXZ	3207	0x140038f78
?ReleaseSnapshot@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3208	0x140029d40
?ReloadIcon@Value@DirectUI@@CAPEAUHICON__@@PEAUGraphic@2@M@Z	3209	0x140025c8c
?Remove@Element@DirectUI@@QEAAJPEAV12@@Z	3210	0x140031cf8
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z	3211	0x14000dc74
?Remove@ElementProviderManager@DirectUI@@SAXPEAVElementProvider@2@@Z	3212	0x1400304f4
?Remove@LinkedList@DirectUI@@QEAAXPEAVLinkedListNode@2@@Z	3213	0x14000eedc
?RemoveAll@Element@DirectUI@@QEAAJXZ	3214	0x140026f34
?RemoveAll@TouchSelect@DirectUI@@QEAAXXZ	3215	0x14000d94c
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z	3216	0x14003cdfc
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ	3217	0x1400030d0
?RemoveFromSelection@SelectionItemProvider@DirectUI@@UEAAJXZ	3218	0x140034764
?RemoveItem@TouchSelect@DirectUI@@QEAAJH@Z	3219	0x1400328f8
?RemoveListener@Element@DirectUI@@QEAAXPEAUIElementListener@2@@Z	3220	0x14003a180
?RemoveLocalValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZ@Z	3221	0x1400357a8
?RemoveLocalValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@@Z	3222	0x14000b6a4
?RemoveRichDuiTooltip@TouchSlider@DirectUI@@QEAAXXZ	3223	0x14003a8d0
?RemoveShortcutFromName@Element@DirectUI@@AEAAPEAGPEBG@Z	3224	0x14001c278
?RemoveTail@LinkedList@DirectUI@@QEAAPEAVLinkedListNode@2@XZ	3225	0x14002dc68
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z	3226	0x140023744
?RemoveTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3227	0x140011c08
?RemoveTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3228	0x14002d55c
?RepeatClick@TouchRepeatButton@DirectUI@@SA?AVUID@@XZ	3229	0x140007adc
?RepeatProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3230	0x1400382c4
?Reset@DuiAccessible@DirectUI@@UEAAJXZ	3231	0x140014060
?Reset@HWNDHostAccessible@DirectUI@@UEAAJXZ	3232	0x140011eb0
?ResetInputState@TouchScrollViewer@DirectUI@@QEAAJXZ	3233	0x14003d52c
?ResetManipulations@TouchScrollViewer@DirectUI@@QEAAJXZ	3234	0x140039590
?ResolveBindings@Macro@DirectUI@@IEAAXXZ	3235	0x14002f61c
?RestoreFocus@NativeHWNDHost@DirectUI@@QEAAHXZ	3236	0x14000eec0
?Resume@Movie@DirectUI@@QEAAXXZ	3237	0x14002d9f4
?ReturnValueParser@DUIXmlParser@DirectUI@@IEAAXPEAVValueParser@ParserTools@2@@Z	3238	0x14003d5ec
?Rewind@Movie@DirectUI@@QEAAXXZ	3239	0x14001b204
?RichTooltipShowing@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3240	0x14000c880
?RightClick@TouchButton@DirectUI@@SA?AVUID@@XZ	3241	0x14000c438
?RuntimeIdProperty@Schema@DirectUI@@2HA	3242	0x14001c730
?STACKDEPTH@CallstackTracker@DirectUI@@0HB	3243	0x14001eeac
?SaveFocus@NativeHWNDHost@DirectUI@@QEAAXXZ	3244	0x14000cfac
?ScaleChanged@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3245	0x14002c890
?ScaleFactorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3246	0x14003c7b0
?Scroll@BaseScrollBar@DirectUI@@SA?AVUID@@XZ	3247	0x14000181c
?Scroll@ScrollProvider@DirectUI@@UEAAJW4ScrollAmount@@0@Z	3248	0x140039268
?Scroll@ScrollProxy@DirectUI@@AEAAJW4ScrollAmount@@0@Z	3249	0x14000be64
?ScrollBarControlType@Schema@DirectUI@@2HA	3250	0x140035514
?ScrollIntoView@ScrollItemProvider@DirectUI@@UEAAJXZ	3251	0x1400171c0
?ScrollItemPattern@Schema@DirectUI@@2HA	3252	0x140005344
?ScrollLine@ScrollProxy@DirectUI@@AEAAJ_N0@Z	3253	0x140036e1c
?ScrollPaddingProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3254	0x140027208
?ScrollPage@ScrollProxy@DirectUI@@AEAAJ_N0@Z	3255	0x14000deac
?ScrollPattern@Schema@DirectUI@@2HA	3256	0x140006400
?ScrollToHorizontalPosition@ScrollProxy@DirectUI@@AEAAJH_N@Z	3257	0x140010768
?ScrollToVerticalPosition@ScrollProxy@DirectUI@@AEAAJH_N@Z	3258	0x14003747c
?Scroll_HorizontalScrollPercent_Property@Schema@DirectUI@@2HA	3259	0x14002fe8c
?Scroll_HorizontalViewSize_Property@Schema@DirectUI@@2HA	3260	0x14000679c
?Scroll_HorizontallyScrollable_Property@Schema@DirectUI@@2HA	3261	0x14001dcf0
?Scroll_VerticalScrollPercent_Property@Schema@DirectUI@@2HA	3262	0x14001ee2c
?Scroll_VerticalViewSize_Property@Schema@DirectUI@@2HA	3263	0x1400085ec
?Scroll_VerticallyScrollable_Property@Schema@DirectUI@@2HA	3264	0x14000c304
?Select@SelectionItemProvider@DirectUI@@UEAAJXZ	3265	0x140004700
?Select@SelectorSelectionItemProxy@DirectUI@@AEAAJXZ	3266	0x1400316a8
?SelectAll@TouchEdit2@DirectUI@@QEAAJXZ	3267	0x140029618
?SelectNone@TouchEdit2@DirectUI@@QEAAJXZ	3268	0x14000d788
?SelectedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3269	0x14001adc8
?SelectionBackgroundColorProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3270	0x14001dca4
?SelectionChange@Combobox@DirectUI@@SA?AVUID@@XZ	3271	0x14000f9bc
?SelectionChange@Selector@DirectUI@@SA?AVUID@@XZ	3272	0x140016044
?SelectionChange@TouchSelect@DirectUI@@SA?AVUID@@XZ	3273	0x14002f6cc
?SelectionForegroundColorProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3274	0x1400384a0
?SelectionInvalidatedEvent@Schema@DirectUI@@2HA	3275	0x14002c0ec
?SelectionItemElementAddedToSelectionEvent@Schema@DirectUI@@2HA	3276	0x14003a8a8
?SelectionItemElementRemovedFromSelectionEvent@Schema@DirectUI@@2HA	3277	0x14003868c
?SelectionItemElementSelectedEvent@Schema@DirectUI@@2HA	3278	0x14001a060
?SelectionItemPattern@Schema@DirectUI@@2HA	3279	0x140008638
?SelectionItem_IsSelected_Property@Schema@DirectUI@@2HA	3280	0x140022258
?SelectionItem_SelectionContainer_Property@Schema@DirectUI@@2HA	3281	0x14003ea3c
?SelectionPattern@Schema@DirectUI@@2HA	3282	0x14003cd6c
?SelectionProp@Combobox@DirectUI@@SAPEBUPropertyInfo@2@XZ	3283	0x14003bea8
?SelectionProp@Selector@DirectUI@@SAPEBUPropertyInfo@2@XZ	3284	0x14003e48c
?SelectionProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	3285	0x14002481c
?Selection_CanSelectMultiple_Property@Schema@DirectUI@@2HA	3286	0x140003f14
?Selection_IsSelectionRequired_Property@Schema@DirectUI@@2HA	3287	0x140004a0c
?Selection_Selection_Property@Schema@DirectUI@@2HA	3288	0x140021e54
?SemanticChange@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3289	0x140003a9c
?SemanticZoomControlType@Schema@DirectUI@@2HA	3290	0x14000bf34
?SendParseError@DUIXmlParser@DirectUI@@IEAAXPEBG0HHJ@Z	3291	0x14003f0f4
?SendParseError@DUIXmlParser@DirectUI@@IEAAXPEBG0PEAUIXmlReader@@J@Z	3292	0x140006478
?SeparatorControlType@Schema@DirectUI@@2HA	3293	0x14002dcf0
?SetAbsorbsShortcut@Element@DirectUI@@QEAAJ_N@Z	3294	0x14002ecc4
?SetAccDefAction@Element@DirectUI@@QEAAJPEBG@Z	3295	0x140025dcc
?SetAccDesc@Element@DirectUI@@QEAAJPEBG@Z	3296	0x1400167ec
?SetAccHelp@Element@DirectUI@@QEAAJPEBG@Z	3297	0x1400178dc
?SetAccItemStatus@Element@DirectUI@@QEAAJPEBG@Z	3298	0x14003e144
?SetAccItemType@Element@DirectUI@@QEAAJPEBG@Z	3299	0x14001acb4
?SetAccName@Element@DirectUI@@QEAAJPEBG@Z	3300	0x140008bf0
?SetAccRole@Element@DirectUI@@QEAAJH@Z	3301	0x140018e5c
?SetAccState@Element@DirectUI@@QEAAJH@Z	3302	0x140028a50
?SetAccValue@Element@DirectUI@@QEAAJPEBG@Z	3303	0x140017ca4
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z	3304	0x140025684
?SetActive@Element@DirectUI@@QEAAJH@Z	3305	0x14000bc8c
?SetActiveState@TouchScrollBar@DirectUI@@QEAAXW4ActiveState@2@_N@Z	3306	0x14002e100
?SetActivityOccuring@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3307	0x140016c98
?SetActivityOccuring@ModernProgressRing@DirectUI@@QEAAJ_N@Z	3308	0x14001f0a8
?SetAddLayeredRef@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3309	0x14001d29c
?SetAddLayeredRef@ModernProgressRing@DirectUI@@QEAAJ_N@Z	3310	0x1400413f4
?SetAliasedRendering@RichText@DirectUI@@QEAAJ_N@Z	3311	0x140006760
?SetAllowArrowOut@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3312	0x140008f9c
?SetAlpha@Element@DirectUI@@QEAAJH@Z	3313	0x140026214
?SetAnimatePopupOnDismiss@TouchSelect@DirectUI@@QEAAJ_N@Z	3314	0x1400106dc
?SetAnimation@Element@DirectUI@@QEAAJH@Z	3315	0x140014be4
?SetAutoGrouping@CCRadioButton@DirectUI@@QEAAJ_N@Z	3316	0x14003fa3c
?SetAutoHeight@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3317	0x1400184ec
?SetAutoStart@Movie@DirectUI@@QEAAJ_N@Z	3318	0x14001a8d0
?SetAutoStop@Movie@DirectUI@@QEAAJ_N@Z	3319	0x140004b44
?SetBackgroundColor@Element@DirectUI@@QEAAJAEBUFill@2@@Z	3320	0x140017fa4
?SetBackgroundColor@Element@DirectUI@@QEAAJK@Z	3321	0x1400305f4
?SetBackgroundColor@Element@DirectUI@@QEAAJKKE@Z	3322	0x14000fcd4
?SetBackgroundColor@Element@DirectUI@@QEAAJKKKE@Z	3323	0x14003c150
?SetBackgroundColor@Element@DirectUI@@QEAAJPEBGHH@Z	3324	0x14001bae0
?SetBackgroundOwnerID@HWNDHost@DirectUI@@QEAAJPEBG@Z	3325	0x140007fcc
?SetBackgroundStdColor@Element@DirectUI@@QEAAJH@Z	3326	0x140037644
?SetBaseline@RichText@DirectUI@@QEAAJH@Z	3327	0x14002c8d0
?SetBorderColor@Element@DirectUI@@QEAAJK@Z	3328	0x14003e5e4
?SetBorderGradientColor@Element@DirectUI@@QEAAJKKE@Z	3329	0x140018890
?SetBorderStdColor@Element@DirectUI@@QEAAJH@Z	3330	0x1400334f0
?SetBorderStyle@Element@DirectUI@@QEAAJH@Z	3331	0x14003537c
?SetBorderThickness@Element@DirectUI@@QEAAJHHHH@Z	3332	0x140038b50
?SetBuffering@TouchSlider@DirectUI@@QEAAJH@Z	3333	0x1400209e0
?SetButtonClassAcceptsEnterKey@DialogElement@DirectUI@@QEAAJ_N@Z	3334	0x14000b28c
?SetButtonClassAcceptsEnterKey@XBaby@DirectUI@@UEAAJ_N@Z	3335	0x140017444
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UEAAJ_N@Z	3336	0x14000b384
?SetCache@RichText@DirectUI@@QEAAXKPEAUIDUIRichTextCache@@@Z	3337	0x14000b42c
?SetCacheDirty@Layout@DirectUI@@IEAAXXZ	3338	0x1400010c8
?SetCaptured@Button@DirectUI@@QEAAJ_N@Z	3339	0x14001f9b8
?SetCaptured@TouchButton@DirectUI@@QEAAJ_N@Z	3340	0x1400276a4
?SetCaretPosition@TouchEdit2@DirectUI@@QEAAJJ@Z	3341	0x14001878c
?SetCheckedState@TouchCheckBox@DirectUI@@QEAAJW4CheckedStateFlags@2@@Z	3342	0x140023b00
?SetClass@Element@DirectUI@@QEAAJPEBG@Z	3343	0x140029840
?SetClassInfoPtr@AccessibleButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3344	0x1400332d4
?SetClassInfoPtr@AnimationStrip@DirectUI@@SAXPEAUIClassInfo@2@@Z	3345	0x14003c8f0
?SetClassInfoPtr@AutoButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3346	0x140005770
?SetClassInfoPtr@BaseScrollViewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3347	0x14002d980
?SetClassInfoPtr@Bind@DirectUI@@SAXPEAUIClassInfo@2@@Z	3348	0x14002620c
?SetClassInfoPtr@Browser@DirectUI@@SAXPEAUIClassInfo@2@@Z	3349	0x14001fabc
?SetClassInfoPtr@Button@DirectUI@@SAXPEAUIClassInfo@2@@Z	3350	0x140004f4c
?SetClassInfoPtr@CCAVI@DirectUI@@SAXPEAUIClassInfo@2@@Z	3351	0x1400201f8
?SetClassInfoPtr@CCBase@DirectUI@@SAXPEAUIClassInfo@2@@Z	3352	0x14000bf60
?SetClassInfoPtr@CCBaseCheckRadioButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3353	0x140012230
?SetClassInfoPtr@CCBaseScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3354	0x140026f18
?SetClassInfoPtr@CCCheckBox@DirectUI@@SAXPEAUIClassInfo@2@@Z	3355	0x140030e5c
?SetClassInfoPtr@CCCommandLink@DirectUI@@SAXPEAUIClassInfo@2@@Z	3356	0x1400158b4
?SetClassInfoPtr@CCHScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3357	0x140025698
?SetClassInfoPtr@CCListBox@DirectUI@@SAXPEAUIClassInfo@2@@Z	3358	0x1400152d4
?SetClassInfoPtr@CCListView@DirectUI@@SAXPEAUIClassInfo@2@@Z	3359	0x1400253a4
?SetClassInfoPtr@CCProgressBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3360	0x14002b1bc
?SetClassInfoPtr@CCPushButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3361	0x140006cec
?SetClassInfoPtr@CCRadioButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3362	0x14001b9c8
?SetClassInfoPtr@CCSysLink@DirectUI@@SAXPEAUIClassInfo@2@@Z	3363	0x14001eb48
?SetClassInfoPtr@CCTrackBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3364	0x140010cdc
?SetClassInfoPtr@CCTreeView@DirectUI@@SAXPEAUIClassInfo@2@@Z	3365	0x1400385a8
?SetClassInfoPtr@CCVScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3366	0x14000479c
?SetClassInfoPtr@CheckBoxGlyph@DirectUI@@SAXPEAUIClassInfo@2@@Z	3367	0x140007f18
?SetClassInfoPtr@Clipper@DirectUI@@SAXPEAUIClassInfo@2@@Z	3368	0x140012170
?SetClassInfoPtr@Combobox@DirectUI@@SAXPEAUIClassInfo@2@@Z	3369	0x14003ec20
?SetClassInfoPtr@DialogElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3370	0x14002fb54
?SetClassInfoPtr@Edit@DirectUI@@SAXPEAUIClassInfo@2@@Z	3371	0x14002a1c8
?SetClassInfoPtr@Element@DirectUI@@SAXPEAUIClassInfo@2@@Z	3372	0x14000811c
?SetClassInfoPtr@ElementWithHWND@DirectUI@@SAXPEAUIClassInfo@2@@Z	3373	0x1400261f4
?SetClassInfoPtr@Expandable@DirectUI@@SAXPEAUIClassInfo@2@@Z	3374	0x1400134e8
?SetClassInfoPtr@Expando@DirectUI@@SAXPEAUIClassInfo@2@@Z	3375	0x14000a904
?SetClassInfoPtr@ExpandoButtonGlyph@DirectUI@@SAXPEAUIClassInfo@2@@Z	3376	0x140003f08
?SetClassInfoPtr@HWNDElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3377	0x140017d84
?SetClassInfoPtr@HWNDHost@DirectUI@@SAXPEAUIClassInfo@2@@Z	3378	0x14002e1d4
?SetClassInfoPtr@Macro@DirectUI@@SAXPEAUIClassInfo@2@@Z	3379	0x140028b28
?SetClassInfoPtr@Movie@DirectUI@@SAXPEAUIClassInfo@2@@Z	3380	0x140033b28
?SetClassInfoPtr@Navigator@DirectUI@@SAXPEAUIClassInfo@2@@Z	3381	0x140006a30
?SetClassInfoPtr@PText@DirectUI@@SAXPEAUIClassInfo@2@@Z	3382	0x140037b64
?SetClassInfoPtr@Page@DirectUI@@SAXPEAUIClassInfo@2@@Z	3383	0x140024b20
?SetClassInfoPtr@Pages@DirectUI@@SAXPEAUIClassInfo@2@@Z	3384	0x14002a790
?SetClassInfoPtr@Progress@DirectUI@@SAXPEAUIClassInfo@2@@Z	3385	0x14002d618
?SetClassInfoPtr@PushButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3386	0x140025458
?SetClassInfoPtr@RadioButtonGlyph@DirectUI@@SAXPEAUIClassInfo@2@@Z	3387	0x1400319f4
?SetClassInfoPtr@RefPointElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3388	0x140002f88
?SetClassInfoPtr@RepeatButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3389	0x14001ba40
?SetClassInfoPtr@Repeater@DirectUI@@SAXPEAUIClassInfo@2@@Z	3390	0x14000e064
?SetClassInfoPtr@ScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3391	0x140013bb4
?SetClassInfoPtr@ScrollViewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3392	0x140029f14
?SetClassInfoPtr@Selector@DirectUI@@SAXPEAUIClassInfo@2@@Z	3393	0x1400286ac
?SetClassInfoPtr@SelectorNoDefault@DirectUI@@SAXPEAUIClassInfo@2@@Z	3394	0x14001bea8
?SetClassInfoPtr@StyledScrollViewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3395	0x1400145b8
?SetClassInfoPtr@TextGraphic@DirectUI@@SAXPEAUIClassInfo@2@@Z	3396	0x1400219fc
?SetClassInfoPtr@Thumb@DirectUI@@SAXPEAUIClassInfo@2@@Z	3397	0x140028f44
?SetClassInfoPtr@UnknownElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3398	0x1400314bc
?SetClassInfoPtr@Viewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3399	0x140003b10
?SetClassInfoPtr@XBaby@DirectUI@@SAXPEAUIClassInfo@2@@Z	3400	0x14003c240
?SetClassInfoPtr@XElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3401	0x1400306e0
?SetClient@BorderLayout@DirectUI@@AEAAXPEAVElement@2@@Z	3402	0x14001d044
?SetColorFontPaletteIndex@RichText@DirectUI@@QEAAJH@Z	3403	0x14000400c
?SetCompositedText@Element@DirectUI@@QEAAJ_N@Z	3404	0x140037c2c
?SetCompositingQuality@Movie@DirectUI@@QEAAJH@Z	3405	0x140040db8
?SetConnect@Bind@DirectUI@@QEAAJPEBG@Z	3406	0x14000fe70
?SetConstrainLayout@RichText@DirectUI@@QEAAJH@Z	3407	0x140037870
?SetContact@TouchScrollViewer@DirectUI@@QEAAJI_N@Z	3408	0x14000d304
?SetContactNeeded@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3409	0x140032090
?SetContactNotify@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3410	0x140012af0
?SetContentAlign@Element@DirectUI@@QEAAJH@Z	3411	0x1400074f8
?SetContentGraphic@Element@DirectUI@@QEAAJPEBGEI@Z	3412	0x14002dacc
?SetContentGraphic@Element@DirectUI@@QEAAJPEBGGG@Z	3413	0x14002cf4c
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z	3414	0x14002cbb8
?SetCursor@Element@DirectUI@@QEAAJPEBG@Z	3415	0x14000c748
?SetCursorHandle@Element@DirectUI@@QEAAJPEAUHICON__@@@Z	3416	0x140031970
?SetDWriteFontCollection@RichText@DirectUI@@QEAAXPEAUIDWriteFontCollection@@@Z	3417	0x14000b92c
?SetDWriteTextLayout@RichText@DirectUI@@QEAAXPEAUIDWriteTextLayout@@@Z	3418	0x140021f18
?SetDataEngine@Repeater@DirectUI@@QEAAXPEAUIDataEngine@2@@Z	3419	0x140013dac
?SetDataEntry@Macro@DirectUI@@QEAAXPEAUIDataEntry@2@PEAVElement@2@@Z	3420	0x140035fc4
?SetDataEntry@PText@DirectUI@@QEAAXPEAUIDataEntry@2@@Z	3421	0x140015a70
?SetDefaultButtonTracking@DialogElement@DirectUI@@UEAAJ_N@Z	3422	0x140034ad4
?SetDefaultButtonTracking@XBaby@DirectUI@@UEAAJ_N@Z	3423	0x140015640
?SetDefaultButtonTracking@XProvider@DirectUI@@UEAAJ_N@Z	3424	0x1400159b0
?SetDefaultFocusID@NativeHWNDHost@DirectUI@@QEAAXPEBG@Z	3425	0x1400052e0
?SetDefaultGraphicType@Macro@DirectUI@@QEAAXE_N@Z	3426	0x140011888
?SetDefaultHInstance@DUIXmlParser@DirectUI@@QEAAXPEAUHINSTANCE__@@@Z	3427	0x14002f938
?SetDefaultState@CCPushButton@DirectUI@@IEAAXKK@Z	3428	0x14002415c
?SetDelegateEventHandler@TouchScrollViewer@DirectUI@@QEAAJPEAUIUnknown@@@Z	3429	0x1400099f0
?SetDeterminate@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3430	0x1400202c0
?SetDirection@Element@DirectUI@@QEAAJH@Z	3431	0x140038720
?SetDirty@Edit@DirectUI@@QEAAJ_N@Z	3432	0x1400340e4
?SetDisableAccTextExtend@RichText@DirectUI@@QEAAJ_N@Z	3433	0x14001888c
?SetDisableMouseInRectCheck@TouchRepeatButton@DirectUI@@QEAAJ_N@Z	3434	0x14001f08c
?SetDisableOffscreenCaching@TouchScrollViewer@DirectUI@@QEAAX_N@Z	3435	0x14003d614
?SetDrawOutlines@Movie@DirectUI@@QEAAJ_N@Z	3436	0x1400273f4
?SetDynamicScaling@DUIXmlParser@DirectUI@@QEAAXW4DynamicScaleParsing@2@@Z	3437	0x14001afd8
?SetEdgeHighlightColor@Element@DirectUI@@QEAAJK@Z	3438	0x14001a258
?SetEdgeHighlightThickness@Element@DirectUI@@QEAAJHHHH@Z	3439	0x14001fd60
?SetElementMovesOnIHMNotify@TouchEditBase@DirectUI@@QEAAJ_N@Z	3440	0x14003f710
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z	3441	0x140030950
?SetEncodedContentString@Element@DirectUI@@QEAAJPEBG@Z	3442	0x1400060b8
?SetEnforceSize@PushButton@DirectUI@@QEAAJ_N@Z	3443	0x140033c48
?SetEnsureVisibleUseLayoutCoordinates@Viewer@DirectUI@@QEAAX_N@Z	3444	0x140010ca0
?SetError@DUIFactory@DirectUI@@QEAAXPEBGZZ	3445	0x14001c5dc
?SetExpand@Macro@DirectUI@@QEAAJPEBG@Z	3446	0x140029274
?SetExpanded@Expandable@DirectUI@@QEAAJ_N@Z	3447	0x14000a5a8
?SetFilterOnPaste@TouchEditBase@DirectUI@@QEAAJ_N@Z	3448	0x140030d0c
?SetFireContinuousSliderEvent@TouchSlider@DirectUI@@QEAAX_N@Z	3449	0x140026308
?SetFlags@TouchHWNDElement@DirectUI@@QEAAJW4TouchHWNDElementFlags@2@0@Z	3450	0x140021388
?SetFocus@ElementProvider@DirectUI@@UEAAJXZ	3451	0x140007964
?SetFocus@HWNDElement@DirectUI@@QEAAX_N@Z	3452	0x14003e214
?SetFocus@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z	3453	0x14003b474
?SetFont@Element@DirectUI@@QEAAJPEBG@Z	3454	0x1400292d8
?SetFontColorRuns@RichText@DirectUI@@QEAAJPEBG@Z	3455	0x14001ffb4
?SetFontFace@Element@DirectUI@@QEAAJPEBG@Z	3456	0x14002b910
?SetFontQuality@Element@DirectUI@@QEAAJH@Z	3457	0x140024174
?SetFontSize@Element@DirectUI@@QEAAJH@Z	3458	0x14003e458
?SetFontSizeRuns@RichText@DirectUI@@QEAAJPEBG@Z	3459	0x140026c38
?SetFontStyle@Element@DirectUI@@QEAAJH@Z	3460	0x14002b8fc
?SetFontWeight@Element@DirectUI@@QEAAJH@Z	3461	0x140019c78
?SetFontWeightRuns@RichText@DirectUI@@QEAAJPEBG@Z	3462	0x1400155ec
?SetForceEditTextToLTR@TouchEditBase@DirectUI@@QEAAJ_N@Z	3463	0x140018820
?SetForegroundColor@Element@DirectUI@@QEAAJK@Z	3464	0x1400174fc
?SetForegroundColor@Element@DirectUI@@QEAAJKKE@Z	3465	0x140012c80
?SetForegroundColor@Element@DirectUI@@QEAAJKKKE@Z	3466	0x140027338
?SetForegroundStdColor@Element@DirectUI@@QEAAJH@Z	3467	0x14001f014
?SetFrameDuration@AnimationStrip@DirectUI@@QEAAJH@Z	3468	0x14000e6e8
?SetFrameIndex@AnimationStrip@DirectUI@@QEAAJH@Z	3469	0x140019ba0
?SetFrameWidth@AnimationStrip@DirectUI@@QEAAJH@Z	3470	0x14001f8c8
?SetGetSheetCallback@DUIXmlParser@DirectUI@@QEAAXP6APEAVValue@2@PEBGPEAX@Z1@Z	3471	0x14000649c
?SetGraphicType@Repeater@DirectUI@@QEAAXE@Z	3472	0x14003a4fc
?SetHandleEnter@TouchButton@DirectUI@@QEAAJ_N@Z	3473	0x14002e5e0
?SetHandleEnterKey@DialogElement@DirectUI@@QEAAJ_N@Z	3474	0x14002ff1c
?SetHandleEnterKey@XBaby@DirectUI@@UEAAJ_N@Z	3475	0x140019e08
?SetHandleEnterKey@XProvider@DirectUI@@IEAAX_N@Z	3476	0x1400224a4
?SetHandleGlobalEnter@TouchButton@DirectUI@@QEAAJ_N@Z	3477	0x140015170
?SetHeight@Element@DirectUI@@QEAAJH@Z	3478	0x14001514c
?SetID@Element@DirectUI@@QEAAJPEBG@Z	3479	0x1400411dc
?SetIMEComposing@TouchEditBase@DirectUI@@QEAAJ_N@Z	3480	0x14001936c
?SetIgnoredKeyCombos@TouchEditBase@DirectUI@@QEAAJW4TouchEditFilteredKeyComboFlags@2@0@Z	3481	0x14002a47c
?SetIndependentAnimations@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3482	0x140018868
?SetInnerBorderThickness@TouchEdit2@DirectUI@@QEAAJHHHH@Z	3483	0x140040c84
?SetInputScope@TouchEdit2@DirectUI@@QEAAJW4__MIDL___MIDL_itf_inputscope_0000_0000_0001@@@Z	3484	0x140028c8c
?SetIntegrateIMECandidateList@TouchEditBase@DirectUI@@QEAAJ_N@Z	3485	0x14003ece0
?SetInteractionMode@TouchScrollViewer@DirectUI@@QEAAJH@Z	3486	0x1400351f4
?SetInterpolationMode@Movie@DirectUI@@QEAAJH@Z	3487	0x1400252f0
?SetIsContinuous@TouchSlider@DirectUI@@QEAAJ_N@Z	3488	0x140010fac
?SetIsPressed@TouchSlider@DirectUI@@QEAAJ_N@Z	3489	0x14000a794
?SetIsShowOnOffFeedback@TouchSlider@DirectUI@@QEAAJ_N@Z	3490	0x14000c938
?SetIsVertical@TouchSlider@DirectUI@@QEAAJ_N@Z	3491	0x140021b28
?SetItemData@TouchSelect@DirectUI@@QEAAJHPEAUIUnknown@@@Z	3492	0x14000a668
?SetItemData@TouchSelectItem@DirectUI@@QEAAJPEAUIUnknown@@@Z	3493	0x140020c48
?SetItemHeightInPopup@TouchSelect@DirectUI@@QEAAJH@Z	3494	0x14000d564
?SetItemState@CCTreeView@DirectUI@@QEAAXPEAU_TREEITEM@@I@Z	3495	0x140002f34
?SetKeyFocus@Element@DirectUI@@UEAAXXZ	3496	0x14003f090
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ	3497	0x14003061c
?SetKeyFocus@TouchEditBase@DirectUI@@UEAAXXZ	3498	0x140032c50
?SetKeyFocus@XBaby@DirectUI@@UEAAXXZ	3499	0x14001491c
?SetKeyFocus@XElement@DirectUI@@UEAAXXZ	3500	0x14000c500
?SetKeyboardNavigationCapture@TouchEditBase@DirectUI@@QEAAJW4TouchEditKeyboardNavigationCapture@2@@Z	3501	0x140026320
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z	3502	0x140007714
?SetLayoutCompletionNotify@Element@DirectUI@@QEAAX_N@Z	3503	0x14000caf0
?SetLayoutPointerToNull@Value@DirectUI@@QEAAXXZ	3504	0x140001d50
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z	3505	0x14000ca50
?SetLightDismissIHM@TouchHWNDElement@DirectUI@@QEAAJ_N@Z	3506	0x140013870
?SetLine@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3507	0x14001fff4
?SetLine@ScrollBar@DirectUI@@UEAAJH@Z	3508	0x1400404e8
?SetLineSize@CCTrackBar@DirectUI@@QEAAJH@Z	3509	0x14001c0f4
?SetLineSpacing@RichText@DirectUI@@QEAAJH@Z	3510	0x140005924
?SetLinkIndicatorsToContent@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3511	0x140023108
?SetLocale@RichText@DirectUI@@QEAAJPEBG@Z	3512	0x140017ac8
?SetManipulationHorizontalAlignment@TouchScrollViewer@DirectUI@@QEAAJH@Z	3513	0x140026130
?SetManipulationVerticalAlignment@TouchScrollViewer@DirectUI@@QEAAJH@Z	3514	0x14003bdc0
?SetMapRunsToClusters@RichText@DirectUI@@QEAAJ_N@Z	3515	0x1400324bc
?SetMargin@Element@DirectUI@@QEAAJHHHH@Z	3516	0x140003d1c
?SetMaxLength@Edit@DirectUI@@QEAAJH@Z	3517	0x140017aa4
?SetMaxLength@TouchEditBase@DirectUI@@QEAAJH@Z	3518	0x14003e5f8
?SetMaxLineCount@RichText@DirectUI@@QEAAXI@Z	3519	0x14001bf14
?SetMaximum@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3520	0x140014e34
?SetMaximum@ModernProgressBar@DirectUI@@QEAAJH@Z	3521	0x14002604c
?SetMaximum@Progress@DirectUI@@QEAAJH@Z	3522	0x140014520
?SetMaximum@ScrollBar@DirectUI@@UEAAJH@Z	3523	0x1400170f0
?SetMetering@TouchSlider@DirectUI@@QEAAJH@Z	3524	0x14003a360
?SetMinSize@Element@DirectUI@@QEAAJHH@Z	3525	0x14003f824
?SetMinimum@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3526	0x14001c8b4
?SetMinimum@ModernProgressBar@DirectUI@@QEAAJH@Z	3527	0x14002cc8c
?SetMinimum@Progress@DirectUI@@QEAAJH@Z	3528	0x140033948
?SetMinimum@ScrollBar@DirectUI@@UEAAJH@Z	3529	0x1400321a8
?SetMoveCaretToEndOnSyncContent@TouchEditBase@DirectUI@@QEAAJ_N@Z	3530	0x14003f04c
?SetMultiline@Edit@DirectUI@@QEAAJ_N@Z	3531	0x14002af78
?SetMultiline@TouchEditBase@DirectUI@@QEAAJ_N@Z	3532	0x14000c8ec
?SetNoBrowseOnFirstAdd@Pages@DirectUI@@QEAAXXZ	3533	0x140020928
?SetNote@CCCommandLink@DirectUI@@QEAAJPEBG@Z	3534	0x140020ae0
?SetNotifyHandler@CCBase@DirectUI@@QEAAXP6AHI_K_JPEA_JPEAX@Z3@Z	3535	0x1400403c0
?SetOffText@TouchSwitch@DirectUI@@QEAAJPEBG@Z	3536	0x140015b1c
?SetOnOffText@TouchSwitch@DirectUI@@QEAAXPEBG0@Z	3537	0x14003aa5c
?SetOnText@TouchSwitch@DirectUI@@QEAAJPEBG@Z	3538	0x140036820
?SetOptimizeMove@HWNDHost@DirectUI@@QEAAJ_N@Z	3539	0x1400306b8
?SetOrder@ScrollBar@DirectUI@@QEAAJH@Z	3540	0x140018604
?SetOverhang@Element@DirectUI@@QEAAJ_N@Z	3541	0x14001f610
?SetOverhangOffset@RichText@DirectUI@@QEAAJH@Z	3542	0x140001fb8
?SetOverrideButtonBackground@CCPushButton@DirectUI@@QEAAJ_N@Z	3543	0x14003ff4c
?SetOverrideScaleFactor@DUIXmlParser@DirectUI@@QEAAXM@Z	3544	0x140005dcc
?SetOverrideScaleFactor@Element@DirectUI@@QEAAXM@Z	3545	0x14001ae00
?SetPVLAnimationState@Element@DirectUI@@QEAAXH@Z	3546	0x14001ba60
?SetPadding@Element@DirectUI@@QEAAJHHHH@Z	3547	0x14003db2c
?SetPage@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3548	0x1400364dc
?SetPage@ScrollBar@DirectUI@@UEAAJH@Z	3549	0x1400091f4
?SetParameter@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAX@Z	3550	0x1400306c4
?SetParentSizeControl@HWNDElement@DirectUI@@QEAAX_N@Z	3551	0x1400252a8
?SetParseErrorCallback@DUIXmlParser@DirectUI@@QEAAXP6AXPEBG0HPEAX@Z1@Z	3552	0x140011e84
?SetParseState@DUIXmlParser@DirectUI@@AEAAXW4_DUI_PARSE_STATE@2@@Z	3553	0x140001da4
?SetParser@Macro@DirectUI@@QEAAXPEAVDUIXmlParser@2@@Z	3554	0x140017ed4
?SetPasswordCharacter@Edit@DirectUI@@QEAAJH@Z	3555	0x14000ba5c
?SetPasswordCharacter@TouchEditBase@DirectUI@@QEAAJH@Z	3556	0x14001c558
?SetPasswordRevealMode@TouchEdit2@DirectUI@@QEAAJW4TouchEditPasswordRevealMode@2@@Z	3557	0x14001f034
?SetPath@Movie@DirectUI@@QEAAJPEBG@Z	3558	0x140038fb4
?SetPercent@ScrollProxy@DirectUI@@AEAAJPEAVBaseScrollBar@2@N@Z	3559	0x140007ad8
?SetPinned@BaseScrollBar@DirectUI@@QEAAX_N@Z	3560	0x140002460
?SetPinning@BaseScrollViewer@DirectUI@@QEAAJH@Z	3561	0x140032970
?SetPixelOffsetMode@Movie@DirectUI@@QEAAJH@Z	3562	0x140040654
?SetPlay@AnimationStrip@DirectUI@@QEAAJ_N@Z	3563	0x140011180
?SetPlayAllFramesMode@Movie@DirectUI@@QEAAJ_N@Z	3564	0x140029a2c
?SetPopupBounds@TouchSelect@DirectUI@@QEAAJHHHH@Z	3565	0x14002f150
?SetPosition@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3566	0x14000e548
?SetPosition@ModernProgressBar@DirectUI@@QEAAJH@Z	3567	0x14000f2c4
?SetPosition@Progress@DirectUI@@QEAAJH@Z	3568	0x140026df4
?SetPosition@ScrollBar@DirectUI@@UEAAJH@Z	3569	0x14002c7a4
?SetPreprocessedXML@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z	3570	0x140012814
?SetPreserveAlphaChannel@Element@DirectUI@@QEAAX_N@Z	3571	0x140039070
?SetPressed@Button@DirectUI@@QEAAJ_N@Z	3572	0x14002210c
?SetPressed@TouchButton@DirectUI@@QEAAJ_N@Z	3573	0x140032e5c
?SetPreventFormatChangeUpdatingModifiedState@TouchEditBase@DirectUI@@QEAAJ_N@Z	3574	0x14003d21c
?SetPromptText@TouchEdit2@DirectUI@@QEAAJPEBG@Z	3575	0x14001147c
?SetPromptWithCaret@TouchEdit2@DirectUI@@QEAAJ_N@Z	3576	0x14000db60
?SetProperty@Bind@DirectUI@@QEAAJPEBG@Z	3577	0x14000f9f8
?SetProportional@ScrollBar@DirectUI@@QEAAJ_N@Z	3578	0x140033524
?SetProvider@XElement@DirectUI@@QEAAJPEAUIUnknown@@@Z	3579	0x14001ab68
?SetRangeMax@CCTrackBar@DirectUI@@QEAAJH@Z	3580	0x14001bee0
?SetRangeMax@TouchSlider@DirectUI@@QEAAXH@Z	3581	0x140021e78
?SetRangeMin@CCTrackBar@DirectUI@@QEAAJH@Z	3582	0x14002a91c
?SetRangeMin@TouchSlider@DirectUI@@QEAAXH@Z	3583	0x14000546c
