Play interactive tour

Edit tour

Windows Analysis Report CiEceGPoOR

Overview

General Information

Sample Name:	CiEceGPoOR (renamed file extension from none to dll)
Analysis ID:	492860
MD5:	2ab698a4e7608708ae2a693966194322
SHA1:	300f4d7d2f462dac7e6ab333d8783bab4f371316
SHA256:	3e814c52ab51985ebaf91bff6baeb9eab08c85529bf09f4a069803a4ee984572
Tags:	Dridexexe
Infos:
Most interesting Screenshot:

Detection

Dridex

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Dridex unpacked file

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Changes memory attributes in foreign processes to executable or writable

Machine Learning detection for sample

Queues an APC in another process (thread injection)

Machine Learning detection for dropped file

Windows Update Standalone Installer command line found (may be used to bypass UAC)

Contains functionality to prevent local Windows debugging

Uses Atom Bombing / ProGate to inject into other processes

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Queries the installation date of Windows

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to launch a process as a different user

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains functionality for execution timing, often used to detect debuggers

Drops files with a non-matching file extension (content does not match file extension)

PE file contains an invalid checksum

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Binary contains a suspicious time stamp

PE file contains more sections than normal

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 4956 cmdline: loaddll64.exe 'C:\Users\user\Desktop\CiEceGPoOR.dll' MD5: E0CC9D126C39A9D2FA1CAD5027EBBD18)

cmd.exe (PID: 4916 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\CiEceGPoOR.dll',#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 4756 cmdline: rundll32.exe 'C:\Users\user\Desktop\CiEceGPoOR.dll',#1 MD5: 73C519F050C20580F8A62C849D49215A)

explorer.exe (PID: 3472 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

BdeUISrv.exe (PID: 7060 cmdline: C:\Windows\system32\BdeUISrv.exe MD5: 25D86BC656025F38D6E626B606F1D39D)

BdeUISrv.exe (PID: 7076 cmdline: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe MD5: 25D86BC656025F38D6E626B606F1D39D)

WMPDMC.exe (PID: 496 cmdline: C:\Windows\system32\WMPDMC.exe MD5: 4085FDA375E50214142BD740559F5835)

WMPDMC.exe (PID: 476 cmdline: C:\Users\user\AppData\Local\WMp\WMPDMC.exe MD5: 4085FDA375E50214142BD740559F5835)

LockScreenContentServer.exe (PID: 3620 cmdline: C:\Windows\system32\LockScreenContentServer.exe MD5: 45E51238434FAF543D66E17EF3783413)

LockScreenContentServer.exe (PID: 5012 cmdline: C:\Users\user\AppData\Local\ukxAYmxLA\LockScreenContentServer.exe MD5: 45E51238434FAF543D66E17EF3783413)

mspaint.exe (PID: 6932 cmdline: C:\Windows\system32\mspaint.exe MD5: 99F86A0D360FD9A3FCAD6B1E7D92A90C)

mspaint.exe (PID: 6940 cmdline: C:\Users\user\AppData\Local\vbVu\mspaint.exe MD5: 99F86A0D360FD9A3FCAD6B1E7D92A90C)

SystemPropertiesRemote.exe (PID: 5680 cmdline: C:\Windows\system32\SystemPropertiesRemote.exe MD5: 70E55B55A17F1D1C4047CC678EB936F0)

SystemPropertiesRemote.exe (PID: 5868 cmdline: C:\Users\user\AppData\Local\pjo7Mc7lI\SystemPropertiesRemote.exe MD5: 70E55B55A17F1D1C4047CC678EB936F0)

AgentService.exe (PID: 6040 cmdline: C:\Windows\system32\AgentService.exe MD5: F7E36C20DB953DFF4FDDB817904C0E48)

AgentService.exe (PID: 6064 cmdline: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe MD5: F7E36C20DB953DFF4FDDB817904C0E48)

wusa.exe (PID: 4368 cmdline: C:\Windows\system32\wusa.exe MD5: 04CE745559916B99248F266BBF5F9ED9)

wusa.exe (PID: 4720 cmdline: C:\Users\user\AppData\Local\igQ\wusa.exe MD5: 04CE745559916B99248F266BBF5F9ED9)

rundll32.exe (PID: 3228 cmdline: rundll32.exe C:\Users\user\Desktop\CiEceGPoOR.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 2964 cmdline: rundll32.exe C:\Users\user\Desktop\CiEceGPoOR.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5228 cmdline: rundll32.exe C:\Users\user\Desktop\CiEceGPoOR.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ MD5: 73C519F050C20580F8A62C849D49215A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.339185192.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000027.00000002.541829732.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000020.00000002.455241434.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000023.00000002.481917685.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000001C.00000002.424243110.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000025.00000002.514511264.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000016.00000002.369765886.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000003.00000002.253536981.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000007.00000002.260833878.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000018.00000002.396379510.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000000A.00000002.268716589.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
Click to see the 7 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: CiEceGPoOR.dll	Metadefender: Detection: 57%			Perma Link
Source: CiEceGPoOR.dll	ReversingLabs: Detection: 80%

Antivirus / Scanner detection for submitted sample

Show sources

Source: CiEceGPoOR.dll

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\f49B\WTSAPI32.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\ukxAYmxLA\dwmapi.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\DwpdI\SYSDM.CPL	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\qGdjcQqe\WINBRAND.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\Z7wAQ0\VERSION.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\DwpdI\SYSDM.CPL	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\uHKs6l\WINMM.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\f49B\WTSAPI32.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\WMp\OLEACC.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\uHKs6l\WINMM.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen

Machine Learning detection for sample

Show sources

Source: CiEceGPoOR.dll

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\f49B\WTSAPI32.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\ukxAYmxLA\dwmapi.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\DwpdI\SYSDM.CPL	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\qGdjcQqe\WINBRAND.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Z7wAQ0\VERSION.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\DwpdI\SYSDM.CPL	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\uHKs6l\WINMM.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\f49B\WTSAPI32.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\WMp\OLEACC.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\uHKs6l\WINMM.dll	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\igQ\wusa.exe

Code function: 39_2_00007FF778CA8780 memset,LocalFree,CryptAcquireContextW,GetLastError,CryptGenRandom,GetLastError,memset,CreateDirectoryA,GetLastError,GetFileAttributesA,GetLastError,DecryptFileA,GetLastError,MultiByteToWideChar,GetLastError,CryptReleaseContext,LocalFree,

39_2_00007FF778CA8780

Source: CiEceGPoOR.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: wusa.pdbGCTL source: wusa.exe, 00000027.00000000.519872524.00007FF778CB7000.00000002.00020000.sdmp
Source:	Binary string: wusa.pdb source: wusa.exe, 00000027.00000000.519872524.00007FF778CB7000.00000002.00020000.sdmp
Source:	Binary string: mspaint.pdb source: mspaint.exe, 00000020.00000002.457507049.00007FF67B198000.00000002.00020000.sdmp
Source:	Binary string: mspaint.pdbGCTL source: mspaint.exe, 00000020.00000002.457507049.00007FF67B198000.00000002.00020000.sdmp
Source:	Binary string: SystemPropertiesRemote.pdb source: SystemPropertiesRemote.exe, 00000023.00000000.460233798.00007FF7376B2000.00000002.00020000.sdmp
Source:	Binary string: BdeUISrv.pdb source: BdeUISrv.exe, 00000016.00000000.347271013.00007FF7CAA69000.00000002.00020000.sdmp
Source:	Binary string: SystemPropertiesRemote.pdbGCTL source: SystemPropertiesRemote.exe, 00000023.00000000.460233798.00007FF7376B2000.00000002.00020000.sdmp
Source:	Binary string: BdeUISrv.pdbGCTL source: BdeUISrv.exe, 00000016.00000000.347271013.00007FF7CAA69000.00000002.00020000.sdmp
Source:	Binary string: LockScreenContentServer.pdbGCTL source: LockScreenContentServer.exe, 0000001C.00000002.425932053.00007FF755D05000.00000002.00020000.sdmp
Source:	Binary string: WMPDMC.pdbGCTL source: WMPDMC.exe, 00000018.00000000.374547106.00007FF71E3ED000.00000002.00020000.sdmp
Source:	Binary string: AgentService.pdbGCTL source: AgentService.exe, 00000025.00000002.516817162.00007FF7A3521000.00000002.00020000.sdmp
Source:	Binary string: AgentService.pdb source: AgentService.exe, 00000025.00000002.516817162.00007FF7A3521000.00000002.00020000.sdmp
Source:	Binary string: WMPDMC.pdb source: WMPDMC.exe, 00000018.00000000.374547106.00007FF71E3ED000.00000002.00020000.sdmp
Source:	Binary string: LockScreenContentServer.pdb source: LockScreenContentServer.exe, 0000001C.00000002.425932053.00007FF755D05000.00000002.00020000.sdmp

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005D290 FindFirstFileExW,	0_2_000000014005D290
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A3499110 ??3@YAXPEAX@Z,??3@YAXPEAX@Z,std::bad_exception::bad_exception,_CxxThrowException,FindFirstFileW,GetLastError,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,FindNextFileW,GetLastError,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,std::bad_exception::bad_exception,_CxxThrowException,std::bad_exception::bad_exception,_CxxThrowException,	37_2_00007FF7A3499110
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: 39_2_00007FF778CA1BC0 memset,memset,CoInitializeEx,FindFirstFileW,GetLastError,lstrcmpiW,FindNextFileW,GetLastError,GetCommandLineW,EventWrite,FindClose,CoUninitialize,LocalFree,	39_2_00007FF778CA1BC0
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: 39_2_00007FF778CA8D04 memset,memset,memset,FindFirstFileW,GetLastError,lstrcmpW,lstrcmpW,DeleteFileW,GetLastError,MoveFileExW,GetLastError,FindNextFileW,GetLastError,FindClose,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,GetLastError,LocalFree,	39_2_00007FF778CA8D04

Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe

Code function: 24_2_00007FF71E332AE8 GetDC,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,GetObjectW,GdiplusStartup,GdipAlloc,GdipCreateBitmapFromHBITMAP,GdipGetImageWidth,GdipGetImageHeight,GdipCreateHBITMAPFromBitmap,GdiplusShutdown,DeleteObject,DeleteDC,ReleaseDC,

24_2_00007FF71E332AE8

E-Banking Fraud:

Yara detected Dridex unpacked file

Show sources

Source: Yara match	File source: 00000002.00000002.339185192.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.541829732.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.455241434.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.481917685.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.424243110.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.514511264.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.369765886.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.253536981.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.260833878.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.396379510.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.268716589.0000000140001000.00000020.00020000.sdmp, type: MEMORY

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140034870	0_2_0000000140034870
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140035270	0_2_0000000140035270
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140048AC0	0_2_0000000140048AC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005C340	0_2_000000014005C340
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140065B80	0_2_0000000140065B80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006A4B0	0_2_000000014006A4B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400524B0	0_2_00000001400524B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140026CC0	0_2_0000000140026CC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014004BD40	0_2_000000014004BD40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400495B0	0_2_00000001400495B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140036F30	0_2_0000000140036F30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140069010	0_2_0000000140069010
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140001010	0_2_0000000140001010
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140066020	0_2_0000000140066020
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002F840	0_2_000000014002F840
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005D850	0_2_000000014005D850
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140064080	0_2_0000000140064080
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140010880	0_2_0000000140010880
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400688A0	0_2_00000001400688A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002D0D0	0_2_000000014002D0D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400018D0	0_2_00000001400018D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140016100	0_2_0000000140016100
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014001D100	0_2_000000014001D100
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002A110	0_2_000000014002A110
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014001D910	0_2_000000014001D910
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140015120	0_2_0000000140015120
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000B120	0_2_000000014000B120
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014004F940	0_2_000000014004F940
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140039140	0_2_0000000140039140
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140023140	0_2_0000000140023140
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140057950	0_2_0000000140057950
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014001E170	0_2_000000014001E170
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140002980	0_2_0000000140002980
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400611A0	0_2_00000001400611A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400389A0	0_2_00000001400389A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400381A0	0_2_00000001400381A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002E1B0	0_2_000000014002E1B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400139D0	0_2_00000001400139D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400319F0	0_2_00000001400319F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002EA00	0_2_000000014002EA00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022A00	0_2_0000000140022A00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003B220	0_2_000000014003B220
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140067A40	0_2_0000000140067A40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140069A50	0_2_0000000140069A50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140007A60	0_2_0000000140007A60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003AAC0	0_2_000000014003AAC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003A2E0	0_2_000000014003A2E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140062B00	0_2_0000000140062B00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140018300	0_2_0000000140018300
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002FB20	0_2_000000014002FB20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140031340	0_2_0000000140031340
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022340	0_2_0000000140022340
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140017B40	0_2_0000000140017B40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000BB40	0_2_000000014000BB40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014004EB60	0_2_000000014004EB60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140005370	0_2_0000000140005370
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002CB80	0_2_000000014002CB80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B390	0_2_000000014006B390
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140054BA0	0_2_0000000140054BA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140033BB0	0_2_0000000140033BB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400263C0	0_2_00000001400263C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400123C0	0_2_00000001400123C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140063BD0	0_2_0000000140063BD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400663F0	0_2_00000001400663F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140023BF0	0_2_0000000140023BF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B41B	0_2_000000014006B41B
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B424	0_2_000000014006B424
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B42D	0_2_000000014006B42D
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B436	0_2_000000014006B436
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B43D	0_2_000000014006B43D
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140024440	0_2_0000000140024440
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140005C40	0_2_0000000140005C40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B446	0_2_000000014006B446
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005F490	0_2_000000014005F490
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022D00	0_2_0000000140022D00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140035520	0_2_0000000140035520
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140019D20	0_2_0000000140019D20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140030530	0_2_0000000140030530
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140023530	0_2_0000000140023530
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140031540	0_2_0000000140031540
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140033540	0_2_0000000140033540
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014007BD50	0_2_000000014007BD50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140078570	0_2_0000000140078570
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140019580	0_2_0000000140019580
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400205A0	0_2_00000001400205A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140025DB0	0_2_0000000140025DB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140071DC0	0_2_0000000140071DC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000C5C0	0_2_000000014000C5C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002DDE0	0_2_000000014002DDE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140031DF0	0_2_0000000140031DF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000DDF0	0_2_000000014000DDF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140001620	0_2_0000000140001620
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140018630	0_2_0000000140018630
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140032650	0_2_0000000140032650
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140064E80	0_2_0000000140064E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140016E80	0_2_0000000140016E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140007EA0	0_2_0000000140007EA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400286B0	0_2_00000001400286B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140006EB0	0_2_0000000140006EB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400276C0	0_2_00000001400276C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002FEC0	0_2_000000014002FEC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002EED0	0_2_000000014002EED0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002B6E0	0_2_000000014002B6E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140053F20	0_2_0000000140053F20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022730	0_2_0000000140022730
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140029780	0_2_0000000140029780
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140018F80	0_2_0000000140018F80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003EFB0	0_2_000000014003EFB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400067B0	0_2_00000001400067B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400667D0	0_2_00000001400667D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140060FE0	0_2_0000000140060FE0
Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe	Code function: 22_2_00007FF7CAA638D0	22_2_00007FF7CAA638D0
Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe	Code function: 22_2_00007FF7CAA62A9C	22_2_00007FF7CAA62A9C
Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe	Code function: 22_2_00007FF7CAA64500	22_2_00007FF7CAA64500
Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe	Code function: 22_2_00007FF7CAA62134	22_2_00007FF7CAA62134
Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe	Code function: 22_2_00007FF7CAA64D78	22_2_00007FF7CAA64D78
Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe	Code function: 22_2_00007FF7CAA63F74	22_2_00007FF7CAA63F74
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E36BFB8	24_2_00007FF71E36BFB8
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3B9FC8	24_2_00007FF71E3B9FC8
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3D6020	24_2_00007FF71E3D6020
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3A003C	24_2_00007FF71E3A003C
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E36A0E0	24_2_00007FF71E36A0E0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E31E0FC	24_2_00007FF71E31E0FC
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3720B4	24_2_00007FF71E3720B4
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E36FD30	24_2_00007FF71E36FD30
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E38DE58	24_2_00007FF71E38DE58
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3BFE18	24_2_00007FF71E3BFE18
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3C5E48	24_2_00007FF71E3C5E48
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3D1EA0	24_2_00007FF71E3D1EA0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E35BB7C	24_2_00007FF71E35BB7C
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E317B78	24_2_00007FF71E317B78
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3E5BB8	24_2_00007FF71E3E5BB8
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E367BC0	24_2_00007FF71E367BC0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E34DC68	24_2_00007FF71E34DC68
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E39FC30	24_2_00007FF71E39FC30
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E365CD8	24_2_00007FF71E365CD8
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3B1D00	24_2_00007FF71E3B1D00
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E325930	24_2_00007FF71E325930
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3CD9F4	24_2_00007FF71E3CD9F4
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3699A0	24_2_00007FF71E3699A0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3CBA68	24_2_00007FF71E3CBA68
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3B5A78	24_2_00007FF71E3B5A78
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3D5A90	24_2_00007FF71E3D5A90
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E321AF0	24_2_00007FF71E321AF0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E385AFC	24_2_00007FF71E385AFC
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E341A98	24_2_00007FF71E341A98
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3D175C	24_2_00007FF71E3D175C
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E33976C	24_2_00007FF71E33976C
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3BB78C	24_2_00007FF71E3BB78C
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E37171C	24_2_00007FF71E37171C
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E35773C	24_2_00007FF71E35773C
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3B57D8	24_2_00007FF71E3B57D8
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3DD7D0	24_2_00007FF71E3DD7D0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E39D820	24_2_00007FF71E39D820
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E353910	24_2_00007FF71E353910
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E359590	24_2_00007FF71E359590
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E37D5F4	24_2_00007FF71E37D5F4
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E36B610	24_2_00007FF71E36B610
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E31F35C	24_2_00007FF71E31F35C
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E35731C	24_2_00007FF71E35731C
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E351320	24_2_00007FF71E351320
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E35D310	24_2_00007FF71E35D310
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3C33A0	24_2_00007FF71E3C33A0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E39D490	24_2_00007FF71E39D490
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3CD4D8	24_2_00007FF71E3CD4D8
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E393510	24_2_00007FF71E393510
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3C94B4	24_2_00007FF71E3C94B4
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3654BC	24_2_00007FF71E3654BC
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3374B8	24_2_00007FF71E3374B8
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E39F18C	24_2_00007FF71E39F18C
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E39B140	24_2_00007FF71E39B140
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3E31F0	24_2_00007FF71E3E31F0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3D11B4	24_2_00007FF71E3D11B4
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E314E60	24_2_00007FF71E314E60
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E37D1C0	24_2_00007FF71E37D1C0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E33D2F8	24_2_00007FF71E33D2F8
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3C52C0	24_2_00007FF71E3C52C0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3232CC	24_2_00007FF71E3232CC
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E344F80	24_2_00007FF71E344F80
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E350F54	24_2_00007FF71E350F54
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3A7000	24_2_00007FF71E3A7000
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E384FFC	24_2_00007FF71E384FFC
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3B8FA0	24_2_00007FF71E3B8FA0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E33D034	24_2_00007FF71E33D034
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E37504C	24_2_00007FF71E37504C
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3AAD78	24_2_00007FF71E3AAD78
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E384D18	24_2_00007FF71E384D18
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E39CD50	24_2_00007FF71E39CD50
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E340D50	24_2_00007FF71E340D50
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3D0E08	24_2_00007FF71E3D0E08
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3B2E28	24_2_00007FF71E3B2E28
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3ACE54	24_2_00007FF71E3ACE54
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E32AB3C	24_2_00007FF71E32AB3C
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E33AB44	24_2_00007FF71E33AB44
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E37CBE8	24_2_00007FF71E37CBE8
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E39AC70	24_2_00007FF71E39AC70
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E366940	24_2_00007FF71E366940
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E358A0C	24_2_00007FF71E358A0C
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3BA9D0	24_2_00007FF71E3BA9D0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E322A84	24_2_00007FF71E322A84
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E364A8C	24_2_00007FF71E364A8C
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E354784	24_2_00007FF71E354784
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E39C72C	24_2_00007FF71E39C72C
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3A4810	24_2_00007FF71E3A4810
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E36A880	24_2_00007FF71E36A880
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3B8900	24_2_00007FF71E3B8900
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E390570	24_2_00007FF71E390570
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E380544	24_2_00007FF71E380544
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E346690	24_2_00007FF71E346690
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3A06B0	24_2_00007FF71E3A06B0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E35C6D0	24_2_00007FF71E35C6D0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3B8318	24_2_00007FF71E3B8318
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E39C330	24_2_00007FF71E39C330
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3A2330	24_2_00007FF71E3A2330
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E36A340	24_2_00007FF71E36A340
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3AC3F0	24_2_00007FF71E3AC3F0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E32A3F0	24_2_00007FF71E32A3F0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3663C8	24_2_00007FF71E3663C8
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3DC464	24_2_00007FF71E3DC464
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3A6428	24_2_00007FF71E3A6428
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3184E8	24_2_00007FF71E3184E8
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E32C4F4	24_2_00007FF71E32C4F4
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E38E510	24_2_00007FF71E38E510
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E352498	24_2_00007FF71E352498
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E368180	24_2_00007FF71E368180
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3D011C	24_2_00007FF71E3D011C
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E33A1BC	24_2_00007FF71E33A1BC
Source: C:\Users\user\AppData\Local\ukxAYmxLA\LockScreenContentServer.exe	Code function: 28_2_00007FF755D032B8	28_2_00007FF755D032B8
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34EA450	37_2_00007FF7A34EA450
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A347E444	37_2_00007FF7A347E444
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34654E0	37_2_00007FF7A34654E0
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A3498500	37_2_00007FF7A3498500
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34704AC	37_2_00007FF7A34704AC
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34B0498	37_2_00007FF7A34B0498
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34964D0	37_2_00007FF7A34964D0
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34CC278	37_2_00007FF7A34CC278
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34B6158	37_2_00007FF7A34B6158
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34B115E	37_2_00007FF7A34B115E
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34AB12C	37_2_00007FF7A34AB12C
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34FE834	37_2_00007FF7A34FE834
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34A96D8	37_2_00007FF7A34A96D8
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34CD6FC	37_2_00007FF7A34CD6FC
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A347858C	37_2_00007FF7A347858C
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A3497580	37_2_00007FF7A3497580
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A347CC30	37_2_00007FF7A347CC30
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34EACE8	37_2_00007FF7A34EACE8
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34FDBA4	37_2_00007FF7A34FDBA4
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34AA974	37_2_00007FF7A34AA974
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34A29F4	37_2_00007FF7A34A29F4
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34F29E0	37_2_00007FF7A34F29E0
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A346E0F4	37_2_00007FF7A346E0F4
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A3499110	37_2_00007FF7A3499110
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34EA014	37_2_00007FF7A34EA014
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34CEE7C	37_2_00007FF7A34CEE7C
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34A1E34	37_2_00007FF7A34A1E34
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A3508F04	37_2_00007FF7A3508F04
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A3484EF0	37_2_00007FF7A3484EF0
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A347BEE4	37_2_00007FF7A347BEE4
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: 39_2_00007FF778CA1BC0	39_2_00007FF778CA1BC0
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: 39_2_00007FF778CA3D88	39_2_00007FF778CA3D88
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: 39_2_00007FF778CA5EA4	39_2_00007FF778CA5EA4
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: 39_2_00007FF778CAA0FC	39_2_00007FF778CAA0FC
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: 39_2_00007FF778CA23F0	39_2_00007FF778CA23F0
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: 39_2_00007FF778CA356C	39_2_00007FF778CA356C
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: 39_2_00007FF778CA8780	39_2_00007FF778CA8780
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: 39_2_00007FF778CA9910	39_2_00007FF778CA9910

Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: String function: 00007FF71E313240 appears 42 times
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: String function: 00007FF778CA9520 appears 162 times
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: String function: 00007FF7A3463F1C appears 39 times
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: String function: 00007FF7A3465BC4 appears 55 times
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: String function: 00007FF7A34A5CE8 appears 64 times
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: String function: 00007FF7A34659E0 appears 153 times

Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe

Code function: 37_2_00007FF7A34693A8 memset,CreateProcessAsUserW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,swprintf_s,??_V@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,

37_2_00007FF7A34693A8

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140046C90 NtClose,	0_2_0000000140046C90
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006A4B0 NtQuerySystemInformation,	0_2_000000014006A4B0
Source: C:\Users\user\AppData\Local\ukxAYmxLA\LockScreenContentServer.exe	Code function: 28_2_00007FF755D03D00 NtQuerySystemInformation,	28_2_00007FF755D03D00

Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe

Code function: 37_2_00007FF7A34E6CB0: DeviceIoControl,??_V@YAXPEAX@Z,CloseHandle,

37_2_00007FF7A34E6CB0

Source: WMPDMC.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WMPDMC.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WMPDMC.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WMPDMC.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WMPDMC.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WMPDMC.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WMPDMC.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WMPDMC.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WMPDMC.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesRemote.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesRemote.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesRemote.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wusa.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wusa.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wusa.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: pwcreator.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: pwcreator.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Narrator.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Narrator.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Narrator.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesRemote.exe0.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesRemote.exe0.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesRemote.exe0.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe

Section loaded: capabilityaccessmanagerclient.dll

Jump to behavior

Source: SYSDM.CPL0.4.dr	Static PE information: Number of sections : 55 > 10
Source: dwmapi.dll.4.dr	Static PE information: Number of sections : 55 > 10
Source: WTSAPI32.dll.4.dr	Static PE information: Number of sections : 55 > 10
Source: SYSDM.CPL.4.dr	Static PE information: Number of sections : 55 > 10
Source: WINMM.dll.4.dr	Static PE information: Number of sections : 55 > 10
Source: WINMM.dll0.4.dr	Static PE information: Number of sections : 55 > 10
Source: CiEceGPoOR.dll	Static PE information: Number of sections : 54 > 10
Source: WINBRAND.dll.4.dr	Static PE information: Number of sections : 55 > 10
Source: OLEACC.dll.4.dr	Static PE information: Number of sections : 55 > 10
Source: VERSION.dll.4.dr	Static PE information: Number of sections : 55 > 10
Source: WTSAPI32.dll0.4.dr	Static PE information: Number of sections : 55 > 10

Source: CiEceGPoOR.dll	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WTSAPI32.dll.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: OLEACC.dll.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dwmapi.dll.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WINMM.dll.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SYSDM.CPL.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: VERSION.dll.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WTSAPI32.dll0.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WINBRAND.dll.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WINMM.dll0.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SYSDM.CPL0.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: CiEceGPoOR.dll	Metadefender: Detection: 57%
Source: CiEceGPoOR.dll	ReversingLabs: Detection: 80%

Source: CiEceGPoOR.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe 'C:\Users\user\Desktop\CiEceGPoOR.dll'
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\CiEceGPoOR.dll',#1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CiEceGPoOR.dll',#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\CiEceGPoOR.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\CiEceGPoOR.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\CiEceGPoOR.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\BdeUISrv.exe C:\Windows\system32\BdeUISrv.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe C:\Users\user\AppData\Local\f49B\BdeUISrv.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\WMPDMC.exe C:\Windows\system32\WMPDMC.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\WMp\WMPDMC.exe C:\Users\user\AppData\Local\WMp\WMPDMC.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\LockScreenContentServer.exe C:\Windows\system32\LockScreenContentServer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\ukxAYmxLA\LockScreenContentServer.exe C:\Users\user\AppData\Local\ukxAYmxLA\LockScreenContentServer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\mspaint.exe C:\Windows\system32\mspaint.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\vbVu\mspaint.exe C:\Users\user\AppData\Local\vbVu\mspaint.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SystemPropertiesRemote.exe C:\Windows\system32\SystemPropertiesRemote.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\pjo7Mc7lI\SystemPropertiesRemote.exe C:\Users\user\AppData\Local\pjo7Mc7lI\SystemPropertiesRemote.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\AgentService.exe C:\Windows\system32\AgentService.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wusa.exe C:\Windows\system32\wusa.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\igQ\wusa.exe C:\Users\user\AppData\Local\igQ\wusa.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\CiEceGPoOR.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\CiEceGPoOR.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\CiEceGPoOR.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\CiEceGPoOR.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CiEceGPoOR.dll',#1	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\BdeUISrv.exe C:\Windows\system32\BdeUISrv.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe C:\Users\user\AppData\Local\f49B\BdeUISrv.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\WMPDMC.exe C:\Windows\system32\WMPDMC.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\WMp\WMPDMC.exe C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\LockScreenContentServer.exe C:\Windows\system32\LockScreenContentServer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\ukxAYmxLA\LockScreenContentServer.exe C:\Users\user\AppData\Local\ukxAYmxLA\LockScreenContentServer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\mspaint.exe C:\Windows\system32\mspaint.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\vbVu\mspaint.exe C:\Users\user\AppData\Local\vbVu\mspaint.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SystemPropertiesRemote.exe C:\Windows\system32\SystemPropertiesRemote.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\pjo7Mc7lI\SystemPropertiesRemote.exe C:\Users\user\AppData\Local\pjo7Mc7lI\SystemPropertiesRemote.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\AgentService.exe C:\Windows\system32\AgentService.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wusa.exe C:\Windows\system32\wusa.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\igQ\wusa.exe C:\Users\user\AppData\Local\igQ\wusa.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A347943C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,GetLastError,CloseHandle,GetLastError,		37_2_00007FF7A347943C
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: 39_2_00007FF778CA5438 LookupPrivilegeValueW,GetLastError,GetCurrentProcess,OpenProcessToken,GetLastError,AdjustTokenPrivileges,GetLastError,GetLastError,CloseHandle,LocalFree,		39_2_00007FF778CA5438

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@46/21@0/0

Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe

Code function: 22_2_00007FF7CAA638D0 CoCreateInstance,StringFromGUID2,wcscpy_s,wcscat_s,wcscat_s,RegOpenKeyExW,RegQueryInfoKeyW,RegCloseKey,wcscpy_s,wcscat_s,wcscat_s,RegOpenKeyExW,RegCloseKey,RegQueryInfoKeyW,RegCloseKey,RegCloseKey,RegCloseKey,

22_2_00007FF7CAA638D0

Source: C:\Users\user\AppData\Local\igQ\wusa.exe

Code function: 39_2_00007FF778CA4B60 GetModuleHandleW,FormatMessageW,GetLastError,wcsrchr,LocalFree,LocalFree,

39_2_00007FF778CA4B60

Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe

Code function: 37_2_00007FF7A346345C StartServiceCtrlDispatcherW,GetLastError,

37_2_00007FF7A346345C

Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe

Code function: 22_2_00007FF7CAA664A0 OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,QueryServiceStatus,StartServiceW,GetLastError,Sleep,QueryServiceStatus,GetLastError,CloseServiceHandle,CloseServiceHandle,

22_2_00007FF7CAA664A0

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CiEceGPoOR.dll',#1

Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Mutant created: \Sessions\1\BaseNamedObjects\{22cd3e45-146f-fcc4-dc5d-c827df9e75ca}
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Mutant created: \Sessions\1\BaseNamedObjects\{eb13c18f-689f-7d9c-75b5-4d52e3a5dfd4}

Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe

Code function: 22_2_00007FF7CAA61DA4 LoadLibraryExW,FindResourceExW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,EnterCriticalSection,LeaveCriticalSection,

22_2_00007FF7CAA61DA4

Source: wusa.exe	String found in binary or memory: Failed to display update-not-installed message box
Source: wusa.exe	String found in binary or memory: Failed to display update-installed message box

Source: CiEceGPoOR.dll

Static PE information: More than 4320 > 100 exports found

Source: CiEceGPoOR.dll

Static PE information: Image base 0x140000000 > 0x60000000

Source: CiEceGPoOR.dll

Static file information: File size 2252800 > 1048576

Source: CiEceGPoOR.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: wusa.pdbGCTL source: wusa.exe, 00000027.00000000.519872524.00007FF778CB7000.00000002.00020000.sdmp
Source:	Binary string: wusa.pdb source: wusa.exe, 00000027.00000000.519872524.00007FF778CB7000.00000002.00020000.sdmp
Source:	Binary string: mspaint.pdb source: mspaint.exe, 00000020.00000002.457507049.00007FF67B198000.00000002.00020000.sdmp
Source:	Binary string: mspaint.pdbGCTL source: mspaint.exe, 00000020.00000002.457507049.00007FF67B198000.00000002.00020000.sdmp
Source:	Binary string: SystemPropertiesRemote.pdb source: SystemPropertiesRemote.exe, 00000023.00000000.460233798.00007FF7376B2000.00000002.00020000.sdmp
Source:	Binary string: BdeUISrv.pdb source: BdeUISrv.exe, 00000016.00000000.347271013.00007FF7CAA69000.00000002.00020000.sdmp
Source:	Binary string: SystemPropertiesRemote.pdbGCTL source: SystemPropertiesRemote.exe, 00000023.00000000.460233798.00007FF7376B2000.00000002.00020000.sdmp
Source:	Binary string: BdeUISrv.pdbGCTL source: BdeUISrv.exe, 00000016.00000000.347271013.00007FF7CAA69000.00000002.00020000.sdmp
Source:	Binary string: LockScreenContentServer.pdbGCTL source: LockScreenContentServer.exe, 0000001C.00000002.425932053.00007FF755D05000.00000002.00020000.sdmp
Source:	Binary string: WMPDMC.pdbGCTL source: WMPDMC.exe, 00000018.00000000.374547106.00007FF71E3ED000.00000002.00020000.sdmp
Source:	Binary string: AgentService.pdbGCTL source: AgentService.exe, 00000025.00000002.516817162.00007FF7A3521000.00000002.00020000.sdmp
Source:	Binary string: AgentService.pdb source: AgentService.exe, 00000025.00000002.516817162.00007FF7A3521000.00000002.00020000.sdmp
Source:	Binary string: WMPDMC.pdb source: WMPDMC.exe, 00000018.00000000.374547106.00007FF71E3ED000.00000002.00020000.sdmp
Source:	Binary string: LockScreenContentServer.pdb source: LockScreenContentServer.exe, 0000001C.00000002.425932053.00007FF755D05000.00000002.00020000.sdmp

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140056A4D push rdi; ret	0_2_0000000140056A4E
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34A84C0 push rsp; retf	37_2_00007FF7A34A84C1
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A34AFF70 pushfq ; retf	37_2_00007FF7A34AFF71
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: 39_2_00007FF778CB1964 push rbx; iretd	39_2_00007FF778CB1965
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: 39_2_00007FF778CB15F8 push rbx; retf	39_2_00007FF778CB15F9