?SetRangeMinAndRangeMax@TouchSlider@DirectUI@@QEAAXHH@Z	3584	0x140010a8c
?SetReadOnly@TouchEditBase@DirectUI@@QEAAJ_N@Z	3585	0x140023e08
?SetReferencePoint@RefPointElement@DirectUI@@QEAAJHH@Z	3586	0x1400143e0
?SetRegisteredDefaultButton@DialogElement@DirectUI@@QEAAJPEAVElement@2@@Z	3587	0x14001eda0
?SetRegisteredDefaultButton@XBaby@DirectUI@@UEAAJPEAVElement@2@@Z	3588	0x14003a07c
?SetRegisteredDefaultButton@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z	3589	0x1400307a0
?SetRegisteredDefaultButtonSelectedState@DialogElementCore@DirectUI@@IEAAX_N@Z	3590	0x1400352a0
?SetRelPixHeight@Element@DirectUI@@QEAAJH@Z	3591	0x14003383c
?SetRelPixMargin@Element@DirectUI@@QEAAJHHHH@Z	3592	0x14000581c
?SetRelPixPadding@Element@DirectUI@@QEAAJHHHH@Z	3593	0x14001b594
?SetRelPixWidth@Element@DirectUI@@QEAAJH@Z	3594	0x140036e40
?SetReorderable@ItemList@DirectUI@@QEAAJ_N@Z	3595	0x140028684
?SetRepeat@Movie@DirectUI@@QEAAJ_N@Z	3596	0x140003098
?SetRespectLanguageDirection@TouchSlider@DirectUI@@QEAAX_N@Z	3597	0x14002eb08
?SetRespondToMouseScroll@TouchSlider@DirectUI@@QEAAX_N@Z	3598	0x14001cda8
?SetRootWindowForTheming@DUIXmlParser@DirectUI@@QEAAXPEAUHWND__@@@Z	3599	0x14001cf30
?SetScaleFactor@DUIXmlParser@DirectUI@@QEAAXM@Z	3600	0x1400413f4
?SetScreenCenter@HWNDElement@DirectUI@@QEAAX_N@Z	3601	0x14000b710
?SetScrollControlHost@TouchScrollViewer@DirectUI@@QEAAJPEAVElement@2@@Z	3602	0x140018874
?SetScrollPadding@TouchScrollViewer@DirectUI@@QEAAJHHHH@Z	3603	0x1400412f8
?SetScrollPercent@ScrollProvider@DirectUI@@UEAAJNN@Z	3604	0x140024038
?SetScrollPercent@ScrollProxy@DirectUI@@AEAAJNN@Z	3605	0x140024694
?SetSelected@Element@DirectUI@@QEAAJ_N@Z	3606	0x140002bdc
?SetSelection@Combobox@DirectUI@@QEAAJH@Z	3607	0x14000553c
?SetSelection@Selector@DirectUI@@UEAAJPEAVElement@2@@Z	3608	0x140001fdc
?SetSelection@SelectorNoDefault@DirectUI@@UEAAJPEAVElement@2@@Z	3609	0x14000db1c
?SetSelection@TouchEdit2@DirectUI@@QEAAJJJ@Z	3610	0x14003e2d0
?SetSelection@TouchSelect@DirectUI@@QEAAJPEAVElement@2@@Z	3611	0x140017c38
?SetSelectionBackgroundColor@TouchEditBase@DirectUI@@QEAAJPEAVValue@2@@Z	3612	0x140040b3c
?SetSelectionForegroundColor@TouchEditBase@DirectUI@@QEAAJPEAVValue@2@@Z	3613	0x14002f074
?SetSelectionIndex@TouchSelect@DirectUI@@QEAAJH@Z	3614	0x14002cf88
?SetShadowIntensity@Element@DirectUI@@QEAAJH@Z	3615	0x140034798
?SetSheet@Element@DirectUI@@QEAAJPEAVStyleSheet@2@@Z	3616	0x14000e274
?SetShortcut@Element@DirectUI@@QEAAJH@Z	3617	0x14002d154
?SetShowClearButtonMinWidth@TouchEdit2@DirectUI@@QEAAJH@Z	3618	0x1400095c4
?SetShowKeyFocus@TouchButton@DirectUI@@QEAAJ_N@Z	3619	0x140038704
?SetShowTick@TouchSlider@DirectUI@@QEAAJ_N@Z	3620	0x14002aef4
?SetSmoothFillAnimation@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3621	0x14002cb30
?SetSmoothingMode@Movie@DirectUI@@QEAAJH@Z	3622	0x14003e678
?SetSnapIntervalX@TouchScrollViewer@DirectUI@@QEAAJM@Z	3623	0x140028344
?SetSnapIntervalY@TouchScrollViewer@DirectUI@@QEAAJM@Z	3624	0x140035f44
?SetSnapMode@TouchScrollViewer@DirectUI@@QEAAJH@Z	3625	0x140028308
?SetSnapOffsetX@TouchScrollViewer@DirectUI@@QEAAJM@Z	3626	0x14002e0a0
?SetSnapOffsetY@TouchScrollViewer@DirectUI@@QEAAJM@Z	3627	0x14000dc94
?SetSnapPointCollectionX@TouchScrollViewer@DirectUI@@QEAAJPEAV?$DynamicArray@N$0A@@2@@Z	3628	0x140014d94
?SetSnapPointCollectionX@TouchScrollViewer@DirectUI@@QEAAJPEBNH@Z	3629	0x14003ec58
?SetSnapPointCollectionY@TouchScrollViewer@DirectUI@@QEAAJPEAV?$DynamicArray@N$0A@@2@@Z	3630	0x140003a60
?SetSnapPointCollectionY@TouchScrollViewer@DirectUI@@QEAAJPEBNH@Z	3631	0x14003f5bc
?SetState@ModernProgressBar@DirectUI@@QEAAJH@Z	3632	0x14002fba4
?SetStdCursor@Element@DirectUI@@QEAAJH@Z	3633	0x140021d84
?SetStepCount@TouchSlider@DirectUI@@QEAAXH@Z	3634	0x140009c90
?SetStopThumbBehavior@RepeatButton@DirectUI@@QEAAXXZ	3635	0x14002a924
?SetString@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@P8Element@2@EAAPEBGPEAPEAVValue@2@@Z@Z	3636	0x14003c784
?SetStyle@CCTreeView@DirectUI@@QEAAKK@Z	3637	0x1400265b0
?SetSubContent@TouchCommandButton@DirectUI@@QEAAJPEBG@Z	3638	0x140021458
?SetSuppressClearButton@TouchEdit2@DirectUI@@QEAAJ_N@Z	3639	0x140026ae4
?SetSuppressSetContact@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3640	0x14003bb18
?SetSyncContentWhileIMEComposing@TouchEditBase@DirectUI@@QEAAJ_N@Z	3641	0x140024044
?SetTargetPage@Navigator@DirectUI@@QEAAJPEBG@Z	3642	0x14002f204
?SetTextContentOverride@TouchSelectItem@DirectUI@@QEAAJPEBG@Z	3643	0x14003e0b8
?SetTextGlowSize@Element@DirectUI@@QEAAJH@Z	3644	0x1400122fc
?SetTextMode@TouchEditBase@DirectUI@@QEAAJW4TouchEditTextMode@2@@Z	3645	0x140014640
?SetThemeChanged@HWNDHost@DirectUI@@IEAAJH@Z	3646	0x140024074
?SetThemedBorder@Edit@DirectUI@@QEAAJ_N@Z	3647	0x140022a5c
?SetThumbPosition@CCTrackBar@DirectUI@@QEAAJH@Z	3648	0x14002a5fc
?SetThumbValue@TouchSlider@DirectUI@@QEAAXH_N0@Z	3649	0x140034068
?SetThumbValue@TouchSlider@DirectUI@@QEAAXH_N@Z	3650	0x140035ebc
?SetTickCount@TouchSlider@DirectUI@@QEAAJH@Z	3651	0x140015544
?SetTitleText@TouchSwitch@DirectUI@@QEAAJPEBG@Z	3652	0x14003d3e8
?SetToHost@XBaby@DirectUI@@UEAAJPEAVElement@2@@Z	3653	0x140037bbc
?SetToggleOnClick@TouchCheckBox@DirectUI@@QEAAJ_N@Z	3654	0x1400088f4
?SetToggleSwitchText@TouchSwitch@DirectUI@@QEAAXPEBG@Z	3655	0x140032d38
?SetToggleValue@TouchSwitch@DirectUI@@QEAAXH@Z	3656	0x140017160
?SetToggleValue@TouchSwitch@DirectUI@@QEAAXH_N0@Z	3657	0x140017aac
?SetToggleValue@TouchSwitch@DirectUI@@QEAAXH_N@Z	3658	0x1400257ec
?SetTooltip@Element@DirectUI@@QEAAJ_N@Z	3659	0x140020c1c
?SetTooltipMaxWidth@Element@DirectUI@@QEAAJH@Z	3660	0x14001018c
?SetTooltipMaximumLineCount@TouchHWNDElement@DirectUI@@QEAAJH@Z	3661	0x140031194
?SetTooltipText@TouchSlider@DirectUI@@QEAAXPEBG@Z	3662	0x140033768
?SetTracking@CCBaseScrollBar@DirectUI@@QEAAJ_N@Z	3663	0x140001794
?SetTransparent@HWNDHost@DirectUI@@QEAAJ_N@Z	3664	0x14001b590
?SetTreatRightMouseButtonAsLeft@TouchButton@DirectUI@@QEAAJ_N@Z	3665	0x14002014c
?SetTypography@RichText@DirectUI@@QEAAJPEBG@Z	3666	0x140036a04
?SetTypographyRuns@RichText@DirectUI@@QEAAJPEBG@Z	3667	0x1400309d4
?SetUnavailableIcon@DUIXmlParser@DirectUI@@QEAAXPEAUHICON__@@@Z	3668	0x140008aa0
?SetUnknownAttrCallback@DUIXmlParser@DirectUI@@QEAAXP6A_NPEBGPEAX@Z1@Z	3669	0x140029824
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z	3670	0x140020d2c
?SetValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@HPEAVValue@2@@Z	3671	0x1400244c0
?SetValue@RangeValueProvider@DirectUI@@UEAAJN@Z	3672	0x14001279c
?SetValue@ValueProvider@DirectUI@@UEAAJPEBG@Z	3673	0x14003eef4
?SetValue@ValueProxy@DirectUI@@AEAAJPEBG@Z	3674	0x140039684
?SetVertical@ScrollBar@DirectUI@@QEAAJ_N@Z	3675	0x140019088
?SetVerticalScript@RichText@DirectUI@@QEAAJ_N@Z	3676	0x14002e374
?SetVirtualizeElements@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3677	0x140009a6c
?SetVisible@Element@DirectUI@@QEAAJ_N@Z	3678	0x14001118c
?SetVisited@TouchHyperLink@DirectUI@@QEAAJ_N@Z	3679	0x140026b10
?SetWantTabs@Edit@DirectUI@@QEAAJ_N@Z	3680	0x1400245bc
?SetWidth@Element@DirectUI@@QEAAJH@Z	3681	0x140032c20
?SetWinStyle@CCBase@DirectUI@@QEAAJH@Z	3682	0x14003340c
?SetWindowAccessGradientColor@TouchHWNDElement@DirectUI@@QEAAJPEAVValue@2@@Z	3683	0x140035808
?SetWindowActive@Element@DirectUI@@QEAAJ_N@Z	3684	0x140014f00
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z	3685	0x14002ba10
?SetWrapKeyboardNavigate@HWNDElement@DirectUI@@QEAAJ_N@Z	3686	0x1400120a4
?SetX@Element@DirectUI@@QEAAJH@Z	3687	0x140036ba8
?SetXBarVisibility@BaseScrollViewer@DirectUI@@QEAAJH@Z	3688	0x1400213c0
?SetXML@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z	3689	0x140017078
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z	3690	0x14002098c
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEBGPEAUHINSTANCE__@@1@Z	3691	0x140018864
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJPEBG0PEAUHINSTANCE__@@1@Z	3692	0x14000d2f4
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z	3693	0x14003820c
?SetXMLFromResourceWithTheme@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@00@Z	3694	0x140024444
?SetXOffset@BaseScrollViewer@DirectUI@@QEAAJH@Z	3695	0x1400314d8
?SetXOffset@Viewer@DirectUI@@QEAAJH@Z	3696	0x14002463c
?SetXScrollable@BaseScrollViewer@DirectUI@@QEAAJ_N@Z	3697	0x140014b0c
?SetXScrollable@Viewer@DirectUI@@QEAAJ_N@Z	3698	0x14003c7e8
?SetY@Element@DirectUI@@QEAAJH@Z	3699	0x14001d728
?SetYBarVisibility@BaseScrollViewer@DirectUI@@QEAAJH@Z	3700	0x140013580
?SetYOffset@BaseScrollViewer@DirectUI@@QEAAJH@Z	3701	0x1400052e0
?SetYOffset@Viewer@DirectUI@@QEAAJH@Z	3702	0x140008be8
?SetYScrollable@BaseScrollViewer@DirectUI@@QEAAJ_N@Z	3703	0x140010bdc
?SetYScrollable@Viewer@DirectUI@@QEAAJ_N@Z	3704	0x14003e5dc
?SetZoomMaximum@TouchScrollViewer@DirectUI@@QEAAJM@Z	3705	0x140018e3c
?SetZoomMinimum@TouchScrollViewer@DirectUI@@QEAAJM@Z	3706	0x14002d664
?ShadowIntensityProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3707	0x1400056c4
?SheetProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3708	0x14000ae28
?ShiftChild@Element@DirectUI@@QEAAJII@Z	3709	0x14001c3cc
?ShortcutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3710	0x14000875c
?ShouldUseDesktopPerMonitorScaling@HWNDElement@DirectUI@@QEAA_NXZ	3711	0x14001f4bc
?ShouldUsePerMonitorScaling@TouchHWNDElement@DirectUI@@QEAA_NXZ	3712	0x14000bc18
?ShowAccel@HWNDElement@DirectUI@@QEAA_NXZ	3713	0x140011230
?ShowClearButtonMinWidthProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3714	0x1400126fc
?ShowContextMenu@ElementProvider@DirectUI@@UEAAJXZ	3715	0x140011c44
?ShowFocus@HWNDElement@DirectUI@@QEAA_NXZ	3716	0x140019038
?ShowKeyFocusProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3717	0x1400201bc
?ShowRichTooltip@TouchHWNDElement@DirectUI@@QEAAJW4TOUCHTOOLTIP_INPUT@@W4TOUCHTOOLTIP_OPTION_FLAGS@@PEAVElement@2@@Z	3718	0x14001606c
?ShowTickProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3719	0x140024c74
?ShowTooltipOnRightForLTRBuild@TouchSlider@DirectUI@@QEAAXXZ	3720	0x140035fac
?ShowUIState@HWNDElement@DirectUI@@QEAAX_N0@Z	3721	0x140039f98
?ShowWindow@NativeHWNDHost@DirectUI@@QEAAXH@Z	3722	0x140029470
?ShowWindow@XHost@DirectUI@@QEAAXH@Z	3723	0x140028e4c
?SideGraphicProp@TextGraphic@DirectUI@@SAPEBUPropertyInfo@2@XZ	3724	0x140002c34
?SizeInLayoutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3725	0x140017ce0
?SizeZero@FlowLayout@DirectUI@@KA?AUtagSIZE@@XZ	3726	0x140001fc0
?SizeZero@VerticalFlowLayout@DirectUI@@KA?AUtagSIZE@@XZ	3727	0x140020e64
?Skip@DuiAccessible@DirectUI@@UEAAJK@Z	3728	0x14001778c
?Skip@HWNDHostAccessible@DirectUI@@UEAAJK@Z	3729	0x14002abac
?SliderControlType@Schema@DirectUI@@2HA	3730	0x14000b62c
?SliderUpdated@TouchSlider@DirectUI@@SA?AVUID@@XZ	3731	0x140017af0
?SmoothingModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3732	0x14001b05c
?SnapIntervalXProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3733	0x140026534
?SnapIntervalYProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3734	0x140036cbc
?SnapModeProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3735	0x140023d1c
?SnapOffsetXProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3736	0x1400200fc
?SnapOffsetYProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3737	0x14000dcb0
?SnapPointCollectionXProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3738	0x140004304
?SnapPointCollectionYProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3739	0x14002c1e4
?SnapshotTransformElement@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3740	0x140020048
?SortChildren@Element@DirectUI@@QEAAJP6AHPEBX0@Z@Z	3741	0x140003c74
?SpinnerControlType@Schema@DirectUI@@2HA	3742	0x14002caac
?SplitButtonControlType@Schema@DirectUI@@2HA	3743	0x1400060b4
?Start@AnimationStrip@DirectUI@@AEAAJXZ	3744	0x14002aaa0
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z	3745	0x1400197d4
?StartNavigate@Browser@DirectUI@@SA?AVUID@@XZ	3746	0x1400226e8
?StartRichTooltipTimer@TouchHWNDElement@DirectUI@@QEAAJW4TOUCHTOOLTIP_INPUT@@@Z	3747	0x140002be4
?StateProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3748	0x140013250
?StaticWndProc@HWNDElement@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z	3749	0x140032e00
?StaticXHostSubclassProc@TaskPage@DirectUI@@CA_JPEAUHWND__@@I_K_J@Z	3750	0x1400312a4
?StaticXmlParserError@TaskPage@DirectUI@@CAXPEBG0HPEAX@Z	3751	0x140001a74
?StatusBarControlType@Schema@DirectUI@@2HA	3752	0x14000a77c
?Stop@AnimationStrip@DirectUI@@AEAAXXZ	3753	0x140018ec4
?Stop@CCAVI@DirectUI@@QEAAXXZ	3754	0x1400045e4
?StopAnimation@Element@DirectUI@@QEAAXI@Z	3755	0x140013b40
?StopUsingCache@RichText@DirectUI@@QEAAXXZ	3756	0x140017bf0
?StrDupW@Value@DirectUI@@CAJPEBGPEAPEAG@Z	3757	0x14001f00c
?StructureChangedEvent@Schema@DirectUI@@2HA	3758	0x1400204e8
?SubContentProp@TouchCommandButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3759	0x140034780
?SuppressClearButtonProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3760	0x14002fcf8
?SupressRightButtonDrag@Thumb@DirectUI@@QEAAX_N@Z	3761	0x140007660
?SyncBackground@HWNDHost@DirectUI@@IEAAXXZ	3762	0x14003bd14
?SyncCallback@Proxy@DirectUI@@SAJPEAUHGADGET__@@PEAXPEAUEventMsg@@@Z	3763	0x14003b0a4
?SyncColorsAndFonts@HWNDHost@DirectUI@@AEAAXXZ	3764	0x140027278
?SyncContentWhileIMEComposingProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3765	0x14002aaf8
?SyncDestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ	3766	0x140004028
?SyncDirection@HWNDHost@DirectUI@@IEAAXXZ	3767	0x14001fbdc
?SyncElementAlphaFromForegroundAlpha@DirectUI@@YAXPEAVElement@1@@Z	3768	0x14001d610
?SyncFont@HWNDHost@DirectUI@@IEAAXXZ	3769	0x14003e17c
?SyncForeground@HWNDHost@DirectUI@@IEAAXXZ	3770	0x140014dac
?SyncNoteAndGlyph@CCCommandLink@DirectUI@@IEAAXPEAUHWND__@@@Z	3771	0x14001f214
?SyncParent@HWNDHost@DirectUI@@IEAAXXZ	3772	0x140018844
?SyncRect@HWNDHost@DirectUI@@IEAAXI_N@Z	3773	0x140006d84
?SyncScrollBar@CCBaseScrollBar@DirectUI@@QEAAXXZ	3774	0x140023494
?SyncStyle@HWNDHost@DirectUI@@IEAAXXZ	3775	0x140037920
?SyncText@HWNDHost@DirectUI@@IEAAXXZ	3776	0x14000eb40
?SyncVisible@HWNDHost@DirectUI@@IEAAXXZ	3777	0x14001c934
?SystemAlertEvent@Schema@DirectUI@@2HA	3778	0x14002d680
?TabControlType@Schema@DirectUI@@2HA	3779	0x14001c818
?TabItemControlType@Schema@DirectUI@@2HA	3780	0x140008f54
?TableControlType@Schema@DirectUI@@2HA	3781	0x1400243d0
?TableItemPattern@Schema@DirectUI@@2HA	3782	0x14001e1e0
?TableItem_ColumnHeaderItems_Property@Schema@DirectUI@@2HA	3783	0x140001378
?TableItem_RowHeaderItems_Property@Schema@DirectUI@@2HA	3784	0x1400398c0
?TablePattern@Schema@DirectUI@@2HA	3785	0x140037f00
?Table_ColumnHeaders_Property@Schema@DirectUI@@2HA	3786	0x14001627c
?Table_RowHeaders_Property@Schema@DirectUI@@2HA	3787	0x140025440
?Table_RowOrColumnMajor_Property@Schema@DirectUI@@2HA	3788	0x14000c26c
?TargetPageProp@Navigator@DirectUI@@SAPEBUPropertyInfo@2@XZ	3789	0x140027ae4
?TelemetrySetDescription@TouchScrollViewer@DirectUI@@QEAAJPEBG@Z	3790	0x14001521c
?TestDeferObject@Element@DirectUI@@QEAAPEAVDeferCycle@2@XZ	3791	0x140034c98
?TextContentOverrideProp@TouchSelectItem@DirectUI@@SAPEBUPropertyInfo@2@XZ	3792	0x140016674
?TextControlType@Schema@DirectUI@@2HA	3793	0x140040808
?TextGlowSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3794	0x140039360
?TextModeProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3795	0x140037024
?TextPattern@Schema@DirectUI@@2HA	3796	0x14003494c
?TextTextSelectionChangedEvent@Schema@DirectUI@@2HA	3797	0x140035e24
?TextTooltipShowing@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3798	0x1400393b0
?ThemeChange@HWNDElement@DirectUI@@SA?AVUID@@XZ	3799	0x14001e65c
?ThemeChangedProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	3800	0x1400359b4
?ThemedBorderProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	3801	0x14002f430
?ThumbControlType@Schema@DirectUI@@2HA	3802	0x140008348
?ThumbPositionProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3803	0x14002540c
?ThumbPositionProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3804	0x14000307c
?TickCountProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3805	0x1400337b4
?TitleBarControlType@Schema@DirectUI@@2HA	3806	0x14001c4b0
?TitleTextProp@TouchSwitch@DirectUI@@SAPEBUPropertyInfo@2@XZ	3807	0x14001987c
?ToString@Value@DirectUI@@QEBAPEAGPEAGI@Z	3808	0x14001a4c4
?Toggle@AutoButton@DirectUI@@SA?AVUID@@XZ	3809	0x140002014
?Toggle@SemanticZoomToggle@DirectUI@@SA?AVUID@@XZ	3810	0x14002806c
?Toggle@ToggleProvider@DirectUI@@UEAAJXZ	3811	0x14001efc4
?ToggleOnClickProp@TouchCheckBox@DirectUI@@SAPEBUPropertyInfo@2@XZ	3812	0x140010cc8
?TogglePattern@Schema@DirectUI@@2HA	3813	0x140029354
?ToggleUIState@HWNDElement@DirectUI@@QEAAX_N0@Z	3814	0x140011498
?Toggle_ToggleState_Property@Schema@DirectUI@@2HA	3815	0x140035b10
?ToolBarControlType@Schema@DirectUI@@2HA	3816	0x140035cd4
?ToolTipClosedEvent@Schema@DirectUI@@2HA	3817	0x14003af40
?ToolTipControlType@Schema@DirectUI@@2HA	3818	0x14001b498
?ToolTipOpenedEvent@Schema@DirectUI@@2HA	3819	0x14001581c
?TooltipMaxWidthProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3820	0x140014fac
?TooltipMaximumLineCountProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3821	0x140011590
?TooltipProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3822	0x140010698
?TooltipTimerStarting@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3823	0x1400309bc
?TossElement@ElementProvider@DirectUI@@UEAAXXZ	3824	0x14001f798
?TossPatternProvider@ElementProvider@DirectUI@@QEAAXW4Pattern@Schema@2@@Z	3825	0x1400101f4
?TrackScore@NavScoring@DirectUI@@QEAAHPEAVElement@2@0@Z	3826	0x140003c64
?TrackingProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3827	0x140013cfc
?TransformPattern@Schema@DirectUI@@2HA	3828	0x140021668
?TranslateThumbPositionToThumbValue@TouchSlider@DirectUI@@QEAAHH@Z	3829	0x140010f2c
?TransparentProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	3830	0x140019a48
?TreatRightMouseButtonAsLeftProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3831	0x1400028b0
?TreeControlType@Schema@DirectUI@@2HA	3832	0x14000d190
?TreeItemControlType@Schema@DirectUI@@2HA	3833	0x14003a448
?TriggeredAnimationComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ	3834	0x140007578
?Try@NavScoring@DirectUI@@QEAAHPEAVElement@2@HPEBUNavReference@2@K@Z	3835	0x140040f0c
?TryLinePattern@Element@DirectUI@@AEAA_NPEAUtagPOINT@@AEBUtagRECT@@@Z	3836	0x14000efd0
?TryPattern@Element@DirectUI@@AEAA_NNNPEAUtagPOINT@@AEBUtagRECT@@@Z	3837	0x14000c780
?TrySparsePattern@Element@DirectUI@@AEAA_NPEAUtagPOINT@@AEBUtagRECT@@@Z	3838	0x1400160cc
?TypographyProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	3839	0x14002ea04
?TypographyRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	3840	0x1400121c8
?UiaEvents@Element@DirectUI@@QEAA_NXZ	3841	0x140033280
?UiaHostProviderFromHwnd@Schema@DirectUI@@2P6AJPEAUHWND__@@PEAPEAUIRawElementProviderSimple@@@ZEA	3842	0x14003450c
?UiaLookupId@Schema@DirectUI@@2P6AHW4AutomationIdentifierType@@PEBU_GUID@@@ZEA	3843	0x1400392ac
?UiaRaiseAutomationEvent@Schema@DirectUI@@2P6AJPEAUIRawElementProviderSimple@@H@ZEA	3844	0x14001b6dc
?UiaRaiseAutomationPropertyChangedEvent@Schema@DirectUI@@2P6AJPEAUIRawElementProviderSimple@@HUtagVARIANT@@1@ZEA	3845	0x1400237e8
?UiaRaiseStructureChangedEvent@Schema@DirectUI@@2P6AJPEAUIRawElementProviderSimple@@W4StructureChangeType@@PEAHH@ZEA	3846	0x140012000
?UiaReturnRawElementProvider@Schema@DirectUI@@2P6A_JPEAUHWND__@@_K_JPEAUIRawElementProviderSimple@@@ZEA	3847	0x1400142c8
?UnRegister@Element@DirectUI@@SAJPEAPEAUIClassInfo@2@@Z	3848	0x14002d5cc
?UnhandledSyschar@XElement@DirectUI@@SA?AVUID@@XZ	3849	0x14000c3a4
?Uninit@CallstackTracker@DirectUI@@SAXXZ	3850	0x14001553c
?Uninit@InvokeHelper@DirectUI@@QEAAXXZ	3851	0x1400184e8
?UninitProcess@FontCache@DirectUI@@SAXXZ	3852	0x14001d2e0
?UninitThread@FontCache@DirectUI@@SAXXZ	3853	0x1400394ac
?UnloadCommonControlExports@AnimationStrip@DirectUI@@AEAAXXZ	3854	0x140031870
?Unlock@CritSecLock@DirectUI@@QEAAXXZ	3855	0x140033028
?UnregisterForAnimationStatusChanges@TouchHWNDElement@DirectUI@@QEAAXXZ	3856	0x1400213f8
?UnregisterForIHMChanges@TouchHWNDElement@DirectUI@@QEAAXXZ	3857	0x14003c8e0
?UnregisterForMonitorPowerChanges@TouchHWNDElement@DirectUI@@QEAAJXZ	3858	0x1400119e4
?UnvirtualizePosition@HWNDHost@DirectUI@@AEAAXXZ	3859	0x14000bc28
?UpdateChildFocus@DialogElementCore@DirectUI@@QEAAXPEAVElement@2@0@Z	3860	0x140014dec
?UpdateChildren@Expando@DirectUI@@IEAAXPEAVValue@2@@Z	3861	0x14003cf0c
?UpdateContentSize@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3862	0x14003e6dc
?UpdateDesiredSize@BorderLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3863	0x14003006c
?UpdateDesiredSize@FillLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3864	0x1400280b8
?UpdateDesiredSize@FlowLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3865	0x140037034
?UpdateDesiredSize@GridLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3866	0x140011f38
?UpdateDesiredSize@Layout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3867	0x14003f220
?UpdateDesiredSize@NineGridLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3868	0x14001b3b0
?UpdateDesiredSize@RowLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3869	0x14003c7c4
?UpdateDesiredSize@TableLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3870	0x140021f04
?UpdateDesiredSize@VerticalFlowLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3871	0x14001d340
?UpdateElement@TouchSelect@DirectUI@@QEAAJHPEAVElement@2@PEBG@Z	3872	0x140032354
?UpdateLayout@Element@DirectUI@@QEAAXXZ	3873	0x140018234
?UpdateLayoutRect@Layout@DirectUI@@SAXPEAVElement@2@HH0HHHH@Z	3874	0x14002a6a4
?UpdateSheets@DUIXmlParser@DirectUI@@QEAAJPEAVElement@2@@Z	3875	0x1400016ec
?UpdateString@TouchSelect@DirectUI@@QEAAJHPEBG@Z	3876	0x140001d2c
?UpdateStyleSheets@HWNDElement@DirectUI@@IEAAXXZ	3877	0x140004894
?UpdateToggleState@SemanticZoomToggle@DirectUI@@QEAAXW4SemanticZoomToggleState@@_N@Z	3878	0x14001a3dc
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z	3879	0x1400319b8
?UpdateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3880	0x1400238e0
?UpdateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3881	0x1400328ec
?UpdateView@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3882	0x1400294b0
?UseFixedTooltipOffset@TouchSlider@DirectUI@@QEAAXXZ	3883	0x1400411c0
?UsePerMonitorScaling@TouchHWNDElement@DirectUI@@QEAAXPEAUHMONITOR__@@@Z	3884	0x1400071f8
?UserTextChanged@TouchEditBase@DirectUI@@SA?AVUID@@XZ	3885	0x140004740
?UserTextUpdateNoChange@TouchEditBase@DirectUI@@SA?AVUID@@XZ	3886	0x14003441c
?UsesDesktopPerMonitorScalingProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3887	0x140018a00
?ValuePattern@Schema@DirectUI@@2HA	3888	0x14001c940
?Value_IsReadOnly_Property@Schema@DirectUI@@2HA	3889	0x14000cca4
?Value_Value_Property@Schema@DirectUI@@2HA	3890	0x140002184
?VerifyParentage@HWNDHost@DirectUI@@IEAAHXZ	3891	0x14000ae84
?VerticalProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3892	0x140035a3c
?VerticalScriptProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	3893	0x14002343c
?VirtualizedItemPattern@Schema@DirectUI@@2HA	3894	0x140007728
?VisibleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3895	0x1400116f0
?VisitedProp@TouchHyperLink@DirectUI@@SAPEBUPropertyInfo@2@XZ	3896	0x14003f7e8
?VisualStateProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3897	0x14002f72c
?WantEvent@EventManager@DirectUI@@CA_NW4Event@Schema@2@H@Z	3898	0x14001a6a8
?WantEvent@EventManager@DirectUI@@SA_NW4Event@Schema@2@@Z	3899	0x14001f0c8
?WantPropertyEvent@EventManager@DirectUI@@SA_NH@Z	3900	0x140009be8
?WantTabsProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	3901	0x140002b1c
?WidthProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3902	0x140008694
?WinStyleProp@CCBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3903	0x1400110a0
?WindowAccessGradientColorProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3904	0x140001110
?WindowActiveProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3905	0x140031730
?WindowControlType@Schema@DirectUI@@2HA	3906	0x14001b9f8
?WindowDpiChanged@HWNDElement@DirectUI@@SA?AVUID@@XZ	3907	0x140039f80
?WindowPattern@Schema@DirectUI@@2HA	3908	0x14002fc78
?WindowWindowClosedEvent@Schema@DirectUI@@2HA	3909	0x14000157c
?WindowWindowOpenedEvent@Schema@DirectUI@@2HA	3910	0x1400011cc
?WndProc@HWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z	3911	0x1400296e8
?WndProc@NativeHWNDHost@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z	3912	0x140008d64
?WndProc@TouchHWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z	3913	0x140034778
?WndProc@XHost@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z	3914	0x1400348e4
?WrapKeyboardNavigateProp@HWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3915	0x1400352d0
?XBarVisibilityProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3916	0x14002e260
?XOffsetProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3917	0x140033f5c
?XOffsetProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3918	0x140037070
?XProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3919	0x140018a48
?XScrollableProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3920	0x1400101bc
?XScrollableProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3921	0x140003968
?YBarVisibilityProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3922	0x140016348
?YOffsetProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3923	0x140019f98
?YOffsetProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3924	0x140036434
?YProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3925	0x14000ba00
?YScrollableProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3926	0x140021adc
?YScrollableProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3927	0x140008434
?ZoomToRect@TouchScrollViewer@DirectUI@@QEAAJPEBUtagRECT@@_N@Z	3928	0x14001da50
?ZoomToRectManualVisualSwap@TouchScrollViewer@DirectUI@@QEAAJMMMMPEBHMMM_N@Z	3929	0x14003af20
?_AddDependency@Element@DirectUI@@SAXPEAV12@PEBUPropertyInfo@2@HPEAUDepRecs@2@PEAVDeferCycle@2@PEAJ@Z	3930	0x140020338
?_BitAccurateFillRect@Macro@DirectUI@@KAXPEAUHDC__@@HHHHEEEEK@Z	3931	0x140012a64
?_BroadcastEventWorker@Element@DirectUI@@AEAAXPEAUEvent@2@@Z	3932	0x14001b1bc
?_BuildChildren@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAVElement@2@@Z	3933	0x140020034
?_BuildElement@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAVElement@2@PEAPEAV42@@Z	3934	0x140002d30
?_BuildFromBinary@DUIXmlParser@DirectUI@@IEAAJPEAVElement@2@0PEBGPEAKPEAPEAV32@@Z	3935	0x14002ef58
?_BuildStyles@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	3936	0x14003c488
?_CachedValueIsEqual@Element@DirectUI@@AEAAHPEBUPropertyInfo@2@PEAV12@@Z	3937	0x140025cbc
?_CalcTabOrder@ShellBorderLayout@DirectUI@@AEAAJPEAVElement@2@@Z	3938	0x14002dbd8
?_ClearNeedsLayout@Element@DirectUI@@QEAAXXZ	3939	0x14000259c
?_ClearTooltipState@TouchHWNDElement@DirectUI@@IEAAXXZ	3940	0x1400168d8
?_CreateAndSetLayout@DirectUI@@YAJPEAVElement@1@P6AJHPEAHPEAPEAVValue@1@@ZH1@Z	3941	0x1400364b0
?_CreateValue@DUIXmlParser@DirectUI@@IEAAJPEBGPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	3942	0x140021278
?_CtrlWndProc@HWNDHost@DirectUI@@CAHPEAXPEAUHWND__@@I_K_JPEA_J@Z	3943	0x140001ba4
?_DeleteCtrlWnd@HWNDHost@DirectUI@@AEAAXXZ	3944	0x140019ec8
?_DestroyTables@DUIXmlParser@DirectUI@@QEAAXXZ	3945	0x140039af8
?_DestroyTooltip@TouchHWNDElement@DirectUI@@IEAAXXZ	3946	0x140007490
?_DisplayNodeCallback@Element@DirectUI@@SAJPEAUHGADGET__@@PEAXPEAUEventMsg@@@Z	3947	0x14001fb58
?_EndOptimizedLayoutQ@Element@DirectUI@@QEAAXXZ	3948	0x140008a8c
?_EnterOnCurrentThread@DUIXmlParser@DirectUI@@IEAAJXZ	3949	0x14003d89c
?_Fill@Element@DirectUI@@IEAAXPEAUHDC__@@KHHHH_N@Z	3950	0x140025374
?_FireWindowDpiChangeEvent@HWNDElement@DirectUI@@IEAAXXZ	3951	0x14001bad0
?_FlushDS@Element@DirectUI@@AEAAXPEAVDeferCycle@2@@Z	3952	0x14002d3c4
?_FlushLayout@Element@DirectUI@@KAXPEAV12@PEAVDeferCycle@2@@Z	3953	0x1400245b0
?_GetBitmapSize@Macro@DirectUI@@KA_NPEAUHBITMAP__@@PEAUtagSIZE@@@Z	3954	0x14002813c
?_GetBuriedSheetDependencies@Element@DirectUI@@AEAAXPEBUPropertyInfo@2@PEAV12@PEAUDepRecs@2@PEAVDeferCycle@2@PEAJ@Z	3955	0x140022f80
?_GetChangesUpdatePass@Element@DirectUI@@QEAAHXZ	3956	0x1400204b0
?_GetClassForElement@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAPEAUIClassInfo@2@@Z	3957	0x14001ff74
?_GetClassForElementByName@DUIXmlParser@DirectUI@@IEAAJPEBGPEAPEAUIClassInfo@2@@Z	3958	0x14002b670
?_GetComputedValue@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@PEAUUpdateCache@2@@Z	3959	0x140005b74
?_GetContent@Viewer@DirectUI@@AEAAPEAVElement@2@XZ	3960	0x140029b4c
?_GetDependencies@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@HPEAUDepRecs@2@HPEAVValue@2@PEAVDeferCycle@2@@Z	3961	0x140013e84
?_GetLineInfo@DUIXmlParser@DirectUI@@IEAA?AULINEINFO@2@PEAUIXmlReader@@@Z	3962	0x140004e2c
?_GetLocalValue@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@@Z	3963	0x14000ff48
?_GetLocalValueFromVM@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@@Z	3964	0x14003e714
?_GetNeedsLayout@Element@DirectUI@@QEAAIXZ	3965	0x140002c38
?_GetPerMonitorScaleFactorForDesktopWindow@HWNDElement@DirectUI@@IEAAHPEAUHWND__@@@Z	3966	0x140012e10
?_GetPropertyForAttribute@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUIClassInfo@2@PEAPEBUPropertyInfo@2@@Z	3967	0x140001558
?_GetSpecifiedValue@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@PEAUUpdateCache@2@@Z	3968	0x14002ea1c
?_GetSpecifiedValueIgnoreCache@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@@Z	3969	0x14002a4b8
?_GetValueForStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEAUIClassInfo@2@PEBG1PEAPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	3970	0x14002cae8
?_HandleImmersiveColorSchemeChange@HWNDElement@DirectUI@@IEAAXXZ	3971	0x14001ab70
?_InheritProperties@Element@DirectUI@@AEAAXXZ	3972	0x140012ffc
?_InitializeTables@DUIXmlParser@DirectUI@@QEAAJXZ	3973	0x14001f0a8
?_InternalEnsureVisible@Viewer@DirectUI@@AEAA_NHHHH@Z	3974	0x140012528
?_InvalidateCachedDSConstraints@Element@DirectUI@@KAXPEAV12@@Z	3975	0x14001ca78
?_IsSemanticZoomControl@ElementProxy@DirectUI@@AEAA_NH@Z	3976	0x14002500c
?_IsWindowHostUsingDoNotStealFocusFlag@ElementProxy@DirectUI@@AEAA_NXZ	3977	0x140027d40
?_LeaveOnCurrentThread@DUIXmlParser@DirectUI@@IEAAXXZ	3978	0x14000a340
?_LoadImage32BitsPerPixel@Macro@DirectUI@@KAPEAVValue@2@PEBG@Z	3979	0x140014360
?_MarkElementForDS@Element@DirectUI@@SAHPEAV12@@Z	3980	0x140022904
?_MarkElementForLayout@Element@DirectUI@@SAHPEAV12@I@Z	3981	0x140039b18
?_OnFontPropChanged@Element@DirectUI@@IEAAXPEAVValue@2@@Z	3982	0x140027f30
?_OnGetInfoTip@CCTreeView@DirectUI@@MEAAJPEBUtagNMTVGETINFOTIPW@@@Z	3983	0x140033a70
?_OnItemChanged@CCTreeView@DirectUI@@MEAAJPEBUtagTVITEMCHANGE@@@Z	3984	0x140017bf8
?_OnUIStateChanged@HWNDElement@DirectUI@@MEAAXGG@Z	3985	0x140037214
?_OnUIStateChanged@TouchHWNDElement@DirectUI@@MEAAXGG@Z	3986	0x14000ef24
?_ParseBehavior@DUIXmlParser@DirectUI@@IEAAJPEAVElement@2@PEBG@Z	3987	0x14000234c
?_ParseLayout@DUIXmlParser@DirectUI@@IEAAJPEBGPEAPEAVValue@2@@Z	3988	0x140037d1c
?_ParseValue@DUIXmlParser@DirectUI@@IEAAJPEBUPropertyInfo@2@PEBGPEAPEAVValue@2@@Z	3989	0x14002a1d8
?_PostEvent@Element@DirectUI@@AEAAXPEAUEvent@2@H@Z	3990	0x14003b954
?_PostSourceChange@Element@DirectUI@@AEAAJXZ	3991	0x140016d14
?_PreSourceChange@Element@DirectUI@@AEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@1@Z	3992	0x1400192ac
?_PreSourceChange@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@HPEAVValue@2@1@Z	3993	0x1400149d0
?_RecordElementBehaviors@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBG@Z	3994	0x140039ec0
?_RecordElementLayout@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBG@Z	3995	0x14000b550
?_RecordElementStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEBG_N@Z	3996	0x140039428
?_RecordElementTrees@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	3997	0x140028ca0
?_RecordElementWithChildren@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@_NPEAPEAG@Z	3998	0x140040940
?_RecordInstantiateElement@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAPEAG@Z	3999	0x140025fbc
?_RecordSetElementProperties@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	4000	0x1400264e0
?_RecordSetValue@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBG1@Z	4001	0x140030510
?_RemoveLocalValue@Element@DirectUI@@IEAAJP6APEBUPropertyInfo@2@XZ_N@Z	4002	0x140036b68
?_RemoveLocalValue@Element@DirectUI@@IEAAJPEBUPropertyInfo@2@_N@Z	4003	0x14000dd1c
?_RepeatButtonActionCallback@RepeatButton@DirectUI@@CAXPEAUGMA_ACTIONINFO@@@Z	4004	0x14002c998
?_Reset@ShellBorderLayout@DirectUI@@AEAAXXZ	4005	0x140012d6c
?_ResolveStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEBGPEAPEAVValue@2@PEAI@Z	4006	0x14002af78
?_ScalePointsToPixels@DUIXmlParser@DirectUI@@AEBAHH@Z	4007	0x140032e18
?_ScalePointsToPixels@DUIXmlParser@DirectUI@@AEBAMM@Z	4008	0x140014130
?_ScaleRelativePixels@DUIXmlParser@DirectUI@@AEBAHH@Z	4009	0x140026a40
?_ScaleRelativePixels@DUIXmlParser@DirectUI@@AEBAMM@Z	4010	0x140035ee4
?_SelfLayoutDoLayout@Clipper@DirectUI@@UEAAXHH@Z	4011	0x14003be18
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z	4012	0x14001c0cc
?_SelfLayoutDoLayout@ScrollBar@DirectUI@@UEAAXHH@Z	4013	0x14001a1ec
?_SelfLayoutDoLayout@TouchScrollBar@DirectUI@@UEAAXHH@Z	4014	0x1400405a0
?_SelfLayoutDoLayout@Viewer@DirectUI@@UEAAXHH@Z	4015	0x140009170
?_SelfLayoutUpdateDesiredSize@Clipper@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4016	0x14002658c
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4017	0x140023990
?_SelfLayoutUpdateDesiredSize@ScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4018	0x140029588
?_SelfLayoutUpdateDesiredSize@TouchScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4019	0x14002616c
?_SelfLayoutUpdateDesiredSize@Viewer@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4020	0x14002e644
?_SetBinaryXml@DUIXmlParser@DirectUI@@IEAAJPEBE_KPEAUHINSTANCE__@@@Z	4021	0x140017f1c
?_SetGroupChanges@Element@DirectUI@@SA_NPEAV12@HPEAVDeferCycle@2@@Z	4022	0x140008308
?_SetNeedsLayout@Element@DirectUI@@QEAAHI@Z	4023	0x14003e700
?_SetProperties@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUIClassInfo@2@PEAVElement@2@@Z	4024	0x140017708
?_SetRelPixRect@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@HHHH@Z	4025	0x1400201f4
?_SetRelPixValue@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@H@Z	4026	0x1400140c4
?_SetValue@Element@DirectUI@@IEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@_N@Z	4027	0x1400368d0
?_SetValue@Element@DirectUI@@IEAAJPEBUPropertyInfo@2@HPEAVValue@2@_N@Z	4028	0x14002b7ac
?_SetXMLFromResource@DUIXmlParser@DirectUI@@IEAAJPEBG0PEAUHINSTANCE__@@11@Z	4029	0x14003be3c
?_SetupParserState@DUIXmlParser@DirectUI@@IEAAJPEAUHINSTANCE__@@0@Z	4030	0x140017db4
?_SinkWndProc@HWNDHost@DirectUI@@CAHPEAXPEAUHWND__@@I_K_JPEA_J@Z	4031	0x14002b140
?_StartOptimizedLayoutQ@Element@DirectUI@@QEAAXXZ	4032	0x14002f32c
?_SyncBackground@Element@DirectUI@@AEAAXXZ	4033	0x140034d48
?_SyncRedrawStyle@Element@DirectUI@@AEAAXXZ	4034	0x14001c578
?_SyncVisible@Element@DirectUI@@AEAAXXZ	4035	0x14001ac58
?_TransferGroupFlags@Element@DirectUI@@SAXPEAV12@H@Z	4036	0x14003c604
?_UpdateDesiredSize@Element@DirectUI@@QEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4037	0x140002114
?_UpdateDesktopScaleFactor@HWNDElement@DirectUI@@AEAAHXZ	4038	0x1400326d0
?_UpdateLayoutPosition@Element@DirectUI@@QEAAXHH@Z	4039	0x14000de80
?_UpdateLayoutSize@Element@DirectUI@@QEAAXHH@Z	4040	0x14001df74
?_UpdatePropertyInCache@Element@DirectUI@@AEAAXPEBUPropertyInfo@2@@Z	4041	0x140015380
?_UpdateTileList@NineGridLayout@DirectUI@@AEAAXHPEAVElement@2@@Z	4042	0x140033324
?_UsesUIAProxies@ElementProxy@DirectUI@@IEAAHXZ	4043	0x14002e0cc
?_VoidPCNotifyTree@Element@DirectUI@@CAXHPEAVDeferCycle@2@@Z	4044	0x14002e414
?_WndProc@InvokeHelper@DirectUI@@CAHPEAXPEAUHWND__@@I_K_JPEA_J@Z	4045	0x140026a24
?_ZeroRelease@Value@DirectUI@@AEAAXXZ	4046	0x1400228ec
?_atmArrow@Expando@DirectUI@@0GA	4047	0x14001ed30
?_atmClipper@Expando@DirectUI@@0GA	4048	0x140029dd4
?_roleMapping@Schema@DirectUI@@0QBURoleMap@12@B	4049	0x140007028
?accDoDefaultAction@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@@Z	4050	0x140005934
?accDoDefaultAction@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@@Z	4051	0x140010874
?accHitTest@DuiAccessible@DirectUI@@UEAAJJJPEAUtagVARIANT@@@Z	4052	0x140024a5c
?accHitTest@HWNDHostAccessible@DirectUI@@UEAAJJJPEAUtagVARIANT@@@Z	4053	0x14000e89c
?accLocation@DuiAccessible@DirectUI@@UEAAJPEAJ000UtagVARIANT@@@Z	4054	0x1400198fc
?accLocation@HWNDHostAccessible@DirectUI@@UEAAJPEAJ000UtagVARIANT@@@Z	4055	0x14001689c
?accNavigate@DuiAccessible@DirectUI@@UEAAJJUtagVARIANT@@PEAU3@@Z	4056	0x14001f974
?accNavigate@HWNDHostAccessible@DirectUI@@UEAAJJUtagVARIANT@@PEAU3@@Z	4057	0x14002f458
?accNavigate@HWNDHostClientAccessible@DirectUI@@UEAAJJUtagVARIANT@@PEAU3@@Z	4058	0x14001c62c
?accSelect@DuiAccessible@DirectUI@@UEAAJJUtagVARIANT@@@Z	4059	0x1400287c8
?accSelect@HWNDHostAccessible@DirectUI@@UEAAJJUtagVARIANT@@@Z	4060	0x140015d50
?advanceFrameActionStart@Movie@DirectUI@@AEAAXXZ	4061	0x140002430
?advanceFrameActionStop@Movie@DirectUI@@AEAAXXZ	4062	0x140013bb8
?cChangeBulk@EventManager@DirectUI@@0HB	4063	0x140023070
?c_RefCountBitOffset@Value@DirectUI@@0HB	4064	0x14001b834
?c_RefCountMask@Value@DirectUI@@0JB	4065	0x14002170c
?c_SingleRefCount@Value@DirectUI@@0JB	4066	0x1400276c8
?c_rgar@AccessibleButton@DirectUI@@0QBUACCESSIBLEROLE@12@B	4067	0x140040bb0
?doAction@Movie@DirectUI@@QEAAXPEAUGMA_ACTIONINFO@@@Z	4068	0x140016e1c
?g_cRefCount@ResourceModuleHandles@DirectUI@@0JC	4069	0x140025674
?g_controlInfoTable@Schema@DirectUI@@0QBUControlInfo@12@B	4070	0x14002e344
?g_cs@ElementProviderManager@DirectUI@@2U_RTL_CRITICAL_SECTION@@A	4071	0x14003090c
?g_cs@EventManager@DirectUI@@0U_RTL_CRITICAL_SECTION@@A	4072	0x14000d29c
?g_cs@InvokeManager@DirectUI@@0U_RTL_CRITICAL_SECTION@@A	4073	0x140013ffc
?g_dwElSlot@DirectUI@@3KA	4074	0x140014b78
?g_eventInfoTable@Schema@DirectUI@@0QBUEventInfo@12@B	4075	0x14000ad28
?g_eventMapping@Schema@DirectUI@@0QBUEventMap@12@B	4076	0x140006c84
?g_eventRegisteredMap@EventManager@DirectUI@@0PAIA	4077	0x1400189f8
?g_fInited@Schema@DirectUI@@0_NA	4078	0x14003962c
?g_fWantAnyEvent@EventManager@DirectUI@@0_NA	4079	0x14001b404
?g_pArrayInvokeHelper@InvokeManager@DirectUI@@0PEAV?$UiaArray@PEAVInvokeHelper@DirectUI@@@2@EA	4080	0x14001ca9c
?g_pArrayPprv@ElementProviderManager@DirectUI@@0PEAV?$UiaArray@PEAVElementProvider@DirectUI@@@2@EA	4081	0x140037ea4
?g_pArrayPropertyEvent@EventManager@DirectUI@@0PEAV?$UiaArray@H@2@EA	4082	0x140034ac0
?g_patternInfoTable@Schema@DirectUI@@0QBUPatternInfo@12@B	4083	0x140009e8c
?g_patternMapping@Schema@DirectUI@@0QBUPatternMap@12@B	4084	0x140033624
?g_propertyInfoTable@Schema@DirectUI@@0QBUPropertyInfo@12@B	4085	0x140022508
?g_rgMouseMap@HWNDHost@DirectUI@@0QAY02$$CBIA	4086	0x1400312f8
?get_BoundingRectangle@ElementProvider@DirectUI@@UEAAJPEAUUiaRect@@@Z	4087	0x14001de10
?get_CanSelectMultiple@SelectionProvider@DirectUI@@UEAAJPEAH@Z	4088	0x140028c54
?get_Column@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4089	0x140037c30
?get_ColumnCount@GridProvider@DirectUI@@UEAAJPEAH@Z	4090	0x14003b1b8
?get_ColumnSpan@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4091	0x14000a948
?get_ContainingGrid@GridItemProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z	4092	0x14003428c
?get_ExpandCollapseState@ExpandCollapseProvider@DirectUI@@UEAAJPEAW4ExpandCollapseState@@@Z	4093	0x140001ef8
?get_FragmentRoot@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderFragmentRoot@@@Z	4094	0x14003652c
?get_HorizontalScrollPercent@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4095	0x14000f97c
?get_HorizontalViewSize@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4096	0x140036438
?get_HorizontallyScrollable@ScrollProvider@DirectUI@@UEAAJPEAH@Z	4097	0x140014a2c
?get_HostRawElementProvider@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z	4098	0x14001c368
?get_IsReadOnly@RangeValueProvider@DirectUI@@UEAAJPEAH@Z	4099	0x140035f54
?get_IsReadOnly@ValueProvider@DirectUI@@UEAAJPEAH@Z	4100	0x14000ae58
?get_IsSelected@SelectionItemProvider@DirectUI@@UEAAJPEAH@Z	4101	0x1400079ac
?get_IsSelectionRequired@SelectionProvider@DirectUI@@UEAAJPEAH@Z	4102	0x14001ccb4
?get_LargeChange@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4103	0x140007c64
?get_Maximum@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4104	0x140013a88
?get_Minimum@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4105	0x140003c38
?get_ProviderOptions@ElementProvider@DirectUI@@UEAAJPEAW4ProviderOptions@@@Z	4106	0x140011ea8
?get_Row@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4107	0x140006834
?get_RowCount@GridProvider@DirectUI@@UEAAJPEAH@Z	4108	0x1400137dc
?get_RowOrColumnMajor@TableProvider@DirectUI@@UEAAJPEAW4RowOrColumnMajor@@@Z	4109	0x14001b674
?get_RowSpan@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4110	0x1400322a4
?get_SelectionContainer@SelectionItemProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z	4111	0x14000ebb0
?get_SmallChange@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4112	0x14001d8f4
?get_ToggleState@ToggleProvider@DirectUI@@UEAAJPEAW4ToggleState@@@Z	4113	0x14000cf7c
?get_Value@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4114	0x14002db48
?get_Value@ValueProvider@DirectUI@@UEAAJPEAPEAG@Z	4115	0x140015798
?get_VerticalScrollPercent@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4116	0x1400221c8
?get_VerticalViewSize@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4117	0x14003e8a4
?get_VerticallyScrollable@ScrollProvider@DirectUI@@UEAAJPEAH@Z	4118	0x1400399ac
?get_accChild@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAUIDispatch@@@Z	4119	0x1400247e8
?get_accChild@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAUIDispatch@@@Z	4120	0x1400123f4
?get_accChildCount@DuiAccessible@DirectUI@@UEAAJPEAJ@Z	4121	0x14001f910
?get_accChildCount@HWNDHostAccessible@DirectUI@@UEAAJPEAJ@Z	4122	0x14002d9f8
?get_accDefaultAction@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4123	0x1400238f8
?get_accDefaultAction@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4124	0x140027464
?get_accDescription@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4125	0x14003f2e4
?get_accDescription@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4126	0x140021ea4
?get_accFocus@DuiAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4127	0x14001817c
?get_accFocus@HWNDHostAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4128	0x14002eb58
?get_accHelp@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4129	0x1400235f0
?get_accHelp@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4130	0x14003f738
?get_accHelpTopic@DuiAccessible@DirectUI@@UEAAJPEAPEAGUtagVARIANT@@PEAJ@Z	4131	0x1400197e0
?get_accHelpTopic@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAGUtagVARIANT@@PEAJ@Z	4132	0x1400357c4
?get_accKeyboardShortcut@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4133	0x14002f864
?get_accKeyboardShortcut@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4134	0x14003710c
?get_accName@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4135	0x14002ddbc
?get_accName@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4136	0x1400075dc
?get_accParent@DuiAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4137	0x140013780
?get_accParent@HWNDElementAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4138	0x1400061a0
?get_accParent@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4139	0x14001d24c
?get_accParent@HWNDHostClientAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4140	0x14000f59c
?get_accRole@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4141	0x14002989c
?get_accRole@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4142	0x140012264
?get_accRole@HWNDHostClientAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4143	0x1400063f8
?get_accSelection@DuiAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4144	0x140017760
?get_accSelection@HWNDHostAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4145	0x140010cc0
?get_accState@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4146	0x140035590
?get_accState@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4147	0x14003e9f8
?get_accValue@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4148	0x140015210
?get_accValue@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4149	0x1400191ec
?put_accName@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4150	0x14003d220
?put_accName@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4151	0x140017944
?put_accValue@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4152	0x14003ef74
?put_accValue@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4153	0x14003da20
?s_HandleDUIEventMessage@Element@DirectUI@@CA_NPEAV12@PEAUEventMsg@@@Z	4154	0x140002498
?s_ImageHlpFuncList@CallstackTracker@DirectUI@@0PAUIMGHLPFN_LOAD@12@A	4155	0x14003a340
?s_SyncCallback@CSafeElementProxy@@SAJPEAUHGADGET__@@PEAXPEAUEventMsg@@@Z	4156	0x140009e0c
?s_XMLParseError@DUIFactory@DirectUI@@CAXPEBG0HPEAX@Z	4157	0x140004844
?s_fdClr@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@K@12@B	4158	0x14003f468
?s_fdFill@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@PEAVValue@DirectUI@@@12@B	4159	0x140040764
?s_fdGraphic@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@PEAVValue@DirectUI@@@12@B	4160	0x140008c60
?s_fdInt@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@H@12@B	4161	0x1400138c4
?s_fdRect@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@UScaledRECT@DirectUI@@@12@B	4162	0x140001bd4
?s_fdSize@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@UScaledSIZE@DirectUI@@@12@B	4163	0x14001d438
?s_fdString@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@PEAVValue@DirectUI@@@12@B	4164	0x140004098
?s_hProcess@CallstackTracker@DirectUI@@0PEAXEA	4165	0x140022740
?s_hinstImageHlp@CallstackTracker@DirectUI@@0PEAUHINSTANCE__@@EA	4166	0x140041084
?s_hinstNtDll@CallstackTracker@DirectUI@@0PEAUHINSTANCE__@@EA	4167	0x140009ad4
?s_initonceInit@CallstackTracker@DirectUI@@0T_RTL_RUN_ONCE@@A	4168	0x140007b84
?s_pClassInfo@AccessibleButton@DirectUI@@0PEAUIClassInfo@2@EA	4169	0x1400042e8
?s_pClassInfo@AnimationStrip@DirectUI@@0PEAUIClassInfo@2@EA	4170	0x1400088f4
?s_pClassInfo@AutoButton@DirectUI@@0PEAUIClassInfo@2@EA	4171	0x14000aae8
?s_pClassInfo@BaseScrollViewer@DirectUI@@0PEAUIClassInfo@2@EA	4172	0x14003f3ac
?s_pClassInfo@Bind@DirectUI@@0PEAUIClassInfo@2@EA	4173	0x140021b64
?s_pClassInfo@Browser@DirectUI@@0PEAUIClassInfo@2@EA	4174	0x140023898
?s_pClassInfo@Button@DirectUI@@0PEAUIClassInfo@2@EA	4175	0x14002e274
?s_pClassInfo@CCAVI@DirectUI@@0PEAUIClassInfo@2@EA	4176	0x1400022e0
?s_pClassInfo@CCBase@DirectUI@@0PEAUIClassInfo@2@EA	4177	0x140009730
?s_pClassInfo@CCBaseCheckRadioButton@DirectUI@@0PEAUIClassInfo@2@EA	4178	0x1400242bc
?s_pClassInfo@CCBaseScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4179	0x140007e84
?s_pClassInfo@CCCheckBox@DirectUI@@0PEAUIClassInfo@2@EA	4180	0x14002d8b8
?s_pClassInfo@CCCommandLink@DirectUI@@0PEAUIClassInfo@2@EA	4181	0x140030ae8
?s_pClassInfo@CCHScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4182	0x14002665c
?s_pClassInfo@CCListBox@DirectUI@@0PEAUIClassInfo@2@EA	4183	0x1400357b8
?s_pClassInfo@CCListView@DirectUI@@0PEAUIClassInfo@2@EA	4184	0x140032cf8
?s_pClassInfo@CCProgressBar@DirectUI@@0PEAUIClassInfo@2@EA	4185	0x14002cf00
?s_pClassInfo@CCPushButton@DirectUI@@0PEAUIClassInfo@2@EA	4186	0x140016f34
?s_pClassInfo@CCRadioButton@DirectUI@@0PEAUIClassInfo@2@EA	4187	0x1400255e4
?s_pClassInfo@CCSysLink@DirectUI@@0PEAUIClassInfo@2@EA	4188	0x14001e4c0
?s_pClassInfo@CCTrackBar@DirectUI@@0PEAUIClassInfo@2@EA	4189	0x140023f94
?s_pClassInfo@CCTreeView@DirectUI@@0PEAUIClassInfo@2@EA	4190	0x14002a44c
?s_pClassInfo@CCVScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4191	0x1400395f8
?s_pClassInfo@CheckBoxGlyph@DirectUI@@0PEAUIClassInfo@2@EA	4192	0x140038ac0
?s_pClassInfo@Clipper@DirectUI@@0PEAUIClassInfo@2@EA	4193	0x140039fbc
?s_pClassInfo@Combobox@DirectUI@@0PEAUIClassInfo@2@EA	4194	0x1400162ac
?s_pClassInfo@DialogElement@DirectUI@@0PEAUIClassInfo@2@EA	4195	0x1400171fc
?s_pClassInfo@Edit@DirectUI@@0PEAUIClassInfo@2@EA	4196	0x140033658
?s_pClassInfo@Element@DirectUI@@0PEAUIClassInfo@2@EA	4197	0x140039b68
?s_pClassInfo@ElementWithHWND@DirectUI@@0PEAUIClassInfo@2@EA	4198	0x1400114d8
?s_pClassInfo@Expandable@DirectUI@@0PEAUIClassInfo@2@EA	4199	0x14003c938
?s_pClassInfo@Expando@DirectUI@@0PEAUIClassInfo@2@EA	4200	0x140021ce0
?s_pClassInfo@ExpandoButtonGlyph@DirectUI@@0PEAUIClassInfo@2@EA	4201	0x14001c148
?s_pClassInfo@HWNDElement@DirectUI@@0PEAUIClassInfo@2@EA	4202	0x1400362a8
?s_pClassInfo@HWNDHost@DirectUI@@0PEAUIClassInfo@2@EA	4203	0x14001665c
?s_pClassInfo@Macro@DirectUI@@0PEAUIClassInfo@2@EA	4204	0x14000987c
?s_pClassInfo@Movie@DirectUI@@0PEAUIClassInfo@2@EA	4205	0x14002f7ec
?s_pClassInfo@Navigator@DirectUI@@0PEAUIClassInfo@2@EA	4206	0x140036430
?s_pClassInfo@PText@DirectUI@@0PEAUIClassInfo@2@EA	4207	0x14003aa40
?s_pClassInfo@Page@DirectUI@@0PEAUIClassInfo@2@EA	4208	0x140003268
?s_pClassInfo@Pages@DirectUI@@0PEAUIClassInfo@2@EA	4209	0x1400017a8
?s_pClassInfo@Progress@DirectUI@@0PEAUIClassInfo@2@EA	4210	0x1400343f8
?s_pClassInfo@PushButton@DirectUI@@0PEAUIClassInfo@2@EA	4211	0x14002db34
?s_pClassInfo@RadioButtonGlyph@DirectUI@@0PEAUIClassInfo@2@EA	4212	0x1400273c4
?s_pClassInfo@RefPointElement@DirectUI@@0PEAUIClassInfo@2@EA	4213	0x140034aa4
?s_pClassInfo@RepeatButton@DirectUI@@0PEAUIClassInfo@2@EA	4214	0x140010b74
?s_pClassInfo@Repeater@DirectUI@@0PEAUIClassInfo@2@EA	4215	0x14003d4d4
?s_pClassInfo@ScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4216	0x140012658
?s_pClassInfo@ScrollViewer@DirectUI@@0PEAUIClassInfo@2@EA	4217	0x140002168
?s_pClassInfo@Selector@DirectUI@@0PEAUIClassInfo@2@EA	4218	0x14001f620
?s_pClassInfo@SelectorNoDefault@DirectUI@@0PEAUIClassInfo@2@EA	4219	0x140012c3c
?s_pClassInfo@StyledScrollViewer@DirectUI@@0PEAUIClassInfo@2@EA	4220	0x1400203dc
?s_pClassInfo@TextGraphic@DirectUI@@0PEAUIClassInfo@2@EA	4221	0x140031964
?s_pClassInfo@Thumb@DirectUI@@0PEAUIClassInfo@2@EA	4222	0x140024ca0
?s_pClassInfo@UnknownElement@DirectUI@@0PEAUIClassInfo@2@EA	4223	0x140020ec8
?s_pClassInfo@Viewer@DirectUI@@0PEAUIClassInfo@2@EA	4224	0x140039038
?s_pClassInfo@XBaby@DirectUI@@0PEAUIClassInfo@2@EA	4225	0x140018a20
?s_pClassInfo@XElement@DirectUI@@0PEAUIClassInfo@2@EA	4226	0x140011fc0
?s_pfnImagehlpApiVersionEx@CallstackTracker@DirectUI@@0P6APEAUAPI_VERSION@@PEAU3@@ZEA	4227	0x1400079f8
?s_pfnRtlCaptureStackBackTrace@CallstackTracker@DirectUI@@0P6AGKKPEAPEAXPEAK@ZEA	4228	0x140041378
?s_pfnSymFromAddr@CallstackTracker@DirectUI@@0P6AHPEAX_KPEA_KPEAU_SYMBOL_INFO@@@ZEA	4229	0x140024f48
?s_pfnSymGetModuleInfo64@CallstackTracker@DirectUI@@0P6AHPEAX_KPEAU_IMAGEHLP_MODULE64@@@ZEA	4230	0x140016790
?s_pfnSymInitialize@CallstackTracker@DirectUI@@0P6AHPEAXPEBDH@ZEA	4231	0x140013c70
?s_pfnSymLoadModule64@CallstackTracker@DirectUI@@0P6A_KPEAX0PEBD1_KK@ZEA	4232	0x140010b5c
?s_pfnSymSetOptions@CallstackTracker@DirectUI@@0P6AKK@ZEA	4233	0x140003be0
?s_uButtonFocusChangeMsg@XElement@DirectUI@@2IB	4234	0x140004bf8
?s_uInvokeHelperMsg@InvokeHelper@DirectUI@@0IB	4235	0x140020e28
?s_uNavigateOutMsg@XElement@DirectUI@@2IB	4236	0x14001490c
?s_uUnhandledSyscharMsg@XElement@DirectUI@@2IB	4237	0x14002fc80
ARGBColorFromEnumI	4238	0x140034aa8
AllowAllScalingPlateaus	4239	0x14001912c
BlurBitmap	4240	0x140001a64
BrushFromEnumI	4241	0x140014968
ColorFromEnumI	4242	0x140038bd0
CreateDUIWrapper	4243	0x1400403f4
CreateDUIWrapperEx	4244	0x14000a6f4
CreateDUIWrapperFromResource	4245	0x14001b788
CreateDUIWrapperTouchEx	1274	0x1400119ec
CreateTouchTooltip	4246	0x140013178
DUI70_DUIXmlParserCreate	4247	0x14003c914
DUI70_DUIXmlParserCreateElement	4248	0x14000d478
DUI70_DUIXmlParserDestroy	4249	0x14002f7b0
DUI70_DUIXmlParserSetXMLFromResource	4250	0x140035d1c
DUI70_ElementAddListener	4251	0x14000bb24
DUI70_ElementDestroy	4252	0x14002f8b8
DUI70_ElementEndDefer	4253	0x140012fdc
DUI70_ElementFindDescendent	4254	0x1400205e4
DUI70_ElementGetChildren	4255	0x1400348a4
DUI70_ElementGetRoot	4256	0x14001dc88
DUI70_ElementRemoveListener	4257	0x140037c98
DUI70_ElementSetAccRole	4258	0x1400265e8
DUI70_ElementSetAccessible	4259	0x14000f3bc
DUI70_ElementSetContentAlign	4260	0x140011eac
DUI70_ElementSetContentString	4261	0x140006a70
DUI70_ElementSetFont	4262	0x140020e28
DUI70_ElementSetID	4263	0x14000406c
DUI70_ElementSetLayoutPos	4264	0x140022e40
DUI70_ElementSetVisible	4265	0x140009f9c
DUI70_ElementStartDefer	4266	0x1400314e8
DUI70_IsTouchButtonClickEqual	4267	0x140018c9c
DUI70_RichTextCreate	4268	0x140033910
DUI70_RichTextSetConstrainLayout	4269	0x14000ce90
DUI70_ValueRelease	4270	0x14003cf94
DUIDrawShadowText	4271	0x14002b2cc
DUIStopPVLAnimation	4272	0x1400170e0
DisableAnimations	4273	0x140032b3c
DisableInitCallstackTracking	4274	0x1400268f4
DrawShadowTextEx	4275	0x140030f08
DuiCreateObject	1442	0x14001c7c4
ElementFromGadget	4276	0x140001d68
EnableAnimations	4277	0x14001e360
FlushThemeHandles	4278	0x1400035dc
ForceDebugBreak	4279	0x140004668
GetDesktopDPI	4280	0x140003e78
GetElementDataEntry	4281	0x140009270
GetElementMacro	4282	0x1400050dc
GetFontCache	4283	0x140041260
GetScaleFactor	4284	0x140009108
GetThemeHandle	4285	0x14001182c
HStrDup	4286	0x140003854
HrSysAllocString	4287	0x1400309d8
InitPreprocessor	4288	0x1400087e0
InitProcessPriv	4289	0x140028248
InitThread	4290	0x1400095b4
IsAnimationsEnabled	4291	0x14002ad7c
IsPalette	4292	0x1400254d0
IsUIAutomationProviderEnabled	4293	0x14003a1b8
MultiByteToUnicode	4294	0x14002dfb8
NotifyAccessibilityEvent	4295	0x14000c96c
PreprocessBuffer	4296	0x14000a060
ProcessAlphaBitmapI	4297	0x14003e424
PurgeThemeHandles	4298	0x140012df0
RegisterAllControls	4299	0x140009c60
RegisterBaseControls	4300	0x14001d488
RegisterBrowserControls	4301	0x14001520c
RegisterCommonControls	4302	0x1400156c0
RegisterExtendedControls	4303	0x140003094
RegisterMacroControls	4304	0x1400227e4
RegisterMiscControls	4305	0x14003ee70
RegisterPVLBehaviorFactory	4306	0x140009e7c
RegisterStandardControls	4307	0x1400155c8
RegisterXControls	4308	0x1400123e8
SetDefAction	4309	0x140025f94
SetDesktopDPIOverride	4310	0x140025628
SkipDLLUnloadInitChecks	4311	0x140013c8c
StartMessagePump	4312	0x140017b50
StopMessagePump	4313	0x140035b7c
StrToID	4314	0x14003c78c
UiaHideOnGetObject	4315	0x140010398
UiaOnDestroySink	4316	0x14000a0b0
UiaOnGetObject	4317	0x140037208
UiaOnToolTip	4318	0x140012d34
UnInitProcessPriv	4319	0x14003b940
UnInitThread	4320	0x1400300bc
UnicodeToMultiByte	4321	0x140012e90