Source: CiEceGPoOR.dll	Static PE information: section name: .qkm
Source: CiEceGPoOR.dll	Static PE information: section name: .cvjb
Source: CiEceGPoOR.dll	Static PE information: section name: .tlmkv
Source: CiEceGPoOR.dll	Static PE information: section name: .wucsxe
Source: CiEceGPoOR.dll	Static PE information: section name: .fltwtj
Source: CiEceGPoOR.dll	Static PE information: section name: .sfplio
Source: CiEceGPoOR.dll	Static PE information: section name: .rpg
Source: CiEceGPoOR.dll	Static PE information: section name: .bewzc
Source: CiEceGPoOR.dll	Static PE information: section name: .vksvaw
Source: CiEceGPoOR.dll	Static PE information: section name: .wmhg
Source: CiEceGPoOR.dll	Static PE information: section name: .kswemc
Source: CiEceGPoOR.dll	Static PE information: section name: .kaxfk
Source: CiEceGPoOR.dll	Static PE information: section name: .pjf
Source: CiEceGPoOR.dll	Static PE information: section name: .retjqj
Source: CiEceGPoOR.dll	Static PE information: section name: .mizn
Source: CiEceGPoOR.dll	Static PE information: section name: .rsrub
Source: CiEceGPoOR.dll	Static PE information: section name: .susbqq
Source: CiEceGPoOR.dll	Static PE information: section name: .jeojcw
Source: CiEceGPoOR.dll	Static PE information: section name: .vwl
Source: CiEceGPoOR.dll	Static PE information: section name: .mub
Source: CiEceGPoOR.dll	Static PE information: section name: .xwxpmb
Source: CiEceGPoOR.dll	Static PE information: section name: .aea
Source: CiEceGPoOR.dll	Static PE information: section name: .lwpch
Source: CiEceGPoOR.dll	Static PE information: section name: .nzgp
Source: CiEceGPoOR.dll	Static PE information: section name: .qimx
Source: CiEceGPoOR.dll	Static PE information: section name: .jbqbr
Source: CiEceGPoOR.dll	Static PE information: section name: .kxxxil
Source: CiEceGPoOR.dll	Static PE information: section name: .drpaa
Source: CiEceGPoOR.dll	Static PE information: section name: .lepjc
Source: CiEceGPoOR.dll	Static PE information: section name: .txam
Source: CiEceGPoOR.dll	Static PE information: section name: .vqjcpr
Source: CiEceGPoOR.dll	Static PE information: section name: .vvwma
Source: CiEceGPoOR.dll	Static PE information: section name: .pinm
Source: CiEceGPoOR.dll	Static PE information: section name: .eowj
Source: CiEceGPoOR.dll	Static PE information: section name: .dzlhaa
Source: CiEceGPoOR.dll	Static PE information: section name: .ncnf
Source: CiEceGPoOR.dll	Static PE information: section name: .vqes
Source: CiEceGPoOR.dll	Static PE information: section name: .rtu
Source: CiEceGPoOR.dll	Static PE information: section name: .qlvquw
Source: CiEceGPoOR.dll	Static PE information: section name: .nzjn
Source: CiEceGPoOR.dll	Static PE information: section name: .dfwg
Source: CiEceGPoOR.dll	Static PE information: section name: .zypdk
Source: CiEceGPoOR.dll	Static PE information: section name: .ufvfoh
Source: CiEceGPoOR.dll	Static PE information: section name: .efst
Source: CiEceGPoOR.dll	Static PE information: section name: .dfk
Source: CiEceGPoOR.dll	Static PE information: section name: .mxubr
Source: CiEceGPoOR.dll	Static PE information: section name: .zqcgin
Source: CiEceGPoOR.dll	Static PE information: section name: .cxkr
Source: WMPDMC.exe.4.dr	Static PE information: section name: .didat
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .qkm
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .cvjb
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .tlmkv
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .wucsxe
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .fltwtj
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .sfplio
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .rpg
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .bewzc
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .vksvaw
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .wmhg
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .kswemc
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .kaxfk
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .pjf
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .retjqj
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .mizn
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .rsrub
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .susbqq
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .jeojcw
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .vwl
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .mub
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .xwxpmb
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .aea
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .lwpch
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .nzgp
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .qimx
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .jbqbr
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .kxxxil
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .drpaa
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .lepjc
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .txam
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .vqjcpr
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .vvwma
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .pinm
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .eowj
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .dzlhaa
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .ncnf
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .vqes
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .rtu
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .qlvquw
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .nzjn
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .dfwg
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .zypdk
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .ufvfoh
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .efst
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .dfk
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .mxubr
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .zqcgin
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .cxkr
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .sroevg
Source: OLEACC.dll.4.dr	Static PE information: section name: .qkm
Source: OLEACC.dll.4.dr	Static PE information: section name: .cvjb
Source: OLEACC.dll.4.dr	Static PE information: section name: .tlmkv
Source: OLEACC.dll.4.dr	Static PE information: section name: .wucsxe
Source: OLEACC.dll.4.dr	Static PE information: section name: .fltwtj
Source: OLEACC.dll.4.dr	Static PE information: section name: .sfplio
Source: OLEACC.dll.4.dr	Static PE information: section name: .rpg
Source: OLEACC.dll.4.dr	Static PE information: section name: .bewzc
Source: OLEACC.dll.4.dr	Static PE information: section name: .vksvaw
Source: OLEACC.dll.4.dr	Static PE information: section name: .wmhg
Source: OLEACC.dll.4.dr	Static PE information: section name: .kswemc
Source: OLEACC.dll.4.dr	Static PE information: section name: .kaxfk
Source: OLEACC.dll.4.dr	Static PE information: section name: .pjf
Source: OLEACC.dll.4.dr	Static PE information: section name: .retjqj
Source: OLEACC.dll.4.dr	Static PE information: section name: .mizn
Source: OLEACC.dll.4.dr	Static PE information: section name: .rsrub
Source: OLEACC.dll.4.dr	Static PE information: section name: .susbqq
Source: OLEACC.dll.4.dr	Static PE information: section name: .jeojcw
Source: OLEACC.dll.4.dr	Static PE information: section name: .vwl
Source: OLEACC.dll.4.dr	Static PE information: section name: .mub
Source: OLEACC.dll.4.dr	Static PE information: section name: .xwxpmb
Source: OLEACC.dll.4.dr	Static PE information: section name: .aea
Source: OLEACC.dll.4.dr	Static PE information: section name: .lwpch
Source: OLEACC.dll.4.dr	Static PE information: section name: .nzgp
Source: OLEACC.dll.4.dr	Static PE information: section name: .qimx
Source: OLEACC.dll.4.dr	Static PE information: section name: .jbqbr
Source: OLEACC.dll.4.dr	Static PE information: section name: .kxxxil
Source: OLEACC.dll.4.dr	Static PE information: section name: .drpaa
Source: OLEACC.dll.4.dr	Static PE information: section name: .lepjc
Source: OLEACC.dll.4.dr	Static PE information: section name: .txam
Source: OLEACC.dll.4.dr	Static PE information: section name: .vqjcpr
Source: OLEACC.dll.4.dr	Static PE information: section name: .vvwma
Source: OLEACC.dll.4.dr	Static PE information: section name: .pinm
Source: OLEACC.dll.4.dr	Static PE information: section name: .eowj
Source: OLEACC.dll.4.dr	Static PE information: section name: .dzlhaa
Source: OLEACC.dll.4.dr	Static PE information: section name: .ncnf
Source: OLEACC.dll.4.dr	Static PE information: section name: .vqes
Source: OLEACC.dll.4.dr	Static PE information: section name: .rtu
Source: OLEACC.dll.4.dr	Static PE information: section name: .qlvquw
Source: OLEACC.dll.4.dr	Static PE information: section name: .nzjn
Source: OLEACC.dll.4.dr	Static PE information: section name: .dfwg
Source: OLEACC.dll.4.dr	Static PE information: section name: .zypdk
Source: OLEACC.dll.4.dr	Static PE information: section name: .ufvfoh
Source: OLEACC.dll.4.dr	Static PE information: section name: .efst
Source: OLEACC.dll.4.dr	Static PE information: section name: .dfk
Source: OLEACC.dll.4.dr	Static PE information: section name: .mxubr
Source: OLEACC.dll.4.dr	Static PE information: section name: .zqcgin
Source: OLEACC.dll.4.dr	Static PE information: section name: .cxkr
Source: OLEACC.dll.4.dr	Static PE information: section name: .wvwopb
Source: dwmapi.dll.4.dr	Static PE information: section name: .qkm
Source: dwmapi.dll.4.dr	Static PE information: section name: .cvjb
Source: dwmapi.dll.4.dr	Static PE information: section name: .tlmkv
Source: dwmapi.dll.4.dr	Static PE information: section name: .wucsxe
Source: dwmapi.dll.4.dr	Static PE information: section name: .fltwtj
Source: dwmapi.dll.4.dr	Static PE information: section name: .sfplio
Source: dwmapi.dll.4.dr	Static PE information: section name: .rpg
Source: dwmapi.dll.4.dr	Static PE information: section name: .bewzc
Source: dwmapi.dll.4.dr	Static PE information: section name: .vksvaw
Source: dwmapi.dll.4.dr	Static PE information: section name: .wmhg
Source: dwmapi.dll.4.dr	Static PE information: section name: .kswemc
Source: dwmapi.dll.4.dr	Static PE information: section name: .kaxfk
Source: dwmapi.dll.4.dr	Static PE information: section name: .pjf
Source: dwmapi.dll.4.dr	Static PE information: section name: .retjqj
Source: dwmapi.dll.4.dr	Static PE information: section name: .mizn
Source: dwmapi.dll.4.dr	Static PE information: section name: .rsrub
Source: dwmapi.dll.4.dr	Static PE information: section name: .susbqq
Source: dwmapi.dll.4.dr	Static PE information: section name: .jeojcw
Source: dwmapi.dll.4.dr	Static PE information: section name: .vwl
Source: dwmapi.dll.4.dr	Static PE information: section name: .mub
Source: dwmapi.dll.4.dr	Static PE information: section name: .xwxpmb
Source: dwmapi.dll.4.dr	Static PE information: section name: .aea
Source: dwmapi.dll.4.dr	Static PE information: section name: .lwpch
Source: dwmapi.dll.4.dr	Static PE information: section name: .nzgp
Source: dwmapi.dll.4.dr	Static PE information: section name: .qimx
Source: dwmapi.dll.4.dr	Static PE information: section name: .jbqbr
Source: dwmapi.dll.4.dr	Static PE information: section name: .kxxxil
Source: dwmapi.dll.4.dr	Static PE information: section name: .drpaa
Source: dwmapi.dll.4.dr	Static PE information: section name: .lepjc
Source: dwmapi.dll.4.dr	Static PE information: section name: .txam
Source: dwmapi.dll.4.dr	Static PE information: section name: .vqjcpr
Source: dwmapi.dll.4.dr	Static PE information: section name: .vvwma
Source: dwmapi.dll.4.dr	Static PE information: section name: .pinm
Source: dwmapi.dll.4.dr	Static PE information: section name: .eowj
Source: dwmapi.dll.4.dr	Static PE information: section name: .dzlhaa
Source: dwmapi.dll.4.dr	Static PE information: section name: .ncnf
Source: dwmapi.dll.4.dr	Static PE information: section name: .vqes
Source: dwmapi.dll.4.dr	Static PE information: section name: .rtu
Source: dwmapi.dll.4.dr	Static PE information: section name: .qlvquw
Source: dwmapi.dll.4.dr	Static PE information: section name: .nzjn
Source: dwmapi.dll.4.dr	Static PE information: section name: .dfwg
Source: dwmapi.dll.4.dr	Static PE information: section name: .zypdk
Source: dwmapi.dll.4.dr	Static PE information: section name: .ufvfoh
Source: dwmapi.dll.4.dr	Static PE information: section name: .efst
Source: dwmapi.dll.4.dr	Static PE information: section name: .dfk
Source: dwmapi.dll.4.dr	Static PE information: section name: .mxubr
Source: dwmapi.dll.4.dr	Static PE information: section name: .zqcgin
Source: dwmapi.dll.4.dr	Static PE information: section name: .cxkr
Source: dwmapi.dll.4.dr	Static PE information: section name: .cadzn
Source: WINMM.dll.4.dr	Static PE information: section name: .qkm
Source: WINMM.dll.4.dr	Static PE information: section name: .cvjb
Source: WINMM.dll.4.dr	Static PE information: section name: .tlmkv
Source: WINMM.dll.4.dr	Static PE information: section name: .wucsxe
Source: WINMM.dll.4.dr	Static PE information: section name: .fltwtj
Source: WINMM.dll.4.dr	Static PE information: section name: .sfplio
Source: WINMM.dll.4.dr	Static PE information: section name: .rpg
Source: WINMM.dll.4.dr	Static PE information: section name: .bewzc
Source: WINMM.dll.4.dr	Static PE information: section name: .vksvaw
Source: WINMM.dll.4.dr	Static PE information: section name: .wmhg
Source: WINMM.dll.4.dr	Static PE information: section name: .kswemc
Source: WINMM.dll.4.dr	Static PE information: section name: .kaxfk
Source: WINMM.dll.4.dr	Static PE information: section name: .pjf
Source: WINMM.dll.4.dr	Static PE information: section name: .retjqj
Source: WINMM.dll.4.dr	Static PE information: section name: .mizn
Source: WINMM.dll.4.dr	Static PE information: section name: .rsrub
Source: WINMM.dll.4.dr	Static PE information: section name: .susbqq
Source: WINMM.dll.4.dr	Static PE information: section name: .jeojcw
Source: WINMM.dll.4.dr	Static PE information: section name: .vwl
Source: WINMM.dll.4.dr	Static PE information: section name: .mub
Source: WINMM.dll.4.dr	Static PE information: section name: .xwxpmb
Source: WINMM.dll.4.dr	Static PE information: section name: .aea
Source: WINMM.dll.4.dr	Static PE information: section name: .lwpch
Source: WINMM.dll.4.dr	Static PE information: section name: .nzgp
Source: WINMM.dll.4.dr	Static PE information: section name: .qimx
Source: WINMM.dll.4.dr	Static PE information: section name: .jbqbr
Source: WINMM.dll.4.dr	Static PE information: section name: .kxxxil
Source: WINMM.dll.4.dr	Static PE information: section name: .drpaa
Source: WINMM.dll.4.dr	Static PE information: section name: .lepjc
Source: WINMM.dll.4.dr	Static PE information: section name: .txam
Source: WINMM.dll.4.dr	Static PE information: section name: .vqjcpr
Source: WINMM.dll.4.dr	Static PE information: section name: .vvwma
Source: WINMM.dll.4.dr	Static PE information: section name: .pinm
Source: WINMM.dll.4.dr	Static PE information: section name: .eowj
Source: WINMM.dll.4.dr	Static PE information: section name: .dzlhaa
Source: WINMM.dll.4.dr	Static PE information: section name: .ncnf
Source: WINMM.dll.4.dr	Static PE information: section name: .vqes
Source: WINMM.dll.4.dr	Static PE information: section name: .rtu
Source: WINMM.dll.4.dr	Static PE information: section name: .qlvquw
Source: WINMM.dll.4.dr	Static PE information: section name: .nzjn
Source: WINMM.dll.4.dr	Static PE information: section name: .dfwg
Source: WINMM.dll.4.dr	Static PE information: section name: .zypdk
Source: WINMM.dll.4.dr	Static PE information: section name: .ufvfoh
Source: WINMM.dll.4.dr	Static PE information: section name: .efst
Source: WINMM.dll.4.dr	Static PE information: section name: .dfk
Source: WINMM.dll.4.dr	Static PE information: section name: .mxubr
Source: WINMM.dll.4.dr	Static PE information: section name: .zqcgin
Source: WINMM.dll.4.dr	Static PE information: section name: .cxkr
Source: WINMM.dll.4.dr	Static PE information: section name: .olw
Source: SYSDM.CPL.4.dr	Static PE information: section name: .qkm
Source: SYSDM.CPL.4.dr	Static PE information: section name: .cvjb
Source: SYSDM.CPL.4.dr	Static PE information: section name: .tlmkv
Source: SYSDM.CPL.4.dr	Static PE information: section name: .wucsxe
Source: SYSDM.CPL.4.dr	Static PE information: section name: .fltwtj
Source: SYSDM.CPL.4.dr	Static PE information: section name: .sfplio
Source: SYSDM.CPL.4.dr	Static PE information: section name: .rpg
Source: SYSDM.CPL.4.dr	Static PE information: section name: .bewzc
Source: SYSDM.CPL.4.dr	Static PE information: section name: .vksvaw
Source: SYSDM.CPL.4.dr	Static PE information: section name: .wmhg
Source: SYSDM.CPL.4.dr	Static PE information: section name: .kswemc
Source: SYSDM.CPL.4.dr	Static PE information: section name: .kaxfk
Source: SYSDM.CPL.4.dr	Static PE information: section name: .pjf
Source: SYSDM.CPL.4.dr	Static PE information: section name: .retjqj
Source: SYSDM.CPL.4.dr	Static PE information: section name: .mizn
Source: SYSDM.CPL.4.dr	Static PE information: section name: .rsrub
Source: SYSDM.CPL.4.dr	Static PE information: section name: .susbqq
Source: SYSDM.CPL.4.dr	Static PE information: section name: .jeojcw
Source: SYSDM.CPL.4.dr	Static PE information: section name: .vwl
Source: SYSDM.CPL.4.dr	Static PE information: section name: .mub
Source: SYSDM.CPL.4.dr	Static PE information: section name: .xwxpmb
Source: SYSDM.CPL.4.dr	Static PE information: section name: .aea
Source: SYSDM.CPL.4.dr	Static PE information: section name: .lwpch
Source: SYSDM.CPL.4.dr	Static PE information: section name: .nzgp
Source: SYSDM.CPL.4.dr	Static PE information: section name: .qimx
Source: SYSDM.CPL.4.dr	Static PE information: section name: .jbqbr
Source: SYSDM.CPL.4.dr	Static PE information: section name: .kxxxil
Source: SYSDM.CPL.4.dr	Static PE information: section name: .drpaa
Source: SYSDM.CPL.4.dr	Static PE information: section name: .lepjc
Source: SYSDM.CPL.4.dr	Static PE information: section name: .txam
Source: SYSDM.CPL.4.dr	Static PE information: section name: .vqjcpr
Source: SYSDM.CPL.4.dr	Static PE information: section name: .vvwma
Source: SYSDM.CPL.4.dr	Static PE information: section name: .pinm
Source: SYSDM.CPL.4.dr	Static PE information: section name: .eowj
Source: SYSDM.CPL.4.dr	Static PE information: section name: .dzlhaa
Source: SYSDM.CPL.4.dr	Static PE information: section name: .ncnf
Source: SYSDM.CPL.4.dr	Static PE information: section name: .vqes
Source: SYSDM.CPL.4.dr	Static PE information: section name: .rtu
Source: SYSDM.CPL.4.dr	Static PE information: section name: .qlvquw
Source: SYSDM.CPL.4.dr	Static PE information: section name: .nzjn
Source: SYSDM.CPL.4.dr	Static PE information: section name: .dfwg
Source: SYSDM.CPL.4.dr	Static PE information: section name: .zypdk
Source: SYSDM.CPL.4.dr	Static PE information: section name: .ufvfoh
Source: SYSDM.CPL.4.dr	Static PE information: section name: .efst
Source: SYSDM.CPL.4.dr	Static PE information: section name: .dfk
Source: SYSDM.CPL.4.dr	Static PE information: section name: .mxubr
Source: SYSDM.CPL.4.dr	Static PE information: section name: .zqcgin
Source: SYSDM.CPL.4.dr	Static PE information: section name: .cxkr
Source: SYSDM.CPL.4.dr	Static PE information: section name: .hcxgmp
Source: VERSION.dll.4.dr	Static PE information: section name: .qkm
Source: VERSION.dll.4.dr	Static PE information: section name: .cvjb
Source: VERSION.dll.4.dr	Static PE information: section name: .tlmkv
Source: VERSION.dll.4.dr	Static PE information: section name: .wucsxe
Source: VERSION.dll.4.dr	Static PE information: section name: .fltwtj
Source: VERSION.dll.4.dr	Static PE information: section name: .sfplio
Source: VERSION.dll.4.dr	Static PE information: section name: .rpg
Source: VERSION.dll.4.dr	Static PE information: section name: .bewzc
Source: VERSION.dll.4.dr	Static PE information: section name: .vksvaw
Source: VERSION.dll.4.dr	Static PE information: section name: .wmhg
Source: VERSION.dll.4.dr	Static PE information: section name: .kswemc
Source: VERSION.dll.4.dr	Static PE information: section name: .kaxfk
Source: VERSION.dll.4.dr	Static PE information: section name: .pjf
Source: VERSION.dll.4.dr	Static PE information: section name: .retjqj
Source: VERSION.dll.4.dr	Static PE information: section name: .mizn
Source: VERSION.dll.4.dr	Static PE information: section name: .rsrub
Source: VERSION.dll.4.dr	Static PE information: section name: .susbqq
Source: VERSION.dll.4.dr	Static PE information: section name: .jeojcw
Source: VERSION.dll.4.dr	Static PE information: section name: .vwl
Source: VERSION.dll.4.dr	Static PE information: section name: .mub
Source: VERSION.dll.4.dr	Static PE information: section name: .xwxpmb
Source: VERSION.dll.4.dr	Static PE information: section name: .aea
Source: VERSION.dll.4.dr	Static PE information: section name: .lwpch
Source: VERSION.dll.4.dr	Static PE information: section name: .nzgp
Source: VERSION.dll.4.dr	Static PE information: section name: .qimx
Source: VERSION.dll.4.dr	Static PE information: section name: .jbqbr
Source: VERSION.dll.4.dr	Static PE information: section name: .kxxxil
Source: VERSION.dll.4.dr	Static PE information: section name: .drpaa
Source: VERSION.dll.4.dr	Static PE information: section name: .lepjc
Source: VERSION.dll.4.dr	Static PE information: section name: .txam
Source: VERSION.dll.4.dr	Static PE information: section name: .vqjcpr
Source: VERSION.dll.4.dr	Static PE information: section name: .vvwma
Source: VERSION.dll.4.dr	Static PE information: section name: .pinm
Source: VERSION.dll.4.dr	Static PE information: section name: .eowj
Source: VERSION.dll.4.dr	Static PE information: section name: .dzlhaa
Source: VERSION.dll.4.dr	Static PE information: section name: .ncnf
Source: VERSION.dll.4.dr	Static PE information: section name: .vqes
Source: VERSION.dll.4.dr	Static PE information: section name: .rtu
Source: VERSION.dll.4.dr	Static PE information: section name: .qlvquw
Source: VERSION.dll.4.dr	Static PE information: section name: .nzjn
Source: VERSION.dll.4.dr	Static PE information: section name: .dfwg
Source: VERSION.dll.4.dr	Static PE information: section name: .zypdk
Source: VERSION.dll.4.dr	Static PE information: section name: .ufvfoh
Source: VERSION.dll.4.dr	Static PE information: section name: .efst
Source: VERSION.dll.4.dr	Static PE information: section name: .dfk
Source: VERSION.dll.4.dr	Static PE information: section name: .mxubr
Source: VERSION.dll.4.dr	Static PE information: section name: .zqcgin
Source: VERSION.dll.4.dr	Static PE information: section name: .cxkr
Source: VERSION.dll.4.dr	Static PE information: section name: .whiws
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .qkm
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .cvjb
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .tlmkv
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .wucsxe
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .fltwtj
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .sfplio
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .rpg
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .bewzc
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .vksvaw
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .wmhg
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .kswemc
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .kaxfk
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .pjf
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .retjqj
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .mizn
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .rsrub
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .susbqq
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .jeojcw
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .vwl
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .mub
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .xwxpmb
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .aea
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .lwpch
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .nzgp
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .qimx
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .jbqbr
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .kxxxil
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .drpaa
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .lepjc
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .txam
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .vqjcpr
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .vvwma
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .pinm
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .eowj
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .dzlhaa
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .ncnf
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .vqes
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .rtu
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .qlvquw
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .nzjn
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .dfwg
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .zypdk
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .ufvfoh
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .efst
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .dfk
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .mxubr
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .zqcgin
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .cxkr
Source: WTSAPI32.dll0.4.dr	Static PE information: section name: .lde
Source: WINBRAND.dll.4.dr	Static PE information: section name: .qkm
Source: WINBRAND.dll.4.dr	Static PE information: section name: .cvjb
Source: WINBRAND.dll.4.dr	Static PE information: section name: .tlmkv
Source: WINBRAND.dll.4.dr	Static PE information: section name: .wucsxe
Source: WINBRAND.dll.4.dr	Static PE information: section name: .fltwtj
Source: WINBRAND.dll.4.dr	Static PE information: section name: .sfplio
Source: WINBRAND.dll.4.dr	Static PE information: section name: .rpg
Source: WINBRAND.dll.4.dr	Static PE information: section name: .bewzc
Source: WINBRAND.dll.4.dr	Static PE information: section name: .vksvaw
Source: WINBRAND.dll.4.dr	Static PE information: section name: .wmhg
Source: WINBRAND.dll.4.dr	Static PE information: section name: .kswemc
Source: WINBRAND.dll.4.dr	Static PE information: section name: .kaxfk
Source: WINBRAND.dll.4.dr	Static PE information: section name: .pjf
Source: WINBRAND.dll.4.dr	Static PE information: section name: .retjqj
Source: WINBRAND.dll.4.dr	Static PE information: section name: .mizn
Source: WINBRAND.dll.4.dr	Static PE information: section name: .rsrub
Source: WINBRAND.dll.4.dr	Static PE information: section name: .susbqq
Source: WINBRAND.dll.4.dr	Static PE information: section name: .jeojcw
Source: WINBRAND.dll.4.dr	Static PE information: section name: .vwl
Source: WINBRAND.dll.4.dr	Static PE information: section name: .mub
Source: WINBRAND.dll.4.dr	Static PE information: section name: .xwxpmb
Source: WINBRAND.dll.4.dr	Static PE information: section name: .aea
Source: WINBRAND.dll.4.dr	Static PE information: section name: .lwpch
Source: WINBRAND.dll.4.dr	Static PE information: section name: .nzgp
Source: WINBRAND.dll.4.dr	Static PE information: section name: .qimx
Source: WINBRAND.dll.4.dr	Static PE information: section name: .jbqbr
Source: WINBRAND.dll.4.dr	Static PE information: section name: .kxxxil
Source: WINBRAND.dll.4.dr	Static PE information: section name: .drpaa
Source: WINBRAND.dll.4.dr	Static PE information: section name: .lepjc
Source: WINBRAND.dll.4.dr	Static PE information: section name: .txam
Source: WINBRAND.dll.4.dr	Static PE information: section name: .vqjcpr
Source: WINBRAND.dll.4.dr	Static PE information: section name: .vvwma
Source: WINBRAND.dll.4.dr	Static PE information: section name: .pinm
Source: WINBRAND.dll.4.dr	Static PE information: section name: .eowj
Source: WINBRAND.dll.4.dr	Static PE information: section name: .dzlhaa
Source: WINBRAND.dll.4.dr	Static PE information: section name: .ncnf
Source: WINBRAND.dll.4.dr	Static PE information: section name: .vqes
Source: WINBRAND.dll.4.dr	Static PE information: section name: .rtu
Source: WINBRAND.dll.4.dr	Static PE information: section name: .qlvquw
Source: WINBRAND.dll.4.dr	Static PE information: section name: .nzjn
Source: WINBRAND.dll.4.dr	Static PE information: section name: .dfwg
Source: WINBRAND.dll.4.dr	Static PE information: section name: .zypdk
Source: WINBRAND.dll.4.dr	Static PE information: section name: .ufvfoh
Source: WINBRAND.dll.4.dr	Static PE information: section name: .efst
Source: WINBRAND.dll.4.dr	Static PE information: section name: .dfk
Source: WINBRAND.dll.4.dr	Static PE information: section name: .mxubr
Source: WINBRAND.dll.4.dr	Static PE information: section name: .zqcgin
Source: WINBRAND.dll.4.dr	Static PE information: section name: .cxkr
Source: WINBRAND.dll.4.dr	Static PE information: section name: .uuah
Source: WINMM.dll0.4.dr	Static PE information: section name: .qkm
Source: WINMM.dll0.4.dr	Static PE information: section name: .cvjb
Source: WINMM.dll0.4.dr	Static PE information: section name: .tlmkv
Source: WINMM.dll0.4.dr	Static PE information: section name: .wucsxe
Source: WINMM.dll0.4.dr	Static PE information: section name: .fltwtj
Source: WINMM.dll0.4.dr	Static PE information: section name: .sfplio
Source: WINMM.dll0.4.dr	Static PE information: section name: .rpg
Source: WINMM.dll0.4.dr	Static PE information: section name: .bewzc
Source: WINMM.dll0.4.dr	Static PE information: section name: .vksvaw
Source: WINMM.dll0.4.dr	Static PE information: section name: .wmhg
Source: WINMM.dll0.4.dr	Static PE information: section name: .kswemc
Source: WINMM.dll0.4.dr	Static PE information: section name: .kaxfk
Source: WINMM.dll0.4.dr	Static PE information: section name: .pjf
Source: WINMM.dll0.4.dr	Static PE information: section name: .retjqj
Source: WINMM.dll0.4.dr	Static PE information: section name: .mizn
Source: WINMM.dll0.4.dr	Static PE information: section name: .rsrub
Source: WINMM.dll0.4.dr	Static PE information: section name: .susbqq
Source: WINMM.dll0.4.dr	Static PE information: section name: .jeojcw
Source: WINMM.dll0.4.dr	Static PE information: section name: .vwl
Source: WINMM.dll0.4.dr	Static PE information: section name: .mub
Source: WINMM.dll0.4.dr	Static PE information: section name: .xwxpmb
Source: WINMM.dll0.4.dr	Static PE information: section name: .aea
Source: WINMM.dll0.4.dr	Static PE information: section name: .lwpch
Source: WINMM.dll0.4.dr	Static PE information: section name: .nzgp
Source: WINMM.dll0.4.dr	Static PE information: section name: .qimx
Source: WINMM.dll0.4.dr	Static PE information: section name: .jbqbr
Source: WINMM.dll0.4.dr	Static PE information: section name: .kxxxil
Source: WINMM.dll0.4.dr	Static PE information: section name: .drpaa
Source: WINMM.dll0.4.dr	Static PE information: section name: .lepjc
Source: WINMM.dll0.4.dr	Static PE information: section name: .txam
Source: WINMM.dll0.4.dr	Static PE information: section name: .vqjcpr
Source: WINMM.dll0.4.dr	Static PE information: section name: .vvwma
Source: WINMM.dll0.4.dr	Static PE information: section name: .pinm
Source: WINMM.dll0.4.dr	Static PE information: section name: .eowj
Source: WINMM.dll0.4.dr	Static PE information: section name: .dzlhaa
Source: WINMM.dll0.4.dr	Static PE information: section name: .ncnf
Source: WINMM.dll0.4.dr	Static PE information: section name: .vqes
Source: WINMM.dll0.4.dr	Static PE information: section name: .rtu
Source: WINMM.dll0.4.dr	Static PE information: section name: .qlvquw
Source: WINMM.dll0.4.dr	Static PE information: section name: .nzjn
Source: WINMM.dll0.4.dr	Static PE information: section name: .dfwg
Source: WINMM.dll0.4.dr	Static PE information: section name: .zypdk
Source: WINMM.dll0.4.dr	Static PE information: section name: .ufvfoh
Source: WINMM.dll0.4.dr	Static PE information: section name: .efst
Source: WINMM.dll0.4.dr	Static PE information: section name: .dfk
Source: WINMM.dll0.4.dr	Static PE information: section name: .mxubr
Source: WINMM.dll0.4.dr	Static PE information: section name: .zqcgin
Source: WINMM.dll0.4.dr	Static PE information: section name: .cxkr
Source: WINMM.dll0.4.dr	Static PE information: section name: .vsruio
Source: SYSDM.CPL0.4.dr	Static PE information: section name: .qkm
Source: SYSDM.CPL0.4.dr	Static PE information: section name: .cvjb
Source: SYSDM.CPL0.4.dr	Static PE information: section name: .tlmkv
Source: SYSDM.CPL0.4.dr	Static PE information: section name: .wucsxe
Source: SYSDM.CPL0.4.dr	Static PE information: section name: .fltwtj
Source: SYSDM.CPL0.4.dr	Static PE information: section name: .sfplio
Source: SYSDM.CPL0.4.dr	Static PE information: section name: .rpg
Source: SYSDM.CPL0.4.dr	Static PE information: section name: .bewzc
Source: SYSDM.CPL0.4.dr	Static PE information: section name: .vksvaw
Source: SYSDM.CPL0.4.dr	Static PE information: section name: .wmhg

Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe

Code function: 24_2_00007FF71E3360A8 LoadLibraryW,GetProcAddress,GetLastError,DeactivateActCtx,SetLastError,

24_2_00007FF71E3360A8

Source: SYSDM.CPL0.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x23067a
Source: dwmapi.dll.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x230f11
Source: WTSAPI32.dll.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x22a582
Source: SYSDM.CPL.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x229847
Source: WINMM.dll.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x237ac4
Source: WINMM.dll0.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x230557
Source: CiEceGPoOR.dll	Static PE information: real checksum: 0x7d786c40 should be: 0x228970
Source: WINBRAND.dll.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x22b2ae
Source: OLEACC.dll.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x231317
Source: VERSION.dll.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x227850
Source: WTSAPI32.dll0.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x230d7c

Source: SystemPropertiesRemote.exe.4.dr

Static PE information: 0xE6AE4658 [Thu Aug 21 18:15:52 2092 UTC]

Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679

Persistence and Installation Behavior:

Windows Update Standalone Installer command line found (may be used to bypass UAC)

Show sources

Source: wusa.exe, 00000027.00000000.519872524.00007FF778CB7000.00000002.00020000.sdmp

Memory string: DWS;zWusaHiddenFailed to allocate and initialize Administrators group SID.WusaIsUserAdminFailed to check token membership.Failed to get message text for id %uWusaLoadMessageWusaMessageBoxFailed: TaskDialog()Failed to get message for error 0x%xWusaGetErrorMessageWusaCreateLockFileFailed to allocate memory for lock file path.Failed to create lock file %SFailed: GetFullPathName() failed for %SWusaGetFullPathNameFailed to allocate memory for full path.Failed to create extract job for location: %SWusaExtractAllFilesFromCabinetFailed to add container for cabinet: %SFailed: ExtractAllFiles()Failed to extract files from cabinet %SFailed: LookupPrivilegeValue()EnablePrivilegeFailed: OpenProcessToken()Failed: AdjustTokenPrivileges()Failed: AdjustTokenPrivileges(); not all token privileges were assignedFailed: GetTokenInformation()WusaGetUserSIDFailed: CopySid()Failed to PostMessage to progress window, error code %uWusaPostMessagewusa.lockFailed to create eventAppModule::InitFailed to initialize COM securityFailed to initialize critical sectionFailed to show welcome dialogFailed to show non administrator dialogUser is not a member of the Administrators group.Failed to show multiple instance dialogError: Another instance of wusa.exe is running.Failed to create sandboxCreated sandbox %lsFailed: AppModule::SetScanCabPath()Failed to get application title text, id %uFailed to allocate BSTR for application titleFailure returned by InitCommonControlsEx()Failure returned by CreateFont()Failed to get STR_EXPAND_START textFailed to get STR_EXPAND_START_UNINSTALL textFailed to get STR_SEARCH_START textFailed to get STR_COPY_START textFailed to get STR_UNINSTALL_START textFailed to set done event to release shutdown blockAppModule::UninitDeleting sandbox %SAppModule::DeleteSandBoxFailed to delete sandboxCommandLineToArgvW() failed.AppModule::ParseCommandLineError: Too few arguments.Failed to get command line length.Failed to allocate memory for ignored arguments.Failed. Restart mode was supplied multiple times30Failed to parse switchFailed. /warnrestart has invalid formatFailed. /kb was supplied multiple timesFailed. /kb has invalid formatKBFailed to prefix KB numberFailed. /log was supplied multiple timesFailed. /gpmode was supplied multiple timesFailed. /gpmode has invalid formatFailed to allocate memory for product codeFailed to set product code to %lsFailed to add an argument to the ignored list Failed to add a blank space to the ignored argument listUnrecognized argument %SFailed to get MSU file nameFailed to get MSU file name or KB numberFailed: /uninstall with /kb and /quiet options is not supportedFailed to show /extract not supported message boxFailed: /extract is not a supported optionCommand line is %lsFailed to get source lengthAppModule::CopyStringWithQuoteFailed to allocate temp buffer"%s"Failed to copy stringFailure returned by SystemParametersInfo()AppModule::CreateFontWFailure returned by CreateFontIndirectW()Failure returned by DeleteObject()Failure r

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\pjo7Mc7lI\SYSDM.CPL			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\DwpdI\SYSDM.CPL			Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\WMp\OLEACC.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\pjo7Mc7lI\SystemPropertiesRemote.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\vbVu\mspaint.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\qGdjcQqe\WINBRAND.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\vbVu\WINMM.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\uHKs6l\Narrator.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\uHKs6l\WINMM.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\qGdjcQqe\pwcreator.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\f49B\WTSAPI32.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Z7wAQ0\VERSION.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\igQ\wusa.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\igQ\WTSAPI32.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\ukxAYmxLA\dwmapi.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\pjo7Mc7lI\SYSDM.CPL	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\ukxAYmxLA\LockScreenContentServer.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\DwpdI\SystemPropertiesRemote.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\DwpdI\SYSDM.CPL	Jump to dropped file

Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe

22_2_00007FF7CAA664A0

Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe

Code function: 24_2_00007FF71E337020 GetWindow,IsWindowVisible,GetWindowThreadProcessId,GetDesktopWindow,GetWindow,GetWindowThreadProcessId,GetParent,GetWindow,GetClassNameW,CompareStringOrdinal,SetForegroundWindow,IsIconic,ShowWindow,

24_2_00007FF71E337020

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\vbVu\mspaint.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\vbVu\mspaint.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\explorer.exe TID: 7056

Thread sleep count: 37 > 30

Jump to behavior

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\qGdjcQqe\WINBRAND.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\uHKs6l\Narrator.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\qGdjcQqe\pwcreator.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe

Code function: 37_2_00007FF7A3484EF0 rdtsc

37_2_00007FF7A3484EF0

Source: C:\Windows\System32\loaddll64.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000000014005C340 GetSystemInfo,

0_2_000000014005C340

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005D290 FindFirstFileExW,	0_2_000000014005D290
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A3499110 ??3@YAXPEAX@Z,??3@YAXPEAX@Z,std::bad_exception::bad_exception,_CxxThrowException,FindFirstFileW,GetLastError,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,FindNextFileW,GetLastError,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,std::bad_exception::bad_exception,_CxxThrowException,std::bad_exception::bad_exception,_CxxThrowException,	37_2_00007FF7A3499110
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: 39_2_00007FF778CA1BC0 memset,memset,CoInitializeEx,FindFirstFileW,GetLastError,lstrcmpiW,FindNextFileW,GetLastError,GetCommandLineW,EventWrite,FindClose,CoUninitialize,LocalFree,	39_2_00007FF778CA1BC0
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: 39_2_00007FF778CA8D04 memset,memset,memset,FindFirstFileW,GetLastError,lstrcmpW,lstrcmpW,DeleteFileW,GetLastError,MoveFileExW,GetLastError,FindNextFileW,GetLastError,FindClose,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,GetLastError,LocalFree,	39_2_00007FF778CA8D04

Source: explorer.exe, 00000004.00000000.300074629.000000000891C000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.274286632.00000000011EE000.00000004.00000020.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.300074629.000000000891C000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.265450646.0000000008AEA000.00000004.00000001.sdmp	Binary or memory string: 00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&L6
Source: explorer.exe, 00000004.00000000.300613223.0000000008AEA000.00000004.00000001.sdmp	Binary or memory string: 0d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&L6
Source: explorer.exe, 00000004.00000000.294639291.00000000011B3000.00000004.00000020.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: explorer.exe, 00000004.00000000.286980293.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000004.00000000.256038426.00000000053C4000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000004.00000000.286980293.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002

Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe

Code function: 24_2_00007FF71E3E97F0 EnterCriticalSection,IsDebuggerPresent,DebugBreak,LeaveCriticalSection,

24_2_00007FF71E3E97F0

Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe

Code function: 24_2_00007FF71E336008 OutputDebugStringA,ActivateActCtx,GetLastError,

24_2_00007FF71E336008

Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe

Code function: 24_2_00007FF71E3360A8 LoadLibraryW,GetProcAddress,GetLastError,DeactivateActCtx,SetLastError,

24_2_00007FF71E3360A8

Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe

Code function: 22_2_00007FF7CAA64A10 RegisterTraceGuidsW,HeapSetInformation,GetLastError,GetProcessHeap,HeapSetInformation,GetLastError,GetCommandLineW,UnregisterTraceGuids,

22_2_00007FF7CAA64A10

Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe

Code function: 37_2_00007FF7A3484EF0 rdtsc

37_2_00007FF7A3484EF0

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000000140048AC0 LdrLoadDll,FindClose,