Version Infos

Description	Data
LegalCopyright	Microsoft Corporation. All rights reserv
InternalName	bitsp
FileVersion	7.5.7600.16385 (win7_rtm.090713-
CompanyName	Microsoft Corporati
ProductName	Microsoft Windows Operating S
ProductVersion	6.1.7600
FileDescription	Background Intellig
OriginalFilename	kbdy
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2021 01:05:53.700915098 CEST	57459	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:05:53.719643116 CEST	53	57459	8.8.8.8	192.168.2.3
Sep 29, 2021 01:06:19.893718958 CEST	57875	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:06:19.921684027 CEST	53	57875	8.8.8.8	192.168.2.3
Sep 29, 2021 01:06:37.846925020 CEST	54154	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:06:37.909765959 CEST	53	54154	8.8.8.8	192.168.2.3
Sep 29, 2021 01:06:38.032449961 CEST	52806	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:06:38.060664892 CEST	53	52806	8.8.8.8	192.168.2.3
Sep 29, 2021 01:06:38.715038061 CEST	53910	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:06:38.728496075 CEST	53	53910	8.8.8.8	192.168.2.3
Sep 29, 2021 01:06:39.154906988 CEST	64021	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:06:39.227231979 CEST	53	64021	8.8.8.8	192.168.2.3
Sep 29, 2021 01:06:39.576843977 CEST	60784	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:06:39.590060949 CEST	53	60784	8.8.8.8	192.168.2.3
Sep 29, 2021 01:06:40.001750946 CEST	51143	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:06:40.014761925 CEST	53	51143	8.8.8.8	192.168.2.3
Sep 29, 2021 01:06:40.484364033 CEST	56009	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:06:40.556797981 CEST	53	56009	8.8.8.8	192.168.2.3
Sep 29, 2021 01:06:41.139518976 CEST	59026	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:06:41.242619038 CEST	53	59026	8.8.8.8	192.168.2.3
Sep 29, 2021 01:06:42.024524927 CEST	49572	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:06:42.038453102 CEST	53	49572	8.8.8.8	192.168.2.3
Sep 29, 2021 01:06:42.970438957 CEST	60823	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:06:42.985362053 CEST	53	60823	8.8.8.8	192.168.2.3
Sep 29, 2021 01:06:43.521251917 CEST	52130	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:06:43.535424948 CEST	53	52130	8.8.8.8	192.168.2.3
Sep 29, 2021 01:06:47.349404097 CEST	55102	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:06:47.365452051 CEST	53	55102	8.8.8.8	192.168.2.3
Sep 29, 2021 01:06:48.562495947 CEST	56236	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:06:48.576232910 CEST	53	56236	8.8.8.8	192.168.2.3
Sep 29, 2021 01:06:53.613822937 CEST	56527	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:06:53.634015083 CEST	53	56527	8.8.8.8	192.168.2.3
Sep 29, 2021 01:06:57.325668097 CEST	49559	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:06:57.352086067 CEST	53	49559	8.8.8.8	192.168.2.3
Sep 29, 2021 01:07:13.439274073 CEST	52650	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:07:13.469450951 CEST	53	52650	8.8.8.8	192.168.2.3
Sep 29, 2021 01:07:26.454340935 CEST	63297	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:07:26.492683887 CEST	53	63297	8.8.8.8	192.168.2.3
Sep 29, 2021 01:07:33.053841114 CEST	58361	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:07:33.066749096 CEST	53	58361	8.8.8.8	192.168.2.3
Sep 29, 2021 01:07:55.760528088 CEST	53615	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:07:55.774360895 CEST	53	53615	8.8.8.8	192.168.2.3
Sep 29, 2021 01:08:17.331727982 CEST	50728	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:08:17.345705032 CEST	53	50728	8.8.8.8	192.168.2.3
Sep 29, 2021 01:08:22.056579113 CEST	53777	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:08:22.083317995 CEST	53	53777	8.8.8.8	192.168.2.3
Sep 29, 2021 01:08:24.265057087 CEST	57106	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:08:24.281701088 CEST	53	57106	8.8.8.8	192.168.2.3
Sep 29, 2021 01:08:57.777307987 CEST	60352	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:08:57.791259050 CEST	53	60352	8.8.8.8	192.168.2.3
Sep 29, 2021 01:09:38.387111902 CEST	56773	53	192.168.2.3	8.8.8.8
Sep 29, 2021 01:09:38.406222105 CEST	53	56773	8.8.8.8	192.168.2.3

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll64.exe PID: 7152 Parent PID: 4336

General

Start time:	01:05:58
Start date:	29/09/2021
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe 'C:\Users\user\Desktop\1zdJLxxTnh.dll'
Imagebase:	0x7ff62eae0000
File size:	1136128 bytes
MD5 hash:	E0CC9D126C39A9D2FA1CAD5027EBBD18
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 5808 Parent PID: 7152

General

Start time:	01:05:59
Start date:	29/09/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\1zdJLxxTnh.dll',#1
Imagebase:	0x7ff6637d0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 1012 Parent PID: 5808

General

Start time:	01:05:59
Start date:	29/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe 'C:\Users\user\Desktop\1zdJLxxTnh.dll',#1
Imagebase:	0x7ff79cf00000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000003.00000002.365405591.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5904 Parent PID: 7152

General

Start time:	01:05:59
Start date:	29/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1zdJLxxTnh.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ
Imagebase:	0x7ff79cf00000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000004.00000002.283056136.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 3352 Parent PID: 1012

General

Start time:	01:06:01
Start date:	29/09/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff720ea0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6588 Parent PID: 7152

General

Start time:	01:06:02
Start date:	29/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1zdJLxxTnh.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ
Imagebase:	0x7ff79cf00000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000000C.00000002.289547097.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5848 Parent PID: 7152

General

Start time:	01:06:06
Start date:	29/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1zdJLxxTnh.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ
Imagebase:	0x7ff79cf00000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000000D.00000002.296819494.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: ProximityUxHost.exe PID: 5800 Parent PID: 3352

General

Start time:	01:06:41
Start date:	29/09/2021
Path:	C:\Windows\System32\ProximityUxHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\ProximityUxHost.exe
Imagebase:	0x7ff7a7f60000
File size:	264480 bytes
MD5 hash:	E7F0E9B3779E54CD271959C600A2A531
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: ProximityUxHost.exe PID: 4896 Parent PID: 3352

General

Start time:	01:06:46
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\fk8bXjSn\ProximityUxHost.exe
Imagebase:	0x7ff7a3c80000
File size:	264480 bytes
MD5 hash:	E7F0E9B3779E54CD271959C600A2A531
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000016.00000002.402800394.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: rstrui.exe PID: 492 Parent PID: 3352

General

Start time:	01:06:58
Start date:	29/09/2021
Path:	C:\Windows\System32\rstrui.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rstrui.exe
Imagebase:	0x7ff7515b0000
File size:	266752 bytes
MD5 hash:	3E8AFFA54035412F86663C8B44CAA2E5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: irftp.exe PID: 4740 Parent PID: 3352

General

Start time:	01:06:58
Start date:	29/09/2021
Path:	C:\Windows\System32\irftp.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\irftp.exe
Imagebase:	0x7ff669c40000
File size:	184832 bytes
MD5 hash:	F1C2D10CA8161DB689CD4FDE756E2DBB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: irftp.exe PID: 6684 Parent PID: 3352

General

Start time:	01:06:59
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\94LPZAU0\irftp.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\94LPZAU0\irftp.exe
Imagebase:	0x7ff7edb50000
File size:	184832 bytes
MD5 hash:	F1C2D10CA8161DB689CD4FDE756E2DBB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000001C.00000002.430835734.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: SystemPropertiesComputerName.exe PID: 5792 Parent PID: 3352

General

Start time:	01:07:10
Start date:	29/09/2021
Path:	C:\Windows\System32\SystemPropertiesComputerName.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SystemPropertiesComputerName.exe
Imagebase:	0x7ff70aa30000
File size:	83968 bytes
MD5 hash:	BEE134E1F23AFD3AE58191D265BB9070
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sessionmsg.exe PID: 5252 Parent PID: 3352

General

Start time:	01:07:11
Start date:	29/09/2021
Path:	C:\Windows\System32\sessionmsg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sessionmsg.exe
Imagebase:	0x7ff75e520000
File size:	74440 bytes
MD5 hash:	1F7CEA0216DE48B877C16F95C7DA1F0F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sessionmsg.exe PID: 5724 Parent PID: 3352

General

Start time:	01:07:12
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\nPqx0Ph\sessionmsg.exe
Imagebase:	0x7ff679360000
File size:	74440 bytes
MD5 hash:	1F7CEA0216DE48B877C16F95C7DA1F0F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000021.00000002.459843217.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: WindowsActionDialog.exe PID: 6136 Parent PID: 3352

General

Start time:	01:07:24
Start date:	29/09/2021
Path:	C:\Windows\System32\WindowsActionDialog.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsActionDialog.exe
Imagebase:	0x7ff6dc520000
File size:	59392 bytes
MD5 hash:	991359EE1E9C1958EB5D0F7314774123
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WindowsActionDialog.exe PID: 1840 Parent PID: 3352

General

Start time:	01:07:27
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\buYWmbl3\WindowsActionDialog.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\buYWmbl3\WindowsActionDialog.exe
Imagebase:	0x7ff6a5e00000
File size:	59392 bytes
MD5 hash:	991359EE1E9C1958EB5D0F7314774123
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000024.00000002.491095361.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: irftp.exe PID: 4592 Parent PID: 3352

General

Start time:	01:07:39
Start date:	29/09/2021
Path:	C:\Windows\System32\irftp.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\irftp.exe
Imagebase:	0x7ff669c40000
File size:	184832 bytes
MD5 hash:	F1C2D10CA8161DB689CD4FDE756E2DBB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: irftp.exe PID: 6252 Parent PID: 3352

General

Start time:	01:07:46
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\hJiut\irftp.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\hJiut\irftp.exe
Imagebase:	0x7ff65a340000
File size:	184832 bytes
MD5 hash:	F1C2D10CA8161DB689CD4FDE756E2DBB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000026.00000002.532861365.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: osk.exe PID: 6228 Parent PID: 3352

General

Start time:	01:07:59
Start date:	29/09/2021
Path:	C:\Windows\System32\osk.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\osk.exe
Imagebase:	0x7ff64ff30000
File size:	622592 bytes
MD5 hash:	88B09DE7D0DF1D2E9BCA9BAE1346CB23
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll64.exe PID: 7152 Parent PID: 4336 loaddll64.exeCOMMON

Executed Functions

Function 00000001400495B0, Relevance: 8.7, APIs: 2, Strings: 2, Instructions: 1727COMMON

Download Yara Rule

Strings

}*, xrefs: 0000000140049BDD
}*, xrefs: 0000000140049620

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: f218d88ecbe768a3c2e15b48e098ea3b44daa8c6dba81671f269a0c6fd7b68aa
Instruction ID: dfe71950bb4b00d773a2c1e4d7d9ca62016f185058a51a46645e99606ce0912a
Opcode Fuzzy Hash: f218d88ecbe768a3c2e15b48e098ea3b44daa8c6dba81671f269a0c6fd7b68aa
Instruction Fuzzy Hash: CDF2E476601B8481EB269F17D5503EE77A1F78EBC8F9A4025EB0A077B5DB38C945C348

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140036F30, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE ref: 000000014003704B
EntryPoint.1ZDJLXXTNH ref: 00000001400370EE

Strings

)8GV, xrefs: 0000000140037008
d, xrefs: 0000000140037032

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ConsoleEntryFreePoint
String ID: )8GV$d
API String ID: 3550414006-3589632123
Opcode ID: d05d8187567b24d43b5378db4c26f8457bb6311b4b9be5c519ef70a53fb6d972
Instruction ID: d510f836e5bc92855b025e221ee4853bd72dbb3d22a76ed0b2795177c136f2ac
Opcode Fuzzy Hash: d05d8187567b24d43b5378db4c26f8457bb6311b4b9be5c519ef70a53fb6d972
Instruction Fuzzy Hash: 2C91983230064096EB26EB66D0513EE23A5AB9C7D4F914526BB1E47BFBEE34CA05C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005C340, Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 886COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE ref: 000000014005D101

Strings

sy;, xrefs: 000000014005C420
sy;, xrefs: 000000014005C9ED

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InfoSystem
String ID: sy;$sy;
API String ID: 31276548-3660992706
Opcode ID: 4ba7a1a776c1b2a8194e3aee1005776fcb25fed3b21deabde970c8a1fedf5655
Instruction ID: 6e6b9d6b41ba510f9365bd6ae70f9dc3139515c8db1fe8c3f4a6c85962f57752
Opcode Fuzzy Hash: 4ba7a1a776c1b2a8194e3aee1005776fcb25fed3b21deabde970c8a1fedf5655
Instruction Fuzzy Hash: 2A82DB72215B848AEB26CF27D4507E977E1F789BC4F498426EB4A077B6DB39C941C380

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004BD40, Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 789COMMON

Download Yara Rule

Strings

}*, xrefs: 000000014004BDB0
}*, xrefs: 000000014004C37C

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: 7295418c03dacbe62c915b6dd4b980e4d41f822c5e8600d002afc3f8743a909a
Instruction ID: 589d9863290c94d963c78ae1aba4b537ce1e649f887b860e334c2c2edf70769e
Opcode Fuzzy Hash: 7295418c03dacbe62c915b6dd4b980e4d41f822c5e8600d002afc3f8743a909a
Instruction Fuzzy Hash: B872E172211B8081EBA68F23D4547ED77A1F78DBC4F8A5125EB4A477B6EB38C944C348

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D290, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 000000014005D2ED

Strings

., xrefs: 000000014005D36A

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindFirst
String ID: .
API String ID: 1974802433-248832578
Opcode ID: 676bd74008c321f1f054d2561c231ee4757c1d63a5241c01311e4a1111e2dca9
Instruction ID: 4bac0f1caae8588fed560e2f4dd75fe3b4005a9d196e6938d52e54566134f4c2
Opcode Fuzzy Hash: 676bd74008c321f1f054d2561c231ee4757c1d63a5241c01311e4a1111e2dca9
Instruction Fuzzy Hash: C841A43260564085FB76DB26E1003AD73A1A748BF8F184713EF69177E9DB7AC982C742

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140026CC0, Relevance: 2.9, Strings: 2, Instructions: 362COMMON

Download Yara Rule

Strings

)8GV, xrefs: 000000014002703B
)8GV, xrefs: 0000000140027120

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: )8GV$)8GV
API String ID: 0-993736920
Opcode ID: 5886ea82fe4a1d5b647365e044932bffc6999eebc1d65fac80672f325e465605
Instruction ID: e7db99c2ed76c24e9271fdfca30502f9120cd4f12b6678b2f47d4e41cadbe873
Opcode Fuzzy Hash: 5886ea82fe4a1d5b647365e044932bffc6999eebc1d65fac80672f325e465605
Instruction Fuzzy Hash: 3BF18F7272064095EB52EB72D8913EE6365FB993C8F900426BB0E47AFADF34CA45C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006A4B0, Relevance: 1.7, APIs: 1, Instructions: 237nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 000000014006A550

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: c571d8b9788f13bc1a6c9d6d9ec75b3e860dc3d379630f9026fe8c942d3d5bbc
Instruction ID: ba306794fc56961ae9be9e8108b60f4a03202e28571258f9feaa1cffdeadac3d
Opcode Fuzzy Hash: c571d8b9788f13bc1a6c9d6d9ec75b3e860dc3d379630f9026fe8c942d3d5bbc
Instruction Fuzzy Hash: 25B16E36601B409AE712EF26D9403EE33A6F7497C8F645825EB4E47BA6DF38D524CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140048AC0, Relevance: 1.7, APIs: 1, Instructions: 185libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL ref: 0000000140048CDE

Part of subcall function 000000014005D1F0: FindNextFileW.KERNELBASE(?,?,CD3BEB56,0000000140048BFE), ref: 000000014005D21B

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindLoadNext
String ID:
API String ID: 50669962-0
Opcode ID: aa0438968589772fc8f2a9ec3ebe64abc64651e75ec2b3921e4afd98a3b5e278
Instruction ID: 5bbbb247b64301f03cc62f5655f26b2922a91791dd430743fbd3ba68f8766a4f
Opcode Fuzzy Hash: aa0438968589772fc8f2a9ec3ebe64abc64651e75ec2b3921e4afd98a3b5e278
Instruction Fuzzy Hash: 07819D3261568092FB22EB26E4513EE6365FBD83D4F814521FB4A57AEBEF38C605C704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140035270, Relevance: 1.7, APIs: 1, Instructions: 181COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140046C90: NtClose.NTDLL ref: 0000000140046CBE

ExitProcess.KERNEL32 ref: 00000001400354E1

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseExitProcess
String ID:
API String ID: 3487036407-0
Opcode ID: 6e17fe50e6f561acc205664f4a43b7bf662508175e8116978b7861a4b69f8d5b
Instruction ID: 3d479053040576d7404e3dfab4813d6254088c9544e20b556efee73ce8d776a8
Opcode Fuzzy Hash: 6e17fe50e6f561acc205664f4a43b7bf662508175e8116978b7861a4b69f8d5b
Instruction Fuzzy Hash: 5771BF32710A5096FB16EB72D4513EE2365AB883D9F844522BF5E53AFADF35C906C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046C90, Relevance: 1.5, APIs: 1, Instructions: 19nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL ref: 0000000140046CBE

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: daec19cacdd098f1244212ea8e14a5d3e1bd9439d57025bc9e494c2d8b520846
Instruction ID: acc9ee73913d888b71121e4cedfe861758cf19cabea33dd7822bbf7d3cf7603a
Opcode Fuzzy Hash: daec19cacdd098f1244212ea8e14a5d3e1bd9439d57025bc9e494c2d8b520846
Instruction Fuzzy Hash: 42E08CA1741A0041EF265276D0803A812809B4D7B4E194B209A7D0B3E0EA3888898716

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400524B0, Relevance: .8, Instructions: 815COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1fe821b06c1a4823bb9271ec043e796f757224c870123343ecb03a76390b80a
Instruction ID: bccbce3911ab829ef3288d496869760cb1404da12fac801df191153d1e38d36e
Opcode Fuzzy Hash: b1fe821b06c1a4823bb9271ec043e796f757224c870123343ecb03a76390b80a
Instruction Fuzzy Hash: 9172CD72601B9485FB26CF17D4503E967A1FB8EFC4F998426EB0A077A5EB39C945C380

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140065B80, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef59d8dad7016460516c65c54e0757d465c5ab080b3c9532efa0d5a42b826e15
Instruction ID: 84a8ec628d281786b49b5e6f6f6dec0d0376b1c45e732984354cafa0c8984479
Opcode Fuzzy Hash: ef59d8dad7016460516c65c54e0757d465c5ab080b3c9532efa0d5a42b826e15
Instruction Fuzzy Hash: D761947121164102FE76B72399047EE5292AFAD3E4F650B21BF6E47BF9EE38C9018740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140034870, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff70e36bafc14066583f36dccf9ed98aecf1f3ce13f55bc2722bc0c9a53d6bef
Instruction ID: 713527809b35fed6260ebd230ad48717dd4fa7a304d79e310e96a8de0daf9cee
Opcode Fuzzy Hash: ff70e36bafc14066583f36dccf9ed98aecf1f3ce13f55bc2722bc0c9a53d6bef
Instruction Fuzzy Hash: 5A717D32B04B4095FB12EBB2E4913DF67A5FBC8388F954025BB4957AAADF38D445CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140061360, Relevance: 6.3, APIs: 4, Instructions: 290registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 0000000140061459
RegEnumKeyW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 00000001400614B4
RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 0000000140061539
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002,?), ref: 0000000140061664

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close$EnumOpen
String ID:
API String ID: 138425441-0
Opcode ID: 672031fc434e6626b90ea1da62f3c38a687c8b9296ffac50e7f6928d6a85a361
Instruction ID: 4377045c35190c944746a6ea10b9b47c13ce871b5e3b3a15cce40fdff127085f
Opcode Fuzzy Hash: 672031fc434e6626b90ea1da62f3c38a687c8b9296ffac50e7f6928d6a85a361
Instruction Fuzzy Hash: 5BC1A43120568082FE629B16E8503EEA791E7C97E0F6C4A21FB6E47BE5DE78C941C740

Uniqueness

Uniqueness Score: -1.00%

Function 000001D7940D2252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001D7940D23B0
VirtualProtect.KERNELBASE ref: 000001D7940D2471
RtlAvlRemoveNode.NTDLL ref: 000001D7940D25B4
VirtualProtect.KERNELBASE ref: 000001D7940D2677

Memory Dump Source

Source File: 00000000.00000002.304871883.000001D7940D0000.00000040.00000001.sdmp, Offset: 000001D7940D0000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 184331b8b536518cb20f49ee1421981e1c7bd7adf83938092c2bcbee049d19c2
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: DEB15577618BC486DB30CB1AE440BDAB7A1F7C9B94F508026EE8D57B58DB79C8458F40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005F9F0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 000000014005FA4B

Strings

4aX, xrefs: 000000014005FA09

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DescriptorSecurity$ConvertString
String ID: 4aX
API String ID: 3907675253-4042356595
Opcode ID: a1249fc2010d9d5d05952f0359ba200457e66aefbced3d07103a2c3463c61beb
Instruction ID: 5c7b4eddd96f597e19123db416744eb931adcf52cf9da5c093af566d74744993
Opcode Fuzzy Hash: a1249fc2010d9d5d05952f0359ba200457e66aefbced3d07103a2c3463c61beb
Instruction Fuzzy Hash: EC216D72214B4582EA12EF66E1403DEB3A0FB8C7C4F844525EB8D07B6AEF39D625C745

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DAE0, Relevance: 3.1, APIs: 2, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44297aa2126b14dcd4d9c9accf23e52108ed4399094c5e3af94dd8103b7f7b57
Instruction ID: c5574eec75406f68cf122a08b4571db932f63f1e1c7d3e43579234279b4bb767
Opcode Fuzzy Hash: 44297aa2126b14dcd4d9c9accf23e52108ed4399094c5e3af94dd8103b7f7b57
Instruction Fuzzy Hash: A151D03130464182FA72EA63A4507EA77A2BB8CBD4F154527BF5A077E2EF7AC801C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DD30, Relevance: 3.1, APIs: 2, Instructions: 122fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 000000014005DDD8
ReadFile.KERNELBASE ref: 000000014005DE49

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 00f6d0f3771a8cfa98223a140d65de6735ec101d3a44d5ddd75e2d9def7749f0
Instruction ID: 869152f87e2051f324d9e8f0f01270def7d2743b76a8e6c9a5e95a296a3a7e26
Opcode Fuzzy Hash: 00f6d0f3771a8cfa98223a140d65de6735ec101d3a44d5ddd75e2d9def7749f0
Instruction Fuzzy Hash: A541583161464087EA62DB3AA4447AAB3A1FBD87E0F144712BB6D4B7F5DF39C802DB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBB9, Relevance: 3.1, APIs: 2, Instructions: 79filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: 8a0a731fb1e22280383dc4c244850d697ffee92b9dbadae0b2290ba2595e9be9
Instruction ID: 944ab0cbe82d54181631abf043b2a82f72de4fdca767e43f24bb2c72b9c0c91f
Opcode Fuzzy Hash: 8a0a731fb1e22280383dc4c244850d697ffee92b9dbadae0b2290ba2595e9be9
Instruction Fuzzy Hash: 8D21B431214A4581EA72DB66A0407EA3795F78CBE4F184617EFAE077E5DF7AC806C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBD2, Relevance: 3.1, APIs: 2, Instructions: 77filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: d6d835041d1b41abb3b5fe648f8f275da576c4891ed88a603463ed8b7f508fb5
Instruction ID: bee1728ae0ee1a0caa625709e376bb4aadd3217f15d1bcce0d190476addee932
Opcode Fuzzy Hash: d6d835041d1b41abb3b5fe648f8f275da576c4891ed88a603463ed8b7f508fb5
Instruction Fuzzy Hash: BE21D332311A4581EA72DA66A0407EA3795B78CBE4F184527AF9D077E5DE7AC806C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBE8, Relevance: 3.1, APIs: 2, Instructions: 76filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: 6bbc7cb38f56b555cae5d46dc9eb85d7f0e424b0d62445df59964c24eed4e9f3
Instruction ID: a00dbcca095f64b26cda9c271166364bdf2e86a9b80154192fb139b54d898421
Opcode Fuzzy Hash: 6bbc7cb38f56b555cae5d46dc9eb85d7f0e424b0d62445df59964c24eed4e9f3
Instruction Fuzzy Hash: 5521E532315A4581EA72DB62A0407EE3791F78CBE4F184517AFAD077E5DE7AC806C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140060D10, Relevance: 3.1, APIs: 2, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,000000014004890D), ref: 0000000140060D85
RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,000000014004890D), ref: 0000000140060DE8

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0af55b123fcd85ad11f65efe4d0ac2719b06ecdcd8a99680970ae4064010c44f
Instruction ID: 09cc4365fb23fa9fe14c599ab373ea3e5ec1bde103bfdbf39ccb6e9a9538c2db
Opcode Fuzzy Hash: 0af55b123fcd85ad11f65efe4d0ac2719b06ecdcd8a99680970ae4064010c44f
Instruction Fuzzy Hash: F521A37671569046EF52CB56E8003AFA391EB897F4F184621BF9C07BE8EA38D582C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBF8, Relevance: 3.1, APIs: 2, Instructions: 73filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: eb6f16229e65501cd5258548e2b4ff06530ad065b40e2a3bf9e2a9b945b11f61
Instruction ID: 68fcab11a3bde380270331896f94efb0ab36e54eb9d04e7f46ecdc112822b6b1
Opcode Fuzzy Hash: eb6f16229e65501cd5258548e2b4ff06530ad065b40e2a3bf9e2a9b945b11f61
Instruction Fuzzy Hash: 6821C132315A4541EA72DB62A0407EA3795F78CBE4F184627EFAD077E5DE7AC806C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046F60, Relevance: 1.7, APIs: 1, Instructions: 216COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0000000140046FDE

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 6fbd370f509e15ded848fb55215db030cd5a070b2eb2f404213be6c4e10dd337
Instruction ID: 560481d37deeb2f3cc02cd101c0a384bc9ca8e36dca6fa428839860d024f360c
Opcode Fuzzy Hash: 6fbd370f509e15ded848fb55215db030cd5a070b2eb2f404213be6c4e10dd337
Instruction Fuzzy Hash: EDA15D3271064099EB12EFB6C4913EE2365A7987C8F915126BF0D67AFAEF34C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005FDA0, Relevance: 1.6, APIs: 1, Instructions: 144synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNELBASE ref: 000000014005FEFE

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 6be956e981540fc735b56164f72d0aea79e48331418f8fd9eaab398243b5d8cf
Instruction ID: 2cd33cf12082532a652157af79f02d7873b375395221c82c38bac87e111ef697
Opcode Fuzzy Hash: 6be956e981540fc735b56164f72d0aea79e48331418f8fd9eaab398243b5d8cf
Instruction Fuzzy Hash: 6E51B2326117408AEB66EB22A0013EE6291EB9DBC4F580535FF4E477E6DF39C802D790

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D1F0, Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,?,CD3BEB56,0000000140048BFE), ref: 000000014005D21B

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: ff4ac6c2ef48f38791092f6d6c449714fc18167456ec2ef2bc1084d7df7feef3
Instruction ID: fe48dd106ee2d63de4642147a978de6f9e341aec22c75ad1205c2678dbe1ece1
Opcode Fuzzy Hash: ff4ac6c2ef48f38791092f6d6c449714fc18167456ec2ef2bc1084d7df7feef3
Instruction Fuzzy Hash: 80115B7561034082FF76DA6691047E933E1EB697C8F051013EF59472E9EB36C8D2C751

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140060BA0, Relevance: 1.5, APIs: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32 ref: 0000000140060C16

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: a3c12b60ccc1d223e9782810bc36042d204e1f874336debb41352ff4bff3a234
Instruction ID: 650aff04d41c3b1619de3e88208a4500c6b85af191ab70c767efd2679610bbe3
Opcode Fuzzy Hash: a3c12b60ccc1d223e9782810bc36042d204e1f874336debb41352ff4bff3a234
Instruction Fuzzy Hash: 1C112E72204B8486D7219F12E84039EB7A5F788B90FA89529EB8D43B58DF39D991CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046690, Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

RtlCreateHeap.NTDLL ref: 00000001400466DD

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 21b05e3ef22cad88cebd019d8e45e363c17e6ba0707ecabdd33f955b9f4b15ed
Instruction ID: 54976bf3431427af6da968cf6b263ec8d4a99ac7c2bea2f2fd5649cd882baac1
Opcode Fuzzy Hash: 21b05e3ef22cad88cebd019d8e45e363c17e6ba0707ecabdd33f955b9f4b15ed
Instruction Fuzzy Hash: B901D635706A8082EB528712FA4039A73A0F78C3C4F198524EF884B7A5EF38C8518B44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046730, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

RtlDeleteBoundaryDescriptor.NTDLL ref: 000000014004678C

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: BoundaryDeleteDescriptor
String ID:
API String ID: 3203483114-0
Opcode ID: 7b0e43f28c4f526d6edd5220e1ccf75e5ddb2081b4342278c18d43c75b4d1ee9
Instruction ID: 7e2fcedd46cf55f04110c2a11ced308778be976df41b62f125aabd7639a18320
Opcode Fuzzy Hash: 7b0e43f28c4f526d6edd5220e1ccf75e5ddb2081b4342278c18d43c75b4d1ee9
Instruction Fuzzy Hash: 70F0F878A4730141FE6A63B354543A511821FCC7C4F0E8834AF095B7A6EE38CD518699

Uniqueness

Uniqueness Score: -1.00%

Function 000001D7940D2057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001D7940D29A8), ref: 000001D7940D20A7

Memory Dump Source

Source File: 00000000.00000002.304871883.000001D7940D0000.00000040.00000001.sdmp, Offset: 000001D7940D0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 5584c262b811b46a98305a467a88917b1806ffd68540d38ef26e95fe8cd6d729
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 24315C72715B9086DB80DF1AE45479A7BA0F389BD8F605026EF8D87B58DF3AC446CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000000014002B6E0, Relevance: 8.2, Strings: 6, Instructions: 741COMMON

Download Yara Rule

Strings

3050, xrefs: 000000014002BB42
3050, xrefs: 000000014002B992
GNOP, xrefs: 000000014002B9CB
0020, xrefs: 000000014002B98B
0020, xrefs: 000000014002BB49
4040, xrefs: 000000014002BB6A

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: 0020$0020$3050$3050$4040$GNOP
API String ID: 0-829999343
Opcode ID: 537da1a0c1bbc7e636232495bc2fdab7c2537f76630bc9218dea00809d8f4601
Instruction ID: 282167bc52f218920562f67345f8403ae15435ff558287d674a5e0b6e797f698
Opcode Fuzzy Hash: 537da1a0c1bbc7e636232495bc2fdab7c2537f76630bc9218dea00809d8f4601
Instruction Fuzzy Hash: 4172507261068195EB22EF26D8913EE6365FB983C8F804016FB4E475FAEF34CA45C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140071DC0, Relevance: 5.7, Strings: 4, Instructions: 682COMMON

Download Yara Rule

Strings

VUUU, xrefs: 000000014007211B
VUUU, xrefs: 000000014007213B
ERCP, xrefs: 0000000140071EED
VUUU, xrefs: 0000000140072194

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU
API String ID: 0-2165971703
Opcode ID: 203c99bb3d64071a34d91be2023c6ff0f734778017a54347eb9ef20583df3fc0
Instruction ID: a95f611128f1d5d13a9bca75b656ea52fec65ffdb08565925219bb8e60db198b
Opcode Fuzzy Hash: 203c99bb3d64071a34d91be2023c6ff0f734778017a54347eb9ef20583df3fc0
Instruction Fuzzy Hash: 2252BE727046848AEB6A8F6AD5503ED7BA1F3087D8F144116FF569BAE8D73CC981C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400667D0, Relevance: 5.4, Strings: 4, Instructions: 448COMMON

Download Yara Rule

Strings

SW, xrefs: 0000000140066CA6
SW, xrefs: 0000000140066A69
SW, xrefs: 0000000140066A1A
SW, xrefs: 0000000140066C49

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: SW$SW$SW$SW
API String ID: 0-1120820918
Opcode ID: 517e9c748c7166ea23e42337479b6e8f1bff1248af9cf0015b4bedbae01fd632
Instruction ID: 5271b3b9b35d550c8de01999338ba1aa790ab169e66fccb1d44a6718ff6f2241
Opcode Fuzzy Hash: 517e9c748c7166ea23e42337479b6e8f1bff1248af9cf0015b4bedbae01fd632
Instruction Fuzzy Hash: 4C026D3170160146EB62EB73D8603EE2396AB9C3C8F554925BB4D87BEAEF35DA01C310

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140031DF0, Relevance: 5.3, Strings: 4, Instructions: 270COMMON

Download Yara Rule

Strings

GC,, xrefs: 000000014003216C
GC,, xrefs: 0000000140032008
GC,, xrefs: 00000001400321D7
GC,, xrefs: 0000000140031FC2

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: GC,$GC,$GC,$GC,
API String ID: 0-2774350030
Opcode ID: 98649618faad92dfac345ced2ac743c97f2c410892ae2dd8dadb9da2da6be478
Instruction ID: dd0ba4053c6bdb050c0e262549aa376da4335980b2dde8bb0cc8774c9fa84b1c
Opcode Fuzzy Hash: 98649618faad92dfac345ced2ac743c97f2c410892ae2dd8dadb9da2da6be478
Instruction Fuzzy Hash: 39B14A3232168096EA16EB22D4513EFA765FBDC7C4F854425FB4E57ABAEE38C605C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140057950, Relevance: 4.5, Strings: 2, Instructions: 1977COMMON

Download Yara Rule

Strings

}*, xrefs: 00000001400579C0
}*, xrefs: 0000000140057F89

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: e9887d82a581d5bcb5ea5d841605ffb3677de7d06064effe96893209b5a6e0e0
Instruction ID: 7c281f25cbc51a2c663274e483e0a5d4adc9f9b548fde4e06667abda5a9e2262
Opcode Fuzzy Hash: e9887d82a581d5bcb5ea5d841605ffb3677de7d06064effe96893209b5a6e0e0
Instruction Fuzzy Hash: 6E03CB72201B8482EB26CF23D4543ED67A1F78DBC4F994416EF4A177A6EB3AC945C380

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400263C0, Relevance: 4.3, Strings: 3, Instructions: 519COMMON

Download Yara Rule

Strings

)8GV, xrefs: 0000000140026A4D
)8GV, xrefs: 00000001400267B0
@, xrefs: 0000000140026B3F

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: )8GV$)8GV$@
API String ID: 0-2802744955
Opcode ID: a3e8ee5ab549556569e9006b525bd9d1ac3761a68850dd604f4cfbeaa6d7384c
Instruction ID: d4403fa2ef2757ed15b0d897a8d3d48ae9d82dee7601a7ae60b507309942f45e
Opcode Fuzzy Hash: a3e8ee5ab549556569e9006b525bd9d1ac3761a68850dd604f4cfbeaa6d7384c
Instruction Fuzzy Hash: 8F326E72610A8095FB22EB72D8513EE6365FB997C8F940026BB4E476FADF34CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400067B0, Relevance: 4.2, Strings: 3, Instructions: 406COMMON

Download Yara Rule

Strings

*/*, xrefs: 0000000140006D02
GET, xrefs: 000000014000688D, 000000014000689B
POST, xrefs: 0000000140006CF6

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: */*$GET$POST
API String ID: 0-3233530491
Opcode ID: f5c0abb872f3f3a9c24645541f102443df8f6c01efe130de31add9333cb11604
Instruction ID: 6cf15a5ed41f927c804a0d4041fd2741414eb33ceb6b5d93e391305a3a4948eb
Opcode Fuzzy Hash: f5c0abb872f3f3a9c24645541f102443df8f6c01efe130de31add9333cb11604
Instruction Fuzzy Hash: 57125C72610A8196EB11EF72E8913DE6765F7883D8F904122FB4E57AAADF34C249C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140035520, Relevance: 3.9, Strings: 3, Instructions: 117COMMON

Download Yara Rule

Strings

{QN, xrefs: 00000001400355E1
GC,, xrefs: 0000000140035622
GC,, xrefs: 0000000140035665

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: GC,$GC,${QN
API String ID: 0-3150587038
Opcode ID: fd0f7604477b89c46016288274ae5da6e1d22dae5e6d5d6e9033f3dbe6d447d0
Instruction ID: 9244b60d004d0bd22f383007071d62e4da67c70af0efad37e4d475a9577969ab
Opcode Fuzzy Hash: fd0f7604477b89c46016288274ae5da6e1d22dae5e6d5d6e9033f3dbe6d447d0
Instruction Fuzzy Hash: D851B3726017408AEB26AF72A0517DF3392EB98398F559529FB4E0BBE9DF39C401C741

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140025DB0, Relevance: 2.9, Strings: 2, Instructions: 401COMMON

Download Yara Rule

Strings

GC,, xrefs: 0000000140025E65
0, xrefs: 0000000140025FF4

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: 0$GC,
API String ID: 0-3557465234
Opcode ID: c501a18cd752f9cb014cd0278b4cdcaf861e6727db0c1722d954af001bda1d39
Instruction ID: 8e8f5bced65d739128878f1be46f709eb140c798bd495bd8ba2efbba04664ca7
Opcode Fuzzy Hash: c501a18cd752f9cb014cd0278b4cdcaf861e6727db0c1722d954af001bda1d39
Instruction Fuzzy Hash: 90F1C132705B8086EB56DB26A5503EE77A5F788BC8F544029FF8A47BA9DF38C845C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002FB20, Relevance: 2.7, Strings: 2, Instructions: 200COMMON

Download Yara Rule

Strings

cLpS, xrefs: 000000014002FB46
cLpS, xrefs: 000000014002FB76

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: cLpS$cLpS
API String ID: 0-581437482
Opcode ID: ee193233b973f877082caca428861b37c4d86ff6b56278014f21858ccd893e61
Instruction ID: d6b56411a1e340b191dd7f08d0c8a8920ca136b0ade9766ce73097337fe28e3c
Opcode Fuzzy Hash: ee193233b973f877082caca428861b37c4d86ff6b56278014f21858ccd893e61
Instruction Fuzzy Hash: F5916E32700A41A6FB12EB72D5513ED2366AB983D8F900126BF1D97AFADF34D919D340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140039140, Relevance: 2.1, Strings: 1, Instructions: 866COMMON

Download Yara Rule

Strings

D, xrefs: 0000000140039B2B

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 0452af0be93170f0712028ec6d1a4f1ed763d309de66f3c97f53239ecee0938c
Instruction ID: a2166a60d7ca2b4a0d1872d5e3506bb785f107662951e93f9f6f62b20c08bf0e
Opcode Fuzzy Hash: 0452af0be93170f0712028ec6d1a4f1ed763d309de66f3c97f53239ecee0938c
Instruction Fuzzy Hash: 32827E3222468186EB13EB26D4907EF6365FBD8794F904612FB5A47AFADF38C605C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000C5C0, Relevance: 2.1, Strings: 1, Instructions: 865COMMON

Download Yara Rule

Strings

GET, xrefs: 000000014000C5D5

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: GET
API String ID: 0-1805413626
Opcode ID: 10a9cab01500edb3aab632b5fd7f2a1bd3141a9130328a12816a57488f7d5cf8
Instruction ID: e67aa13565bd515be4758c424d677281e7e48e69fdea67d752e56d6b70eb8f16
Opcode Fuzzy Hash: 10a9cab01500edb3aab632b5fd7f2a1bd3141a9130328a12816a57488f7d5cf8
Instruction Fuzzy Hash: 7182CFB262568082FB52EB26E491BEE6761F7C97C8F851022FB4A576E7CF38C505C701

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140015120, Relevance: 2.1, APIs: 1, Instructions: 555COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32 ref: 000000014001530B

Part of subcall function 0000000140046C90: NtClose.NTDLL ref: 0000000140046CBE

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseEnvironmentExpandStrings
String ID:
API String ID: 1839112984-0
Opcode ID: 45e4f39da0bad21561b5064be163dd8534aff24f975c135ffc3a62d6c7fd4cf0
Instruction ID: c0dbe0ee55e83fb6c0f3bef3624a57e5635b4c6ed11a4d6c977be8f15ec7e338
Opcode Fuzzy Hash: 45e4f39da0bad21561b5064be163dd8534aff24f975c135ffc3a62d6c7fd4cf0
Instruction Fuzzy Hash: CB427E32710A4096FB12EB72D4913EE6765EB983D8F814422BB4D4BAFAEF34C645C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140019D20, Relevance: 2.0, APIs: 1, Instructions: 546COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba6099a796099f88d7bab708f55a928b817f83135c291c7786eaa4b3626c6e6
Instruction ID: abc698a25be580435ac5d46bd6b01b3c7dd535f90f9c32282677b8a643a0cbd6
Opcode Fuzzy Hash: 6ba6099a796099f88d7bab708f55a928b817f83135c291c7786eaa4b3626c6e6
Instruction Fuzzy Hash: 3C427D3271068095FB22EB76D8513EE2361EB993C8F904121BB0E5BAFAEF79C545C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140019580, Relevance: 2.0, APIs: 1, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c4a50b3d7872d86ef6a3e9cc2d845a37f5e520826fd0ba3a0c731759240b417
Instruction ID: 0bcce83d19b55e388762cc41cc2fbdfa61478623d1bee2f25155124e52c32027
Opcode Fuzzy Hash: 9c4a50b3d7872d86ef6a3e9cc2d845a37f5e520826fd0ba3a0c731759240b417
Instruction Fuzzy Hash: 8A128E3271468095FB22EB72D8913EE2355EB997C4F804026BB4E5BAFADF35C605C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006EB0, Relevance: 1.9, Strings: 1, Instructions: 651COMMON

Download Yara Rule

Strings

cLpS, xrefs: 00000001400072A3

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: cLpS
API String ID: 0-2886372077
Opcode ID: 39b3e9410c272ead3331ad6fef3a5a390c12b147565654b66b7ca87bf70ff1a0
Instruction ID: 96b4c198141fe6e7034ab14ad9d5ea3cda72442e6a1109ae0a48173783152c86
Opcode Fuzzy Hash: 39b3e9410c272ead3331ad6fef3a5a390c12b147565654b66b7ca87bf70ff1a0
Instruction Fuzzy Hash: CF528D7272464092FA12EB62E8517EE63A5FB9C7C4F814022BB4E57BBADF38C505C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400139D0, Relevance: 1.8, Strings: 1, Instructions: 571COMMON

Download Yara Rule

Strings

m, xrefs: 000000014001422E

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateMutex
String ID: m
API String ID: 1964310414-3775001192
Opcode ID: 548cbf9660611174ae7dc0bac9e348dfce328ca606fda0702f7edea96afa79e3
Instruction ID: 0a9d90af75a6ede7406656d6adb6787827cf479cbe6b14872f7c626c13ea0b6d
Opcode Fuzzy Hash: 548cbf9660611174ae7dc0bac9e348dfce328ca606fda0702f7edea96afa79e3
Instruction Fuzzy Hash: 6A529B32710A80A6F74EEB32C5913EE7369F788384F904026AB2947AE6DF34D576C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001D100, Relevance: 1.7, Strings: 1, Instructions: 497COMMON

Download Yara Rule

Strings

s( j, xrefs: 000000014001D128

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: s( j
API String ID: 0-1450404818
Opcode ID: 19985d2dc72a707ec5f83c91129fc97538500d80b5f4466283615156a38f1139
Instruction ID: 6f5b3d0b06e06ce3defbe5b62ba999e8dce43b7996f1ec96da6707378b1ebcba
Opcode Fuzzy Hash: 19985d2dc72a707ec5f83c91129fc97538500d80b5f4466283615156a38f1139
Instruction Fuzzy Hash: 14325632715B9085EB16EF66D8513ED73A5FB88B88F454026EB4E5BBAADF38C505C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140029780, Relevance: 1.7, Strings: 1, Instructions: 491COMMON

Download Yara Rule

Strings

kw9b, xrefs: 000000014002989A

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseEnumValue
String ID: kw9b
API String ID: 858281747-837114885
Opcode ID: 062067738a6c65797c1994c51f5107b387f40eae3e46339bf266da43be95fc51
Instruction ID: a79da12e532d7eb86b4034213f2927d281404f76e1d3d8be4d202bd2a10f559e
Opcode Fuzzy Hash: 062067738a6c65797c1994c51f5107b387f40eae3e46339bf266da43be95fc51
Instruction Fuzzy Hash: D622A03270064056FB22EB62E4513EE6361EB8C7D8F814625BB4E57AFADF38CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140033BB0, Relevance: 1.7, Strings: 1, Instructions: 454COMMON

Download Yara Rule

Strings

U, xrefs: 000000014003408F

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: d35766a0e92f2a955336e5ef9212eb4e65c519fd0c6c88ba874b9b73bc6b998d
Instruction ID: 04dcf981b535b3d5a04f4e0f983876b723d65533687fb2a3abc72c4897885b35
Opcode Fuzzy Hash: d35766a0e92f2a955336e5ef9212eb4e65c519fd0c6c88ba874b9b73bc6b998d
Instruction Fuzzy Hash: 7A22A032714A8095FB22EB76D4913EE2761EB993D4F900122BB4E5BAFADF38C545C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023530, Relevance: 1.7, Strings: 1, Instructions: 430COMMON

Download Yara Rule

Strings

Content-Type, xrefs: 000000014002385F

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: Content-Type
API String ID: 0-2058190213
Opcode ID: cd802d8b45f15130d3c27f80ef655ed1c5064d239956586ea4d9a7fa25c30ca4
Instruction ID: 8ed0294b40edec3e111ebf6e63eddced9ff886ac8d86313f53d4d34ac86a637b
Opcode Fuzzy Hash: cd802d8b45f15130d3c27f80ef655ed1c5064d239956586ea4d9a7fa25c30ca4
Instruction Fuzzy Hash: D0128B7271064096EB26EB72D0953EE63A5EB9D7C8F804029FB4E576B6DF34C909C341

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400389A0, Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

0, xrefs: 0000000140038A46

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID: 0
API String ID: 3535843008-4108050209
Opcode ID: 5efda3073f98ba850d64a6a6b6fb973051fc5223a8b2b59b7862bd26d1a0a119
Instruction ID: 021d52728ad99ff4b45c00a2ee63d530dbb35c35c3e7b67721d4418a9cae59c0
Opcode Fuzzy Hash: 5efda3073f98ba850d64a6a6b6fb973051fc5223a8b2b59b7862bd26d1a0a119
Instruction Fuzzy Hash: A4D1483271064185EB22EB66D8503EF6365FB987C8F944421FF4E57AAAEF34CA05C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400205A0, Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

, xrefs: 000000014002069B

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: d615a8395c91a4f270b16f16243a88213025be9c74bd528c78ddbcfbe443d7c5
Instruction ID: 091f4e73938a5afec608f70625f4eed5baac112ec883e15b973b01c59944fd94
Opcode Fuzzy Hash: d615a8395c91a4f270b16f16243a88213025be9c74bd528c78ddbcfbe443d7c5
Instruction Fuzzy Hash: 8FB1903271164156FB26EB72C0513EE2365A78C7C8F554429BF0E67BEAEE34D906C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002EED0, Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

, xrefs: 000000014002F04E

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 266006fd5134fcae821d54f81f057cdba6f5be873c6199ef93d4c42334c526d2
Instruction ID: 79bcb73a3e0a748e54816e3c2b9a8955141e4b7d1d3c260807ef7fd3e9233e09
Opcode Fuzzy Hash: 266006fd5134fcae821d54f81f057cdba6f5be873c6199ef93d4c42334c526d2
Instruction Fuzzy Hash: 4681AF3171528042FA66AB63A5513EE6382BBDC7C0F954839BF0E57BEADE38C9019750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023140, Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

tI*k, xrefs: 0000000140023300

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: tI*k
API String ID: 0-257501792
Opcode ID: b15996fbae463eef0efc9f4e5c4cbf386dde064011b2806a6f0ecd12f6b98297
Instruction ID: 2b3e36108f388e75195695150bf3b7502d87346db4925aa772ee75e92517338c
Opcode Fuzzy Hash: b15996fbae463eef0efc9f4e5c4cbf386dde064011b2806a6f0ecd12f6b98297
Instruction Fuzzy Hash: C891B332710A41C6FB12EB73D4913ED2365AB987C8F815026BF0E67AABDE34C605C391

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140078570, Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

ERCP, xrefs: 00000001400785BF

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: ERCP
API String ID: 0-1384759551
Opcode ID: 9a8959bd3d8286152fe3b07e5e9b9c99826fd1463cb640f02497020a3b8cf481
Instruction ID: 36d71a898891e4cfc692b0c24b63e4f8a605753b41eb4ec31f3d0d909baacb04
Opcode Fuzzy Hash: 9a8959bd3d8286152fe3b07e5e9b9c99826fd1463cb640f02497020a3b8cf481
Instruction Fuzzy Hash: 8541C2677244554AE3189F2598213BE2391F7E8781B008838BBC7C3B99E97CCE41C754

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004F940, Relevance: .9, Instructions: 873COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcdaca1a3c271cd417c85bb097e58509ad96e32764cb2952681562445dcde157
Instruction ID: fc2f62d5942ef41123ea32f2955be4f6aadf7052ab01c2248917173129c7cd0f
Opcode Fuzzy Hash: dcdaca1a3c271cd417c85bb097e58509ad96e32764cb2952681562445dcde157
Instruction Fuzzy Hash: 8A82BD72301B8486EB269F23D4503EE67A5F78DFC4F964022EB4A577A6DB38C945C384

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140053F20, Relevance: .8, Instructions: 808COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7250f98c0d712e4fed8a9177b7990c03dbf5da58cb0dd37bc7f0a46ed34db0c
Instruction ID: b1defcb4bfd3908c290bb80924a7f4486985742b072abc47c5e9bd5be53152ef
Opcode Fuzzy Hash: d7250f98c0d712e4fed8a9177b7990c03dbf5da58cb0dd37bc7f0a46ed34db0c
Instruction Fuzzy Hash: FF72CE32601BA482EB26CF17E4503ED77A5FB99BC8F9A4016EB49477B6DB36C941C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140054BA0, Relevance: .8, Instructions: 797COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6290f3f4936625c1500c9bb5ab49f73b0f0e92f6783c0cfd327242af27f29f
Instruction ID: 8249503d4e55669e8e7119aec1729776b7b2f3ca46fae70a891a003f6664f3d4
Opcode Fuzzy Hash: 0b6290f3f4936625c1500c9bb5ab49f73b0f0e92f6783c0cfd327242af27f29f
Instruction Fuzzy Hash: 3472DF32201B9486EB26DB17E4603ED77A5FB9DBC5F894012EB4A477B6DB3AC941C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140016E80, Relevance: .7, Instructions: 739COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 2b8a8e0ce6ea76fc5cbfefb7c9d7d90e7aa636387741d01d84db68111b4c969a
Instruction ID: 4fdb0601fab6f7a848b28641239d596080eab1ec2c6ff824b21f12e2ef69b5a1
Opcode Fuzzy Hash: 2b8a8e0ce6ea76fc5cbfefb7c9d7d90e7aa636387741d01d84db68111b4c969a
Instruction Fuzzy Hash: 48722D32724A4095EB02EB76D4913EE6765EB983C4FC05012BB4E879BBEF38C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004EB60, Relevance: .7, Instructions: 687COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf02e0b346a645ce41284f4b25ae6de0e0561089bc0c4212f6de5587c4ccb21
Instruction ID: d53d10191d1a85c044aba7f3ec212ac92ce5176a248edb2932ce54add84afe44
Opcode Fuzzy Hash: bbf02e0b346a645ce41284f4b25ae6de0e0561089bc0c4212f6de5587c4ccb21
Instruction Fuzzy Hash: 9D52BE72601B8081EB269F23D4543EE77A1F78CBC4F8A5426EB4A577B6DB38D845C348

Uniqueness

Uniqueness Score: -1.00%

Function 000000014007BD50, Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1d6ac494662c45c571e96f77a6e8211c4f0b163f6c515dcb42af03e52a945a
Instruction ID: 9c06e88039ccf999e040ad7794a2e2d02b6699145a9792014979c24fd1337f6c
Opcode Fuzzy Hash: dd1d6ac494662c45c571e96f77a6e8211c4f0b163f6c515dcb42af03e52a945a
Instruction Fuzzy Hash: B4623CB76206548BD7668F26C080B6C37B1F35DFA8F25521ADF0A43799CB39D891CB90

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003B220, Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c541702096c1ae675d9f8552b841f1df762d73269a6d039e8a3e529e919bb3f5
Instruction ID: acd1ff4a64a9c803ec812a22a8ce79600e1464d52fdb42fb628072365476121f
Opcode Fuzzy Hash: c541702096c1ae675d9f8552b841f1df762d73269a6d039e8a3e529e919bb3f5
Instruction Fuzzy Hash: 64429E31301A8141FA23EB6698513EF6391EB8C7E8F544616BF5A5BBEAEE38C505C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140024440, Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc2a6e3d2e1231b3fe707f0d0f35a30ce2f56e53bfff03d4db06bbddff5caabd
Instruction ID: 78f3400fd7e206f6a511ea736ed45412fb3e7259efd4ed926287f6c9bd4c6aa7
Opcode Fuzzy Hash: fc2a6e3d2e1231b3fe707f0d0f35a30ce2f56e53bfff03d4db06bbddff5caabd
Instruction Fuzzy Hash: E6427C32204A8096EB66EB32D0513EE67A4E79D3C8F914026F79A876F7DF38C945C741