0_2_0000000140048AC0

Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe	Code function: 22_2_00007FF7CAA67DA0 SetUnhandledExceptionFilter,	22_2_00007FF7CAA67DA0
Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe	Code function: 22_2_00007FF7CAA67984 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_00007FF7CAA67984
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3EACE0 SetUnhandledExceptionFilter,	24_2_00007FF71E3EACE0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3EA9E4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_00007FF71E3EA9E4
Source: C:\Users\user\AppData\Local\ukxAYmxLA\LockScreenContentServer.exe	Code function: 28_2_00007FF755D045C4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF755D045C4
Source: C:\Users\user\AppData\Local\ukxAYmxLA\LockScreenContentServer.exe	Code function: 28_2_00007FF755D04340 SetUnhandledExceptionFilter,	28_2_00007FF755D04340
Source: C:\Users\user\AppData\Local\pjo7Mc7lI\SystemPropertiesRemote.exe	Code function: 35_2_00007FF7376B1430 SetUnhandledExceptionFilter,	35_2_00007FF7376B1430
Source: C:\Users\user\AppData\Local\pjo7Mc7lI\SystemPropertiesRemote.exe	Code function: 35_2_00007FF7376B16B4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	35_2_00007FF7376B16B4
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Code function: 37_2_00007FF7A3510304 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	37_2_00007FF7A3510304
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: 39_2_00007FF778CB6AA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	39_2_00007FF778CB6AA4
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Code function: 39_2_00007FF778CB6830 SetUnhandledExceptionFilter,	39_2_00007FF778CB6830

HIPS / PFW / Operating System Protection Evasion:

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: WTSAPI32.dll.4.dr

Jump to dropped file

Changes memory attributes in foreign processes to executable or writable

Show sources

Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFA9B8EEFE0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFA9B8EE000 protect: page execute read	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFA9B312A20 protect: page execute and read and write	Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Windows\System32\rundll32.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Contains functionality to prevent local Windows debugging

Show sources

Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3E97F0 EnterCriticalSection,IsDebuggerPresent,DebugBreak,LeaveCriticalSection,		24_2_00007FF71E3E97F0
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Code function: 24_2_00007FF71E3E9860 EnterCriticalSection,IsDebuggerPresent,DebugBreak,GetLastError,SetLastError,LeaveCriticalSection,		24_2_00007FF71E3E9860

Uses Atom Bombing / ProGate to inject into other processes

Show sources

Source: C:\Windows\System32\rundll32.exe

Atom created: 405553565741544156488D6C24D14881EC98 0x00000000 inc eax 0x00000001 push ebp 0x00000002 push ebx 0x00000003 push esi 0x00000004 push edi 0x00000005 inc ecx 0x00000006 push esp 0x00000007 inc ecx 0x00000008 push esi 0x00000009 dec eax 0x0000000a lea ebp, dword ptr [esp-2Fh] 0x0000000e dec eax 0x0000000f sub esp, 00000098h

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CiEceGPoOR.dll',#1

Jump to behavior

Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe

Code function: 22_2_00007FF7CAA64500 ConvertStringSidToSidW,IsValidSid,GetAclInformation,GetLengthSid,malloc,InitializeAcl,GetAclInformation,GetAce,AddAce,AddAccessAllowedAce,free,free,SetSecurityDescriptorDacl,LocalFree,CoInitializeSecurity,GetLastError,LocalFree,free,free,free,free,

22_2_00007FF7CAA64500

Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe

Code function: 22_2_00007FF7CAA672BC memset,RpcStringBindingComposeW,RpcBindingFromStringBindingW,AllocateAndInitializeSid,GetLastError,RpcBindingSetAuthInfoExW,RpcStringFreeW,FreeSid,RpcBindingFree,

22_2_00007FF7CAA672BC

Source: explorer.exe, 00000004.00000000.307712318.0000000001640000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000000.307712318.0000000001640000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000000.307712318.0000000001640000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000004.00000000.274051236.0000000001128000.00000004.00000020.sdmp	Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000004.00000000.307712318.0000000001640000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000004.00000000.307712318.0000000001640000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\ukxAYmxLA\LockScreenContentServer.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\ukxAYmxLA\LockScreenContentServer.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\vbVu\mspaint.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\vbVu\mspaint.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\pjo7Mc7lI\SystemPropertiesRemote.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\pjo7Mc7lI\SystemPropertiesRemote.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\igQ\wusa.exe	Queries volume information: unknown VolumeInformation

Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe

Code function: DisableContainerHwnd,DestroyWindow,DeleteObject,GetModuleHandleW,GetClassInfoExW,memset,GetModuleHandleW,LoadCursorW,GetStockObject,DefWindowProcW,RegisterClassExW,GetModuleHandleW,CreateWindowExW,SetWindowLongPtrW,SetWindowLongPtrW,SendMessageW,GetWindowLongPtrW,GetWindowLongPtrW,SetWindowLongPtrW,GetThreadUILanguage,GetUserDefaultUILanguage,GetLocaleInfoW,GetWindowLongPtrW,SetWindowLongPtrW,CreateGadget,GetLastError,SetGadgetMessageFilter,SetGadgetStyle,GetDC,GetDeviceCaps,ReleaseDC,GetDC,CreateHalftonePalette,ReleaseDC,memset,SetGadgetRootInfo,TlsGetValue,

24_2_00007FF71E3699A0

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe

Code function: 22_2_00007FF7CAA67F30 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

22_2_00007FF7CAA67F30

Source: C:\Users\user\AppData\Local\WMp\WMPDMC.exe

Code function: 24_2_00007FF71E378F90 GetVersion,LoadLibraryExW,

24_2_00007FF71E378F90

Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe	Code function: 22_2_00007FF7CAA672BC memset,RpcStringBindingComposeW,RpcBindingFromStringBindingW,AllocateAndInitializeSid,GetLastError,RpcBindingSetAuthInfoExW,RpcStringFreeW,FreeSid,RpcBindingFree,	22_2_00007FF7CAA672BC
Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe	Code function: 22_2_00007FF7CAA674BE RpcBindingFree,	22_2_00007FF7CAA674BE
Source: C:\Users\user\AppData\Local\f49B\BdeUISrv.exe	Code function: 22_2_00007FF7CAA67450 NdrClientCall3,RpcBindingFree,	22_2_00007FF7CAA67450

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Command and Scripting Interpreter12	Valid Accounts1	Valid Accounts1	Masquerading11	OS Credential Dumping	System Time Discovery1	Remote Services	Screen Capture1	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Service Execution2	Windows Service3	Access Token Manipulation11	Valid Accounts1	LSASS Memory	Security Software Discovery41	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Native API1	DLL Side-Loading1	Windows Service3	Virtualization/Sandbox Evasion1	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Exploitation for Client Execution1	Logon Script (Mac)	Process Injection412	Access Token Manipulation11	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	DLL Side-Loading1	Process Injection412	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	File and Directory Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information3	DCSync	System Information Discovery35	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Rundll321	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Software Packing2	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Timestomp1	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	DLL Side-Loading1	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
CiEceGPoOR.dll	57%	Metadefender		Browse
CiEceGPoOR.dll	80%	ReversingLabs	Win64.Infostealer.Dridex
CiEceGPoOR.dll	100%	Avira	HEUR/AGEN.1114452
CiEceGPoOR.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\f49B\WTSAPI32.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\ukxAYmxLA\dwmapi.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\DwpdI\SYSDM.CPL	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\qGdjcQqe\WINBRAND.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\Z7wAQ0\VERSION.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\DwpdI\SYSDM.CPL	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\uHKs6l\WINMM.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\f49B\WTSAPI32.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\WMp\OLEACC.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\uHKs6l\WINMM.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\f49B\WTSAPI32.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\ukxAYmxLA\dwmapi.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\DwpdI\SYSDM.CPL	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\qGdjcQqe\WINBRAND.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Z7wAQ0\VERSION.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\DwpdI\SYSDM.CPL	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\uHKs6l\WINMM.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\f49B\WTSAPI32.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\WMp\OLEACC.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\uHKs6l\WINMM.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\DwpdI\SystemPropertiesRemote.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\DwpdI\SystemPropertiesRemote.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\WMp\WMPDMC.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\WMp\WMPDMC.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\f49B\BdeUISrv.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\f49B\BdeUISrv.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
3.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.2.AgentService.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
28.2.LockScreenContentServer.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
7.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
24.2.WMPDMC.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.2.wusa.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.loaddll64.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
32.2.mspaint.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.2.SystemPropertiesRemote.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.BdeUISrv.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	492860
Start date:	29.09.2021
Start time:	03:54:34
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 16m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	CiEceGPoOR (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@46/21@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 36.1% (good quality ratio 34.7%) Quality average: 93.9% Quality standard deviation: 22%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 20.82.209.183, 40.112.88.60, 80.67.82.235, 80.67.82.211, 20.50.102.62, 20.54.110.249, 204.79.197.200, 13.107.21.200 Excluded domains from analysis (whitelisted): store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, www.bing.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, dual-a-0001.a-msedge.net, ris-prod.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/492860/sample/CiEceGPoOR.dll

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\DwpdI\SYSDM.CPL Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2256896
Entropy (8bit):	3.380894553174277
Encrypted:	false
SSDEEP:	12288:kVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:BfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	EE703BF34E61D2DC59F997A4B44A85C2
SHA1:	DF19CE64F479AC91DFDAD9914CC2259E6D46BFF9
SHA-256:	5FD55D6FFC125DF1D96DD190A7876A085DCF391DA84AD60CCD2F0CEB1A4A52A4
SHA-512:	2B905E221D96D91540AE4348889B6D41C31E5AA2C8F969C447FED2A342C2826FD73A5BD02BAA114194FA5D67DD7B99242954DC0325F0CF69474F21DCAC71E9D2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.7..DN^.........." .........P......p..........@.............................p".....@lx}..b..........................................`"......c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\DwpdI\SystemPropertiesRemote.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.06451035203089
Encrypted:	false
SSDEEP:	1536:g1cZZtREC/rMcgEPJV+G57ThjEC0kzJP+V5JO:NZzECTMpuDhjRVJG8
MD5:	70E55B55A17F1D1C4047CC678EB936F0
SHA1:	1E6EB17BE9961F27280EEF306490A42302495E69
SHA-256:	464B613BF38262C4C088068855B557082D1FCA8F697F8C99D77704471069C32B
SHA-512:	72349FD8FE3F64921ECC442CE2F89DB5831B1F573FB5B68F155FF311EF16555FBEEB0C620CA5DB1E165DA4F2620D0CC879A6DE39640268034B137D120DFCC373
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a..[a..[a..[h..[o..[..Z`..[..Zc..[..Zp..[a..[C..[..Zd..[..Z`..[..q[`..[..Z`..[Richa..[........................PE..d...XF............"..........>.................@....................................F.....`.......... .......................................&.......P.. '...@.................. ...."..T............................ ...............!..8............................text............................... ..`.rdata..V.... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc... '...P...(..................@..@.reloc.. ............F..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\WMp\OLEACC.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2256896
Entropy (8bit):	3.382690286745838
Encrypted:	false
SSDEEP:	12288:LVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:KfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	1B56C69AD8B525F4D3BF6E1AEDF17E6E
SHA1:	F512E6D87B458BC362A7B4EB432BBC55F99603CB
SHA-256:	933602A98EC630126C0FF2ECF13001BC8272AF5C780188955A8510404FAEF361
SHA-512:	8B631F3F51F32171BD82209B75EECA6731011DB3D01A676583D5A893C8ABBB78630F7F4211EE2DFA99482FAA042149977D299844424FB6A9BFC316DEE3EF6A1B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.7..DN^.........." .........P......p..........@.............................p".....@lx}..b..........................................`"......c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\WMp\WMPDMC.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1517568
Entropy (8bit):	6.62150533612437
Encrypted:	false
SSDEEP:	24576:esSffc55l2PlDph6LYq3BRf6Te8+n3wAJF1/Mk+F6uwY6V0qRr8kmHVJZh/u:cct2PpphUlxRn3wAblMk+F6+6S2r8/Hu
MD5:	4085FDA375E50214142BD740559F5835
SHA1:	22D548F1E0F4832AAEE3D983A156FDABD3021DA4
SHA-256:	93F61516B7FD3CE8F1E97F25B760BDF62AE58CC7714B559FEFC2C75AD1130804
SHA-512:	7712F8E551D475A9D2FF3BED9992A2B3D53AB01F61DCB7313320181F9EB6B5B84558CCA45AE95150267128C8B228F806F869157B7F4961755076DD83F02E3BDF
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@..................-......*......+....../...../.A.....'.X...........,....Rich...................PE..d...D..9.........."................. ..........@..........................................`.......... ............................................... ..x.......l............0...S..`Y..T....................G..(....F..............8G...............................text.............................. ..`.rdata..Pg.......h..................@..@.data...p=...@.......,..............@....pdata..l............D..............@..@.didat..............................@....rsrc...x.... ......................@..@.reloc...S...0...T..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1189376
Entropy (8bit):	6.169931271903684
Encrypted:	false
SSDEEP:	24576:+pL4Q4y94x7ZWe6b1B5I2M62kM0s1vt2txc/viVO1IORNfLc:uL4Q3S9b6b1UA9MPwOR5c
MD5:	F7E36C20DB953DFF4FDDB817904C0E48
SHA1:	8C6117B5DD68D397FD7C32F4746FB9B353D5DAE5
SHA-256:	2C5EDE0807D8A5EC4B6E0FE0C308B37DBBDE12714FD9ADC4CE3EF4E0A5692207
SHA-512:	32333A33DECD1AF0915FFDC48DA99831DA345010A91630C5245F2548939E33157F6151F596C09D0BEEAC3F15F08F79D4EEF4FAA4158BA023DEDFC4F6F6F56DF8
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:K..[%M.[%M.[%M.?&L.[%M.? L.[%M.?!L.[%M.?$L.[%M.[$M.Z%M.?,L.[%M.?.M.[%M.?'L.[%MRich.[%M........................PE..d...m.>l.........."..........B.................@.....................................=....`.......... ...............................................P.. ........x...........`..`...p-..T...................pI..(...pH...............I...............................text...L........................... ..`.rdata..\| ......."..................@..@.data...@....@...r..."..............@....pdata...x.......z..................@..@.rsrc... ....P......................@..@.reloc..`....`......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Z7wAQ0\VERSION.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2256896
Entropy (8bit):	3.3813315171863225
Encrypted:	false
SSDEEP:	12288:OVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:TfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	1561A1A689F95195D6D24DADD60ACA89
SHA1:	520410E244597D00A4FE8AACDBE064B3DD370F96
SHA-256:	DEAEE22737295F5A0F47F62C91F20CE80614BDBA967FED48C99ADADE428B1406
SHA-512:	6C95EB2724D51FF70FE663647B4D4BEA189A646D742AA6D2EFF9E3F5892BB5EB052351CCA58B189311D73CD883F2493B9F6AECABF7963210F8E787747443CEDA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.7..DN^.........." .........P......p..........@.............................p".....@lx}..b..........................................`".+....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\f49B\BdeUISrv.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	5.7946530792580475
Encrypted:	false
SSDEEP:	768:NS51B2sZMD1mYu/Lr7p0dHkf9abpWnGjTopPjZdWC2bNrHuOKAh/4J99j4ktPUww:J/Yn/Lr7qwYb7/oRjeJh2991t8Yte
MD5:	25D86BC656025F38D6E626B606F1D39D
SHA1:	673F32CCA79DC890ADA1E5A2CF6ECA3EF863629D
SHA-256:	202BEC0F63167ED57FCB55DB48C9830A5323D72C662D9A58B691D16CE4DB8C1E
SHA-512:	D4B4BC411B122499E611E1F9A45FD40EC2ABA23354F261D4668BF0578D30AEC5419568489261FC773ABBB350CC77C1E00F8E7C0B135A1FD4A9B6500825FA6E06
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3..hw.;w.;w.;~.";u.;...:t.;...:`.;...:q.;...:d.;w.;..;...:..;..N;v.;...:v.;Richw.;................PE..d...X............."......v...\......0y.........@............................. ......Db....`.......... ......................................p...................................x......T............................................................................text...At.......v.................. ..`.rdata...3.......4...z..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..x...........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\f49B\WTSAPI32.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2256896
Entropy (8bit):	3.3874708703184213
Encrypted:	false
SSDEEP:	12288:sVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ZfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	2E52AF8975EFA854E1683B74463B6913
SHA1:	A463E30799756FBC830F2F2876EC30AC10CB26BA
SHA-256:	A51730C6B2A93621290BCAB6EC90D1FB72EC90D4C4E24B2A11CD04FF3C16909F
SHA-512:	D5A79940CE2FD45DD946E9D0192F8902B3DBEB44A49E77FDFB293398CB5AE873B1109B63CB066848BDF4962C4BF917381EB8F5BEC364CAAA8C14BF21E57F2C89
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.7..DN^.........." .........P......p..........@.............................p".....@lx}..b..........................................`"......c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\igQ\WTSAPI32.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2256896
Entropy (8bit):	3.387421868586717
Encrypted:	false
SSDEEP:	12288:nVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:OfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	0D2066DE3B0C48AC2327A0FE775FFE6A
SHA1:	522F2FB0DBE0C7109DE245227FC8BFCAA943860A
SHA-256:	14DFF84D1E8A1AF2B2DC387E9484A9DA800214AC5496119DF35E59A0B556441F
SHA-512:	447D722785D2A33232F0B58B1EE4293F653C2A7F6C32AFB3737D0142FE80A665A86912E479D5780985E74C8F394B31175A65000EB0BD3C7AA788DD91587F98CF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.7..DN^.........." .........P......p..........@.............................p".....@lx}..b..........................................`"......c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\igQ\wusa.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	308736
Entropy (8bit):	6.55894801361276
Encrypted:	false
SSDEEP:	6144:TozDd3UafMCFoMVclxM8cVM49UApxyN90vE:ToXd33MCFoqSxM5MmUAy90
MD5:	04CE745559916B99248F266BBF5F9ED9
SHA1:	76FA00103A89C735573D1D8946D8787A839475B6
SHA-256:	1D86701A861FFA88FE050A466E04281A4809C334B16832A84231DC6A5FBC4195
SHA-512:	B4D2EF6B90164E17258F53BCAF954076D02EDB7F496F4F79B2CF7848B90614F6160C8EB008BA5904521DD8B1449840B2D7EE368860E58E01FBEAB9873B654B3A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;..-..~..~..~v./~}.~....}.~....i.~....{.~....d.~..~w.~....k.~..C~~.~....~.~Rich..~................PE..d.....TS.........."......`...X.......f.........@....................................g.....`.......... .......................................I...........T...p..................`....?..T...................Pq..(...Pp..............xq..@............................text...3^.......`.................. ..`.rdata..^....p.......d..............@..@.data........`.......T..............@....pdata.......p.......X..............@..@.rsrc....T.......V...^..............@..@.reloc..`...........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\pjo7Mc7lI\SYSDM.CPL Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2256896
Entropy (8bit):	3.3808861421525056
Encrypted:	false
SSDEEP:	12288:3VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:+fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	3AA64EB2847BBCE9E3C31FA18E7B9F5D
SHA1:	E749026A2F54435991838F4EE146A346A342BA58
SHA-256:	178D81184F3C327ED2BF276E3D00E6C6F3415EEFEA6B3AD6487D038477FCEEDF
SHA-512:	EF128F3770DA7A1B2D2B7E05C305DE5FFECF1D6E4B74C72366A2A0B15545EC0F998DAF3C966E735F89337604B0739A81964C463C37F65127B2C2013D0B8918FE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.7..DN^.........." .........P......p..........@.............................p".....@lx}..b..........................................`"......c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\pjo7Mc7lI\SystemPropertiesRemote.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.06451035203089
Encrypted:	false
SSDEEP:	1536:g1cZZtREC/rMcgEPJV+G57ThjEC0kzJP+V5JO:NZzECTMpuDhjRVJG8
MD5:	70E55B55A17F1D1C4047CC678EB936F0
SHA1:	1E6EB17BE9961F27280EEF306490A42302495E69
SHA-256:	464B613BF38262C4C088068855B557082D1FCA8F697F8C99D77704471069C32B
SHA-512:	72349FD8FE3F64921ECC442CE2F89DB5831B1F573FB5B68F155FF311EF16555FBEEB0C620CA5DB1E165DA4F2620D0CC879A6DE39640268034B137D120DFCC373
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a..[a..[a..[h..[o..[..Z`..[..Zc..[..Zp..[a..[C..[..Zd..[..Z`..[..q[`..[..Z`..[Richa..[........................PE..d...XF............"..........>.................@....................................F.....`.......... .......................................&.......P.. '...@.................. ...."..T............................ ...............!..8............................text............................... ..`.rdata..V.... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc... '...P...(..................@..@.reloc.. ............F..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\qGdjcQqe\WINBRAND.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2256896
Entropy (8bit):	3.3812520581221097
Encrypted:	false
SSDEEP:	12288:VVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:MfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	06FA4A77517150DC152DD03EF202812D
SHA1:	9891B2A841F9EC52F80343AFC0676731492A8ABA
SHA-256:	EFD60F575EDAFA67104912C5398578C69CFCC4618ABD4A4AA29C8A7C1628122D
SHA-512:	B65C1944DD4E0BD2360BF3AAF884A7D6FA3E931EE521CF9A1F8256D7716FFA1DFA8330286BD67FFB48A5C1187AA61B6C4CD680C5B29757E9105EFAA6EABA26D9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.7..DN^.........." .........P......p..........@.............................p".....@lx}..b..........................................`"......c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\qGdjcQqe\pwcreator.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	800768
Entropy (8bit):	5.701025089752158
Encrypted:	false
SSDEEP:	24576:TD+9c2wgjOGTtUNbYYotGatTAcBg9okYyW:kc2wg6GTtUNsAaScBgWDy
MD5:	BF33FA218E0B4F6AEC77616BE0F5DD9D
SHA1:	F3F0A424406B743410F6E5C72209979AC9537FAE
SHA-256:	E7760E07BE5CF608CC10FDDF0AB21E765F36962372BF9DA4360DCB196E08425D
SHA-512:	8BF912B8785DE97757F862A0C327A6BC921A895C79C8D6D593BA79C5450D12382A511BF974A2C01A183CCFA0F612AC4A80D6F346058ED1FB694ED71A43B1122C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... ...NI..NI..NI..MH..NI..JH..NI..KH..NI..OH..NI..OIa~NI..GH,.NI...I..NI..LH..NIRich..NI........PE..d....._.........."..................'.........@.....................................?....`.......... ......................................x6..\|........a.......B...........p......P...T...........................P...............P...(............................text...Q........................... ..`.rdata..............................@..@.data....:...p.......T..............@....pdata...B.......D..................@..@.rsrc....a.......b..................@..@.reloc.......p.......(..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\uHKs6l\Narrator.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	349696
Entropy (8bit):	6.567354682144278
Encrypted:	false
SSDEEP:	3072:2v1g/YrkRsWlO3nWOgV1M2uMFS/BaMiXbAJUoTq7XLtqkXIJA9QD4hLtcRiWh6f3:2vSckvCWOgB6YsyzZBL+RQFgZKUV
MD5:	56036993FB96C42F30C443A11BD56F4D
SHA1:	93367421725D818963F337F179EE61710BB2ABD3
SHA-256:	D3A728CFC32D43A9C96A45EFE6B3B7A21A8435F758C1C382978047982B6ADBB0
SHA-512:	E3DBC40DC7717BB9EC31657126FFA29D69362EE570BAC3D5B31918876261CF9E6954FDB31C2145788FF186E01A29A1696B914B626797CC8BC46F5FCB43D90F23
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E[...[...[...R.B.S...4...U...4...X...4...E...4...B...[.......4...q...4.,.Z...4...Z...4...Z...Rich[...........................PE..d................."......V...........5.........@....................................GV....`.......... ......................................H>..T.......................................T...............................................P............................text....U.......V.................. ..`.rdata..p2...p...4...Z..............@..@.data...h...........................@....pdata..............................@..@.rsrc...............................@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\uHKs6l\WINMM.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2260992
Entropy (8bit):	3.3902758972646265
Encrypted:	false
SSDEEP:	12288:UVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:RfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	BE85B26E12C6BFA0503499448FD81878
SHA1:	B12FDE317045637F7FF332C8FF422CFE5FFE7BDB
SHA-256:	9A6A55C16D44315902FAFB6FE507AF04CB7CD8A3F1286DB3C9ED030C6430947E
SHA-512:	B007EB34865787E8A40CFB6BD4F2D83F6985EA74E2A87ABB8CCBD1403D468607685E1863F155E956EBA3CDA04DCD3C0658DF140FF602D0E8864F5076DE638B5D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.7..DN^.........." .........`......p..........@..............................".....@lx}..b..........................................`".h....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\ukxAYmxLA\LockScreenContentServer.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47600
Entropy (8bit):	6.182394161787695
Encrypted:	false
SSDEEP:	768:0SD9dkiWX/i7Ek29r9Hu53ldEkUZGYP7loL1Prco:pVKFudldlUZGYP7loPwo
MD5:	45E51238434FAF543D66E17EF3783413
SHA1:	1CE0BA884E5C2ADA74A34D10F32A5E7431C66411
SHA-256:	DAFF63C2C374463E0CF476B5CBADF2D58D0DADE0BB0C29DDAE543A69BA34FB93
SHA-512:	353467F3477B136909C1AD0206A3E9CA84AC9104B386529345BBEBABFCA1B3239F6C0B387C2C1018B937885144D43ACAADA264EB4D266B815A632A3DFEDEB331
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........4E..gE..gE..gL.4gg..g..fG..g..fQ..g..fB..g..fT..gE..g...g..fC..g.XgD..g*..fD..gRichE..g................PE..d...\|dV..........."......>...Z.......@.........@..........................................`.......... .......................................h.......... ................#......L....a..T....................U..(....T...............U...............................text....<.......>.................. ..`.rdata..`@...P...B...B..............@..@.data...............................@....pdata..............................@..@.rsrc... ...........................@..@.reloc..L...........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\ukxAYmxLA\dwmapi.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2256896
Entropy (8bit):	3.3857591682018664
Encrypted:	false
SSDEEP:	12288:iVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:/fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	12B57CCEEB262F2166C8F5A2F255ABCE
SHA1:	C53EE689A89C945AE1065152258DDB0C49620E5D
SHA-256:	3DE50E5768723366E847A5F1076086F7DB7A6CDF9A564FF247043531B6162386
SHA-512:	08068C34FD911B25C43EC11E579C3D5CAD6AE8A27D6BA8D8B3F5267F59C3F0B700EA2FE135444D3B011D9A9DB63DADC5051204BB681703A02ED6FF22F6F70C88
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.7..DN^.........." .........P......p..........@.............................p".....@lx}..b..........................................`".&....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\vbVu\WINMM.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2260992
Entropy (8bit):	3.390257188753584
Encrypted:	false
SSDEEP:	12288:WVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:LfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	B6BF5C2E91887A902462C7E8621E0004
SHA1:	5EF91A0F0E0DBBB56E9B55EAD19BEAA3CA6C678B
SHA-256:	7A25516846C100F6954FA8A40D73F0834F3D8FC4BE872F53DDA16F11951B853C
SHA-512:	52E7431379523CC35512FF391FB86ADE97F5F8B89F0D96781A180C52EDDB33811D4BC84D31790B924FC560E1916C368EC060AFAD6115052E4967181CD6837EEB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.7..DN^.........." .........`......p..........@..............................".....@lx}..b..........................................`".h....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\vbVu\mspaint.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6780928
Entropy (8bit):	6.184072371216434
Encrypted:	false
SSDEEP:	98304:ez2u7InCOgQwyRPM1mlawYL260GBGrGrGWAub7jPhivQ:ez6n/gQw4MIlawYVb7jP8v
MD5:	99F86A0D360FD9A3FCAD6B1E7D92A90C
SHA1:	65F36247C0FFBB881947F68B352128C0C9CFCBE5
SHA-256:	D46519B76D09DFF8BC5C7B34A4E73AD8E7CF6E4C40BDAD6C769E34A099ECE017
SHA-512:	5071487AA218712FBA3A1FCEA6A810C3B27D26A145BC728315CA8078B6A88E51989038CAE4F5EE494B1FEE7515C6E86742D280D1A763B044BDBE7D2E360124A9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................;...............................o............W..........Rich............PE..d.....S..........."......j...<^.....0..........@..............................g......_h...`.......... ......................................X........p..`BY......f............g.....,..T....................9..(... ................:..("......@....................text....i.......j.................. ..`.rdata...............n..............@..@.data........`...P...L..............@....pdata...f.......h..................@..@.didat..h....`......................@....rsrc...`BY..p...DY.................@..@.reloc.......g..,...Lg.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\89dad5d484a9f889a3a8dfca823edc3e_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	4447
Entropy (8bit):	5.485455297414369
Encrypted:	false
SSDEEP:	48:JZC1UowElfeoaBJOQfbe+uowEViZC1UowEsxOvNeGQotxnToRowEMhgB:JcB3lfefJOQfy+X3VicB3sU9fTou3MiB
MD5:	94883D0CAF88428A2154B4F79D3E2671
SHA1:	4990F6F80F7422B65130FF1D54DBB1B9EDE66F09
SHA-256:	BD29BBB8364271950A6B4BD3119F038011F0A5FF3042462D403784837EBA53CF
SHA-512:	9456E0E76003FC754D686752771E6A10C69F7D7666483A903C7591723B5E738F11A3F8CCD2DCF9C78059DF66853DA0E00B32CA9EB386ADE9F742D04D35C11923
Malicious:	false
Reputation:	unknown
Preview:	........................................user.........................................user.....................RSA1................)..........).:..J..X.m1.).de._8.]..9..4.=s.s...lG.7G.Uf.J..+.......j.i.]A.%m+\-X.........{..b....em...S`.9.I...'..P......................z..O........E..._D.2....".....,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ...K..Ye..".....6.W.(......2e.4=............. ....zN.Z............X.]{...=.H_.....1.u?.....+(...T.. 1..&.(.`!.........G.l......uS...@..E..V.TZ......_.v.....ok.......&..>eL...`.C.}./Z..u/..^..0.#..ucJ.M9.s.=...N....L..L..]....d..b.E]..6...p....@7....Z..r..n.n.,v.5..asogC....um+8..i.5..._)...O.s.H.c.......V.H...)..!.s{/...m.a.4..~!.../.#7..9....%-q0....].....a.TN.. ..\..p..w..C...L.........+ .j.}1...%.\|t.J...g.~... .>...}..!....r.c.._.Y.zE}.3... ...=...r~M.1....E.Y#3.W...@....~.J...}.0.cU..o...m.7'..\y[..M.@! ........~L.&]).?+9..v,~.o.(.c...i....2.....H.L.u.;\q....U.l....f>..B`..5... #/[.

Static File Info

General
File type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Entropy (8bit):	4.317932567104927
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	CiEceGPoOR.dll
File size:	2252800
MD5:	2ab698a4e7608708ae2a693966194322
SHA1:	300f4d7d2f462dac7e6ab333d8783bab4f371316
SHA256:	3e814c52ab51985ebaf91bff6baeb9eab08c85529bf09f4a069803a4ee984572
SHA512:	2bdce7f070a92e50089af42f087a18516cc465c45169d9877337f8cdd4d93abcdb227c0c55bc29625db1ad28c299f96c5482b0e4e8329a027b92a6aa9c420623
SSDEEP:	12288:wVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1Cp3A:1fP7fWsK5z9A+WGAW+V5SB6Ct4bnbW
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|.

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x140041070
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x5E4E44CC [Thu Feb 20 08:35:24 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6668be91e2c948b183827f040944057f

Entrypoint Preview

Instruction
dec eax
xor eax, eax
dec eax
add eax, 5Ah
dec eax
mov dword ptr [00073D82h], ecx
dec eax
lea ecx, dword ptr [FFFFECABh]
dec eax
mov dword ptr [00073D7Ch], edx
dec eax
add eax, ecx
dec esp
mov dword ptr [00073D92h], ecx
dec esp
mov dword ptr [00073DA3h], ebp
dec esp
mov dword ptr [00073D7Ch], eax
dec esp
mov dword ptr [00073D85h], edi
dec esp
mov dword ptr [00073D86h], esi
dec esp
mov dword ptr [00073D8Fh], esp
dec eax
mov ecx, eax
dec eax
sub ecx, 5Ah
dec eax
mov dword ptr [00073D89h], esi
dec eax
test eax, eax
je 00007F1FE0BFCDBFh
dec eax
mov dword ptr [00073D45h], esp
dec eax
mov dword ptr [00073D36h], ebp
dec eax
mov dword ptr [00073D7Fh], ebx
dec eax
mov dword ptr [00073D70h], edi
dec eax
test eax, eax
je 00007F1FE0BFCD9Eh
jmp ecx
dec eax
add edi, ecx
dec eax
mov dword ptr [FFFFEC37h], ecx
dec eax
xor ecx, eax
jmp ecx
retn 0008h
ud2
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebx
dec eax
sub esp, 00000080h
mov eax, F957B016h
mov byte ptr [esp+7Fh], 00000037h
mov edx, dword ptr [esp+78h]
inc ecx
mov eax, edx
inc ecx
or eax, 5D262B0Ch
inc esp
mov dword ptr [esp+78h], eax
dec eax
mov dword ptr [eax+eax+00h], 00000000h

Rich Headers

Programming Language:

[LNK] VS2012 UPD4 build 61030
[ASM] VS2013 UPD2 build 30501
[ C ] VS2012 UPD2 build 60315
[C++] VS2013 UPD4 build 31101
[RES] VS2012 UPD3 build 60610
[LNK] VS2017 v15.5.4 build 25834
[ C ] VS2017 v15.5.4 build 25834
[ASM] VS2010 build 30319
[EXP] VS2015 UPD1 build 23506
[IMP] VS2008 SP1 build 30729
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD2 build 60315
[C++] VS2015 UPD1 build 23506
[ C ] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1e0010	0x451b2	.cxkr
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa6390	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc0000	0x468	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc1000	0x2324	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x42000	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x40796	0x41000	False	0.776085486779	data	7.73364605679	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x42000	0x64f2c	0x65000	False	0.702390160891	data	7.86574512659	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa7000	0x178b8	0x18000	False	0.0694580078125	data	3.31515306295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0xbf000	0x12c	0x1000	False	0.06005859375	PEX Binary Archive	0.581723022719	IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc0000	0x880	0x1000	False	0.139892578125	data	1.23838501563	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc1000	0x2324	0x3000	False	0.0498046875	data	4.65321444248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.qkm	0xc4000	0x74a	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.cvjb	0xc5000	0x1e66	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tlmkv	0xc7000	0xbde	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.wucsxe	0xc8000	0x45174	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.fltwtj	0x10e000	0x1267	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.sfplio	0x110000	0x736	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rpg	0x111000	0x45174	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bewzc	0x157000	0x1124	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vksvaw	0x159000	0x736	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.wmhg	0x15a000	0x1278	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.kswemc	0x15c000	0x36d	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.kaxfk	0x15d000	0x197d	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pjf	0x15f000	0xbde	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.retjqj	0x160000	0x7fd	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.mizn	0x161000	0x9cd	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrub	0x162000	0x197d	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.susbqq	0x164000	0x6cd0	0x7000	False	0.00177873883929	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.jeojcw	0x16b000	0x13e	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vwl	0x16c000	0xae7	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.mub	0x16d000	0x6cd0	0x7000	False	0.00177873883929	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xwxpmb	0x174000	0x573	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.aea	0x175000	0x7fd	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.lwpch	0x176000	0x7fd	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.nzgp	0x177000	0x1f7	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.qimx	0x178000	0x13e	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.jbqbr	0x179000	0x1f7	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.kxxxil	0x17a000	0xbf6	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.drpaa	0x17b000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.lepjc	0x17c000	0x1f7	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.txam	0x17d000	0x45174	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vqjcpr	0x1c3000	0x128f	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vvwma	0x1c5000	0x6cd0	0x7000	False	0.00177873883929	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pinm	0x1cc000	0x6ec	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.eowj	0x1cd000	0xbf6	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.dzlhaa	0x1ce000	0x896	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ncnf	0x1cf000	0x42a	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vqes	0x1d0000	0x1124	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rtu	0x1d2000	0x197d	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.qlvquw	0x1d4000	0x13e	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.nzjn	0x1d5000	0x1278	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.dfwg	0x1d7000	0x1e66	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.zypdk	0x1d9000	0x5a7	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ufvfoh	0x1da000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.efst	0x1db000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.dfk	0x1dc000	0x5a7	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.mxubr	0x1dd000	0x197d	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.zqcgin	0x1df000	0x2da	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.cxkr	0x1e0000	0x451c2	0x46000	False	0.218610491071	data	5.76270152146	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xc00a0	0x370	data	English	United States
RT_MANIFEST	0xc0410	0x56	ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
USER32.dll	LookupIconIdFromDirectoryEx, WaitForInputIdle, GetParent, GetFocus
SETUPAPI.dll	CM_Get_Resource_Conflict_DetailsW
KERNEL32.dll	DeleteCriticalSection, DeleteTimerQueue, TerminateJobObject, GetFileInformationByHandle, GetThreadLocale, GetNamedPipeServerProcessId, GetConsoleFontSize
GDI32.dll	CreateBitmapIndirect, GetPolyFillMode
CRYPT32.dll	CertGetCTLContextProperty
ADVAPI32.dll	AddAccessDeniedObjectAce
SHLWAPI.dll	ChrCmpIW