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018630, Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5df13ac6ad6b177f0d6348ee0792d0267ce7592fd72d9a49b7ba42017b7971a
Instruction ID: 8108868c1ca7c4f1afbe8bd34af9d7f1e96dfbbf12b1edd0cffad3fdf1fa0b6f
Opcode Fuzzy Hash: e5df13ac6ad6b177f0d6348ee0792d0267ce7592fd72d9a49b7ba42017b7971a
Instruction Fuzzy Hash: 3F429E3231068095FB22EB72D8913EE6765EB983D8F844122BB0D97AFADF34C645C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023BF0, Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060d71c651ab3aed04444553114f4ea5a7531cc3ca58c37faf4133b09f387ec2
Instruction ID: 183f2e46b23aa86a2c091461a645f9a581571388db0d92becfc597eb429af356
Opcode Fuzzy Hash: 060d71c651ab3aed04444553114f4ea5a7531cc3ca58c37faf4133b09f387ec2
Instruction Fuzzy Hash: 0732AB3271064089EB16EB36D4513EE27A5EB8CBD8F555126FF0E877BADE38C4868340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400123C0, Relevance: .5, Instructions: 544COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30db4ded57f65ad5fd13648519ecc6db5536df19e5deb93067b0525fe46ee407
Instruction ID: 71edd40f2b1ab928f6f3b4ddf8d26af45cb7d1258c95c78617a62a1a74f3288a
Opcode Fuzzy Hash: 30db4ded57f65ad5fd13648519ecc6db5536df19e5deb93067b0525fe46ee407
Instruction Fuzzy Hash: BF32AC3261068195EB12EB26D4913EE2765FB983C8F814122FB4E57AFBEF38C645C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B120, Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8328b10af82aab1ef65ff433d7820bced4cba86e0066b221c3c838f9fd1e431
Instruction ID: 3ba19fba285517c5acd5c21b3c9b7592edaf423ca2de06bba8230fcf7af2400b
Opcode Fuzzy Hash: e8328b10af82aab1ef65ff433d7820bced4cba86e0066b221c3c838f9fd1e431
Instruction Fuzzy Hash: 3C429B72624A8095FB12EB62D4957EE2365FB983C8F814022FB0D57ABBDF34C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400381A0, Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ee38f4c6dee734349d5b0dcc202e437ae908f573234f4aff5f510a5883c84b0
Instruction ID: eb795f204498a8d956ef0de19ff8bd43d97085c04d8ed5933d3115b51340510f
Opcode Fuzzy Hash: 7ee38f4c6dee734349d5b0dcc202e437ae908f573234f4aff5f510a5883c84b0
Instruction Fuzzy Hash: 7022793270064186EA23EB2AD4957EF63A5EB88BD4F554626FF0A477F6EE34C506C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003A2E0, Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8d1907d2a62ce1ae108db488a351868ceb64fffc9dd42578434a0f34ae656a
Instruction ID: 697e8bd1027fccc09012cb901671f32632dfdae7722e2c733c5167ca59ce0a7a
Opcode Fuzzy Hash: 1e8d1907d2a62ce1ae108db488a351868ceb64fffc9dd42578434a0f34ae656a
Instruction Fuzzy Hash: AE227C3271064186EA23EB26D4513EF63A1FB89BD4F544625EB4A577F6EF38C50AC340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B390, Relevance: .5, Instructions: 458COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b3dc1032e7b852d429d3288fc6d56ff3ef19d98c02d1d103b4f123b92fc1f1
Instruction ID: 5c003effdee5129b35cf12aebe167f862a01b0c8d0d2f43ab9f1123e32a30f31
Opcode Fuzzy Hash: 71b3dc1032e7b852d429d3288fc6d56ff3ef19d98c02d1d103b4f123b92fc1f1
Instruction Fuzzy Hash: 8C0203B21082A489F7768B26C9413FA7BE2E759788F254906FB8A435F5D738C9C1D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000DDF0, Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e375be9be99e9838cc7803ed6e7672458d2ec84ccfc9a0c18b017f9565b827c
Instruction ID: c2c66f55aa66479377f68c186b881699d763759fa92e2ffabb716b860ed1a50b
Opcode Fuzzy Hash: 2e375be9be99e9838cc7803ed6e7672458d2ec84ccfc9a0c18b017f9565b827c
Instruction Fuzzy Hash: CD224D72710A8091EB12EB72D4913EE6765FB987C8F904116FB4E876BAEF38C245C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005C40, Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f513173c25ae17789a403cea68c9e18d94625c6d02a52581dcb230289bad16b3
Instruction ID: 217fabc6e38e1d640ccd999207fddb20e056db183073941d35cbdb4b11e649c3
Opcode Fuzzy Hash: f513173c25ae17789a403cea68c9e18d94625c6d02a52581dcb230289bad16b3
Instruction Fuzzy Hash: 10229B72620A8091EB12EB62E4957EE2365F79D7C4F814022FB4E576BBDF38C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140067A40, Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed167cb2d41bf65051b1e1e6ca4fc372791feb4efe79826a7b7afb1d034e643
Instruction ID: 3448a1cfdf5732c1482eebf940cb1862e5db89764351cf67f11e8459266109f6
Opcode Fuzzy Hash: 6ed167cb2d41bf65051b1e1e6ca4fc372791feb4efe79826a7b7afb1d034e643
Instruction Fuzzy Hash: CD026C727006418AEB12DF26D4907EE73A6F788BC4F614525EB0E977AADF34D90AC740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000BB40, Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8296aae514971c10519780c04e533f569930ad849b100b0340065f0f39cb86db
Instruction ID: a963730c34943060851cd64ea719675db259de8104656558a9074d2de6a51302
Opcode Fuzzy Hash: 8296aae514971c10519780c04e533f569930ad849b100b0340065f0f39cb86db
Instruction Fuzzy Hash: 41128F7222468096FB52EB22D4917EE6765FBD93C8F811022FB4E57AABDF38C505C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140069010, Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: bc4fe18ed797083e74f4d5cd17e8a6e4e1d5126150df91a93b346629e9c3d65f
Instruction ID: 5afa6d75f76fbbc9d7f53df6043056336d1db5d7591574d5123318d553f9c856
Opcode Fuzzy Hash: bc4fe18ed797083e74f4d5cd17e8a6e4e1d5126150df91a93b346629e9c3d65f
Instruction Fuzzy Hash: 19124E3272469096EB12EF72D8913DE6765FB987C8F815022BB0D57AABDF34C605C710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001E170, Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 6fe5d38ad1f8690ed4216c8729f4cdddbe586800c401b9c27fb863a53c2b00d8
Instruction ID: ac8bef764291a5126b18a53dad73757551fec454a5992e6944e07fe4b855ac86
Opcode Fuzzy Hash: 6fe5d38ad1f8690ed4216c8729f4cdddbe586800c401b9c27fb863a53c2b00d8
Instruction Fuzzy Hash: 2A023B32724A80A2FB52EB72D4913EE6764FB983C4F815022BB4D57AEADF35C545C710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002FEC0, Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4119716334bae8ce4a12a511c9ef3e68b40bfa4d08e13555b81686db08763198
Instruction ID: b67327a95b15ec145a913cc43aeca3e3a8a77925bd43874970612b3ea802a6ff
Opcode Fuzzy Hash: 4119716334bae8ce4a12a511c9ef3e68b40bfa4d08e13555b81686db08763198
Instruction Fuzzy Hash: A802707272064095EB02EB66D4913EE6765FB987C8F905022FB4D83ABBEF34C649C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002980, Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 4f031dda890f5b6590393d19acee77402144b9c4bbfec744419d7f2e8af65a5e
Instruction ID: 5d574d698b33f004de0812fa71b34c36bbdae31478704d480fb686f148b39898
Opcode Fuzzy Hash: 4f031dda890f5b6590393d19acee77402144b9c4bbfec744419d7f2e8af65a5e
Instruction Fuzzy Hash: EB024C72324A8096FB12EB62D4913EE6765EB983D4FC15022BB4E57AEBDF34C605C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018F80, Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4831c91d88212ea6bae896733b605764c098bda2cb8106883d018c424b82a2c3
Instruction ID: d38a929efe70148cd0bcafb05e8c0916e90d43f0c382b2c9e415ecaf47ade149
Opcode Fuzzy Hash: 4831c91d88212ea6bae896733b605764c098bda2cb8106883d018c424b82a2c3
Instruction Fuzzy Hash: C8F16D32610A8095FB12EB76D8513EE6365EB983D8F940521BB0E57AFBEF35C605C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140010880, Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d8f91d721c478637f80766b80e37fef242b82150883bd374cc6845ff3be0a72
Instruction ID: f0fb79f68922493fed5bc905321703954c20a875d362dace52344ff7232635a8
Opcode Fuzzy Hash: 8d8f91d721c478637f80766b80e37fef242b82150883bd374cc6845ff3be0a72
Instruction Fuzzy Hash: D7029272320AA19AEB42DF36C8917EE2724F748789F805016FF4B57AAAEF35C545C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001D910, Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: 5ad00df89051eaa49967073b66a19c6f1da8073d71a21332a449de5316238ce7
Instruction ID: 9c3e8f75c9e591130820bb2956cb3806339feb13e112d9af22726fcddd3bd126
Opcode Fuzzy Hash: 5ad00df89051eaa49967073b66a19c6f1da8073d71a21332a449de5316238ce7
Instruction Fuzzy Hash: 12026C32314A8095FB52EB72D4917EE2765EB983C4F805022BB4E97AEBDF35C649C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140033540, Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfb671b366bed9e4c2a3244232a6f4841e324ae8991314f0a71ea1274cc59bec
Instruction ID: d0d419901b6e3c3183ee3913f1137c5e588d0fadc92f77f7791849e6aeb29d3b
Opcode Fuzzy Hash: cfb671b366bed9e4c2a3244232a6f4841e324ae8991314f0a71ea1274cc59bec
Instruction Fuzzy Hash: 8A029132614A8095EB22EF32D4913EE6765FB98388F904412FB4E57AFADF34C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140017B40, Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a271461545f8d7b832081a624fb0379c86db8b71a6fcc540a55edf685f09f5
Instruction ID: fccd9241a873054b7c24d42fb58abb6f012b2f7f19fe3a4c061a127f88627f2a
Opcode Fuzzy Hash: e2a271461545f8d7b832081a624fb0379c86db8b71a6fcc540a55edf685f09f5
Instruction Fuzzy Hash: 41E18E3271068095FB12EB76D8917EE6765EB983C8F804021BB0D5BAEBEF35C645C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002CB80, Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c0f4076e790a67f6d98515807fb9bce675ae33bef5415c9236f66c5c68241f2
Instruction ID: 02ee9b89192d395c78975687d30e6fb06be8b995001c736011e159ca0d17724c
Opcode Fuzzy Hash: 8c0f4076e790a67f6d98515807fb9bce675ae33bef5415c9236f66c5c68241f2
Instruction Fuzzy Hash: E2E13D32714A4095EB02EB66D4913EE6765FB983D8F900012FB4D97AFAEF34CA49C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400018D0, Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e31cd9d0c2abe67ba1f982af43b8ae355da1bd35b9ac6401d5f88127279679d0
Instruction ID: 95da75048f27146dafc5de9d612871b80806eb61125b8034b1f63b71f4cba504
Opcode Fuzzy Hash: e31cd9d0c2abe67ba1f982af43b8ae355da1bd35b9ac6401d5f88127279679d0
Instruction Fuzzy Hash: 47F12C3262498096EB12EB62D8513ED6365FBD8388F814522BB4E479FBEF74CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003AAC0, Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88ffde5285e374d450e796d5cd304a5fa7d017e996fe3ac39e62eede96bb0df1
Instruction ID: cf5fdc312f2229dc6ff813412d90ddbabd12b8e4de7574aebc9877f7d05b411a
Opcode Fuzzy Hash: 88ffde5285e374d450e796d5cd304a5fa7d017e996fe3ac39e62eede96bb0df1
Instruction Fuzzy Hash: 28D19032711A4195EB12EB76D4903EE23A1EB993C4F844425BF4E57BEAEF38C605C350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140064080, Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16253b5d55ff71ace7e49d720cc951c571e11621ee8e21fa8c6a30ce5dfdcbdc
Instruction ID: bf23390ce128f79092fde7b2b9043ef6653a4f1b38eae35900255c6e9c132ad5
Opcode Fuzzy Hash: 16253b5d55ff71ace7e49d720cc951c571e11621ee8e21fa8c6a30ce5dfdcbdc
Instruction Fuzzy Hash: ABC1D4231282D04BD7569B3764503FAAE91E79A3C8F280655FFC997AEBD63CC2149B10

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002D0D0, Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7584585ec3b4b53ec8fb5b27a8843822aad1f1e51d0aa4fbe30674dd8de1ab0d
Instruction ID: d0d512be425b72175eef7d799d9923e381f6a995b1e0446f0295c878f1c0c086
Opcode Fuzzy Hash: 7584585ec3b4b53ec8fb5b27a8843822aad1f1e51d0aa4fbe30674dd8de1ab0d
Instruction Fuzzy Hash: CED13972724A4091EB02EB76D4913EE6765F7983C8F904016BB4D97ABAEF38C605C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140030530, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da2952e0823b3d5a59f73c7ab384f762a6d9a624e53a469d815e2d2c0d7a72ca
Instruction ID: 96955b53f7f5b4430e01eb0035ad3df088e7672fa3a311151148bede835f9000
Opcode Fuzzy Hash: da2952e0823b3d5a59f73c7ab384f762a6d9a624e53a469d815e2d2c0d7a72ca
Instruction Fuzzy Hash: E7C16136B0564089FB22EB76D0613EF27A1AB9C388F554425BF4E976FADE34C506C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002A110, Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: f2e071e7f6ab674ec47851a4750d1b7c0b6bf997477befec93a155f2d50e3c60
Instruction ID: 08807915bc927436db1a901aa043915a979950c5e23cf508b5f0d65b77d78aa9
Opcode Fuzzy Hash: f2e071e7f6ab674ec47851a4750d1b7c0b6bf997477befec93a155f2d50e3c60
Instruction Fuzzy Hash: 0CD17032614A8096EB02EB26D4513EE6364FBD97C4F815122FB4D57AEBDF38CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005F490, Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c98a7c03b056bf897b50c999e530441a062f43ea8ff7e63b9bd448889a0739
Instruction ID: f96005f1b71c62cd91ec633b0fa556b6f093996ab6e40a041e3cbd638a23d0d9
Opcode Fuzzy Hash: 29c98a7c03b056bf897b50c999e530441a062f43ea8ff7e63b9bd448889a0739
Instruction Fuzzy Hash: C1C1BD3270164096FB12EF76D4413ED23A4EB883A8F484622BF2D57AE6EF38D955D350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022D00, Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005ad93020e0817431c5e85dbe6d11178de2602f8c4bd9af456519582a9ff990
Instruction ID: 38de139323f3e079e5738bdd278af51575638bb101dd3218b17e6965c0953cb4
Opcode Fuzzy Hash: 005ad93020e0817431c5e85dbe6d11178de2602f8c4bd9af456519582a9ff990
Instruction Fuzzy Hash: 1DB16A3671062094FB46EBA2D8A17DE2365BB89BC8F825025FF0D67BA7DE38C505C354

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140031540, Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f425d040841da7f8aca5576ff87e7ae9262ef18f39f843680b29a7b76c8902f7
Instruction ID: bfe4e87f351d28bd3d3693bc96d2151355ab9388d993d4a46e39ffd0a3f78ad6
Opcode Fuzzy Hash: f425d040841da7f8aca5576ff87e7ae9262ef18f39f843680b29a7b76c8902f7
Instruction Fuzzy Hash: E6C16332704A809AFB22EBB2D4513EE2365AB9C3D8F854521BF1E676EADF30C505C354

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140062B00, Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfd4a30f1a27aef1054c36b1d99c0610af0cc08103e55e4b01f0e7caa7c836f
Instruction ID: f23c3879964f3f83b961310f1bad7f7be1ef7afa2b68ec7d59790f469601a501
Opcode Fuzzy Hash: bcfd4a30f1a27aef1054c36b1d99c0610af0cc08103e55e4b01f0e7caa7c836f
Instruction Fuzzy Hash: A9A10231211E8145EBA79A2798543EF27A6AB8C3D4F645825FF0E5B6E9EF34C901C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B41B, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16274a22d167cb7459d5025cfc47ed7afc639167fa2c9c1057ca1fd72c03709f
Instruction ID: c0d98bc7e162404dc537a7c1af49e5fbe25e03b535df8b2493956c53732576b9
Opcode Fuzzy Hash: 16274a22d167cb7459d5025cfc47ed7afc639167fa2c9c1057ca1fd72c03709f
Instruction Fuzzy Hash: B2A114F31182A486FB778A2685413FA7FE2E719789F254402FB8A435F6C63CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140066020, Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a77b3ded0776d671925a3aad9e7cc492f01908de9f9e7db45f2ad695b1e2ca
Instruction ID: d17e179c4ad3c1814a715198efb3da372d22ab0628f3c9d9f6a3a053a6971865
Opcode Fuzzy Hash: 39a77b3ded0776d671925a3aad9e7cc492f01908de9f9e7db45f2ad695b1e2ca
Instruction Fuzzy Hash: 79A1903271164045EB22EB7298507EE67E6AB9C3C8F550925BF4D47BEAEF34CA068310

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007A60, Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb3ae0ca8b09634f6b3eb7f35d10a75bd1e51e3d218a5b4533eb8f41dc86bd2
Instruction ID: 7cb660c1bafc6db3c15f0a4866a94b05aa7759728bb06ab0739d07cd917ce7e2
Opcode Fuzzy Hash: 8bb3ae0ca8b09634f6b3eb7f35d10a75bd1e51e3d218a5b4533eb8f41dc86bd2
Instruction Fuzzy Hash: 33B18C7262464191EB12EB62E4913EE6365FB9C7C4F801022FB4E47ABBDF38C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B43D, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8327572ae460ec67bee7642bc1df1dfc8e00bf19c98c3d2f0bb37742338d2b
Instruction ID: ff1b56ecf022c2229069a5389c0477a62f006b84fd5f9f69eebb894724ab9066
Opcode Fuzzy Hash: dc8327572ae460ec67bee7642bc1df1dfc8e00bf19c98c3d2f0bb37742338d2b
Instruction Fuzzy Hash: 44A125F21182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B424, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92fc6e297697f72d3d55b197ac04fe50775a4f95a26f4c9e919e5e137ab98750
Instruction ID: f965aa676d2cc64f6a485257af634002c7fef1377d4791c8bed9b1b7e56d6411
Opcode Fuzzy Hash: 92fc6e297697f72d3d55b197ac04fe50775a4f95a26f4c9e919e5e137ab98750
Instruction Fuzzy Hash: 79A115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B42D, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e075c1df208aa39fb877a834bfc4403f559291216783e55fb63477ae2eadfdc
Instruction ID: 86c182e730ead1fa639f737d8458d4edb1cdee6041daaa12aedc2aef895c7c0c
Opcode Fuzzy Hash: 1e075c1df208aa39fb877a834bfc4403f559291216783e55fb63477ae2eadfdc
Instruction Fuzzy Hash: 83A115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B436, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68406ce4345875cbc0110dbe212228596ffa7fd34d07f9d141f7f6a9cf54bfa
Instruction ID: 7a8579acbe1e06e5dcc528155c10978c06d1d02f61772b3afab02cdca005db6d
Opcode Fuzzy Hash: b68406ce4345875cbc0110dbe212228596ffa7fd34d07f9d141f7f6a9cf54bfa
Instruction Fuzzy Hash: 3EA115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B446, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a2fa5d4e375044cfc16d96b5b502da69406d12098659286745a9d4aecf6a6c
Instruction ID: 9b5f4d2890da7bc9148b0c777fb781a5a0913674a9f0c1f21bc34f13756e8484
Opcode Fuzzy Hash: 20a2fa5d4e375044cfc16d96b5b502da69406d12098659286745a9d4aecf6a6c
Instruction Fuzzy Hash: 37A114F31182A489FB778A2685413FA7FE2E719789F254402FB8A475F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140069A50, Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f08ee0d756057847edd0d181a5b9af1eeafec0c3c2ab46f94514504cf2ba2413
Instruction ID: 9e8436de532ad8a8b9d83a7ce7f67d33a1e65f1b543d517c902b78be038a8119
Opcode Fuzzy Hash: f08ee0d756057847edd0d181a5b9af1eeafec0c3c2ab46f94514504cf2ba2413
Instruction Fuzzy Hash: 6FA19F3271464095EB22EB72D4913EE63A5A78C7C8F914426FF0D57AFAEE38C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001010, Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b042d90c0f8c1feaf42d72467fc8ea1d5898c5b9afd74594c11dc23e78b13021
Instruction ID: 891caef274385c1d9a1a05b5f8e139ad0eea2bdcde326525a3acf11d5ee056db
Opcode Fuzzy Hash: b042d90c0f8c1feaf42d72467fc8ea1d5898c5b9afd74594c11dc23e78b13021
Instruction Fuzzy Hash: 79918D7270164095EB16EF66E4507EE23A5ABDC7C4F448425BF4E97BA6EE34C906C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002EA00, Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f7007dcec79cbd028848c0e6b5f903ec75487d0d5c02af892f7002b917e7028
Instruction ID: 09ec91f3f7d35e473cfa3e72b303784d96220d522314983c3d838af10b8059fe
Opcode Fuzzy Hash: 2f7007dcec79cbd028848c0e6b5f903ec75487d0d5c02af892f7002b917e7028
Instruction Fuzzy Hash: C4A16E32314A8095FB22EB72D8513EE2365EB987D4F940426BB4D57AFADF34CA05C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018300, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce67bfafa3a41e60d72f08d4a165a2184096e63d57257d43e1b540ba17e5e704
Instruction ID: 9282ef7f3f2e177ec3162a27807bc3d77d508fe5c2bed51c5ff564ba7b898efa
Opcode Fuzzy Hash: ce67bfafa3a41e60d72f08d4a165a2184096e63d57257d43e1b540ba17e5e704
Instruction Fuzzy Hash: 99912232B15A4099FB12EBB2D4913ED23659B9C7C8F814525BF0DA76EBEE34C609C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002E1B0, Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 32bffcc2ddfcb3d691dc0d2c9b892c77d94147a7b8145dc7682b20892f7e7318
Instruction ID: a01e236db0e61280ae7bc249da652572acbbc64743681568c883ee8cb5c556df
Opcode Fuzzy Hash: 32bffcc2ddfcb3d691dc0d2c9b892c77d94147a7b8145dc7682b20892f7e7318
Instruction Fuzzy Hash: D7916C3272468092FB12EB62D4957DE6365FB9C7C4F811022BB4D43AABDF78C544CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003EFB0, Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bec047f33ee0572188590f4278c6d3b9bee721e36306d1774188d0e8c9170a8
Instruction ID: 2085d5fbde7ab3b46fd7c59f247d5158c6ccb74e37f4a5dfc0e2ff2c0c09d730
Opcode Fuzzy Hash: 9bec047f33ee0572188590f4278c6d3b9bee721e36306d1774188d0e8c9170a8
Instruction Fuzzy Hash: 87814F36204A85C6EB679B2BE9403AF6B61F38DBD0F594512EF9A477B5CE38C442D310

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400276C0, Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edcdc2154c5838ab1c8625022021c2da12bae5cdd39a93ebf1f5cb6a04e32108
Instruction ID: bfac23c94d9038130fb0cc9f6c7292f6f1aa2b418e68c536fc9a693e481bc66c
Opcode Fuzzy Hash: edcdc2154c5838ab1c8625022021c2da12bae5cdd39a93ebf1f5cb6a04e32108
Instruction Fuzzy Hash: 1E91B13270164096FB22EB22D4517EE23A0EB9C3C8F855426BB4E57AFADF34C944C351

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140064E80, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bede4ae264e8185b0f9f24becd31f8195eff363a0612df846459a6d3a9af60c0
Instruction ID: 348a5c641c523964159132b8cb670365254cd557f13034448bd6fc243d7f1d42
Opcode Fuzzy Hash: bede4ae264e8185b0f9f24becd31f8195eff363a0612df846459a6d3a9af60c0
Instruction Fuzzy Hash: AB81503271064095FB12EB76D8913EE63A5AB9D7C8F944621BF0D4BAEAEF34C605C350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140016100, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a72caf03c22970d4fef77dedbe1bee6898f8b085468b7394fac77d0cc2e7ab
Instruction ID: 4362bffb4ce140633d60009826b42a117c21897de7dbf4a94b418fc321f1d931
Opcode Fuzzy Hash: c5a72caf03c22970d4fef77dedbe1bee6898f8b085468b7394fac77d0cc2e7ab
Instruction Fuzzy Hash: 35812032714A809AFB12EB72D4513ED2365EB9C388F814425BB4E67AEBEF35C605C354

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140032650, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 2ea0aee7501054cc679b21b17b3ec8bdf9c6d9fd89a4ddb5a7d9a4c31d441e67
Instruction ID: a8b049447ef23dc7a2f3147d56ae0c312f8ac6a7955db6ed7517384e00930876
Opcode Fuzzy Hash: 2ea0aee7501054cc679b21b17b3ec8bdf9c6d9fd89a4ddb5a7d9a4c31d441e67
Instruction Fuzzy Hash: 0371893270264096FB66AB7294503EE6391EB9C7C8F054526BB1D47BEAEF39C905C360

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400663F0, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d7b3c9e63ec17fbb3decf34851c1318d937a82485f1e960baa699eab580419
Instruction ID: 4c1290556f20f3e20b66d81894b0d385f6ea8bc2319cc982c81cb2944955426d
Opcode Fuzzy Hash: 53d7b3c9e63ec17fbb3decf34851c1318d937a82485f1e960baa699eab580419
Instruction Fuzzy Hash: 6E61B031301A4041EA66E737A9517EF97929F9D7D0FA44621BF5E877FAEE38C9028700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D850, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ec1b3edf0780c5c25e1336ba948ef3e7aec6e0b63b2610df3acb1851feab05
Instruction ID: 50d9e92313d7fbe24902196c924c1612cff9653e99501bbf2772a847790ebefc
Opcode Fuzzy Hash: 17ec1b3edf0780c5c25e1336ba948ef3e7aec6e0b63b2610df3acb1851feab05
Instruction Fuzzy Hash: 7D618D3271464496FB22EB72C0913EE23A5ABDC7C8F854422BF4D57AEAEE35C501C791

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001620, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e611ef6babe13b88f779e8dc5a7611e7c7a64f37548e21c7e35d19833addd5d9
Instruction ID: f8f81a1e6eeb4aa67bd22a5a7a70358e1ddf5b3241a247c9d5674b6b5ab46101
Opcode Fuzzy Hash: e611ef6babe13b88f779e8dc5a7611e7c7a64f37548e21c7e35d19833addd5d9
Instruction Fuzzy Hash: 9061C43262465091FB21EB26E0517EE6360FBCD7C4F815122BB5D47AEAEF79C541CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400319F0, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 2d057d9775497d8ce77184132c21eb618076589cfab5adda7cc754a5fd0d3834
Instruction ID: f33abad4c1c8ba015261be05896130ca5dc3e7c07ce7e813c180037223ea8262
Opcode Fuzzy Hash: 2d057d9775497d8ce77184132c21eb618076589cfab5adda7cc754a5fd0d3834
Instruction Fuzzy Hash: 08718E32714A809AEB12EF76D4913EE7761F798388F844026FB4D47AAADF74C548CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400688A0, Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: d3a452de0128449f2e5039728471469ce51d7081f01deae87ca1d54060856238
Instruction ID: 125c4d10a522e701d1fb6d0f1aef761f583aa31ccbb75f1db25899523a723602
Opcode Fuzzy Hash: d3a452de0128449f2e5039728471469ce51d7081f01deae87ca1d54060856238
Instruction Fuzzy Hash: 0151633271468052FB22EBB6E4513EE6761EBD83C4F951122BB4D47AEADE38C544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022730, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025899d978c00459a39b97666279dda4e96ed2cbcc4f77a24580eef4709ea6a8
Instruction ID: af2d80f9b144edbe9aa630ca6e788b257520dbedf888a3db325da96401233726
Opcode Fuzzy Hash: 025899d978c00459a39b97666279dda4e96ed2cbcc4f77a24580eef4709ea6a8
Instruction Fuzzy Hash: FA612832600B8085E755DF36A481BDD33A9F78DB88FA84138EF990B36ADF318055D768

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140031340, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f431bbfb257fb34b4f249f0b6c1a5781a1840d33aa954166e75b638a15f3be8f
Instruction ID: 50cb9f747c07e87171e39f534f7bbd71060f83f950b2ada1a46c15cbddfc577a
Opcode Fuzzy Hash: f431bbfb257fb34b4f249f0b6c1a5781a1840d33aa954166e75b638a15f3be8f
Instruction Fuzzy Hash: A0511B32700A4096FB12EB76D4917EE2365AB9C7C8F954421BF0DA7AEADF34C605C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002F840, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1a38846fc5b12dd28166e38272f044d4b391af603d2f1471411a8db1635f5ab
Instruction ID: 9602d307e9de31d357e639a9611a18ab9b6f2b9e1d5f0c6a8a00986c6f50d329
Opcode Fuzzy Hash: e1a38846fc5b12dd28166e38272f044d4b391af603d2f1471411a8db1635f5ab
Instruction Fuzzy Hash: 7F51AD32200A40A2EA22EB22D9957FE63A5F7DC7D0F854626FB0D836B6DF34C556D710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002DDE0, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: d96108c4bde49195b51d10af4498cce92db92bc86361a98dabd69ade9e6efc75
Instruction ID: aca98edda921e0e11dbb2b437e66833b6d9475281c93859f86ded24665675a69
Opcode Fuzzy Hash: d96108c4bde49195b51d10af4498cce92db92bc86361a98dabd69ade9e6efc75
Instruction Fuzzy Hash: E5516E3271465095FB52EB76E4913EE6761EBD8388F850026BB4E479EADF38C948CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140060FE0, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1f30609a35c92b6828c9fb432082ebd1e5c5e84766b67bb61e5bcc9401a082
Instruction ID: 51a026cb75a50cc44213724d5bb8c382370875f63e51d6fdf42d7c4c4c07ed92
Opcode Fuzzy Hash: 1c1f30609a35c92b6828c9fb432082ebd1e5c5e84766b67bb61e5bcc9401a082
Instruction Fuzzy Hash: 5D415F32B1066095FB12E77798517EE23A2ABCD7C4FA94421BF0E57AEBDE34C5018354

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400611A0, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8619ee3f9ccd1f320a5fbfbf5c9367aa5b7df2049cee1b1ea35a7e4b7e812f95
Instruction ID: fec891e6c53086f7b9094a78f95b73510c7007b912bc3ef8a41aa8e11e9acb14
Opcode Fuzzy Hash: 8619ee3f9ccd1f320a5fbfbf5c9367aa5b7df2049cee1b1ea35a7e4b7e812f95
Instruction Fuzzy Hash: 01413D31B2066095FB12EB7798513EE13A6ABDC7C4F994421BF0E97AEADE38C5058314

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022A00, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a10d479a193238a188e8adb5c0a2baa624421bbad2986b298b06f84ca2b66ec
Instruction ID: 4d6ce7f696a26fe9a74b6bb9734e6d6bbac3d85ccec2ef1c97bdec5ab73240ea
Opcode Fuzzy Hash: 9a10d479a193238a188e8adb5c0a2baa624421bbad2986b298b06f84ca2b66ec
Instruction Fuzzy Hash: FC51D732610B9085E785DF36E4813DD33A9F748F88F58413AAB8D4B7AADF348152C764

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400286B0, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 0dd31b007056381f4657a5f1dbdce23ecbf955912ad383fd51e82bbfc18d9e36
Instruction ID: a9185cf0004c76bb3001b2cb896eaa84c5f9aff40342764b4326ba4d96cea24c
Opcode Fuzzy Hash: 0dd31b007056381f4657a5f1dbdce23ecbf955912ad383fd51e82bbfc18d9e36
Instruction Fuzzy Hash: 9F514632310B81A2E74EDB32E5813D9B369FB8C384F908415EB9813AA6DF35D676D704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022340, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0bc628afaa724f2a407568f7776cab89400c990b0d91b82c0bf42df1747497
Instruction ID: 1e1e8128ca37617077ad8d3bddb138d765a5f71e348f586f351b06e9a9582713
Opcode Fuzzy Hash: 8d0bc628afaa724f2a407568f7776cab89400c990b0d91b82c0bf42df1747497
Instruction Fuzzy Hash: 5C51C773611B9085E745DF36E8813DD37A8F748F88F58413AEB894B6AADF308156C760

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140063BD0, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a990b53e0665ad0886faa979631976ec8b00dc7985899795eb44eacb3e5b3434
Instruction ID: 5f416d68214368cc8d497caad67b5ad9eebcd67f96a0df70edf52f54e079c757
Opcode Fuzzy Hash: a990b53e0665ad0886faa979631976ec8b00dc7985899795eb44eacb3e5b3434
Instruction Fuzzy Hash: DE31F53221099842FBA6471B9C613F93292E79C3E4F649625FB8E537F4D67DC8038B80

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005370, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bce42950a1e8a62078921d64ca997753bf7c09f413ca20ce6f360246a445e94
Instruction ID: 604a730c127844f2816d2636316060c5dd02da03d6f4240a24423d76594c64fe
Opcode Fuzzy Hash: 5bce42950a1e8a62078921d64ca997753bf7c09f413ca20ce6f360246a445e94
Instruction Fuzzy Hash: 55313F32610B9091E749DB36D9813DD73A9F78CB84FA58526A39847AA6DF35C177C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007EA0, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304569547.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.304561531.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304705052.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.304720340.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.304727863.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc6e0ee29a39c7d5a8b9bac5d98e7e3adc62a080d0eb157144b98198d9367420
Instruction ID: 1d8fa33d8030516f9812c7435f1c2f5fee2e6c5a40d503ba1f82db291cb841dc
Opcode Fuzzy Hash: cc6e0ee29a39c7d5a8b9bac5d98e7e3adc62a080d0eb157144b98198d9367420
Instruction Fuzzy Hash: 7131DC32600B4080E745DF3699813EDB3E9FBACB88FA9853697484A9B6DF35C157D310