Exports

Name	Ordinal	Address
??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ	1	0x14001a1c8
??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ	2	0x140017a64
??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ	3	0x14002fb50
??0?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@QEAA@XZ	4	0x14002d76c
??0?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@QEAA@XZ	5	0x14000c748
??0?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@QEAA@XZ	6	0x14000d290
??0?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@QEAA@XZ	7	0x140020b08
??0?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@QEAA@XZ	8	0x14001d9e0
??0?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@QEAA@XZ	9	0x14001d498
??0?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@QEAA@XZ	10	0x140041250
??0?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@QEAA@XZ	11	0x140017d4c
??0?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@QEAA@XZ	12	0x140003784
??0?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@QEAA@XZ	13	0x1400248fc
??0?$SafeArrayAccessor@H@DirectUI@@QEAA@XZ	14	0x14001fb98
??0AccessibleButton@DirectUI@@QEAA@$$QEAV01@@Z	15	0x14001502c
??0AccessibleButton@DirectUI@@QEAA@AEBV01@@Z	16	0x1400300e4
??0AccessibleButton@DirectUI@@QEAA@XZ	17	0x140017f08
??0AnimationStrip@DirectUI@@QEAA@AEBV01@@Z	18	0x140004d54
??0AnimationStrip@DirectUI@@QEAA@XZ	19	0x14002ba2c
??0AutoButton@DirectUI@@QEAA@$$QEAV01@@Z	20	0x1400315e0
??0AutoButton@DirectUI@@QEAA@AEBV01@@Z	21	0x140040768
??0AutoButton@DirectUI@@QEAA@XZ	22	0x14000f348
??0AutoLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z	23	0x14003bc94
??0AutoThread@DirectUI@@QEAA@XZ	24	0x140022e5c
??0AutoVariant@DirectUI@@QEAA@XZ	25	0x140010340
??0BaseScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	26	0x1400256d4
??0BaseScrollBar@DirectUI@@QEAA@AEBV01@@Z	27	0x14001b8c4
??0BaseScrollBar@DirectUI@@QEAA@XZ	28	0x1400206c4
??0BaseScrollViewer@DirectUI@@QEAA@AEBV01@@Z	29	0x14001c07c
??0BaseScrollViewer@DirectUI@@QEAA@XZ	30	0x140007744
??0Bind@DirectUI@@QEAA@$$QEAV01@@Z	31	0x140029d84
??0Bind@DirectUI@@QEAA@AEBV01@@Z	32	0x140029f50
??0Bind@DirectUI@@QEAA@XZ	33	0x1400030e8
??0BorderLayout@DirectUI@@QEAA@AEBV01@@Z	34	0x1400159c8
??0BorderLayout@DirectUI@@QEAA@XZ	35	0x140039174
??0Browser@DirectUI@@QEAA@$$QEAV01@@Z	36	0x1400226c4
??0Browser@DirectUI@@QEAA@AEBV01@@Z	37	0x14003767c
??0Browser@DirectUI@@QEAA@XZ	38	0x1400314ec
??0BrowserSelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z	39	0x14003badc
??0BrowserSelectionProxy@DirectUI@@QEAA@AEBV01@@Z	40	0x140034c18
??0BrowserSelectionProxy@DirectUI@@QEAA@XZ	41	0x140040d14
??0Button@DirectUI@@QEAA@AEBV01@@Z	42	0x14002b1cc
??0Button@DirectUI@@QEAA@XZ	43	0x14003b630
??0CCAVI@DirectUI@@QEAA@$$QEAV01@@Z	44	0x140031180
??0CCAVI@DirectUI@@QEAA@AEBV01@@Z	45	0x140020910
??0CCAVI@DirectUI@@QEAA@XZ	46	0x140011c98
??0CCBase@DirectUI@@QEAA@AEBV01@@Z	47	0x14001c6cc
??0CCBase@DirectUI@@QEAA@KPEBG@Z	48	0x14003a9ac
??0CCBaseCheckRadioButton@DirectUI@@QEAA@$$QEAV01@@Z	49	0x140009ae4
??0CCBaseCheckRadioButton@DirectUI@@QEAA@AEBV01@@Z	50	0x1400072c8
??0CCBaseCheckRadioButton@DirectUI@@QEAA@K@Z	51	0x140013b34
??0CCBaseScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	52	0x140020158
??0CCBaseScrollBar@DirectUI@@QEAA@AEBV01@@Z	53	0x14002511c
??0CCBaseScrollBar@DirectUI@@QEAA@K@Z	54	0x14003482c
??0CCCheckBox@DirectUI@@QEAA@$$QEAV01@@Z	55	0x1400031d4
??0CCCheckBox@DirectUI@@QEAA@AEBV01@@Z	56	0x140017dd4
??0CCCheckBox@DirectUI@@QEAA@K@Z	57	0x14002d210
??0CCCommandLink@DirectUI@@QEAA@$$QEAV01@@Z	58	0x140002754
??0CCCommandLink@DirectUI@@QEAA@AEBV01@@Z	59	0x140002238
??0CCCommandLink@DirectUI@@QEAA@K@Z	60	0x14002e2c0
??0CCHScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	61	0x14003aa7c
??0CCHScrollBar@DirectUI@@QEAA@AEBV01@@Z	62	0x14002047c
??0CCHScrollBar@DirectUI@@QEAA@XZ	63	0x1400036d8
??0CCListBox@DirectUI@@QEAA@$$QEAV01@@Z	64	0x14003fdd8
??0CCListBox@DirectUI@@QEAA@AEBV01@@Z	65	0x14002ed28
??0CCListBox@DirectUI@@QEAA@XZ	66	0x14000ac3c
??0CCListView@DirectUI@@QEAA@$$QEAV01@@Z	67	0x14002894c
??0CCListView@DirectUI@@QEAA@AEBV01@@Z	68	0x140030728
??0CCListView@DirectUI@@QEAA@XZ	69	0x140008db4
??0CCProgressBar@DirectUI@@QEAA@$$QEAV01@@Z	70	0x14000d0c4
??0CCProgressBar@DirectUI@@QEAA@AEBV01@@Z	71	0x140017484
??0CCProgressBar@DirectUI@@QEAA@XZ	72	0x140002b18
??0CCPushButton@DirectUI@@QEAA@$$QEAV01@@Z	73	0x14000a868
??0CCPushButton@DirectUI@@QEAA@AEBV01@@Z	74	0x14001a868
??0CCPushButton@DirectUI@@QEAA@K@Z	75	0x14003e1b8
??0CCRadioButton@DirectUI@@QEAA@$$QEAV01@@Z	76	0x14001bbfc
??0CCRadioButton@DirectUI@@QEAA@AEBV01@@Z	77	0x140008fe4
??0CCRadioButton@DirectUI@@QEAA@XZ	78	0x14001c020
??0CCSysLink@DirectUI@@QEAA@$$QEAV01@@Z	79	0x14002f1f8
??0CCSysLink@DirectUI@@QEAA@AEBV01@@Z	80	0x14003219c
??0CCSysLink@DirectUI@@QEAA@XZ	81	0x140016a14
??0CCTrackBar@DirectUI@@QEAA@$$QEAV01@@Z	82	0x140029f64
??0CCTrackBar@DirectUI@@QEAA@AEBV01@@Z	83	0x140002500
??0CCTrackBar@DirectUI@@QEAA@XZ	84	0x14001f160
??0CCTreeView@DirectUI@@QEAA@$$QEAV01@@Z	85	0x1400354ac
??0CCTreeView@DirectUI@@QEAA@AEBV01@@Z	86	0x14000f44c
??0CCTreeView@DirectUI@@QEAA@K@Z	87	0x140009aa8
??0CCVScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	88	0x1400177b4
??0CCVScrollBar@DirectUI@@QEAA@AEBV01@@Z	89	0x1400101dc
??0CCVScrollBar@DirectUI@@QEAA@XZ	90	0x14003c704
??0CallstackTracker@DirectUI@@QEAA@XZ	91	0x14001f9d8
??0CheckBoxGlyph@DirectUI@@QEAA@AEBV01@@Z	92	0x14001f1c8
??0CheckBoxGlyph@DirectUI@@QEAA@XZ	93	0x140026dc4
??0ClassInfoBase@DirectUI@@QEAA@AEBV01@@Z	94	0x14000714c
??0ClassInfoBase@DirectUI@@QEAA@XZ	95	0x14002de2c
??0Clipper@DirectUI@@QEAA@$$QEAV01@@Z	96	0x140007a9c
??0Clipper@DirectUI@@QEAA@AEBV01@@Z	97	0x14002aecc
??0Clipper@DirectUI@@QEAA@XZ	98	0x14001ae34
??0Combobox@DirectUI@@QEAA@AEBV01@@Z	99	0x14002da18
??0Combobox@DirectUI@@QEAA@XZ	100	0x140038c68
??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z	101	0x14000d2cc
??0DCSurface@DirectUI@@QEAA@AEBV01@@Z	102	0x1400323f0
??0DCSurface@DirectUI@@QEAA@PEAUHDC__@@@Z	103	0x14003de18
??0DUIFactory@DirectUI@@QEAA@PEAUHWND__@@@Z	104	0x140015fec
??0DUIXmlParser@DirectUI@@QEAA@AEBV01@@Z	105	0x140024380
??0DUIXmlParser@DirectUI@@QEAA@XZ	106	0x1400164f4
??0DialogElement@DirectUI@@QEAA@$$QEAV01@@Z	107	0x14000a9cc
??0DialogElement@DirectUI@@QEAA@AEBV01@@Z	108	0x140006550
??0DialogElement@DirectUI@@QEAA@XZ	109	0x1400163f8
??0DuiAccessible@DirectUI@@QEAA@XZ	110	0x140004798
??0Edit@DirectUI@@QEAA@AEBV01@@Z	111	0x140014f18
??0Edit@DirectUI@@QEAA@XZ	112	0x14003d7dc
??0Element@DirectUI@@QEAA@AEBV01@@Z	113	0x14000d60c
??0Element@DirectUI@@QEAA@XZ	114	0x140014d8c
??0ElementProvider@DirectUI@@QEAA@XZ	115	0x140001080
??0ElementProxy@DirectUI@@IEAA@XZ	116	0x140025778
??0ElementProxy@DirectUI@@QEAA@$$QEAV01@@Z	117	0x140020804
??0ElementProxy@DirectUI@@QEAA@AEBV01@@Z	118	0x140017114
??0ElementWithHWND@DirectUI@@QEAA@$$QEAV01@@Z	119	0x14001b198
??0ElementWithHWND@DirectUI@@QEAA@AEBV01@@Z	120	0x14000e910
??0ElementWithHWND@DirectUI@@QEAA@XZ	121	0x14002f0d4
??0ExpandCollapseProvider@DirectUI@@QEAA@XZ	122	0x1400362e8
??0ExpandCollapseProxy@DirectUI@@QEAA@$$QEAV01@@Z	123	0x14003434c
??0ExpandCollapseProxy@DirectUI@@QEAA@AEBV01@@Z	124	0x140037424
??0ExpandCollapseProxy@DirectUI@@QEAA@XZ	125	0x140038044
??0Expandable@DirectUI@@QEAA@$$QEAV01@@Z	126	0x140027120
??0Expandable@DirectUI@@QEAA@AEBV01@@Z	127	0x14001f5c0
??0Expandable@DirectUI@@QEAA@XZ	128	0x14002e5b4
??0Expando@DirectUI@@QEAA@$$QEAV01@@Z	129	0x1400029f0
??0Expando@DirectUI@@QEAA@AEBV01@@Z	130	0x1400198a4
??0Expando@DirectUI@@QEAA@XZ	131	0x140013d8c
??0ExpandoButtonGlyph@DirectUI@@QEAA@AEBV01@@Z	132	0x140016aec
??0ExpandoButtonGlyph@DirectUI@@QEAA@XZ	133	0x14000441c
??0FillLayout@DirectUI@@QEAA@AEBV01@@Z	134	0x1400099c0
??0FillLayout@DirectUI@@QEAA@XZ	135	0x140020094
??0FlowLayout@DirectUI@@QEAA@AEBV01@@Z	136	0x14002203c
??0FlowLayout@DirectUI@@QEAA@XZ	137	0x140033100
??0FontCache@DirectUI@@QEAA@$$QEAV01@@Z	138	0x14000ab30
??0FontCache@DirectUI@@QEAA@AEBV01@@Z	139	0x140016a80
??0FontCache@DirectUI@@QEAA@XZ	140	0x14003b874
??0FontCheckOut@DirectUI@@QEAA@PEAVElement@1@PEAUHDC__@@@Z	141	0x140012320
??0GridItemProvider@DirectUI@@QEAA@XZ	142	0x1400312d8
??0GridItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	143	0x140024900
??0GridItemProxy@DirectUI@@QEAA@AEBV01@@Z	144	0x140026f94
??0GridItemProxy@DirectUI@@QEAA@XZ	145	0x14000f9e0
??0GridLayout@DirectUI@@QEAA@AEBV01@@Z	146	0x14003fb50
??0GridLayout@DirectUI@@QEAA@XZ	147	0x14002b680
??0GridProvider@DirectUI@@QEAA@XZ	148	0x140011e60
??0GridProxy@DirectUI@@QEAA@$$QEAV01@@Z	149	0x140024a9c
??0GridProxy@DirectUI@@QEAA@AEBV01@@Z	150	0x14002a640
??0GridProxy@DirectUI@@QEAA@XZ	151	0x14002dd70
??0HWNDElement@DirectUI@@QEAA@AEBV01@@Z	152	0x140007d6c
??0HWNDElement@DirectUI@@QEAA@XZ	153	0x140030fec
??0HWNDElementAccessible@DirectUI@@QEAA@XZ	154	0x14002cf6c
??0HWNDElementProvider@DirectUI@@QEAA@XZ	155	0x14000c908
??0HWNDElementProxy@DirectUI@@IEAA@XZ	156	0x140037340
??0HWNDElementProxy@DirectUI@@QEAA@$$QEAV01@@Z	157	0x14002a8b8
??0HWNDElementProxy@DirectUI@@QEAA@AEBV01@@Z	158	0x14001be44
??0HWNDHost@DirectUI@@QEAA@AEBV01@@Z	159	0x140033620
??0HWNDHost@DirectUI@@QEAA@XZ	160	0x14001d770
??0HWNDHostAccessible@DirectUI@@QEAA@XZ	161	0x14002bf3c
??0HWNDHostClientAccessible@DirectUI@@QEAA@XZ	162	0x14000b0c4
??0IDataEngine@DirectUI@@QEAA@AEBU01@@Z	163	0x140010fb8
??0IDataEngine@DirectUI@@QEAA@XZ	164	0x140033808
??0IDataEntry@DirectUI@@QEAA@AEBU01@@Z	165	0x140037080
??0IDataEntry@DirectUI@@QEAA@XZ	166	0x140011864
??0IProvider@DirectUI@@QEAA@$$QEAV01@@Z	167	0x14003d6a4
??0IProvider@DirectUI@@QEAA@AEBV01@@Z	168	0x140030024
??0IProvider@DirectUI@@QEAA@XZ	169	0x140016f70
??0ISBLeak@DirectUI@@QEAA@$$QEAU01@@Z	170	0x140013ca0
??0ISBLeak@DirectUI@@QEAA@AEBU01@@Z	171	0x140018d64
??0ISBLeak@DirectUI@@QEAA@XZ	172	0x140011bc8
??0IXElementCP@DirectUI@@QEAA@$$QEAV01@@Z	173	0x14003e0e8
??0IXElementCP@DirectUI@@QEAA@AEBV01@@Z	174	0x140011fd4
??0IXElementCP@DirectUI@@QEAA@XZ	175	0x14001c29c
??0IXProviderCP@DirectUI@@QEAA@$$QEAV01@@Z	176	0x14003e830
??0IXProviderCP@DirectUI@@QEAA@AEBV01@@Z	177	0x14003edc0
??0IXProviderCP@DirectUI@@QEAA@XZ	178	0x140001684
??0InvokeHelper@DirectUI@@QEAA@XZ	179	0x140029800
??0InvokeProvider@DirectUI@@QEAA@XZ	180	0x14003b09c
??0InvokeProxy@DirectUI@@QEAA@$$QEAV01@@Z	181	0x14003fa5c
??0InvokeProxy@DirectUI@@QEAA@AEBV01@@Z	182	0x14003736c
??0InvokeProxy@DirectUI@@QEAA@XZ	183	0x14002874c
??0ItemList@DirectUI@@QEAA@XZ	184	0x14001f8a8
??0Layout@DirectUI@@QEAA@AEBV01@@Z	185	0x14001d4d4
??0Layout@DirectUI@@QEAA@XZ	186	0x140027648
??0LinkedList@DirectUI@@QEAA@XZ	187	0x1400277fc
??0Macro@DirectUI@@QEAA@$$QEAV01@@Z	188	0x14001e55c
??0Macro@DirectUI@@QEAA@AEBV01@@Z	189	0x140001d78
??0Macro@DirectUI@@QEAA@XZ	190	0x14002a8a4
??0ModernProgressBar@DirectUI@@QEAA@XZ	191	0x14001bab0
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	192	0x140034c68
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	193	0x140031614
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@XZ	194	0x14003b640
??0ModernProgressRing@DirectUI@@QEAA@XZ	195	0x140031bd8
??0Movie@DirectUI@@QEAA@AEBV01@@Z	196	0x140001430
??0Movie@DirectUI@@QEAA@XZ	197	0x140017a90
??0NativeHWNDHost@DirectUI@@QEAA@AEBV01@@Z	198	0x14002e858
??0NativeHWNDHost@DirectUI@@QEAA@XZ	199	0x14000178c
??0Navigator@DirectUI@@QEAA@$$QEAV01@@Z	200	0x14000dcf0
??0Navigator@DirectUI@@QEAA@AEBV01@@Z	201	0x140029cd4
??0Navigator@DirectUI@@QEAA@XZ	202	0x14003785c
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	203	0x140035b74
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z	204	0x140016f8c
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@XZ	205	0x14002a390
??0NineGridLayout@DirectUI@@QEAA@AEBV01@@Z	206	0x140004a44
??0NineGridLayout@DirectUI@@QEAA@XZ	207	0x140015ee4
??0PText@DirectUI@@QEAA@AEBV01@@Z	208	0x140025828
??0PText@DirectUI@@QEAA@XZ	209	0x14000fee0
??0Page@DirectUI@@QEAA@$$QEAV01@@Z	210	0x14000b244
??0Page@DirectUI@@QEAA@AEBV01@@Z	211	0x14000cc14
??0Page@DirectUI@@QEAA@XZ	212	0x140019254
??0Pages@DirectUI@@QEAA@$$QEAV01@@Z	213	0x14003f5d4
??0Pages@DirectUI@@QEAA@AEBV01@@Z	214	0x14003be80
??0Pages@DirectUI@@QEAA@XZ	215	0x14003d1f8
??0Progress@DirectUI@@QEAA@AEBV01@@Z	216	0x140018a7c
??0Progress@DirectUI@@QEAA@XZ	217	0x140017450
??0ProgressRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	218	0x14003449c
??0ProgressRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	219	0x140025d40
??0ProgressRangeValueProxy@DirectUI@@QEAA@XZ	220	0x140034968
??0ProviderProxy@DirectUI@@IEAA@XZ	221	0x14003ac04
??0ProviderProxy@DirectUI@@QEAA@$$QEAV01@@Z	222	0x14001f754
??0ProviderProxy@DirectUI@@QEAA@AEBV01@@Z	223	0x14003e45c
??0Proxy@DirectUI@@QEAA@AEBV01@@Z	224	0x140030640
??0Proxy@DirectUI@@QEAA@XZ	225	0x1400018d4
??0PushButton@DirectUI@@QEAA@$$QEAV01@@Z	226	0x140017a80
??0PushButton@DirectUI@@QEAA@AEBV01@@Z	227	0x140021e70
??0PushButton@DirectUI@@QEAA@XZ	228	0x14003d9d0
??0RadioButtonGlyph@DirectUI@@QEAA@AEBV01@@Z	229	0x1400165b0
??0RadioButtonGlyph@DirectUI@@QEAA@XZ	230	0x140039e2c
??0RangeValueProvider@DirectUI@@QEAA@XZ	231	0x1400098b8
??0RangeValueProxy@DirectUI@@IEAA@XZ	232	0x140004acc
??0RangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	233	0x1400143b0
??0RangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	234	0x140002d28
??0RefPointElement@DirectUI@@QEAA@AEBV01@@Z	235	0x1400018d8
??0RefPointElement@DirectUI@@QEAA@XZ	236	0x14000298c
??0RefcountBase@DirectUI@@QEAA@XZ	237	0x14000f6d8
??0RepeatButton@DirectUI@@QEAA@AEBV01@@Z	238	0x140029920
??0RepeatButton@DirectUI@@QEAA@XZ	239	0x14003bf74
??0Repeater@DirectUI@@QEAA@$$QEAV01@@Z	240	0x140010c00
??0Repeater@DirectUI@@QEAA@AEBV01@@Z	241	0x1400044e8
??0Repeater@DirectUI@@QEAA@XZ	242	0x14003d478
??0ResourceModuleHandles@DirectUI@@QEAA@XZ	243	0x140021480
??0RichText@DirectUI@@QEAA@XZ	244	0x140023d18
??0RowLayout@DirectUI@@QEAA@AEBV01@@Z	245	0x14003b0a8
??0RowLayout@DirectUI@@QEAA@XZ	246	0x140024588
??0ScrollBar@DirectUI@@QEAA@AEBV01@@Z	247	0x140036550
??0ScrollBar@DirectUI@@QEAA@XZ	248	0x140037078
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	249	0x14000f824
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	250	0x140001484
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@XZ	251	0x14001db1c
??0ScrollItemProvider@DirectUI@@QEAA@XZ	252	0x140033c90
??0ScrollItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	253	0x1400267bc
??0ScrollItemProxy@DirectUI@@QEAA@AEBV01@@Z	254	0x14003b6f4
??0ScrollItemProxy@DirectUI@@QEAA@XZ	255	0x140017cf0
??0ScrollProvider@DirectUI@@QEAA@XZ	256	0x140027450
??0ScrollProxy@DirectUI@@QEAA@$$QEAV01@@Z	257	0x140008474
??0ScrollProxy@DirectUI@@QEAA@AEBV01@@Z	258	0x14001d8fc
??0ScrollProxy@DirectUI@@QEAA@XZ	259	0x140002b24
??0ScrollViewer@DirectUI@@QEAA@AEBV01@@Z	260	0x1400142a8
??0ScrollViewer@DirectUI@@QEAA@XZ	261	0x14003d0e8
??0SelectionItemProvider@DirectUI@@QEAA@XZ	262	0x14002ff5c
??0SelectionItemProxy@DirectUI@@IEAA@XZ	263	0x14003d208
??0SelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	264	0x14001e530
??0SelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z	265	0x140040690
??0SelectionProvider@DirectUI@@QEAA@XZ	266	0x14000ff6c
??0SelectionProxy@DirectUI@@IEAA@XZ	267	0x14003bc44
??0SelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z	268	0x140011980
??0SelectionProxy@DirectUI@@QEAA@AEBV01@@Z	269	0x140022c88
??0Selector@DirectUI@@QEAA@AEBV01@@Z	270	0x14001dfa8
??0Selector@DirectUI@@QEAA@XZ	271	0x14002e18c
??0SelectorNoDefault@DirectUI@@QEAA@$$QEAV01@@Z	272	0x14002b764
??0SelectorNoDefault@DirectUI@@QEAA@AEBV01@@Z	273	0x140032f7c
??0SelectorNoDefault@DirectUI@@QEAA@XZ	274	0x14001a070
??0SelectorSelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	275	0x1400325e8
??0SelectorSelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z	276	0x140038ec0
??0SelectorSelectionItemProxy@DirectUI@@QEAA@XZ	277	0x14002deec
??0SelectorSelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z	278	0x14002f690
??0SelectorSelectionProxy@DirectUI@@QEAA@AEBV01@@Z	279	0x140034be0
??0SelectorSelectionProxy@DirectUI@@QEAA@XZ	280	0x140040f44
??0ShellBorderLayout@DirectUI@@QEAA@AEBV01@@Z	281	0x140026de8
??0ShellBorderLayout@DirectUI@@QEAA@XZ	282	0x140019b10
??0StyleSheet@DirectUI@@QEAA@$$QEAV01@@Z	283	0x140024e0c
??0StyleSheet@DirectUI@@QEAA@AEBV01@@Z	284	0x1400211fc
??0StyleSheet@DirectUI@@QEAA@XZ	285	0x14001b220
??0StyledScrollViewer@DirectUI@@QEAA@AEBV01@@Z	286	0x14001963c
??0StyledScrollViewer@DirectUI@@QEAA@XZ	287	0x140039d54
??0Surface@DirectUI@@QEAA@AEBV01@@Z	288	0x14003b4e8
??0Surface@DirectUI@@QEAA@XZ	289	0x14002be2c
??0TableItemProvider@DirectUI@@QEAA@XZ	290	0x140012510
??0TableItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	291	0x140011508
??0TableItemProxy@DirectUI@@QEAA@AEBV01@@Z	292	0x14001be54
??0TableItemProxy@DirectUI@@QEAA@XZ	293	0x1400164e8
??0TableLayout@DirectUI@@QEAA@AEBV01@@Z	294	0x14002d528
??0TableLayout@DirectUI@@QEAA@XZ	295	0x14003b67c
??0TableProvider@DirectUI@@QEAA@XZ	296	0x140029b1c
??0TableProxy@DirectUI@@QEAA@$$QEAV01@@Z	297	0x1400383b0
??0TableProxy@DirectUI@@QEAA@AEBV01@@Z	298	0x14001480c
??0TableProxy@DirectUI@@QEAA@XZ	299	0x140006258
??0TaskPage@DirectUI@@QEAA@AEBV01@@Z	300	0x140025cc4
??0TaskPage@DirectUI@@QEAA@XZ	301	0x140041588
??0TextGraphic@DirectUI@@QEAA@$$QEAV01@@Z	302	0x140010a50
??0TextGraphic@DirectUI@@QEAA@AEBV01@@Z	303	0x140016ea8
??0TextGraphic@DirectUI@@QEAA@XZ	304	0x14001d988
??0Thumb@DirectUI@@QEAA@AEBV01@@Z	305	0x140039ee4
??0Thumb@DirectUI@@QEAA@XZ	306	0x1400283c8
??0ToggleProvider@DirectUI@@QEAA@XZ	307	0x14000996c
??0ToggleProxy@DirectUI@@QEAA@$$QEAV01@@Z	308	0x14000b688
??0ToggleProxy@DirectUI@@QEAA@AEBV01@@Z	309	0x14002d488
??0ToggleProxy@DirectUI@@QEAA@XZ	310	0x1400324cc
??0TouchButton@DirectUI@@QEAA@XZ	311	0x14000606c
??0TouchCheckBox@DirectUI@@QEAA@XZ	312	0x14000ce04
??0TouchCheckBoxGlyph@DirectUI@@QEAA@XZ	313	0x1400400a8
??0TouchCommandButton@DirectUI@@QEAA@XZ	314	0x14001be58
??0TouchEdit2@DirectUI@@QEAA@XZ	315	0x140034f14
??0TouchHWNDElement@DirectUI@@QEAA@XZ	316	0x14002ba10
??0TouchHyperLink@DirectUI@@QEAA@XZ	317	0x14001d2f8
??0TouchRepeatButton@DirectUI@@QEAA@XZ	318	0x140040b98
??0TouchScrollBar@DirectUI@@QEAA@XZ	319	0x14002f088
??0TouchSelect@DirectUI@@QEAA@XZ	320	0x14001c884
??0TouchSelectItem@DirectUI@@QEAA@XZ	321	0x140012974
??0UnknownElement@DirectUI@@QEAA@AEBV01@@Z	322	0x140036614
??0UnknownElement@DirectUI@@QEAA@XZ	323	0x14003cb14
??0ValueProvider@DirectUI@@QEAA@XZ	324	0x1400212c8
??0ValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	325	0x140003f28
??0ValueProxy@DirectUI@@QEAA@AEBV01@@Z	326	0x140037bb8
??0ValueProxy@DirectUI@@QEAA@XZ	327	0x1400026b8
??0VerticalFlowLayout@DirectUI@@QEAA@AEBV01@@Z	328	0x140035268
??0VerticalFlowLayout@DirectUI@@QEAA@XZ	329	0x1400075d8
??0Viewer@DirectUI@@QEAA@AEBV01@@Z	330	0x14000f818
??0Viewer@DirectUI@@QEAA@XZ	331	0x140032b50
??0XBaby@DirectUI@@QEAA@AEBV01@@Z	332	0x140023cb8
??0XBaby@DirectUI@@QEAA@XZ	333	0x140039fcc
??0XElement@DirectUI@@QEAA@AEBV01@@Z	334	0x14003da94
??0XElement@DirectUI@@QEAA@XZ	335	0x1400370a4
??0XHost@DirectUI@@QEAA@XZ	336	0x140006e7c
??0XProvider@DirectUI@@QEAA@AEBV01@@Z	337	0x14001466c
??0XProvider@DirectUI@@QEAA@XZ	338	0x140016c24
??0XResourceProvider@DirectUI@@QEAA@$$QEAV01@@Z	339	0x14003bb54
??0XResourceProvider@DirectUI@@QEAA@AEBV01@@Z	340	0x140026790
??0XResourceProvider@DirectUI@@QEAA@XZ	341	0x140006544
??1?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@UEAA@XZ	342	0x14000b89c
??1?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@UEAA@XZ	343	0x14001aeec
??1?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@UEAA@XZ	344	0x1400270e4
??1?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@UEAA@XZ	345	0x14002ae5c
??1?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@UEAA@XZ	346	0x1400160dc
??1?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@UEAA@XZ	347	0x14000e454
??1?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@UEAA@XZ	348	0x140029400
??1?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@UEAA@XZ	349	0x140034c78
??1?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@UEAA@XZ	350	0x1400120c8
??1?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@UEAA@XZ	351	0x14001a878
??1?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@UEAA@XZ	352	0x140024a50
??1?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@UEAA@XZ	353	0x14002273c
??1?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@UEAA@XZ	354	0x140008aec
??1?$SafeArrayAccessor@H@DirectUI@@QEAA@XZ	355	0x140006cdc
??1AccessibleButton@DirectUI@@UEAA@XZ	356	0x14000fa20
??1AnimationStrip@DirectUI@@UEAA@XZ	357	0x140012280
??1AutoButton@DirectUI@@UEAA@XZ	358	0x14000bc4c
??1AutoLock@DirectUI@@QEAA@XZ	359	0x14001cda0
??1AutoThread@DirectUI@@QEAA@XZ	360	0x14001823c
??1AutoVariant@DirectUI@@QEAA@XZ	361	0x14000ab8c
??1BaseScrollViewer@DirectUI@@UEAA@XZ	362	0x14002fa04
??1Bind@DirectUI@@UEAA@XZ	363	0x14000f9a0
??1BorderLayout@DirectUI@@UEAA@XZ	364	0x140001b10
??1Browser@DirectUI@@UEAA@XZ	365	0x14000fd5c
??1Button@DirectUI@@UEAA@XZ	366	0x14001602c
??1CCAVI@DirectUI@@UEAA@XZ	367	0x1400076a8
??1CCBase@DirectUI@@UEAA@XZ	368	0x140037ae8
??1CCBaseCheckRadioButton@DirectUI@@UEAA@XZ	369	0x1400017e4
??1CCBaseScrollBar@DirectUI@@UEAA@XZ	370	0x14002ea3c
??1CCCheckBox@DirectUI@@UEAA@XZ	371	0x14002ae20
??1CCCommandLink@DirectUI@@UEAA@XZ	372	0x14003dbb0
??1CCHScrollBar@DirectUI@@UEAA@XZ	373	0x140011ae4
??1CCListBox@DirectUI@@UEAA@XZ	374	0x140005e5c
??1CCListView@DirectUI@@UEAA@XZ	375	0x14003467c
??1CCProgressBar@DirectUI@@UEAA@XZ	376	0x140013f08
??1CCPushButton@DirectUI@@UEAA@XZ	377	0x14000613c
??1CCRadioButton@DirectUI@@UEAA@XZ	378	0x140030260
??1CCSysLink@DirectUI@@UEAA@XZ	379	0x140028dbc
??1CCTrackBar@DirectUI@@UEAA@XZ	380	0x1400230a4
??1CCTreeView@DirectUI@@UEAA@XZ	381	0x140025930
??1CCVScrollBar@DirectUI@@UEAA@XZ	382	0x140021f20
??1CallstackTracker@DirectUI@@QEAA@XZ	383	0x14003127c
??1CheckBoxGlyph@DirectUI@@UEAA@XZ	384	0x140003928
??1ClassInfoBase@DirectUI@@UEAA@XZ	385	0x140001bfc
??1Clipper@DirectUI@@UEAA@XZ	386	0x1400340ec
??1Combobox@DirectUI@@UEAA@XZ	387	0x1400341fc
??1CritSecLock@DirectUI@@QEAA@XZ	388	0x14002d9dc
??1DCSurface@DirectUI@@UEAA@XZ	389	0x14002c26c
??1DUIFactory@DirectUI@@QEAA@XZ	390	0x14001980c
??1DUIXmlParser@DirectUI@@UEAA@XZ	391	0x140011104
??1DialogElement@DirectUI@@UEAA@XZ	392	0x14000eb90
??1DuiAccessible@DirectUI@@UEAA@XZ	393	0x140032ffc
??1Edit@DirectUI@@UEAA@XZ	394	0x140023ea0
??1Element@DirectUI@@UEAA@XZ	395	0x14002a8ec
??1ElementProvider@DirectUI@@UEAA@XZ	396	0x14003b420
??1ElementWithHWND@DirectUI@@UEAA@XZ	397	0x140035198
??1ExpandCollapseProvider@DirectUI@@UEAA@XZ	398	0x140019f18
??1Expandable@DirectUI@@UEAA@XZ	399	0x14000de10
??1Expando@DirectUI@@UEAA@XZ	400	0x140002808
??1ExpandoButtonGlyph@DirectUI@@UEAA@XZ	401	0x140020918
??1FillLayout@DirectUI@@UEAA@XZ	402	0x140008734
??1FlowLayout@DirectUI@@UEAA@XZ	403	0x140033074
??1FontCheckOut@DirectUI@@QEAA@XZ	404	0x140010808
??1GridItemProvider@DirectUI@@UEAA@XZ	405	0x140017740
??1GridLayout@DirectUI@@UEAA@XZ	406	0x14000b918
??1GridProvider@DirectUI@@UEAA@XZ	407	0x14003d768
??1HWNDElement@DirectUI@@UEAA@XZ	408	0x140021414
??1HWNDElementAccessible@DirectUI@@UEAA@XZ	409	0x140040708
??1HWNDElementProvider@DirectUI@@UEAA@XZ	410	0x140024190
??1HWNDHost@DirectUI@@UEAA@XZ	411	0x14001f9cc
??1HWNDHostAccessible@DirectUI@@UEAA@XZ	412	0x140040810
??1HWNDHostClientAccessible@DirectUI@@UEAA@XZ	413	0x140004184
??1IDataEngine@DirectUI@@UEAA@XZ	414	0x14002b9e4
??1IDataEntry@DirectUI@@UEAA@XZ	415	0x14002f2ec
??1InvokeHelper@DirectUI@@UEAA@XZ	416	0x14002c604
??1InvokeProvider@DirectUI@@UEAA@XZ	417	0x140039bc8
??1ItemList@DirectUI@@UEAA@XZ	418	0x140002124
??1Layout@DirectUI@@UEAA@XZ	419	0x14003e31c
??1LinkedList@DirectUI@@QEAA@XZ	420	0x1400092b4