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 1012 Parent PID: 5808 rundll32.exeCOMMON

Executed Functions

Function 0000022EC0772252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0000022EC07723B0
VirtualProtect.KERNELBASE ref: 0000022EC0772471
RtlAvlRemoveNode.NTDLL ref: 0000022EC07725B4
VirtualProtect.KERNELBASE ref: 0000022EC0772677

Memory Dump Source

Source File: 00000003.00000002.365747581.0000022EC0770000.00000040.00000001.sdmp, Offset: 0000022EC0770000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: f289c1d6c5583bc5ee5438567f9ec1888272a3176b39f49f4aabc69965bc19aa
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 7EB14476618BC486DB70CB5AE44079EB7A1F7C9BC0F118026EF8957B58DB79C8528F40

Uniqueness

Uniqueness Score: -1.00%

Function 0000022EC0772057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000022EC07729A8), ref: 0000022EC07720A7

Memory Dump Source

Source File: 00000003.00000002.365747581.0000022EC0770000.00000040.00000001.sdmp, Offset: 0000022EC0770000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 8128cc81a07b0be64f1d653a7760ca895dfc62f94d0b4bb9bc5ba7f297a8923a
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 0D314972615B8086DB90DF5AE45475A7BA0F389BC4F218026EF8D87B28DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 5904 Parent PID: 7152 rundll32.exeCOMMON

Executed Functions

Function 0000023F24282252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0000023F242823B0
VirtualProtect.KERNELBASE ref: 0000023F24282471
RtlAvlRemoveNode.NTDLL ref: 0000023F242825B4
VirtualProtect.KERNELBASE ref: 0000023F24282677

Memory Dump Source

Source File: 00000004.00000002.283218786.0000023F24280000.00000040.00000001.sdmp, Offset: 0000023F24280000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: a99041f714afe9cf0ed126b181ab3191ea86ed3830b3c4f82525349bd5e22493
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 88B15576618BD486D770CB1AF44079EB7A1F7C9B80F108026EE8957B98DB7DC9418F40

Uniqueness

Uniqueness Score: -1.00%

Function 0000023F24282057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000023F242829A8), ref: 0000023F242820A7

Memory Dump Source

Source File: 00000004.00000002.283218786.0000023F24280000.00000040.00000001.sdmp, Offset: 0000023F24280000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 14639492a870642d70d61a954ce6d0477e8df668fed7b061ab52731969849b06
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 48313672715B9086D780DF1AE45475A7BA0F389BC4F208026EF8D87B68DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6588 Parent PID: 7152 rundll32.exeCOMMON

Executed Functions

Function 000001D2B8852252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001D2B88523B0
VirtualProtect.KERNELBASE ref: 000001D2B8852471
RtlAvlRemoveNode.NTDLL ref: 000001D2B88525B4
VirtualProtect.KERNELBASE ref: 000001D2B8852677

Memory Dump Source

Source File: 0000000C.00000002.290631996.000001D2B8850000.00000040.00000001.sdmp, Offset: 000001D2B8850000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 5d052aa9f1537fdd0617b226b15e804fbb2855bdba8c5c1ad65c158020114145
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 36B15276618BC98AD770CB1AE4407DAB7A1F7D9B80F108026EE8D57B59DBBDC8418F40

Uniqueness

Uniqueness Score: -1.00%

Function 000001D2B8852057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001D2B88529A8), ref: 000001D2B88520A7

Memory Dump Source

Source File: 0000000C.00000002.290631996.000001D2B8850000.00000040.00000001.sdmp, Offset: 000001D2B8850000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 99b8bab9a67de5c50ebdd41d3028cf61cc2d1646a6767ae9cc19e5da10e88264
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: BE315C76715B8486D780DF1AE45479A7BA1F389BC4F204026EF8D87B18DF7AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 5848 Parent PID: 7152 rundll32.exeCOMMON

Executed Functions

Function 0000018447902252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00000184479023B0
VirtualProtect.KERNELBASE ref: 0000018447902471
RtlAvlRemoveNode.NTDLL ref: 00000184479025B4
VirtualProtect.KERNELBASE ref: 0000018447902677

Memory Dump Source

Source File: 0000000D.00000002.298338015.0000018447900000.00000040.00000001.sdmp, Offset: 0000018447900000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 9b0c32138d0cdcec99cfef1ccd01593d56e0c7008b66727ac13c0f8115d50466
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 6CB14276618BC986E770CB1AE4407DEB7A1F7C9B84F108026EE8957B58DF79C9428F40

Uniqueness

Uniqueness Score: -1.00%

Function 0000018447902057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,00000184479029A8), ref: 00000184479020A7

Memory Dump Source

Source File: 0000000D.00000002.298338015.0000018447900000.00000040.00000001.sdmp, Offset: 0000018447900000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: a1ee68885487e177a0b61a981dd57bc773eebbfde41f53b1ec39bae834fd8317
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: AB315C72615B9486D780DF1AE45479A7BB1F389BC4F208026EF8D87B18DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: ProximityUxHost.exe PID: 4896 Parent PID: 3352 ProximityUxHost.exeCOMMON

Executed Functions

Non-executed Functions

Function 00007FF7A3C9ECB8, Relevance: 54.6, APIs: 19, Strings: 12, Instructions: 303timeCOMMON

Download Yara Rule

APIs

StrToID.DUI70 ref: 00007FF7A3C9EEDD
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z.DUI70 ref: 00007FF7A3C9EEEA
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@P6APEBUPropertyInfo@2@XZHPEAUUpdateCache@2@@Z.DUI70 ref: 00007FF7A3C9EF12
?_ZeroRelease@Value@DirectUI@@AEAAXXZ.DUI70 ref: 00007FF7A3C9EF53
?CreateBool@Value@DirectUI@@SAPEAV12@_N@Z.DUI70 ref: 00007FF7A3C9EF65
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z.DUI70 ref: 00007FF7A3C9EF81
?_ZeroRelease@Value@DirectUI@@AEAAXXZ.DUI70 ref: 00007FF7A3C9EFA8
DuiCreateObject.DUI70 ref: 00007FF7A3C9EFC7
?CreateBool@Value@DirectUI@@SAPEAV12@_N@Z.DUI70 ref: 00007FF7A3C9EFFC
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z.DUI70 ref: 00007FF7A3C9F01F
?_ZeroRelease@Value@DirectUI@@AEAAXXZ.DUI70 ref: 00007FF7A3C9F041
SetTimer.USER32 ref: 00007FF7A3C9F0AC
KillTimer.USER32 ref: 00007FF7A3C9F0C4
KillTimer.USER32 ref: 00007FF7A3C9F0EC
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@P6APEBUPropertyInfo@2@XZHPEAUUpdateCache@2@@Z.DUI70 ref: 00007FF7A3C9F10B
?_ZeroRelease@Value@DirectUI@@AEAAXXZ.DUI70 ref: 00007FF7A3C9F12D
?CreateBool@Value@DirectUI@@SAPEAV12@_N@Z.DUI70 ref: 00007FF7A3C9F142
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z.DUI70 ref: 00007FF7A3C9F163
?_ZeroRelease@Value@DirectUI@@AEAAXXZ.DUI70 ref: 00007FF7A3C9F181

Strings

eSendContentDescription, xrefs: 00007FF7A3C9ED04
eWaiting, xrefs: 00007FF7A3C9ED34
eCancelButton, xrefs: 00007FF7A3C9ED7B
eSendContentTitle, xrefs: 00007FF7A3C9ECF6
eDone, xrefs: 00007FF7A3C9ED47
eProgressBar, xrefs: 00007FF7A3C9ED2D
eCanceled, xrefs: 00007FF7A3C9ED5E
eReceivingDescription, xrefs: 00007FF7A3C9ED70
eError, xrefs: 00007FF7A3C9ED17
eReceiveConnecting, xrefs: 00007FF7A3C9ED4E
eReceiveFinishing, xrefs: 00007FF7A3C9ED87
eInstructions, xrefs: 00007FF7A3C9ED1E

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Direct$Value@$Element@$Info@2@PropertyRelease@Zero$Create$Bool@TimerV12@_Value@2@@$Cache@2@@KillUpdateValue@2@$Descendent@FindObjectV12@
String ID: eCancelButton$eCanceled$eDone$eError$eInstructions$eProgressBar$eReceiveConnecting$eReceiveFinishing$eReceivingDescription$eSendContentDescription$eSendContentTitle$eWaiting
API String ID: 1467024812-3528510536
Opcode ID: 1ba92dd36d5bafc0041588fb3238b3a2bc2a6023d50ee68dd1607744e8e13248
Instruction ID: 83bc941f7a9aaa866e2732f2b43ba9f0f64fdbfb5b5d18eb66125d7a58184e11
Opcode Fuzzy Hash: 1ba92dd36d5bafc0041588fb3238b3a2bc2a6023d50ee68dd1607744e8e13248
Instruction Fuzzy Hash: E8E1C932A0A7828AE791DF24DC443AD77A4FB08798F864035EA4D17BA4DF3EE454C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C9C8A0, Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 177COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9C8BD
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9C8EF
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z.DUI70 ref: 00007FF7A3C9C968
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z.DUI70 ref: 00007FF7A3C9C98C
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z.DUI70 ref: 00007FF7A3C9C9D0
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z.DUI70 ref: 00007FF7A3C9C9E8
?CreateBool@Value@DirectUI@@SAPEAV12@_N@Z.DUI70 ref: 00007FF7A3C9C9FE
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z.DUI70 ref: 00007FF7A3C9CA1F
?_ZeroRelease@Value@DirectUI@@AEAAXXZ.DUI70 ref: 00007FF7A3C9CA41
StrToID.DUI70 ref: 00007FF7A3C9CA4E
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z.DUI70 ref: 00007FF7A3C9CA5B
?GetClassInfoPtr@ModernProgressBar@DirectUI@@SAPEAUIClassInfo@2@XZ.DUI70 ref: 00007FF7A3C9CA82
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ.DUI70 ref: 00007FF7A3C9CABE
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9CB17
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9CB26

Strings

TapToSend_Send, xrefs: 00007FF7A3C9C9A4
eProgressBar, xrefs: 00007FF7A3C9CA47
TapToSend_Receive, xrefs: 00007FF7A3C9C9B0
, xrefs: 00007FF7A3C9C907, 00007FF7A3C9CAA8

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Direct$Element@Parser@Value$Value@$ClassCreateInfo@2@V12@$Bar@Bool@Create@Descendent@Destroy@E__@@0@ElementElement@2@1FindFromInfoListener@Listener@2@@ModernProgressPropertyPtr@Release@Resource@V12@_V32@@Value@2@Value@2@@Zero
String ID: $TapToSend_Receive$TapToSend_Send$eProgressBar
API String ID: 4291424374-3449774739
Opcode ID: 056742588f249f18ae341f376087049ff82e35069b5533be3a9bb282929f3a9f
Instruction ID: 76e64b90443be934b0a7c1f6fd7200dd36603fc267d8dd2caa5e83c91400b54b
Opcode Fuzzy Hash: 056742588f249f18ae341f376087049ff82e35069b5533be3a9bb282929f3a9f
Instruction Fuzzy Hash: 4D718031A0A64292E790AF15EC54679B3A1FB88784F868135EA4D537F0EF3EE445C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C8F0B4, Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 206fileCOMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8F0F5
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8F11C
memset.MSVCRT ref: 00007FF7A3C8F191
LoadStringW.USER32 ref: 00007FF7A3C8F1AD
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C8F1B7
memset.MSVCRT ref: 00007FF7A3C8F1E9
AssocQueryStringW.API-MS-WIN-SHLWAPI-WINRT-STORAGE-L1-1-1 ref: 00007FF7A3C8F215
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7A3C8F2A4
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C8F2BD
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7A3C8F2F5
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C8F2FF
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7A3C8F31C
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C8F33F
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8F3A3
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8F3B2

Strings

%s\%s%s, xrefs: 00007FF7A3C8F24D
, xrefs: 00007FF7A3C8F136, 00007FF7A3C8F379

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$ErrorLast$FileStringmemset$AssocCloseCreateFreeHandleLoadQueryTaskWrite
String ID: $%s\%s%s
API String ID: 808724122-36080484
Opcode ID: ffdfd3f709964b0045c939eb64775d2ce2671d3cf31a5be9de04f5478dec3850
Instruction ID: 3ad4e73455f503383ec5e291960b680781e6bb07edb4bfebe2cbd449949e3ba6
Opcode Fuzzy Hash: ffdfd3f709964b0045c939eb64775d2ce2671d3cf31a5be9de04f5478dec3850
Instruction Fuzzy Hash: 1891A532609A4652F790AF25FC407A9A3A1FB84755F824136DA4D637E4DF3EE605C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C8B868, Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 345COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8B8A7
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8B8D0
SHCreateItemInKnownFolder.SHELL32 ref: 00007FF7A3C8B986
PropVariantClear.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C8BABB
LoadStringW.USER32 ref: 00007FF7A3C8BAFD
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C8BB07
LoadStringW.USER32 ref: 00007FF7A3C8BB43
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C8BB4F
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C8BCB7
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C8BD19
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8BD47
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8BD56

Strings

, xrefs: 00007FF7A3C8B8EC, 00007FF7A3C8BC76, 00007FF7A3C8BCF7
Windows.SystemToast.NfpAppLaunch, xrefs: 00007FF7A3C8BC12
null, xrefs: 00007FF7A3C8B924

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$ErrorFreeLastLoadStringTask$ClearCreateFolderItemKnownPropVariant
String ID: $Windows.SystemToast.NfpAppLaunch$null
API String ID: 34829657-2205189751
Opcode ID: 68a69c6709e14953f221eeb2d56e81336288341bd5c5a7003c7284f2e2b9b58e
Instruction ID: 5214ad01a9484d51ec731dab5abf9f58d542f1fd64ee8ef2af503f3b557d0f8e
Opcode Fuzzy Hash: 68a69c6709e14953f221eeb2d56e81336288341bd5c5a7003c7284f2e2b9b58e
Instruction Fuzzy Hash: D1F18132A0AB5682EB90EF19EC40269B7A0FB44785F824135DE4D637B4DF3EE945C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CA2CA0, Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

BCryptOpenAlgorithmProvider.BCRYPT(?,?,?,?,?,?,?,00007FF7A3C9FDE6), ref: 00007FF7A3CA2D33
BCryptGetProperty.BCRYPT ref: 00007FF7A3CA2D67
BCryptGetProperty.BCRYPT ref: 00007FF7A3CA2DB9
BCryptGenerateSymmetricKey.BCRYPT ref: 00007FF7A3CA2E15
BCryptDestroyKey.BCRYPT(?,?,?,?,?,?,?,00007FF7A3C9FDE6), ref: 00007FF7A3CA2E2B
BCryptCloseAlgorithmProvider.BCRYPT(?,?,?,?,?,?,?,00007FF7A3C9FDE6), ref: 00007FF7A3CA2E45
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,?,?,?,00007FF7A3C9FDE6), ref: 00007FF7A3CA2E58

Strings

Microsoft Primitive Provider, xrefs: 00007FF7A3CA2D25
BlockLength, xrefs: 00007FF7A3CA2DB2
ObjectLength, xrefs: 00007FF7A3CA2D60
AES, xrefs: 00007FF7A3CA2D2C

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Crypt$AlgorithmPropertyProvider$CloseDestroyFreeGenerateOpenSymmetricTask
String ID: AES$BlockLength$Microsoft Primitive Provider$ObjectLength
API String ID: 299416460-142503546
Opcode ID: 4f5f95a861c11fc92980cc0d4e389d503e32726620d7ed762e9d1b07ffaf54ed
Instruction ID: a0577254db2f514b121b6b4fd9aa6f5177de13718c3e83d5fd0976635021f628
Opcode Fuzzy Hash: 4f5f95a861c11fc92980cc0d4e389d503e32726620d7ed762e9d1b07ffaf54ed
Instruction Fuzzy Hash: F151AE32B09B1692EB50AF55E880369B3B1FB48B85F814132DB4C13BA4DF7EE594C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CAA8E0, Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 344networkCOMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00000000,00000000,00007FF7A3CA6D60,?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3CAA90E
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3CAA934
htons.WS2_32 ref: 00007FF7A3CAAA5B
htons.WS2_32 ref: 00007FF7A3CAAB5E
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,00000000), ref: 00007FF7A3CAACBF
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000), ref: 00007FF7A3CAACD2
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3CAADBA
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3CAADC9

Strings

, xrefs: 00007FF7A3CAA950, 00007FF7A3CAAA9D, 00007FF7A3CAAB07, 00007FF7A3CAABDF, 00007FF7A3CAAD44, 00007FF7A3CAAD87

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$htons$ByteCharErrorLastMultiWide
String ID:
API String ID: 1972711602-1936338011
Opcode ID: 063a1322a061c6239bdf842d0eed5be1975cfd198cd0169c95218bc09babb54b
Instruction ID: 65852c560c9fdd67c07e2d03a28bc31242e154f249df87952ef12f8eebf901a0
Opcode Fuzzy Hash: 063a1322a061c6239bdf842d0eed5be1975cfd198cd0169c95218bc09babb54b
Instruction Fuzzy Hash: E4E1B235E0A64646F794EF299C001B9B7A2BF84B84F964436D91DA32F4EE3FE545C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C9C510, Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 227comCOMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9C54B
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9C574
CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C9C600
LoadStringW.USER32 ref: 00007FF7A3C9C64F
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C9C659
CoAddRefServerProcess.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C9C748
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9C859
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9C868

Strings

, xrefs: 00007FF7A3C9C58E, 00007FF7A3C9C80F

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$CreateErrorInstanceLastLoadProcessServerString
String ID:
API String ID: 1352647872-1936338011
Opcode ID: ea1fdaefbe6c667b7122484c86a50dcea13faa2b2faf475b58a565489e8f1e16
Instruction ID: f00344b7cf99ce3b4c8ed3acb1897e84e2700ea3ab780e247e9c439a8527451e
Opcode Fuzzy Hash: ea1fdaefbe6c667b7122484c86a50dcea13faa2b2faf475b58a565489e8f1e16
Instruction Fuzzy Hash: 55B14336A0AB4682EB90EF19EC50169A3A5FB84B44F874136E94D537B4DF3EE845C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CB08D0, Relevance: 9.0, APIs: 6, Instructions: 50timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF7A3CB0901
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CB090F
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CB091B
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF7A3CB0927
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF7A3CB0937
QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0 ref: 00007FF7A3CB0952

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 28502da2da87cde1b690195c51bb069a4062b9bb83ba6169efa3fc07551376e2
Instruction ID: 8b0ce9edbef90de7763de32b6b4a8fa583189ea8897990e8d9fa00ba2a6b8085
Opcode Fuzzy Hash: 28502da2da87cde1b690195c51bb069a4062b9bb83ba6169efa3fc07551376e2
Instruction Fuzzy Hash: 07116022B06F418AEB80EF71EC4406873E4FB48758B811A31EA6D937A4EF3DD1648350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C944D4, Relevance: 6.3, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7A3C9453C
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7A3C9454F
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7A3C94562

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 83d21334fec6ce122cb886cbdd33357ef161b010e7d1b894141f6f1d2bf5a11e
Instruction ID: 292b4f6d0dcf898287e0fb866d1988b6f241ac88cf96fbc0d818ab8cf615b437
Opcode Fuzzy Hash: 83d21334fec6ce122cb886cbdd33357ef161b010e7d1b894141f6f1d2bf5a11e
Instruction Fuzzy Hash: A4215525B0A64186EAA4FF519851139A364EF84BC0F5A4031FA4E63BA5DF3EE4518760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C8D49C, Relevance: 3.0, APIs: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7A3C8D4D9
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C8D4E7

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 722e77a1763cb019b17f3fdd4d6ada84a517755e23988f6efbc34ad1e1c10008
Instruction ID: 94644e391ba06e8a10e1e425e1a6fb797298ab79ccfdee8226164be0d18b60ec
Opcode Fuzzy Hash: 722e77a1763cb019b17f3fdd4d6ada84a517755e23988f6efbc34ad1e1c10008
Instruction Fuzzy Hash: 8AF0B472718F0182E350AF20AC48B2D72E9FB48790FA20038C65D823A0DF3ED951C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C84C88, Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C84CBC
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C84CE7
CompareStringOrdinal.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7A3C84D97
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C84DB3
CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C84EA4
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C84EB3
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C84EE9
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C84EFC
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C84F0F
SHStrDupW.API-MS-WIN-SHCORE-OBSOLETE-L1-1-0 ref: 00007FF7A3C84F24
SHStrDupW.API-MS-WIN-SHCORE-OBSOLETE-L1-1-0 ref: 00007FF7A3C84F3F
memcpy.MSVCRT ref: 00007FF7A3C84F7D
SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C84F93
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C84FA2
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C84FC3
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C85035
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C85044

Strings

NDEF:wkt.Hs, xrefs: 00007FF7A3C84D88
, xrefs: 00007FF7A3C84D03, 00007FF7A3C84DF3, 00007FF7A3C84E6C, 00007FF7A3C85005

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$FreeTask$CriticalErrorEventLastSection$CompareCreateEnterLeaveOrdinalStringmemcpy
String ID: $NDEF:wkt.Hs
API String ID: 2853489874-353013457
Opcode ID: 2ab1f1d180c2166592995a74c73a3197426dffc94dbc183f05c64cab32be60e7
Instruction ID: 81fec69f2a0c6fd24f02200b489a47d9fca42072af87aeaba5395365f27943e5
Opcode Fuzzy Hash: 2ab1f1d180c2166592995a74c73a3197426dffc94dbc183f05c64cab32be60e7
Instruction Fuzzy Hash: EAB1913260AA8286E790EF25EC4027AA7A1FF84785F964135DA4D577F0DF3EE645C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C85064, Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 249synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3C85083
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3C850AA
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3C8517C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3C8518A
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3C851B3
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3C85233
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3C852B1
ResetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3C852BB
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3C852C5
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C85347
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C85356
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C85365
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C8536E
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3C853D7

Part of subcall function 00007FF7A3C85408: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C85443
Part of subcall function 00007FF7A3C85408: TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8546E
Part of subcall function 00007FF7A3C85408: memset.MSVCRT ref: 00007FF7A3C8554C
Part of subcall function 00007FF7A3C85408: CompareStringOrdinal.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7A3C8559E

TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3C853E6

Strings

, xrefs: 00007FF7A3C850C4, 00007FF7A3C8511F, 00007FF7A3C851F2, 00007FF7A3C85285, 00007FF7A3C852A7, 00007FF7A3C853A8

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$CriticalSection$FreeTask$EnterErrorLastLeave$CompareEventObjectOrdinalResetSingleStringWaitmemset
String ID:
API String ID: 2884978440-1936338011
Opcode ID: e3ca2709ea8780e841509524e47159a4723979f03d70259be014738557d523c5
Instruction ID: a2db1dd065bcf6297d081744840b34bdd721d8ab44de33d352dd3091b2bd42a4
Opcode Fuzzy Hash: e3ca2709ea8780e841509524e47159a4723979f03d70259be014738557d523c5
Instruction Fuzzy Hash: B4B19331A0E64692E794AF25EC503B9B3A1FB44742F924136DA0EA36F0DF7EE545C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C97820, Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 208synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C97845
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C97870
ResetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C978DF
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C978F5
DafStartFinalize.DEVICEASSOCIATION ref: 00007FF7A3C97925
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C9798C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C9799E
ResetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C979C4
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C979CE
DafStartDeviceStatusNotification.DEVICEASSOCIATION ref: 00007FF7A3C979FE
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C97A7D
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C97A8F
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C97B09
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C97B18

Strings

, xrefs: 00007FF7A3C9788A, 00007FF7A3C9796D, 00007FF7A3C97A46, 00007FF7A3C97AB4

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue$EventObjectResetSingleStartWait$DeviceFinalizeNotificationStatus
String ID:
API String ID: 1479010313-1936338011
Opcode ID: f60c92d92e8e8ebd51cf25a30a80f1fa7f5d93f577c29e80a5e046fb54542c54
Instruction ID: 41eddecc01a36de5d21ade7f223dcc70130b9c04ab96a90b7cd9466ba60e74d6
Opcode Fuzzy Hash: f60c92d92e8e8ebd51cf25a30a80f1fa7f5d93f577c29e80a5e046fb54542c54
Instruction Fuzzy Hash: DD91B632A0A65286E791AF15AC40279E3A1FF84784F974535E94EA73F0EE3EE545C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CA44F0, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 104memorysynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA451B

Part of subcall function 00007FF7A3C904B0: _vsnwprintf.MSVCRT ref: 00007FF7A3C904F0

OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3CA4563
ReleaseSemaphore.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3CA4583
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3CA458D
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3CA45A1
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7A3CA45B4
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3CA45BF
TlsAlloc.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA45CA
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3CA45D7
CreateSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-2-1 ref: 00007FF7A3CA4600
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3CA460E
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7A3CA4626
TlsFree.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA464A

Strings

ComTaskPool:%d, xrefs: 00007FF7A3CA4521

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$Semaphore$CloseHandle$AllocCreateCurrentFreeObjectOpenProcessReleaseSingleWait_vsnwprintf
String ID: ComTaskPool:%d
API String ID: 2468636831-4207256202
Opcode ID: ae68e3090804d3b558d5b0d9794763ffd4d6323a642fca303b3799710145c1a8
Instruction ID: 8ac9b1b740d085f8fb24b722ca48269c0a7ebc31de2b6c074dde52385a7d303a
Opcode Fuzzy Hash: ae68e3090804d3b558d5b0d9794763ffd4d6323a642fca303b3799710145c1a8
Instruction Fuzzy Hash: 69415031E0AB4282F7D0BF65AC45279A2A5FF48750F824531E96EA27F0DF3EE4458621

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C9E078, Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 169synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9E0B5
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9E0DC
memset.MSVCRT ref: 00007FF7A3C9E155
CreateMutexW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C9E180
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7A3C9E1A1
#21.PROXIMITYCOMMON ref: 00007FF7A3C9E1D8
WindowsGetStringLen.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF7A3C9E222
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF7A3C9E234

Part of subcall function 00007FF7A3CA5DF0: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00000000,?,?,?,00007FF7A3C9E25E), ref: 00007FF7A3CA5E1E
Part of subcall function 00007FF7A3CA5DF0: TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00000000,?,?,?,00007FF7A3C9E25E), ref: 00007FF7A3CA5E47
Part of subcall function 00007FF7A3CA5DF0: #24.PROXIMITYCOMMON(?,?,?,00000000,?,?,?,00007FF7A3C9E25E), ref: 00007FF7A3CA5F0C
Part of subcall function 00007FF7A3CA5DF0: CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,00000000,?,?,?,00007FF7A3C9E25E), ref: 00007FF7A3CA5F28

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9E2CF
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9E2DE

Strings

WindowsUri, xrefs: 00007FF7A3C9E24A
NearFieldProximity_Global_Share_Content_AppId, xrefs: 00007FF7A3C9E15A
, xrefs: 00007FF7A3C9E0F8, 00007FF7A3C9E29F
Global\%s, xrefs: 00007FF7A3C9E166

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$StringWindows$BufferCloseCreateFreeHandleMutexTaskmemset
String ID: $Global\%s$NearFieldProximity_Global_Share_Content_AppId$WindowsUri
API String ID: 297068061-240404791
Opcode ID: b7fe45d84b920a893e82e22a120d74fc04a2dccd497a9ca2034890d6ed65754a
Instruction ID: 2de99ab1932d5b40ee6d31854d8531ddf2581035c7dab30b349735e204297dec
Opcode Fuzzy Hash: b7fe45d84b920a893e82e22a120d74fc04a2dccd497a9ca2034890d6ed65754a
Instruction Fuzzy Hash: 8971E831A0AA8251E7A0EF24EC402B9A3A0FB44794F834132E90D576F5EF3EE545C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C828F0, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8290F
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C82B26
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C82B35
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C82941

Part of subcall function 00007FF7A3C81730: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF7A3C817A5

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C829BE
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C829ED
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C82A63
SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C82A82
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C82A8C
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C82AB1
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C82B9C
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C82BAB

Strings

, xrefs: 00007FF7A3C8295B, 00007FF7A3C82A38, 00007FF7A3C82AF6, 00007FF7A3C82B6F

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$CriticalSection$EnterErrorEventLastLeaveMessageTrace
String ID:
API String ID: 995313911-1936338011
Opcode ID: 7569c689fa8c585dc3eced29f61320697e5680682527b03087c9efa79248efba
Instruction ID: 1c54986085346b066ec339e5c28892788ed840456b888da79644a40b9f1390c1
Opcode Fuzzy Hash: 7569c689fa8c585dc3eced29f61320697e5680682527b03087c9efa79248efba
Instruction Fuzzy Hash: 0381A231A0A64696EB94AF14FC542B9B3A0FF54741F824136D94E632F0EE3EE945C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CA3824, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA3852
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA3879
memset.MSVCRT ref: 00007FF7A3CA3903
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3CA393C
SHStrDupW.API-MS-WIN-SHCORE-OBSOLETE-L1-1-0 ref: 00007FF7A3CA3948
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3CA395E
SHStrDupW.API-MS-WIN-SHCORE-OBSOLETE-L1-1-0 ref: 00007FF7A3CA396A
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3CA3983
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3CA3992
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA3A07
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA3A16

Strings

, xrefs: 00007FF7A3CA3895, 00007FF7A3CA39DC

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeTaskValue$memset
String ID:
API String ID: 188525246-1936338011
Opcode ID: 633e3bcf529e76041e65409242babe6d4141eeec81a1f36162d8aba8ccd6c9ed
Instruction ID: dac4a58206a286464360e816683cf240527a35845234d422f15b0f3829481427
Opcode Fuzzy Hash: 633e3bcf529e76041e65409242babe6d4141eeec81a1f36162d8aba8ccd6c9ed
Instruction Fuzzy Hash: 8151B632A0A64292E794EF15EC50379A3A1FB44B41F864536EA5E677F0DF3EE445C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C960A4, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 134synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C960BF
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C960E6
ResetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C9615B
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C96165
DevCreateObjectQueryFromId.API-MS-WIN-DEVICES-QUERY-L1-1-0 ref: 00007FF7A3C961C9
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C961DF
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C961F1
DevCloseObjectQuery.API-MS-WIN-DEVICES-QUERY-L1-1-0 ref: 00007FF7A3C96214
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C96281
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C96290

Strings

, xrefs: 00007FF7A3C96100, 00007FF7A3C96254

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$Object$ErrorLastQuery$CloseCreateEventFromResetSingleWait
String ID:
API String ID: 2285537250-1936338011
Opcode ID: afad105fd8ed682d97f4192a61d9840595704913a42405ede1f6fd19e26bd3be
Instruction ID: 20f7ea8b6d4afba1723e460976d4fa21a1577c05661addc1196a693f42d446d2
Opcode Fuzzy Hash: afad105fd8ed682d97f4192a61d9840595704913a42405ede1f6fd19e26bd3be
Instruction Fuzzy Hash: 9351B332609A4286E7D0AF24EC403A9B3E1FB84754F924135EA5D676F4EF3EE455C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C96884, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 143synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C968A5
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C968CC
ResetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C9693B
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C96945
DafStartReadCeremonyData.DEVICEASSOCIATION ref: 00007FF7A3C9697C
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C969EC
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C969FE
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C96A77
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C96A86

Strings

, xrefs: 00007FF7A3C968E6, 00007FF7A3C969BB, 00007FF7A3C96A4A

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$ErrorLast$CeremonyDataEventObjectReadResetSingleStartWait
String ID:
API String ID: 3565483117-1936338011
Opcode ID: b3ab303b3fc289ef1794f4bad07f69ed5f88f9e7f3641a5bb3aab95ccc9851a2
Instruction ID: 76d4e2a8835a1578a37cbdcee6271b57097970c83f496d772ab9d694ed1cb83c
Opcode Fuzzy Hash: b3ab303b3fc289ef1794f4bad07f69ed5f88f9e7f3641a5bb3aab95ccc9851a2
Instruction Fuzzy Hash: 12519531B0964286E7D0AF25EC402B9A3A0FB44750F834136E95EA36F4EF3EE555C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C940B0, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 112synchronizationCOMMON

Download Yara Rule

APIs

CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00007FF7A3C93DF4), ref: 00007FF7A3C940DA
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00007FF7A3C93DF4), ref: 00007FF7A3C940F0
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,00007FF7A3C93DF4), ref: 00007FF7A3C940FB
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00007FF7A3C93DF4), ref: 00007FF7A3C94107
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9418E
CreateMutexExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C941CA
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7A3C941F0

Strings

internal\sdk\inc\wil\ResultMacros.h, xrefs: 00007FF7A3C94117
x, xrefs: 00007FF7A3C941A3
Local\SM0:%d:%d:%hs, xrefs: 00007FF7A3C94199