??1Macro@DirectUI@@UEAA@XZ	421	0x14002e940
??1ModernProgressBar@DirectUI@@UEAA@XZ	422	0x14003a190
??1ModernProgressRing@DirectUI@@UEAA@XZ	423	0x14001c6ec
??1Movie@DirectUI@@UEAA@XZ	424	0x14000c444
??1NativeHWNDHost@DirectUI@@UEAA@XZ	425	0x14000358c
??1Navigator@DirectUI@@UEAA@XZ	426	0x140002664
??1NineGridLayout@DirectUI@@UEAA@XZ	427	0x14000d434
??1PText@DirectUI@@UEAA@XZ	428	0x14003154c
??1Page@DirectUI@@UEAA@XZ	429	0x140001b74
??1Pages@DirectUI@@UEAA@XZ	430	0x1400376a4
??1Progress@DirectUI@@UEAA@XZ	431	0x1400030dc
??1Proxy@DirectUI@@UEAA@XZ	432	0x140028a50
??1PushButton@DirectUI@@UEAA@XZ	433	0x14002a6a0
??1RadioButtonGlyph@DirectUI@@UEAA@XZ	434	0x14000e934
??1RangeValueProvider@DirectUI@@UEAA@XZ	435	0x14003003c
??1RefPointElement@DirectUI@@UEAA@XZ	436	0x140005860
??1RefcountBase@DirectUI@@UEAA@XZ	437	0x140017738
??1RepeatButton@DirectUI@@UEAA@XZ	438	0x14001b6c0
??1Repeater@DirectUI@@UEAA@XZ	439	0x14003ab6c
??1ResourceModuleHandles@DirectUI@@QEAA@XZ	440	0x140025c64
??1RichText@DirectUI@@UEAA@XZ	441	0x140038c30
??1RowLayout@DirectUI@@UEAA@XZ	442	0x1400092c4
??1ScrollBar@DirectUI@@UEAA@XZ	443	0x140003c40
??1ScrollItemProvider@DirectUI@@UEAA@XZ	444	0x140015b54
??1ScrollProvider@DirectUI@@UEAA@XZ	445	0x14001a0e4
??1ScrollViewer@DirectUI@@UEAA@XZ	446	0x14002c9d0
??1SelectionItemProvider@DirectUI@@UEAA@XZ	447	0x14003254c
??1SelectionProvider@DirectUI@@UEAA@XZ	448	0x140023fd0
??1Selector@DirectUI@@UEAA@XZ	449	0x14002547c
??1SelectorNoDefault@DirectUI@@UEAA@XZ	450	0x14003d4bc
??1ShellBorderLayout@DirectUI@@UEAA@XZ	451	0x1400227b4
??1StyledScrollViewer@DirectUI@@UEAA@XZ	452	0x140019eec
??1Surface@DirectUI@@UEAA@XZ	453	0x140035a40
??1TableItemProvider@DirectUI@@UEAA@XZ	454	0x14001824c
??1TableLayout@DirectUI@@UEAA@XZ	455	0x14000e0e4
??1TableProvider@DirectUI@@UEAA@XZ	456	0x140027f64
??1TaskPage@DirectUI@@UEAA@XZ	457	0x140010bc4
??1TextGraphic@DirectUI@@UEAA@XZ	458	0x140019b14
??1Thumb@DirectUI@@UEAA@XZ	459	0x140003240
??1ToggleProvider@DirectUI@@UEAA@XZ	460	0x140029a84
??1TouchButton@DirectUI@@UEAA@XZ	461	0x140040910
??1TouchCheckBox@DirectUI@@UEAA@XZ	462	0x140027f04
??1TouchCheckBoxGlyph@DirectUI@@UEAA@XZ	463	0x140024d48
??1TouchHWNDElement@DirectUI@@UEAA@XZ	464	0x14001c798
??1TouchHyperLink@DirectUI@@UEAA@XZ	465	0x14003c0e4
??1TouchScrollBar@DirectUI@@UEAA@XZ	466	0x1400255bc
??1TouchSelect@DirectUI@@UEAA@XZ	467	0x14002f820
??1TouchSelectItem@DirectUI@@UEAA@XZ	468	0x140029f28
??1UnknownElement@DirectUI@@UEAA@XZ	469	0x14003b420
??1ValueProvider@DirectUI@@UEAA@XZ	470	0x140011cd8
??1VerticalFlowLayout@DirectUI@@UEAA@XZ	471	0x140012bc0
??1Viewer@DirectUI@@UEAA@XZ	472	0x140002aa4
??1XBaby@DirectUI@@UEAA@XZ	473	0x1400271a4
??1XElement@DirectUI@@UEAA@XZ	474	0x140015f70
??1XHost@DirectUI@@QEAA@XZ	475	0x14001941c
??1XProvider@DirectUI@@UEAA@XZ	476	0x14003b198
??4?$FunctionDefinition@H@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	477	0x1400252b0
??4?$FunctionDefinition@H@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	478	0x140015c50
??4?$FunctionDefinition@K@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	479	0x140011034
??4?$FunctionDefinition@K@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	480	0x140039218
??4?$FunctionDefinition@PEAVValue@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	481	0x140001de0
??4?$FunctionDefinition@PEAVValue@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	482	0x14001d288
??4?$FunctionDefinition@UScaledRECT@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	483	0x140003d60
??4?$FunctionDefinition@UScaledRECT@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	484	0x14003ba6c
??4?$FunctionDefinition@UScaledSIZE@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	485	0x140034d18
??4?$FunctionDefinition@UScaledSIZE@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	486	0x14003ee40
??4ACCESSIBLEROLE@AccessibleButton@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	487	0x14002cdb4
??4ACCESSIBLEROLE@AccessibleButton@DirectUI@@QEAAAEAU012@AEBU012@@Z	488	0x14003a188
??4AccessibleButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	489	0x1400174cc
??4AccessibleButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	490	0x140024580
??4AnimationStrip@DirectUI@@QEAAAEAV01@AEBV01@@Z	491	0x140006fd4
??4AutoButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	492	0x1400099dc
??4AutoButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	493	0x14002f34c
??4AutoLock@DirectUI@@QEAAAEAV01@AEBV01@@Z	494	0x140002bb8
??4AutoThread@DirectUI@@QEAAAEAV01@AEBV01@@Z	495	0x14002bb70
??4AutoVariant@DirectUI@@QEAAAEAV01@AEBV01@@Z	496	0x140024dfc
??4BaseScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	497	0x140027f50
??4BaseScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	498	0x14000b0fc
??4BaseScrollViewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	499	0x1400291dc
??4Bind@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	500	0x14002bd64
??4Bind@DirectUI@@QEAAAEAV01@AEBV01@@Z	501	0x140001328
??4BorderLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	502	0x140027388
??4Browser@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	503	0x14003932c
??4Browser@DirectUI@@QEAAAEAV01@AEBV01@@Z	504	0x140026f78
??4BrowserSelectionProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	505	0x14000b06c
??4BrowserSelectionProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	506	0x1400111b0
??4Button@DirectUI@@QEAAAEAV01@AEBV01@@Z	507	0x1400377cc
??4CCAVI@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	508	0x14003b8d0
??4CCAVI@DirectUI@@QEAAAEAV01@AEBV01@@Z	509	0x140036874
??4CCBase@DirectUI@@QEAAAEAV01@AEBV01@@Z	510	0x140017b5c
??4CCBaseCheckRadioButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	511	0x140021adc
??4CCBaseCheckRadioButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	512	0x140018594
??4CCBaseScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	513	0x140032940
??4CCBaseScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	514	0x140017dc8
??4CCCheckBox@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	515	0x14000c33c
??4CCCheckBox@DirectUI@@QEAAAEAV01@AEBV01@@Z	516	0x140016b24
??4CCCommandLink@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	517	0x140009a50
??4CCCommandLink@DirectUI@@QEAAAEAV01@AEBV01@@Z	518	0x1400200bc
??4CCHScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	519	0x14001f6e4
??4CCHScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	520	0x14002ebfc
??4CCListBox@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	521	0x14002dae8
??4CCListBox@DirectUI@@QEAAAEAV01@AEBV01@@Z	522	0x140014860
??4CCListView@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	523	0x1400311d0
??4CCListView@DirectUI@@QEAAAEAV01@AEBV01@@Z	524	0x14003cc68
??4CCProgressBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	525	0x14000b86c
??4CCProgressBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	526	0x14002f04c
??4CCPushButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	527	0x140018260
??4CCPushButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	528	0x140036424
??4CCRadioButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	529	0x14000125c
??4CCRadioButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	530	0x140015c40
??4CCSysLink@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	531	0x14001a6a0
??4CCSysLink@DirectUI@@QEAAAEAV01@AEBV01@@Z	532	0x140007cec
??4CCTrackBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	533	0x14000399c
??4CCTrackBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	534	0x140028cf8
??4CCTreeView@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	535	0x14000a290
??4CCTreeView@DirectUI@@QEAAAEAV01@AEBV01@@Z	536	0x14001efa4
??4CCVScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	537	0x14000accc
??4CCVScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	538	0x14003f128
??4CallstackTracker@DirectUI@@QEAAAEAV01@AEBV01@@Z	539	0x14003f344
??4CheckBoxGlyph@DirectUI@@QEAAAEAV01@AEBV01@@Z	540	0x14001c604
??4ClassInfoBase@DirectUI@@QEAAAEAV01@AEBV01@@Z	541	0x140001be0
??4Clipper@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	542	0x140040154
??4Clipper@DirectUI@@QEAAAEAV01@AEBV01@@Z	543	0x14000be54
??4Combobox@DirectUI@@QEAAAEAV01@AEBV01@@Z	544	0x140033054
??4CritSecLock@DirectUI@@QEAAAEAV01@AEBV01@@Z	545	0x14002c3dc
??4DCSurface@DirectUI@@QEAAAEAV01@AEBV01@@Z	546	0x14000c4f0
??4DUIFactory@DirectUI@@QEAAAEAV01@AEBV01@@Z	547	0x14000d588
??4DUIXmlParser@DirectUI@@QEAAAEAV01@AEBV01@@Z	548	0x140021284
??4DialogElement@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	549	0x140034e28
??4DialogElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	550	0x1400415b8
??4DialogElementCore@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	551	0x14003f2ac
??4DialogElementCore@DirectUI@@QEAAAEAV01@AEBV01@@Z	552	0x140029fe4
??4DuiNavigate@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	553	0x140014b90
??4DuiNavigate@DirectUI@@QEAAAEAV01@AEBV01@@Z	554	0x140012038
??4Edit@DirectUI@@QEAAAEAV01@AEBV01@@Z	555	0x14001a17c
??4Element@DirectUI@@QEAAAEAV01@AEBV01@@Z	556	0x14003af80
??4ElementProviderManager@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	557	0x14003fc40
??4ElementProviderManager@DirectUI@@QEAAAEAV01@AEBV01@@Z	558	0x14001a498
??4ElementProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	559	0x140035358
??4ElementProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	560	0x14000db0c
??4ElementWithHWND@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	561	0x140001e10
??4ElementWithHWND@DirectUI@@QEAAAEAV01@AEBV01@@Z	562	0x140022a70
??4EventManager@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	563	0x14001f234
??4EventManager@DirectUI@@QEAAAEAV01@AEBV01@@Z	564	0x14002b11c
??4ExpandCollapseProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	565	0x140026f90
??4ExpandCollapseProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	566	0x14002a338
??4Expandable@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	567	0x14001431c
??4Expandable@DirectUI@@QEAAAEAV01@AEBV01@@Z	568	0x14003dc04
??4Expando@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	569	0x14000addc
??4Expando@DirectUI@@QEAAAEAV01@AEBV01@@Z	570	0x140005abc
??4ExpandoButtonGlyph@DirectUI@@QEAAAEAV01@AEBV01@@Z	571	0x14000d2dc
??4Expression@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	572	0x1400075d0
??4Expression@DirectUI@@QEAAAEAV01@AEBV01@@Z	573	0x140022d0c
??4FillLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	574	0x14000c348
??4FlowLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	575	0x14003760c
??4FontCache@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	576	0x140027b44
??4FontCache@DirectUI@@QEAAAEAV01@AEBV01@@Z	577	0x14002b53c
??4FontCheckOut@DirectUI@@QEAAAEAV01@AEBV01@@Z	578	0x1400043c0
??4GridItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	579	0x14003c8c4
??4GridItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	580	0x140014cac
??4GridLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	581	0x140037850
??4GridProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	582	0x140012f48
??4GridProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	583	0x1400399d4
??4HWNDElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	584	0x14002af1c
??4HWNDElementProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	585	0x14001fbfc
??4HWNDElementProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	586	0x14001b418
??4HWNDHost@DirectUI@@QEAAAEAV01@AEBV01@@Z	587	0x140004af0
??4IDataEngine@DirectUI@@QEAAAEAU01@AEBU01@@Z	588	0x140034458
??4IDataEntry@DirectUI@@QEAAAEAU01@AEBU01@@Z	589	0x1400341ac
??4IProvider@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	590	0x14002c0b0
??4IProvider@DirectUI@@QEAAAEAV01@AEBV01@@Z	591	0x14001b2f0
??4ISBLeak@DirectUI@@QEAAAEAU01@$$QEAU01@@Z	592	0x14001b3d4
??4ISBLeak@DirectUI@@QEAAAEAU01@AEBU01@@Z	593	0x140030ec0
??4IXElementCP@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	594	0x140024890
??4IXElementCP@DirectUI@@QEAAAEAV01@AEBV01@@Z	595	0x14002f48c
??4IXProviderCP@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	596	0x140030f40
??4IXProviderCP@DirectUI@@QEAAAEAV01@AEBV01@@Z	597	0x14000fa70
??4InvokeManager@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	598	0x14000a98c
??4InvokeManager@DirectUI@@QEAAAEAV01@AEBV01@@Z	599	0x1400091c0
??4InvokeProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	600	0x14002cb14
??4InvokeProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	601	0x140024230
??4Layout@DirectUI@@QEAAAEAV01@AEBV01@@Z	602	0x1400140c0
??4LinkedList@DirectUI@@QEAAAEAV01@AEBV01@@Z	603	0x140032284
??4LinkedListNode@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	604	0x14002c9a4
??4LinkedListNode@DirectUI@@QEAAAEAV01@AEBV01@@Z	605	0x140028124
??4Macro@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	606	0x140040a48
??4Macro@DirectUI@@QEAAAEAV01@AEBV01@@Z	607	0x140016fb8
??4ModernProgressBarRangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	608	0x14003f2a0
??4ModernProgressBarRangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	609	0x14001b3b4
??4Movie@DirectUI@@QEAAAEAV01@AEBV01@@Z	610	0x140007310
??4NativeHWNDHost@DirectUI@@QEAAAEAV01@AEBV01@@Z	611	0x1400119ac
??4NavReference@DirectUI@@QEAAAEAU01@$$QEAU01@@Z	612	0x1400180dc
??4NavReference@DirectUI@@QEAAAEAU01@AEBU01@@Z	613	0x1400259f0
??4NavScoring@DirectUI@@QEAAAEAU01@$$QEAU01@@Z	614	0x14001fba4
??4NavScoring@DirectUI@@QEAAAEAU01@AEBU01@@Z	615	0x14003481c
??4Navigator@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	616	0x14003ff08
??4Navigator@DirectUI@@QEAAAEAV01@AEBV01@@Z	617	0x140031364
??4NavigatorSelectionItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	618	0x140005f20
??4NavigatorSelectionItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	619	0x1400053c0
??4NineGridLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	620	0x14002b808
??4PText@DirectUI@@QEAAAEAV01@AEBV01@@Z	621	0x1400205fc
??4PVLAnimation@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	622	0x1400126f0
??4PVLAnimation@DirectUI@@QEAAAEAV01@AEBV01@@Z	623	0x14002a4f0
??4Page@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	624	0x140017eb4
??4Page@DirectUI@@QEAAAEAV01@AEBV01@@Z	625	0x140039f74
??4Pages@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	626	0x140037008
??4Pages@DirectUI@@QEAAAEAV01@AEBV01@@Z	627	0x14000b260
??4Progress@DirectUI@@QEAAAEAV01@AEBV01@@Z	628	0x140028b2c
??4ProgressRangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	629	0x1400097bc
??4ProgressRangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	630	0x14001cb1c
??4ProviderProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	631	0x14002cb8c
??4ProviderProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	632	0x14003d820
??4Proxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	633	0x140013908
??4PushButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	634	0x14000f958
??4PushButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	635	0x14004175c
??4RadioButtonGlyph@DirectUI@@QEAAAEAV01@AEBV01@@Z	636	0x14003f43c
??4RangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	637	0x140014918
??4RangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	638	0x1400019b4
??4RefPointElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	639	0x14002a0ac
??4RepeatButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	640	0x14000abd0
??4Repeater@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	641	0x140004c94
??4Repeater@DirectUI@@QEAAAEAV01@AEBV01@@Z	642	0x140029e0c
??4ResourceModuleHandles@DirectUI@@QEAAAEAV01@AEBV01@@Z	643	0x14000f2fc
??4RowLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	644	0x14001be18
??4Schema@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	645	0x14000972c
??4Schema@DirectUI@@QEAAAEAV01@AEBV01@@Z	646	0x140023130
??4ScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	647	0x14003d1fc
??4ScrollBarRangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	648	0x140012bac
??4ScrollBarRangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	649	0x14003a7b4
??4ScrollItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	650	0x14000ee90
??4ScrollItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	651	0x140037254
??4ScrollProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	652	0x140021dc0
??4ScrollProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	653	0x140003d10
??4ScrollViewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	654	0x140028d3c
??4SelectionItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	655	0x140014f7c
??4SelectionItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	656	0x1400278a4
??4SelectionProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	657	0x140010644
??4SelectionProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	658	0x14001aa88
??4Selector@DirectUI@@QEAAAEAV01@AEBV01@@Z	659	0x14001f070
??4SelectorNoDefault@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	660	0x14003bd90
??4SelectorNoDefault@DirectUI@@QEAAAEAV01@AEBV01@@Z	661	0x140008484
??4SelectorSelectionItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	662	0x14002f0b4
??4SelectorSelectionItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	663	0x1400326b0
??4SelectorSelectionProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	664	0x140026f78
??4SelectorSelectionProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	665	0x14001e4bc
??4ShellBorderLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	666	0x140032ec0
??4StyleSheet@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	667	0x140010850
??4StyleSheet@DirectUI@@QEAAAEAV01@AEBV01@@Z	668	0x1400330c4
??4StyledScrollViewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	669	0x14003e3b4
??4Surface@DirectUI@@QEAAAEAV01@AEBV01@@Z	670	0x14002f2d8
??4TableItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	671	0x14003a474
??4TableItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	672	0x140030658
??4TableLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	673	0x140010b38
??4TableProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	674	0x140039674
??4TableProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	675	0x14003bee4
??4TaskPage@DirectUI@@QEAAAEAV01@AEBV01@@Z	676	0x14001636c
??4TextGraphic@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	677	0x140038370
??4TextGraphic@DirectUI@@QEAAAEAV01@AEBV01@@Z	678	0x140032a00
??4Thumb@DirectUI@@QEAAAEAV01@AEBV01@@Z	679	0x140006b88
??4ToggleProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	680	0x140040100
??4ToggleProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	681	0x14002f590
??4UnknownElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	682	0x14003c218
??4Value@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	683	0x140021a48
??4Value@DirectUI@@QEAAAEAV01@AEBV01@@Z	684	0x1400089d4
??4ValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	685	0x1400269e8
??4ValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	686	0x140026260
??4VerticalFlowLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	687	0x14000ba28
??4Viewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	688	0x14000ccf4
??4XBaby@DirectUI@@QEAAAEAV01@AEBV01@@Z	689	0x140004974
??4XElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	690	0x14002ada8
??4XHost@DirectUI@@QEAAAEAV01@AEBV01@@Z	691	0x14003a64c
??4XProvider@DirectUI@@QEAAAEAV01@AEBV01@@Z	692	0x140028da8
??4XResourceProvider@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	693	0x140007ca8
??4XResourceProvider@DirectUI@@QEAAAEAV01@AEBV01@@Z	694	0x14003c404
??B?$SafeArrayAccessor@H@DirectUI@@QEAAPEAHXZ	695	0x14003b238
??BTaskPage@DirectUI@@QEAAPEAU_PSP@@XZ	696	0x14001096c
??_7?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@6BIProvider@1@@	697	0x1400163a0
??_7?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@6BRefcountBase@1@@	698	0x14001957c
??_7?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@6BIProvider@1@@	699	0x14001fde0
??_7?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@6BRefcountBase@1@@	700	0x14001d578
??_7?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@6BIProvider@1@@	701	0x140004998
??_7?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@6BRefcountBase@1@@	702	0x14001f830
??_7?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@6BIProvider@1@@	703	0x14003ac64
??_7?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@6BRefcountBase@1@@	704	0x140006008
??_7?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@6BIProvider@1@@	705	0x14002f8dc
??_7?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@6BRefcountBase@1@@	706	0x140035fdc
??_7?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@6BIProvider@1@@	707	0x14000dbfc
??_7?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@6BRefcountBase@1@@	708	0x14000d374
??_7?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@6BIProvider@1@@	709	0x14002143c
??_7?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@6BRefcountBase@1@@	710	0x1400038fc
??_7?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@6BIProvider@1@@	711	0x140009958
??_7?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@6BRefcountBase@1@@	712	0x1400154b8
??_7?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@6BIProvider@1@@	713	0x140025bc4
??_7?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@6BRefcountBase@1@@	714	0x140005bbc
??_7?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@6BIProvider@1@@	715	0x140037750
??_7?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@6BRefcountBase@1@@	716	0x14000eaa4
??_7?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@6BIProvider@1@@	717	0x14002ba88
??_7?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@6BRefcountBase@1@@	718	0x14002e828
??_7?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@6BIProvider@1@@	719	0x1400019e0
??_7?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@6BRefcountBase@1@@	720	0x1400133e0
??_7?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@6BIProvider@1@@	721	0x14000f6a0
??_7?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@6BRefcountBase@1@@	722	0x140037cf4
??_7AccessibleButton@DirectUI@@6B@	723	0x140004114
??_7AnimationStrip@DirectUI@@6B@	724	0x14002ba60
??_7AutoButton@DirectUI@@6B@	725	0x140016214
??_7BaseScrollBar@DirectUI@@6B@	726	0x14001ee9c
??_7BaseScrollViewer@DirectUI@@6BElement@1@@	727	0x14002ba48
??_7BaseScrollViewer@DirectUI@@6BIElementListener@1@@	728	0x14000cdac
??_7Bind@DirectUI@@6B@	729	0x140002334
??_7BorderLayout@DirectUI@@6B@	730	0x14000c324
??_7Browser@DirectUI@@6B@	731	0x140011e90
??_7BrowserSelectionProxy@DirectUI@@6B@	732	0x1400192dc
??_7Button@DirectUI@@6B@	733	0x14003bafc
??_7CCAVI@DirectUI@@6B@	734	0x140015028
??_7CCBase@DirectUI@@6B@	735	0x140016850
??_7CCBaseCheckRadioButton@DirectUI@@6B@	736	0x140011ddc
??_7CCBaseScrollBar@DirectUI@@6BBaseScrollBar@1@@	737	0x1400165c4
??_7CCBaseScrollBar@DirectUI@@6BCCBase@1@@	738	0x14001f26c
??_7CCCheckBox@DirectUI@@6B@	739	0x14003b2a8
??_7CCCommandLink@DirectUI@@6B@	740	0x14001fb28
??_7CCHScrollBar@DirectUI@@6BBaseScrollBar@1@@	741	0x14001f504
??_7CCHScrollBar@DirectUI@@6BCCBase@1@@	742	0x14000bdd8
??_7CCListBox@DirectUI@@6B@	743	0x14000e0a0
??_7CCListView@DirectUI@@6B@	744	0x1400401dc
??_7CCProgressBar@DirectUI@@6B@	745	0x140024e08
??_7CCPushButton@DirectUI@@6B@	746	0x140012534
??_7CCRadioButton@DirectUI@@6B@	747	0x140039380
??_7CCSysLink@DirectUI@@6B@	748	0x14000b84c
??_7CCTrackBar@DirectUI@@6B@	749	0x14000e048
??_7CCTreeView@DirectUI@@6B@	750	0x14001323c
??_7CCVScrollBar@DirectUI@@6BBaseScrollBar@1@@	751	0x14002dac8
??_7CCVScrollBar@DirectUI@@6BCCBase@1@@	752	0x14001aed8
??_7CheckBoxGlyph@DirectUI@@6B@	753	0x140011fa4
??_7ClassInfoBase@DirectUI@@6B@	754	0x140003150