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorHandleLast$CurrentMutexProcessSemaphore
String ID: Local\SM0:%d:%d:%hs$internal\sdk\inc\wil\ResultMacros.h$x
API String ID: 656119268-1766370323
Opcode ID: 3f616b85e7aea4a032a2bf07bca3d2791cfa7d81ef0cb9a184528ec67d324f14
Instruction ID: 470fc044c932190affdaf3fc87d543ecd6ce49e40d799bf8e16703891f03ad6b
Opcode Fuzzy Hash: 3f616b85e7aea4a032a2bf07bca3d2791cfa7d81ef0cb9a184528ec67d324f14
Instruction Fuzzy Hash: 3B41D83570AB4186E790AF51EC413A9E360FB88B84F964031FE4D57BA5DF3EE4458750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C8C8C4, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 190threadCOMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8C8E6
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8C90D
SHStrDupW.API-MS-WIN-SHCORE-OBSOLETE-L1-1-0 ref: 00007FF7A3C8C9FD
SHCreateThread.API-MS-WIN-SHCORE-THREAD-L1-1-0 ref: 00007FF7A3C8CA1E
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C8CA6C
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C8CAF9
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8CB60
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8CB6F

Strings

, xrefs: 00007FF7A3C8C92C, 00007FF7A3C8CAC4, 00007FF7A3C8CB35

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$CreateErrorFreeLastTaskThread
String ID:
API String ID: 1596903781-1936338011
Opcode ID: 9a9ea22db5db58511442b5fab391ac9ef1517a91ac5ae58a776fe0d1e55f57c3
Instruction ID: 9893057f58a83c1df68c4f670547039122f393d474bab6fac6bfd81c6d517396
Opcode Fuzzy Hash: 9a9ea22db5db58511442b5fab391ac9ef1517a91ac5ae58a776fe0d1e55f57c3
Instruction Fuzzy Hash: D8818332A0AA5682EB85EF19DC502B9E390FB44B81F878535D91D637F0DE3EE905C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C91CA0, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 150comCOMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C91CBC
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C91CE3
RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF7A3C91D48
CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C91D7C
RoUninitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF7A3C91E30
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C91EAF
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C91EBE

Strings

, xrefs: 00007FF7A3C91CFD, 00007FF7A3C91E0F, 00007FF7A3C91E8B
about:internet, xrefs: 00007FF7A3C91DAA

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$CreateInitializeInstanceUninitialize
String ID: $about:internet
API String ID: 3409890593-4065124427
Opcode ID: e03bdd7d113bc0c05c5f5c25368a47bd6d1ff5d672c96751d0af3d4dc40213d0
Instruction ID: b1ad46dd80f71134e7d8f175495445040fa7a9f244b127488a50bd7d8a260067
Opcode Fuzzy Hash: e03bdd7d113bc0c05c5f5c25368a47bd6d1ff5d672c96751d0af3d4dc40213d0
Instruction Fuzzy Hash: 2C618331A0AA4686EB85EF25EC55279B3A0FB44740F824136E90D637F0EF7EE905C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C9BD00, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9BD1C
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9BD43
?Click@Button@DirectUI@@SA?AVUID@@XZ.DUI70 ref: 00007FF7A3C9BDB4
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ.DUI70 ref: 00007FF7A3C9BDC8
StrToID.DUI70 ref: 00007FF7A3C9BDE8
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9BE8E
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9BE9D

Strings

eCancelButton, xrefs: 00007FF7A3C9BDDA
, xrefs: 00007FF7A3C9BD5D, 00007FF7A3C9BE2C

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$Button@Click@Direct$Touch
String ID: $eCancelButton
API String ID: 3902901452-3606016016
Opcode ID: 263a711647ce1ae475abf10481bf4fab4e6c260b9552912a193deae2a402c77d
Instruction ID: 75d7957e3003bc342d2ab39269d6ba0d0811d241c58725932a5d51228f2a9b79
Opcode Fuzzy Hash: 263a711647ce1ae475abf10481bf4fab4e6c260b9552912a193deae2a402c77d
Instruction Fuzzy Hash: C651753260AA4696EB84EF15EC40178B3A5FB44B84F824432DA5D637F1DF3EE945C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C8D828, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 110synchronizationthreadCOMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8D843
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8D86A
CreateThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8D8EB
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3C8D8FD
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C8D925
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7A3C8D92E
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8D990
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8D99F

Strings

, xrefs: 00007FF7A3C8D884, 00007FF7A3C8D968

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$CloseCreateErrorHandleLastObjectSingleThreadWait
String ID:
API String ID: 1880775629-1936338011
Opcode ID: 9585737788cd1e7b729df9cdac466fb3df605355e884f3f26212585262ca18d0
Instruction ID: 609e90936b05f1fb8d2eb46a5d0a2ea899d96729e953155db4189eaf3a62aad7
Opcode Fuzzy Hash: 9585737788cd1e7b729df9cdac466fb3df605355e884f3f26212585262ca18d0
Instruction Fuzzy Hash: 80419132A0A74292FB94AF28EC44379A3A0FB44751F864536D90E632F0DF3EE546C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CAF8BC, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,00000000,?,?,00000000,00000000,0000013F,00007FF7A3CAFDAC), ref: 00007FF7A3CAF903
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00000000,0000013F,00007FF7A3CAFDAC), ref: 00007FF7A3CAF92A
UrlUnescapeW.API-MS-WIN-CORE-URL-L1-1-0(?,?,00000000,00000000,0000013F,00007FF7A3CAFDAC), ref: 00007FF7A3CAF9FE
SysFreeString.OLEAUT32 ref: 00007FF7A3CAFA28
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,00000000,00000000,0000013F,00007FF7A3CAFDAC), ref: 00007FF7A3CAFC15
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00000000,0000013F,00007FF7A3CAFDAC), ref: 00007FF7A3CAFC25
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00000000,0000013F,00007FF7A3CAFDAC), ref: 00007FF7A3CAFC34

Strings

, xrefs: 00007FF7A3CAF946, 00007FF7A3CAFA7D, 00007FF7A3CAFBD7

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$Free$StringTaskUnescape
String ID:
API String ID: 1707985248-1936338011
Opcode ID: ce01822b6e8d3524308899a2280dd91093aee1548bf7124aa8bc9961122e2607
Instruction ID: 6eb7172a94cacb45b85c1bada26b7e133279bb8644b66752036a7598ed5b3356
Opcode Fuzzy Hash: ce01822b6e8d3524308899a2280dd91093aee1548bf7124aa8bc9961122e2607
Instruction Fuzzy Hash: 91B16F32A0AA4682EA50AF19EC50569B7A1FB84B84F924532EE5D537F4DF3EE805C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C858D0, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C85905
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8592C
#20.PROXIMITYCOMMON ref: 00007FF7A3C859DB
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C85AB7
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C85AC8
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C85AD7

Strings

Pairing:Bluetooth, xrefs: 00007FF7A3C85A09
, xrefs: 00007FF7A3C85946, 00007FF7A3C85A8F

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$FreeTask
String ID: $Pairing:Bluetooth
API String ID: 3641703983-549690982
Opcode ID: 8ca05ff47ac2dd69ef84ceea52a56942b5fdd690bb550fad265c717885d5dace
Instruction ID: 29327cb235180311663d37bb0d3b4e643ccdcd4f61bf55824b40571cac9dfa92
Opcode Fuzzy Hash: 8ca05ff47ac2dd69ef84ceea52a56942b5fdd690bb550fad265c717885d5dace
Instruction Fuzzy Hash: BD61B63160AB8691EB90EF14E8802B9B3A0FB44795F924136EA4D537F4DF7EE546C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CAE090, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 172comCOMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CAE0BD
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CAE0E4
CoAddRefServerProcess.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3CAE1A2
CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3CAE255
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CAE2E4
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CAE2F3

Strings

, xrefs: 00007FF7A3CAE0FE, 00007FF7A3CAE2A4

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$CreateInstanceProcessServer
String ID:
API String ID: 3526729273-1936338011
Opcode ID: c1891646eae08802ef6731d851a353267cdfe159e8424716993aa6b4395b2a8d
Instruction ID: a963deb8eb29f5c9d14e64818a373f6c1e5c3bc0150c017442215837b27c611e
Opcode Fuzzy Hash: c1891646eae08802ef6731d851a353267cdfe159e8424716993aa6b4395b2a8d
Instruction Fuzzy Hash: C671A631A0AA5682EB94EF25EC50278B3A5FB84B44F864531DA5D633F0DF3EE445C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C8646C, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(000000C8), ref: 00007FF7A3C864AE
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C864D6
memcpy.MSVCRT ref: 00007FF7A3C865E7
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C8665A
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8666C
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8667B

Strings

, xrefs: 00007FF7A3C864F2, 00007FF7A3C865A1, 00007FF7A3C86632

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$FreeTaskmemcpy
String ID:
API String ID: 176482533-1936338011
Opcode ID: 62249b5df0f9f004b8a55374caed60433a105f6f19a7810109ba5c28e2281eda
Instruction ID: 72a3c7329c20b67c728bcd0ed3ac5f6764ebbf9aa0834adecfa1f9a412a43551
Opcode Fuzzy Hash: 62249b5df0f9f004b8a55374caed60433a105f6f19a7810109ba5c28e2281eda
Instruction Fuzzy Hash: BD618D32A0AA5685E780EF64EC505BCB7A4FB48749F824136DE0D637E4DE3EE556C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C97C74, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,00000000,00007FF7A3C97BF5), ref: 00007FF7A3C97C98
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,00000000,00007FF7A3C97BF5), ref: 00007FF7A3C97CBF
SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FF7A3C97BF5), ref: 00007FF7A3C97D31
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00007FF7A3C97BF5), ref: 00007FF7A3C97D3F
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,00000000,00007FF7A3C97BF5), ref: 00007FF7A3C97E28
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,00000000,00007FF7A3C97BF5), ref: 00007FF7A3C97E37

Strings

, xrefs: 00007FF7A3C97CD9, 00007FF7A3C97D9F, 00007FF7A3C97DD9

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$ErrorEventLast
String ID:
API String ID: 4241079071-1936338011
Opcode ID: 6327cfa28b9c171946f579ea13127de338fc5c48e80a12e7bc350e4ab73c1f47
Instruction ID: 5150bd8cd735609e7aceb073a670bd6b93b2d1f0d2d33aa1d4dfbf7c2fb28ab9
Opcode Fuzzy Hash: 6327cfa28b9c171946f579ea13127de338fc5c48e80a12e7bc350e4ab73c1f47
Instruction Fuzzy Hash: 6551B531B0AA5286EB90EF18EC40279B3A1FB44744F924536E94D636F0EF3EE545C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CAD4C0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CAD4E3
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CAD513
CoAddRefServerProcess.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3CAD5CE
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CAD67D
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CAD68C

Strings

, xrefs: 00007FF7A3CAD52B, 00007FF7A3CAD653

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$ProcessServer
String ID:
API String ID: 3390778062-1936338011
Opcode ID: a77ece152508b8d619e4dbb983cd3d3afaaeccbb60a367404a0698a00a57e1cb
Instruction ID: 000b1620355bd584a278d8d0316ea476a854343a442a4515a6388bc61457adb0
Opcode Fuzzy Hash: a77ece152508b8d619e4dbb983cd3d3afaaeccbb60a367404a0698a00a57e1cb
Instruction Fuzzy Hash: 7851CC71A0AB4682EA91BF15EC64378A3A1FB44744F868936D95D633F0DF3EE845C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C96500, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C96528
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C96558
SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C965E6
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C96644
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C96653

Strings

, xrefs: 00007FF7A3C96572, 00007FF7A3C96620

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$Event
String ID:
API String ID: 3803239005-1936338011
Opcode ID: 5841cf89f262488fb340796dfcb258519ad07b5e5a5a538256f93b31b1f65a1e
Instruction ID: 5ce566b7c229edd8d5a9bdcc40b97a1335d6ae996f5c8e4bcc005755e73fb1a6
Opcode Fuzzy Hash: 5841cf89f262488fb340796dfcb258519ad07b5e5a5a538256f93b31b1f65a1e
Instruction Fuzzy Hash: 8E41B271A0A64692E6D4AF24EC40279B3A0FB44764F834136EE1E633E0EF3EE455C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C97420, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C97444
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9746B
SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C974DF
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C97536
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C97545

Strings

, xrefs: 00007FF7A3C97485, 00007FF7A3C97512

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$Event
String ID:
API String ID: 3803239005-1936338011
Opcode ID: b9bb73136e40f62c9dfb1e13e3cb16093f1d747eed75dafd4a7f0354268e0218
Instruction ID: 56422911cb30caaa9172e2e92143e40310272696f84ebf1d19c19bc64ce792f7
Opcode Fuzzy Hash: b9bb73136e40f62c9dfb1e13e3cb16093f1d747eed75dafd4a7f0354268e0218
Instruction Fuzzy Hash: 2531C531A0AA9696E780AF14EC40179B3A0FB44754F834136E95E637F1EF3EE545CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C8DCE8, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 215COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8DD02
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8DD34
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8E021
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8E030

Strings

Windows.SystemToast.NfpReceiveContent, xrefs: 00007FF7A3C8DE56
, xrefs: 00007FF7A3C8DD50, 00007FF7A3C8DF41, 00007FF7A3C8DFAF

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value
String ID: $Windows.SystemToast.NfpReceiveContent
API String ID: 3702945584-63947683
Opcode ID: c628764bc521e4ad4fd585333f6fcc9b410da1e1af53f40cbd163420f615c68b
Instruction ID: 18397f2666cff3040e13128f498215c74692ea61d6079a00c19de06a99d2f020
Opcode Fuzzy Hash: c628764bc521e4ad4fd585333f6fcc9b410da1e1af53f40cbd163420f615c68b
Instruction Fuzzy Hash: 6BA1AD31A0A74691EA90EF19EC546B9A3A4FF44784F864136D90D637F0EF3EEA45C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C8E900, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 180COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,00000000,?,00000000,00000000,000001DF,?,00007FF7A3C8ED57), ref: 00007FF7A3C8E91D
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,00000000,00000000,000001DF,?,00007FF7A3C8ED57), ref: 00007FF7A3C8E951
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,00000000,00000000,000001DF,?,00007FF7A3C8ED57), ref: 00007FF7A3C8EBAE
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,00000000,00000000,000001DF,?,00007FF7A3C8ED57), ref: 00007FF7A3C8EBBD

Strings

Windows.SystemToast.NfpReceiveContent, xrefs: 00007FF7A3C8EA73
, xrefs: 00007FF7A3C8E96D, 00007FF7A3C8EACE, 00007FF7A3C8EB3C

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value
String ID: $Windows.SystemToast.NfpReceiveContent
API String ID: 3702945584-63947683
Opcode ID: 71f007dd1d0ded7d2df4502372828ca565465e7398e77a63824908f2b1973370
Instruction ID: deecad2fff35baa51affadbe1dda92d872680bb71f369b72cb8f12f564e2676b
Opcode Fuzzy Hash: 71f007dd1d0ded7d2df4502372828ca565465e7398e77a63824908f2b1973370
Instruction Fuzzy Hash: 08819231A0A64691EA90EF29EC402B9B7A4FB44B45FC24135D94E637F1DF3EE649C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C9B860, Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9B87C
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9B8A3
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7A3C9B997
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9BA19
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C9BA28

Strings

, xrefs: 00007FF7A3C9B8BB, 00007FF7A3C9B9EC

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$CloseHandle
String ID:
API String ID: 152943319-1936338011
Opcode ID: 1c6465cfab21e0fe8ea20a411e16ea24eac07f2a2255683c9d25110d6ddf5ec7
Instruction ID: 192f1a84800c8830f1a181bb3d4379d30ccef683b204d48c4ffc95d0c3cebc0d
Opcode Fuzzy Hash: 1c6465cfab21e0fe8ea20a411e16ea24eac07f2a2255683c9d25110d6ddf5ec7
Instruction Fuzzy Hash: 8351A13171AA45A2EA98EF28EC503B8B3A4FB44754F824532EA1D632F1DF7EE455C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CA7CC0, Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA7CEC
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA7D14

Part of subcall function 00007FF7A3CA91E0: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000000,00007FF7A3C81B73), ref: 00007FF7A3CA9204
Part of subcall function 00007FF7A3CA91E0: TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA922B

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA8041
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA8050

Strings

, xrefs: 00007FF7A3CA7D2E, 00007FF7A3CA7D88, 00007FF7A3CA7EE6, 00007FF7A3CA8009

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value
String ID:
API String ID: 3702945584-1936338011
Opcode ID: 70108c712af82ef57059c18aa264673be5295b07316131870ca2e74d43562da3
Instruction ID: aad9abd1c69e209cad9afa86254ddf940da471beec07ee11d0e0c1878e317765
Opcode Fuzzy Hash: 70108c712af82ef57059c18aa264673be5295b07316131870ca2e74d43562da3
Instruction Fuzzy Hash: B7B12532E0A64686EB80EF64EC406B9B7A5FB44784F920931D96DA36F0DF3ED545C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CAFC68, Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CAFC90
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CAFCBA
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CAFEBB
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CAFECA

Strings

, xrefs: 00007FF7A3CAFCD4, 00007FF7A3CAFDE6, 00007FF7A3CAFE76

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value
String ID:
API String ID: 3702945584-1936338011
Opcode ID: f6a52fc4dbee3567a726af0b407443aeb55217c787a953aa9c611a48f0dceea9
Instruction ID: 16cde378d38b6d2f8cf54ca311b33282c08a8d568d02a72dc999534d287d1f88
Opcode Fuzzy Hash: f6a52fc4dbee3567a726af0b407443aeb55217c787a953aa9c611a48f0dceea9
Instruction Fuzzy Hash: 50818432B0AA5685EB84AF29DC502B877A1FB44B84F824536DA1D677F4CF3ED845C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CA9CBC, Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA9CED
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA9D11

Part of subcall function 00007FF7A3CA86E4: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000000,00007FF7A3C81B73), ref: 00007FF7A3CA8709
Part of subcall function 00007FF7A3CA86E4: TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA8730
Part of subcall function 00007FF7A3CA86E4: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA8816
Part of subcall function 00007FF7A3CA86E4: TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA8825

Part of subcall function 00007FF7A3CA89C4: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3CA89E9
Part of subcall function 00007FF7A3CA89C4: TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3CA8A19
Part of subcall function 00007FF7A3CA89C4: memcpy.MSVCRT ref: 00007FF7A3CA8AB1
Part of subcall function 00007FF7A3CA89C4: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3CA8B1B
Part of subcall function 00007FF7A3CA89C4: TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3CA8B2A

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA9EAF
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA9EBE

Strings

, xrefs: 00007FF7A3CA9D2B, 00007FF7A3CA9E80

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$memcpy
String ID:
API String ID: 2338107199-1936338011
Opcode ID: f7419fd5b002d7131d38e07e50fe5b80f9a4880fdb6b7692907f00d261b6d146
Instruction ID: be29d0b3f9d06b13d2f0645aef5216b1b8d31d0ecaf0d0e0b90bc0b89d926b1f
Opcode Fuzzy Hash: f7419fd5b002d7131d38e07e50fe5b80f9a4880fdb6b7692907f00d261b6d146
Instruction Fuzzy Hash: DE610732E0968686EB90EF24DC017B8A7A2EB44344F964831CA5C673F1DF3ED845C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C820B0, Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C820DE
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C82105
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C82206
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C82215

Strings

, xrefs: 00007FF7A3C82122, 00007FF7A3C821D7

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value
String ID:
API String ID: 3702945584-1936338011
Opcode ID: 7e5d44b68058ae2352fc81273941a45d77de32193872018d8d987099de91ded1
Instruction ID: e8eeface4319291ff0ec52aea0d92f99ad325f64586f4c0c31b5d1d08726f071
Opcode Fuzzy Hash: 7e5d44b68058ae2352fc81273941a45d77de32193872018d8d987099de91ded1
Instruction Fuzzy Hash: 3F41C231A0A64682EB84EF14FC40569B3A0FB94781FA14136DE5D637E4EE3EEA468750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CA8CB8, Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3CA8CDD
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3CA8D0D
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3CA8E07
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF7A3C81B73), ref: 00007FF7A3CA8E16

Strings

, xrefs: 00007FF7A3CA8D27, 00007FF7A3CA8D86

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value
String ID:
API String ID: 3702945584-1936338011
Opcode ID: d8caf69249b4c45c80b0450d04d96508be72dd7b31926a155751f3629fbbab40
Instruction ID: c8798d7cc03d03804798ce707c3754e73c0e58b7c785082a6d119c99184d7e7a
Opcode Fuzzy Hash: d8caf69249b4c45c80b0450d04d96508be72dd7b31926a155751f3629fbbab40
Instruction Fuzzy Hash: 5D41D732E0A78297E794EF28E844568B7A1FB48740F864936DA5DA33E0DF3EE545C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CA6060, Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,00007FF7A3C9B115,?,?,?,?,?,00007FF7A3C9AD74), ref: 00007FF7A3CA607C
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,00007FF7A3C9B115,?,?,?,?,?,00007FF7A3C9AD74), ref: 00007FF7A3CA60A3
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,00007FF7A3C9B115,?,?,?,?,?,00007FF7A3C9AD74), ref: 00007FF7A3CA61C4
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,00007FF7A3C9B115,?,?,?,?,?,00007FF7A3C9AD74), ref: 00007FF7A3CA61D3

Strings

, xrefs: 00007FF7A3CA60BD, 00007FF7A3CA619B

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value
String ID:
API String ID: 3702945584-1936338011
Opcode ID: 8369b4f90c76bddd7b1d637da93c4da2549e862c8d249d45348dcd18d869ae7d
Instruction ID: 93e759b843960349536ea4ccbc03f83b5d26776087e9c9d2021064f4af678d4e
Opcode Fuzzy Hash: 8369b4f90c76bddd7b1d637da93c4da2549e862c8d249d45348dcd18d869ae7d
Instruction Fuzzy Hash: 7941A271A0AA4282EB94EF15EC40279A762FB84B80F814936DA5E637F0DF7EE4558310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CA64F0, Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA6511
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA6538
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA6614
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3CA6623

Strings

, xrefs: 00007FF7A3CA6552

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value
String ID:
API String ID: 3702945584-1936338011
Opcode ID: fbc2921cfa7ac41a15cebc00ef6f642a181438a2f5a623b92cbca6a906b4627b
Instruction ID: e139b2301c42af168db567d18ec609019b9214143ec616ceada464953fee625f
Opcode Fuzzy Hash: fbc2921cfa7ac41a15cebc00ef6f642a181438a2f5a623b92cbca6a906b4627b
Instruction Fuzzy Hash: AE41A231A0AA4286EBC4EF15EC40169B3A2FB84744F858936DA5D637F8DF3EE455C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C84100, Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

WindowsIsStringEmpty.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF7A3C84125
WindowsStringHasEmbeddedNull.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF7A3C8413B
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF7A3C84159
RoOriginateError.API-MS-WIN-CORE-WINRT-ERROR-L1-1-0 ref: 00007FF7A3C841D4
RoOriginateErrorW.API-MS-WIN-CORE-WINRT-ERROR-L1-1-0 ref: 00007FF7A3C84213

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: StringWindows$ErrorOriginate$BufferEmbeddedEmptyNull
String ID:
API String ID: 3892016750-0
Opcode ID: bca54d3dea8a9a67dcd70dc72bfdcd0418f68e3e5e53e1e6981be83c6e34180b
Instruction ID: d8671f57656bbba0fb9a1d3cd940a9d1b7fbf9031e799f71a06eb372bcaecd64
Opcode Fuzzy Hash: bca54d3dea8a9a67dcd70dc72bfdcd0418f68e3e5e53e1e6981be83c6e34180b
Instruction Fuzzy Hash: 52310721F0EB4681FB80AF26EC41279E350EF94B85F955131D94E226F4DF3EE5848720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CA40D0, Relevance: 7.5, APIs: 5, Instructions: 44threadtimeCOMMON

Download Yara Rule

APIs

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7A3CA40F2
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7A3CA4101
SetThreadpoolTimer.API-MS-WIN-CORE-THREADPOOL-L1-2-0 ref: 00007FF7A3CA4118
WaitForThreadpoolTimerCallbacks.API-MS-WIN-CORE-THREADPOOL-L1-2-0 ref: 00007FF7A3CA4127
CloseThreadpoolTimer.API-MS-WIN-CORE-THREADPOOL-L1-2-0 ref: 00007FF7A3CA4131

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseThreadpoolTimer$Handle$CallbacksWait
String ID:
API String ID: 2664227504-0
Opcode ID: 5beb8d8f71b2b96b61d615882d76015c807f0ee26b58c59c1a91e751b0bd8f84
Instruction ID: 9b83ec1590e0020345fdeb7c3237c76346cab1a2a796153dd4df49b51c73dfef
Opcode Fuzzy Hash: 5beb8d8f71b2b96b61d615882d76015c807f0ee26b58c59c1a91e751b0bd8f84
Instruction Fuzzy Hash: 0311FB35A0AA4185EB84AF66EC51378A361FF88F44F864431DE1E137A4CF3ED4448620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C888A0, Relevance: 6.3, APIs: 4, Instructions: 258threadCOMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C88914
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C88B75
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C88BC2
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C88C10

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentExclusiveLockReleaseThread
String ID:
API String ID: 2448954584-0
Opcode ID: 1ced69400995fcd4066aa630436d7f9a3b93e8035459f30be660d29bfab17310
Instruction ID: f2be1d7bf067eb3a02bde80b89189e13b340f1aab4c4f8912b7f9daf95b5cd37
Opcode Fuzzy Hash: 1ced69400995fcd4066aa630436d7f9a3b93e8035459f30be660d29bfab17310
Instruction Fuzzy Hash: 1EC1C272A067418AEB90DF25E8803A8B7E4FB48B88F414531DE4E67BA8DF3DD651C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C900D0, Relevance: 6.3, APIs: 4, Instructions: 258threadCOMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C90144
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3C903A5
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C903F2
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C90440

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentExclusiveLockReleaseThread
String ID:
API String ID: 2448954584-0
Opcode ID: 2b46d569fed30fa39dbfc4ec827dfa37264879639c3d2057fdeabd0ebf961179
Instruction ID: 54fe1b5fb791e1ef329cbec0a09fd5b154d90e0fa7886d0715fd1e676fceba89
Opcode Fuzzy Hash: 2b46d569fed30fa39dbfc4ec827dfa37264879639c3d2057fdeabd0ebf961179
Instruction Fuzzy Hash: BDC1D372A06B519AEB94DF64D88036CB7A0FB48B84F424135EE4E67BA8EF3DD451C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CB0510, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF7A3CB0A03
RtlLookupFunctionEntry.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF7A3CB0A22
RtlVirtualUnwind.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF7A3CB0A6F
__raise_securityfailure.LIBCMT ref: 00007FF7A3CB0B54

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 347e5ab18e918e074d91e98b3ad16368384c27b2eb990138dcaaa81dc8fbeeb4
Instruction ID: fbc02213a0e70afd64e284994fce0b2c20bcfae4e1dbb25d4d7f76d37ff53499
Opcode Fuzzy Hash: 347e5ab18e918e074d91e98b3ad16368384c27b2eb990138dcaaa81dc8fbeeb4
Instruction Fuzzy Hash: 4F41C635A0AB0295EA94AF48FC80365B3A8FB88744FD18136D98D937B4DF3EE444C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CAB080, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A3CAB8A0: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7A3CAB0BF), ref: 00007FF7A3CAB8C8
Part of subcall function 00007FF7A3CAB8A0: SendMessageW.USER32 ref: 00007FF7A3CAB8E5

DeleteCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3CAB108
DeleteCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3CAB112
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7A3CAB12B
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7A3CAB144

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$CloseDeleteHandle$EnterMessageSend
String ID:
API String ID: 3127453214-0
Opcode ID: d5f88ff780cbd63d8155a17fdf2b72534ca5c33751aba5632424c39a779365e4
Instruction ID: 5c72aad912412cb801664486d89bf0f9de0ad37331747f52770ffcffec0a840a
Opcode Fuzzy Hash: d5f88ff780cbd63d8155a17fdf2b72534ca5c33751aba5632424c39a779365e4
Instruction Fuzzy Hash: 4F214D22A16B4596EB80AF24D840368B365FB48F68F960631CA2E163F5DF3ED484C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3CA4460, Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

CreateEventExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7A3CA447A
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3CA448E
GetModuleHandleExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7A3CA44BB
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7A3CA44C9

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$CreateEventHandleModule
String ID:
API String ID: 496228703-0
Opcode ID: c55e92bfb265ed5a82e179ab8b69d461bd70d285cc822bd0ec173bb7836fec48
Instruction ID: 8d0340de7e2f8f642f1bf0d29993f96becf720fd4a7d634cbbe3d258fa6d8500
Opcode Fuzzy Hash: c55e92bfb265ed5a82e179ab8b69d461bd70d285cc822bd0ec173bb7836fec48
Instruction Fuzzy Hash: D9019E25B1AB1292FB8C6F366C2237961D1BF04B40F81403DDE4FA22E0DE2DD8018260

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C8C490, Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF7A3C8C4AA
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C8C4D6
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7A3C8C4E4
RoUninitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF7A3C8C50C

Part of subcall function 00007FF7A3C8C118: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8C15E
Part of subcall function 00007FF7A3C8C118: TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7A3C8C187
Part of subcall function 00007FF7A3C8C118: memset.MSVCRT ref: 00007FF7A3C8C25F

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeTaskValue$InitializeUninitializememset
String ID:
API String ID: 1107711376-0
Opcode ID: 290dbffbab07f6efec06907b4db0ab4684335176457b1e42d73188ac7598dc7a
Instruction ID: d80d1839a225bba6f6d51834b33880347a2d812ebf9d17603bbaae31cea804c5
Opcode Fuzzy Hash: 290dbffbab07f6efec06907b4db0ab4684335176457b1e42d73188ac7598dc7a
Instruction Fuzzy Hash: 1C11243260AB4192EB84AF56ED40139E370FB48B95B854436DF5E57BA4CF3AE5A08310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C90C64, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55windowCOMMON

Download Yara Rule

APIs

TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0(?,?,?,?,?,?,?,00007FF7A3C92816), ref: 00007FF7A3C90D3C

Strings

NULL, xrefs: 00007FF7A3C90CCF
NULL, xrefs: 00007FF7A3C90CB9

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageTrace
String ID: NULL$NULL
API String ID: 471583391-284533664
Opcode ID: f65522f7de372578c7a4a2108b50f008a3617cc91ac2a063796c7c46309fc626
Instruction ID: 569548d18ef56c7d6cf172197a6f6d369c3dc8a51687a3f0c94daf3dbbf7cc6c
Opcode Fuzzy Hash: f65522f7de372578c7a4a2108b50f008a3617cc91ac2a063796c7c46309fc626
Instruction Fuzzy Hash: 6521C571A0AB84D1EAA09F40F840769F3A9FB40790F924234EAD9127E8DF3DD554C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C950D0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF7A3C951A7

Strings

NULL, xrefs: 00007FF7A3C95141
NULL, xrefs: 00007FF7A3C95123

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageTrace
String ID: NULL$NULL
API String ID: 471583391-284533664
Opcode ID: 1e36a4d045becf595b3c79320cb6fb6fbaea7ad9afb828ee2a63042ac890ecd5
Instruction ID: 440b4ff9da9195d18e1281b2aa34bd72fc778a3d7bb88524188e4d9488f6e0b0
Opcode Fuzzy Hash: 1e36a4d045becf595b3c79320cb6fb6fbaea7ad9afb828ee2a63042ac890ecd5
Instruction Fuzzy Hash: 5D218E71A1AB85C1EAA0DF04F840769B3A4FB44790F924234EA9D127E8EF3ED558C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C81470, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON

Download Yara Rule

APIs

TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF7A3C81522

Strings

NULL, xrefs: 00007FF7A3C814D7
NULL, xrefs: 00007FF7A3C814CD

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageTrace
String ID: NULL$NULL
API String ID: 471583391-284533664
Opcode ID: b643bd57be811406dcaf4a0a2d1f24dee255636b4303a28fe92609935564f9c5
Instruction ID: 34ffef651539be0ad11e6b3e760caeda3bb30db10cf2a222f21df1919bb26680
Opcode Fuzzy Hash: b643bd57be811406dcaf4a0a2d1f24dee255636b4303a28fe92609935564f9c5
Instruction Fuzzy Hash: C511D632A0DB5481EAA1DF10F80026AB6E5FB907E1F924234EADD53BE8CF3DC5518750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A3C8D504, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF7A3C8D5B1

Strings

NULL, xrefs: 00007FF7A3C8D579
NULL, xrefs: 00007FF7A3C8D55C

Memory Dump Source

Source File: 00000016.00000002.404935838.00007FF7A3C81000.00000020.00020000.sdmp, Offset: 00007FF7A3C80000, based on PE: true

Associated: 00000016.00000002.404912678.00007FF7A3C80000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405012990.00007FF7A3CB2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.405333316.00007FF7A3CBC000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.405464373.00007FF7A3CBD000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageTrace
String ID: NULL$NULL
API String ID: 471583391-284533664
Opcode ID: 7afd4331b5991afe08c26723c7086f11d6c90b49d24f2d93666624c90201fab9
Instruction ID: 92097591401a30a7f131fab150cb97a15f1eff0d2834e3221b95cb651b4f265b
Opcode Fuzzy Hash: 7afd4331b5991afe08c26723c7086f11d6c90b49d24f2d93666624c90201fab9
Instruction Fuzzy Hash: 8F1104A2A0EB4481EA61EF44F804766E3E0FB94795F924235EA9D037E4DF3DC9408700

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 1zdJLxxTnh

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back