??_7Clipper@DirectUI@@6B@	755	0x140007b68
??_7Combobox@DirectUI@@6B@	756	0x140023ba0
??_7DCSurface@DirectUI@@6B@	757	0x14002b4a8
??_7DUIXmlParser@DirectUI@@6B@	758	0x14001d7d0
??_7DialogElement@DirectUI@@6BHWNDElement@1@@	759	0x140011374
??_7DialogElement@DirectUI@@6BIDialogElement@1@@	760	0x14000b484
??_7DialogElement@DirectUI@@6BIElementListener@1@@	761	0x14003d6e4
??_7DuiAccessible@DirectUI@@6BIAccIdentity@@@	762	0x140038234
??_7DuiAccessible@DirectUI@@6BIAccessible@@@	763	0x14002bec0
??_7DuiAccessible@DirectUI@@6BIEnumVARIANT@@@	764	0x14001e43c
??_7DuiAccessible@DirectUI@@6BIOleWindow@@@	765	0x140031bcc
??_7DuiAccessible@DirectUI@@6BIServiceProvider@@@	766	0x140030840
??_7Edit@DirectUI@@6B@	767	0x14002880c
??_7Element@DirectUI@@6B@	768	0x14001eb10
??_7ElementProvider@DirectUI@@6BIRawElementProviderAdviseEvents@@@	769	0x14002d2d8
??_7ElementProvider@DirectUI@@6BIRawElementProviderFragment@@@	770	0x140009d08
??_7ElementProvider@DirectUI@@6BIRawElementProviderSimple2@@@	771	0x14001fdb8
??_7ElementProvider@DirectUI@@6BRefcountBase@1@@	772	0x14001853c
??_7ElementWithHWND@DirectUI@@6B@	773	0x1400393ec
??_7ExpandCollapseProvider@DirectUI@@6B@	774	0x14001b064
??_7ExpandCollapseProvider@DirectUI@@6BIProvider@1@@	775	0x14001ca24
??_7ExpandCollapseProvider@DirectUI@@6BRefcountBase@1@@	776	0x1400413e0
??_7ExpandCollapseProxy@DirectUI@@6B@	777	0x140036c48
??_7Expandable@DirectUI@@6B@	778	0x14001d778
??_7Expando@DirectUI@@6B@	779	0x14003252c
??_7ExpandoButtonGlyph@DirectUI@@6B@	780	0x140021fa4
??_7FillLayout@DirectUI@@6B@	781	0x14002e6d0
??_7FlowLayout@DirectUI@@6B@	782	0x140016a78
??_7FontCache@DirectUI@@6B@	783	0x1400077b0
??_7GridItemProvider@DirectUI@@6B@	784	0x140040830
??_7GridItemProvider@DirectUI@@6BIProvider@1@@	785	0x140027b90
??_7GridItemProvider@DirectUI@@6BRefcountBase@1@@	786	0x140037e58
??_7GridItemProxy@DirectUI@@6B@	787	0x140034578
??_7GridLayout@DirectUI@@6B@	788	0x14000982c
??_7GridProvider@DirectUI@@6B@	789	0x14000ac40
??_7GridProvider@DirectUI@@6BIProvider@1@@	790	0x14000ea88
??_7GridProvider@DirectUI@@6BRefcountBase@1@@	791	0x140034740
??_7GridProxy@DirectUI@@6B@	792	0x140014ed0
??_7HWNDElement@DirectUI@@6B@	793	0x14001b3f4
??_7HWNDElementAccessible@DirectUI@@6BIAccIdentity@@@	794	0x140027c70
??_7HWNDElementAccessible@DirectUI@@6BIAccessible@@@	795	0x1400373a8
??_7HWNDElementAccessible@DirectUI@@6BIEnumVARIANT@@@	796	0x140028c84
??_7HWNDElementAccessible@DirectUI@@6BIOleWindow@@@	797	0x14000fc38
??_7HWNDElementAccessible@DirectUI@@6BIServiceProvider@@@	798	0x140021158
??_7HWNDElementProvider@DirectUI@@6B@	799	0x140017088
??_7HWNDElementProvider@DirectUI@@6BIRawElementProviderAdviseEvents@@@	800	0x140024e6c
??_7HWNDElementProvider@DirectUI@@6BIRawElementProviderFragment@@@	801	0x14000d45c
??_7HWNDElementProvider@DirectUI@@6BIRawElementProviderSimple2@@@	802	0x140038110
??_7HWNDElementProvider@DirectUI@@6BRefcountBase@1@@	803	0x140030c58
??_7HWNDHost@DirectUI@@6B@	804	0x14002ecec
??_7HWNDHostAccessible@DirectUI@@6BIAccIdentity@@@	805	0x14001e8c0
??_7HWNDHostAccessible@DirectUI@@6BIAccessible@@@	806	0x140030810
??_7HWNDHostAccessible@DirectUI@@6BIEnumVARIANT@@@	807	0x140001d3c
??_7HWNDHostAccessible@DirectUI@@6BIOleWindow@@@	808	0x140007378
??_7HWNDHostAccessible@DirectUI@@6BIServiceProvider@@@	809	0x140040994
??_7HWNDHostClientAccessible@DirectUI@@6BIAccIdentity@@@	810	0x14001f684
??_7HWNDHostClientAccessible@DirectUI@@6BIAccessible@@@	811	0x14003661c
??_7HWNDHostClientAccessible@DirectUI@@6BIEnumVARIANT@@@	812	0x140019ff4
??_7HWNDHostClientAccessible@DirectUI@@6BIOleWindow@@@	813	0x14002bf88
??_7HWNDHostClientAccessible@DirectUI@@6BIServiceProvider@@@	814	0x140041020
??_7IDataEngine@DirectUI@@6B@	815	0x140014698
??_7IDataEntry@DirectUI@@6B@	816	0x140038cd4
??_7ISBLeak@DirectUI@@6B@	817	0x140027478
??_7IXElementCP@DirectUI@@6B@	818	0x14001c218
??_7IXProviderCP@DirectUI@@6B@	819	0x1400020d8
??_7InvokeHelper@DirectUI@@6B@	820	0x140036eb8
??_7InvokeProvider@DirectUI@@6B@	821	0x14002b19c
??_7InvokeProvider@DirectUI@@6BIProvider@1@@	822	0x14003f960
??_7InvokeProvider@DirectUI@@6BRefcountBase@1@@	823	0x140020094
??_7InvokeProxy@DirectUI@@6B@	824	0x140021d8c
??_7Layout@DirectUI@@6B@	825	0x14000b6ac
??_7Macro@DirectUI@@6B@	826	0x14003ae78
??_7ModernProgressBarRangeValueProxy@DirectUI@@6B@	827	0x14001f3dc
??_7Movie@DirectUI@@6B@	828	0x140041654
??_7NativeHWNDHost@DirectUI@@6B@	829	0x140012618
??_7Navigator@DirectUI@@6B@	830	0x1400313e0
??_7NavigatorSelectionItemProxy@DirectUI@@6B@	831	0x14001dd70
??_7NineGridLayout@DirectUI@@6B@	832	0x14002307c
??_7PText@DirectUI@@6B@	833	0x140013968
??_7Page@DirectUI@@6B@	834	0x14003c25c
??_7Pages@DirectUI@@6B@	835	0x14002d3f8
??_7Progress@DirectUI@@6B@	836	0x140010a5c
??_7ProgressRangeValueProxy@DirectUI@@6B@	837	0x140035938
??_7Proxy@DirectUI@@6B@	838	0x1400125a8
??_7PushButton@DirectUI@@6B@	839	0x140024be8
??_7RadioButtonGlyph@DirectUI@@6B@	840	0x140022074
??_7RangeValueProvider@DirectUI@@6B@	841	0x14002f624
??_7RangeValueProvider@DirectUI@@6BIProvider@1@@	842	0x140032dd0
??_7RangeValueProvider@DirectUI@@6BRefcountBase@1@@	843	0x14001ea08
??_7RangeValueProxy@DirectUI@@6B@	844	0x14000507c
??_7RefPointElement@DirectUI@@6B@	845	0x140032de8
??_7RefcountBase@DirectUI@@6B@	846	0x14003d728
??_7RepeatButton@DirectUI@@6B@	847	0x14001ea04
??_7Repeater@DirectUI@@6B@	848	0x140002b90
??_7RowLayout@DirectUI@@6B@	849	0x14002ab6c
??_7ScrollBar@DirectUI@@6BBaseScrollBar@1@@	850	0x14001ebbc
??_7ScrollBar@DirectUI@@6BElement@1@@	851	0x14001f930
??_7ScrollBarRangeValueProxy@DirectUI@@6B@	852	0x1400393d0
??_7ScrollItemProvider@DirectUI@@6B@	853	0x1400228e0
??_7ScrollItemProvider@DirectUI@@6BIProvider@1@@	854	0x1400125d8
??_7ScrollItemProvider@DirectUI@@6BRefcountBase@1@@	855	0x140034d50
??_7ScrollItemProxy@DirectUI@@6B@	856	0x140031204
??_7ScrollProvider@DirectUI@@6B@	857	0x14000f1b4
??_7ScrollProvider@DirectUI@@6BIProvider@1@@	858	0x14003b278
??_7ScrollProvider@DirectUI@@6BRefcountBase@1@@	859	0x14001894c
??_7ScrollProxy@DirectUI@@6B@	860	0x140001090
??_7ScrollViewer@DirectUI@@6BElement@1@@	861	0x140006288
??_7ScrollViewer@DirectUI@@6BIElementListener@1@@	862	0x1400405d8
??_7SelectionItemProvider@DirectUI@@6B@	863	0x1400395e4
??_7SelectionItemProvider@DirectUI@@6BIProvider@1@@	864	0x140002864
??_7SelectionItemProvider@DirectUI@@6BRefcountBase@1@@	865	0x140037930
??_7SelectionItemProxy@DirectUI@@6B@	866	0x140022edc
??_7SelectionProvider@DirectUI@@6B@	867	0x1400313c4
??_7SelectionProvider@DirectUI@@6BIProvider@1@@	868	0x1400320d4
??_7SelectionProvider@DirectUI@@6BRefcountBase@1@@	869	0x14001b234
??_7SelectionProxy@DirectUI@@6B@	870	0x14001e120
??_7Selector@DirectUI@@6B@	871	0x14003b830
??_7SelectorNoDefault@DirectUI@@6B@	872	0x140006364
??_7SelectorSelectionItemProxy@DirectUI@@6B@	873	0x140002034
??_7SelectorSelectionProxy@DirectUI@@6B@	874	0x140008128
??_7ShellBorderLayout@DirectUI@@6B@	875	0x140034024
??_7StyleSheet@DirectUI@@6B@	876	0x14002b834
??_7StyledScrollViewer@DirectUI@@6BElement@1@@	877	0x140026b68
??_7StyledScrollViewer@DirectUI@@6BIElementListener@1@@	878	0x14000ef84
??_7Surface@DirectUI@@6B@	879	0x1400187cc
??_7TableItemProvider@DirectUI@@6B@	880	0x140002dcc
??_7TableItemProvider@DirectUI@@6BIProvider@1@@	881	0x140035290
??_7TableItemProvider@DirectUI@@6BRefcountBase@1@@	882	0x14002d010
??_7TableItemProxy@DirectUI@@6B@	883	0x14003aa64
??_7TableLayout@DirectUI@@6B@	884	0x14002966c
??_7TableProvider@DirectUI@@6B@	885	0x140029ac8
??_7TableProvider@DirectUI@@6BIProvider@1@@	886	0x14003b0e8
??_7TableProvider@DirectUI@@6BRefcountBase@1@@	887	0x140006f08
??_7TableProxy@DirectUI@@6B@	888	0x14000d9d0
??_7TaskPage@DirectUI@@6BIElementListener@1@@	889	0x14001650c
??_7TaskPage@DirectUI@@6BIXProviderCP@1@@	890	0x140034e04
??_7TextGraphic@DirectUI@@6B@	891	0x14002a45c
??_7Thumb@DirectUI@@6B@	892	0x14001eb3c
??_7ToggleProvider@DirectUI@@6B@	893	0x14003c99c
??_7ToggleProvider@DirectUI@@6BIProvider@1@@	894	0x140018e18
??_7ToggleProvider@DirectUI@@6BRefcountBase@1@@	895	0x140029f78
??_7ToggleProxy@DirectUI@@6B@	896	0x140009540
??_7UnknownElement@DirectUI@@6B@	897	0x140031d0c
??_7ValueProvider@DirectUI@@6B@	898	0x140010078
??_7ValueProvider@DirectUI@@6BIProvider@1@@	899	0x1400035c0
??_7ValueProvider@DirectUI@@6BRefcountBase@1@@	900	0x14003d3a0
??_7ValueProxy@DirectUI@@6B@	901	0x1400391b8
??_7VerticalFlowLayout@DirectUI@@6B@	902	0x14003f984
??_7Viewer@DirectUI@@6B@	903	0x1400321a8
??_7XBaby@DirectUI@@6B@	904	0x140039288
??_7XBaby@DirectUI@@6BHWNDElement@1@@	905	0x140022d54
??_7XBaby@DirectUI@@6BIDialogElement@1@@	906	0x1400408e4
??_7XBaby@DirectUI@@6BIElementListener@1@@	907	0x1400352f8
??_7XElement@DirectUI@@6BHWNDHost@1@@	908	0x14000fe40
??_7XElement@DirectUI@@6BIXElementCP@1@@	909	0x14002f85c
??_7XProvider@DirectUI@@6B@	910	0x14001dde4
??_7XResourceProvider@DirectUI@@6B@	911	0x14002eed0
??_FCCBase@DirectUI@@QEAAXXZ	912	0x14002be38
??_FCCBaseScrollBar@DirectUI@@QEAAXXZ	913	0x14000c6e4
??_FCCCheckBox@DirectUI@@QEAAXXZ	914	0x140033dec
??_FCCCommandLink@DirectUI@@QEAAXXZ	915	0x14001ed20
??_FCCPushButton@DirectUI@@QEAAXXZ	916	0x14002b0d8
??_FCCTreeView@DirectUI@@QEAAXXZ	917	0x14001e3c4
?AbsorbsShortcutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	918	0x14001d2e4
?AccDefActionProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	919	0x140018760
?AccDescProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	920	0x14000a3a4
?AccHelpProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	921	0x14002f060
?AccItemStatusProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	922	0x140009350
?AccItemTypeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	923	0x140004944
?AccNameProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	924	0x140018794
?AccNavigate@DuiAccessible@DirectUI@@SAJPEAVElement@2@JPEAPEAV32@@Z	925	0x14001b764
?AccRoleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	926	0x140009384
?AccStateProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	927	0x140034da8
?AccValueProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	928	0x14002b394
?AcceleratorKeyProperty@Schema@DirectUI@@2HA	929	0x14001e13c
?Access@?$SafeArrayAccessor@H@DirectUI@@QEAAJPEAUtagSAFEARRAY@@G@Z	930	0x1400171c8
?AccessKeyProperty@Schema@DirectUI@@2HA	931	0x140006f80
?AccessibleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	932	0x140026344
?ActionInitiated@Navigator@DirectUI@@SA?AVUID@@XZ	933	0x140019190
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z	934	0x1400287c8
?ActivateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z	935	0x1400308b8
?ActivateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z	936	0x140006994
?ActiveProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	937	0x140037538
?ActiveStateChanged@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	938	0x1400053ec
?ActualReferencePointProp@RefPointElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	939	0x1400214d4
?Add@BaseScrollViewer@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	940	0x14003c988
?Add@Element@DirectUI@@QEAAJPEAV12@@Z	941	0x14003d5f4
?Add@Element@DirectUI@@QEAAJPEAV12@P6AHPEBX1@Z@Z	942	0x140037298
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z	943	0x14000c804
?Add@ElementProviderManager@DirectUI@@SAJPEAVElementProvider@2@@Z	944	0x140031da0
?Add@Expando@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	945	0x14002a9b0
?Add@LinkedList@DirectUI@@QEAAXPEAVLinkedListNode@2@@Z	946	0x140003680
?Add@Macro@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	947	0x14000d950
?Add@Pages@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	948	0x14001d01c
?Add@TouchEdit2@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	949	0x140010f9c
?Add@TouchSelect@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	950	0x14000be8c
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z	951	0x14003ef34
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ	952	0x140025184
?AddChildren@ScrollViewer@DirectUI@@MEAAJXZ	953	0x140031530
?AddChildren@StyledScrollViewer@DirectUI@@MEAAJXZ	954	0x14002d7c0
?AddElement@TouchSelect@DirectUI@@QEAAJPEAVElement@2@PEBG@Z	955	0x140011e58
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z	956	0x140015174
?AddRectangleChange@EventManager@DirectUI@@CAJPEAVElement@2@_N1@Z	957	0x14000abd8
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ	958	0x140039e70
?AddRef@DuiAccessible@DirectUI@@UEAAKXZ	959	0x140040704
?AddRef@Element@DirectUI@@QEAAKXZ	960	0x140025b3c
?AddRef@ElementProvider@DirectUI@@UEAAKXZ	961	0x140025f64
?AddRef@ExpandCollapseProvider@DirectUI@@UEAAKXZ	962	0x14002fa80
?AddRef@GridItemProvider@DirectUI@@UEAAKXZ	963	0x140003a08
?AddRef@GridProvider@DirectUI@@UEAAKXZ	964	0x140027590
?AddRef@HWNDElementProvider@DirectUI@@UEAAKXZ	965	0x14003e2e0
?AddRef@InvokeProvider@DirectUI@@UEAAKXZ	966	0x140010d08
?AddRef@RangeValueProvider@DirectUI@@UEAAKXZ	967	0x14001303c
?AddRef@RefcountBase@DirectUI@@QEAAJXZ	968	0x140026840
?AddRef@ScrollItemProvider@DirectUI@@UEAAKXZ	969	0x14000115c
?AddRef@ScrollProvider@DirectUI@@UEAAKXZ	970	0x140018360
?AddRef@SelectionItemProvider@DirectUI@@UEAAKXZ	971	0x14002eb34
?AddRef@SelectionProvider@DirectUI@@UEAAKXZ	972	0x1400156f8
?AddRef@TableItemProvider@DirectUI@@UEAAKXZ	973	0x14000f360
?AddRef@TableProvider@DirectUI@@UEAAKXZ	974	0x14001ad58
?AddRef@ToggleProvider@DirectUI@@UEAAKXZ	975	0x140022e90
?AddRef@Value@DirectUI@@QEAAXXZ	976	0x14002ee60
?AddRef@ValueProvider@DirectUI@@UEAAKXZ	977	0x140008858
?AddRef@XProvider@DirectUI@@UEAAKXZ	978	0x14002d17c
?AddRulesToStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAVStyleSheet@2@PEBGPEAV?$DynamicArray@UXMLParserCond@DirectUI@@$0A@@2@PEAV?$DynamicArray@PEAG$0A@@2@@Z	979	0x14002d638
?AddString@CCListBox@DirectUI@@QEAAHPEBG@Z	980	0x14000273c
?AddString@Combobox@DirectUI@@QEAAHPEBG@Z	981	0x140033dd4
?AddString@TouchSelect@DirectUI@@QEAAJPEBG@Z	982	0x140022ee0
?AddString@TouchSelect@DirectUI@@QEAAJPEBGPEAPEAVElement@2@@Z	983	0x14002b6ac
?AddStringWithLabelOverride@TouchSelect@DirectUI@@QEAAJPEBG0PEAPEAVElement@2@@Z	984	0x1400344ac
?AddToSelection@NavigatorSelectionItemProxy@DirectUI@@AEAAJPEAVBrowser@2@@Z	985	0x14001604c
?AddToSelection@SelectionItemProvider@DirectUI@@UEAAJXZ	986	0x140034b04
?AddToSelection@SelectorSelectionItemProxy@DirectUI@@AEAAJXZ	987	0x140032cd4
?AdvanceFrame@AnimationStrip@DirectUI@@IEAAXXZ	988	0x14001da8c
?AdvanceFrame@Movie@DirectUI@@SA?AVUID@@XZ	989	0x140018770
?AdviseEventAdded@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z	990	0x14002c9d0
?AdviseEventAdded@EventManager@DirectUI@@SAJHPEAUtagSAFEARRAY@@@Z	991	0x14002c8c0
?AdviseEventRemoved@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z	992	0x14001c9f8
?AdviseEventRemoved@EventManager@DirectUI@@SAJHPEAUtagSAFEARRAY@@@Z	993	0x14002d064
?AliasedRenderingProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	994	0x140010c54
?AlphaProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	995	0x14001d1d4
?AnimatePopupOnDismissProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	996	0x140033ce4
?AnimateScroll@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	997	0x1400036a0
?AnimationChange@Element@DirectUI@@SA?AVUID@@XZ	998	0x140025970
?AnimationProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	999	0x14000e418
?AnimationStatusChange@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1000	0x140010328
?ApplySinkRegion@HWNDHost@DirectUI@@AEAAXPEBUtagRECT@@_N@Z	1001	0x14001ae0c
?Arrow@Expando@DirectUI@@KAGXZ	1002	0x140028788
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ	1003	0x140002484
?AsyncContentLoadedEvent@Schema@DirectUI@@2HA	1004	0x14002d750
?Attach@Layout@DirectUI@@UEAAXPEAVElement@2@@Z	1005	0x14002ef88
?AttachCtrlSubclassProc@HWNDHost@DirectUI@@KAXPEAUHWND__@@@Z	1006	0x140002278
?AutoGroupingProp@CCRadioButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1007	0x1400279b4
?AutoStartProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1008	0x14002ba58
?AutoStopProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1009	0x140016f44
?AutomationFocusChangedEvent@Schema@DirectUI@@2HA	1010	0x1400047e4
?AutomationIdProperty@Schema@DirectUI@@2HA	1011	0x140020de8
?AutomationPropertyChangedEvent@Schema@DirectUI@@2HA	1012	0x14002034c
?BackgroundOwnerIDProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	1013	0x14002bbd4
?BackgroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1014	0x1400332b0
?BaselineProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1015	0x140039208
?BorderColorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1016	0x140010eb0
?BorderStyleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1017	0x1400035d4
?BorderThicknessProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1018	0x14003ee1c
?BoundingRectangleProperty@Schema@DirectUI@@2HA	1019	0x1400404dc
?BroadcastEvent@Element@DirectUI@@QEAAXPEAUEvent@2@@Z	1020	0x140031ce8
?BufferingProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	1021	0x140036480
?BuildCacheInfo@FlowLayout@DirectUI@@IEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@_N@Z	1022	0x14001e78c
?BuildCacheInfo@VerticalFlowLayout@DirectUI@@IEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@_N@Z	1023	0x140037dec
?BuildElement@Macro@DirectUI@@MEAAJXZ	1024	0x1400150d4
?BuildElement@Repeater@DirectUI@@MEAAJXZ	1025	0x140034ce0
?ButtonClassAcceptsEnterKeyProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	1026	0x14001febc
?ButtonControlType@Schema@DirectUI@@2HA	1027	0x140031470
?CacheParser@XBaby@DirectUI@@UEAAXPEAVDUIXmlParser@2@@Z	1028	0x1400400d4
?CalendarControlType@Schema@DirectUI@@2HA	1029	0x140036878
?CanPerformManualVisualSwap@TouchScrollViewer@DirectUI@@QEAA_NXZ	1030	0x1400309e4
?CanSetFocus@HWNDElement@DirectUI@@UEAA_NXZ	1031	0x1400067b0
?CanSetFocus@XBaby@DirectUI@@UEAA_NXZ	1032	0x140002e3c
?CanSetFocus@XProvider@DirectUI@@UEAAJPEA_N@Z	1033	0x14000fb68
?CancelClick@TouchButton@DirectUI@@QEAA_NW4ClickDevice@12@@Z	1034	0x14002ffd4
?CancelCurrentDrag@TouchSlider@DirectUI@@QEAAXXZ	1035	0x140033b74
?CaptureCallstackFrames@CallstackTracker@DirectUI@@QEAAHXZ	1036	0x140011aec
?CapturedProp@Button@DirectUI@@SAPEBUPropertyInfo@2@XZ	1037	0x14002180c
?CapturedProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1038	0x14003f9b0
?CaretMoved@TouchEditBase@DirectUI@@SA?AVUID@@XZ	1039	0x1400098dc
?CheckBoxControlType@Schema@DirectUI@@2HA	1040	0x1400335b8
?CheckScroll@BaseScrollViewer@DirectUI@@AEAAXPEAVBaseScrollBar@2@HHH@Z	1041	0x14002c110
?CheckedStateProp@TouchCheckBox@DirectUI@@SAPEBUPropertyInfo@2@XZ	1042	0x140038364
?ChildrenProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1043	0x140009a70
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z	1044	0x140010368
?ClassNameProperty@Schema@DirectUI@@2HA	1045	0x1400395d4
?ClassProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1046	0x140025dd8
?ClearButtonClicked@TouchEdit2@DirectUI@@SA?AVUID@@XZ	1047	0x140016d74
?ClearCacheDirty@Layout@DirectUI@@IEAAXXZ	1048	0x1400242d8
?ClearParser@DUIFactory@DirectUI@@AEAAXXZ	1049	0x140036f2c
?Click@Button@DirectUI@@SA?AVUID@@XZ	1050	0x140015448
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ	1051	0x14001cfac
?ClickDefaultButton@DialogElement@DirectUI@@UEAA_NXZ	1052	0x14002bc30
?ClickDefaultButton@DialogElementCore@DirectUI@@QEAA_NXZ	1053	0x1400119d0
?ClickDefaultButton@XBaby@DirectUI@@UEAA_NXZ	1054	0x14002c81c
?ClickDefaultButton@XProvider@DirectUI@@UEAAHXZ	1055	0x1400399fc
?ClickablePointProperty@Schema@DirectUI@@2HA	1056	0x1400319ac
?Clipper@Expando@DirectUI@@KAGXZ	1057	0x140002e80
?Clone@DuiAccessible@DirectUI@@UEAAJPEAPEAUIEnumVARIANT@@@Z	1058	0x140017b30
?Clone@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAUIEnumVARIANT@@@Z	1059	0x14001ce94
?Close@ElementProviderManager@DirectUI@@SAXXZ	1060	0x140002b60
?Close@EventManager@DirectUI@@SAXXZ	1061	0x14001db90
?Close@InvokeManager@DirectUI@@SAXXZ	1062	0x14003f394
?ClosePopup@TouchSelect@DirectUI@@QEAAXXZ	1063	0x14000e1c0
?CloseThread@InvokeManager@DirectUI@@SAXXZ	1064	0x140036af0
?Collapse@ExpandCollapseProvider@DirectUI@@UEAAJXZ	1065	0x14002f82c
?ColorFontPaletteIndexProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1066	0x140039868
?ComboBoxControlType@Schema@DirectUI@@2HA	1067	0x140006450
?CompositedTextProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1068	0x14003949c
?CompositingQualityProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1069	0x14001caa8
?CompositionChange@HWNDElement@DirectUI@@SA?AVUID@@XZ	1070	0x14000a580
?ConnectProp@Bind@DirectUI@@SAPEBUPropertyInfo@2@XZ	1071	0x1400107c8
?ConstrainLayoutProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1072	0x14003616c
?ContentAlignProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1073	0x1400373f0
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1074	0x14001899c
?Context@Button@DirectUI@@SA?AVUID@@XZ	1075	0x14001f304
?ContextMenuHintShowing@ContextMenuBehavior@DirectUI@@SA?AVUID@@XZ	1076	0x14003b72c
?ContextMenuRequested@ContextMenuBehavior@DirectUI@@SA?AVUID@@XZ	1077	0x14003ac7c
?ContextMenuRequested@TouchEdit2@DirectUI@@SA?AVUID@@XZ	1078	0x140016ab0
?ContextSensitiveHelp@DuiAccessible@DirectUI@@UEAAJH@Z	1079	0x1400163ec
?ContextSensitiveHelp@HWNDHostAccessible@DirectUI@@UEAAJH@Z	1080	0x14002f96c
?ControlTypeProperty@Schema@DirectUI@@2HA	1081	0x140023d50
?CopySheets@DUIXmlParser@DirectUI@@QEAAJPEAPEAV?$DynamicArray@PEAVValue@DirectUI@@$0A@@2@@Z	1082	0x140018b24
?Count@?$SafeArrayAccessor@H@DirectUI@@QEAAHXZ	1083	0x1400280c8
?Create@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1084	0x1400346a0
?Create@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1085	0x140010794
?Create@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1086	0x14000caf4
?Create@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1087	0x140040400
?Create@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1088	0x14002282c
?Create@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1089	0x140028d60
?Create@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1090	0x14002ccd8
?Create@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1091	0x140010480
?Create@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1092	0x14000dc4c
?Create@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1093	0x14000a8cc
?Create@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1094	0x140021258
?Create@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1095	0x140032c10
?Create@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1096	0x14001658c
?Create@AcceleratorBehavior@@SAJPEAPEAUIDuiBehavior@@@Z	1097	0x140021078
?Create@AccessibleButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1098	0x14003b4a4
?Create@AnimationStrip@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1099	0x1400293fc
?Create@AutoButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1100	0x14001a830
?Create@Bind@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1101	0x1400219e0
?Create@BorderLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1102	0x1400248c0
?Create@BorderLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1103	0x14000de98
?Create@Browser@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1104	0x14001c6fc
?Create@Button@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1105	0x14001ac54
?Create@Button@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1106	0x140037500
?Create@CCAVI@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1107	0x140011a00
?Create@CCAVI@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1108	0x1400269e4
?Create@CCBase@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1109	0x140005344
?Create@CCBase@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1110	0x140032dc0
?Create@CCCheckBox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1111	0x14001d21c
?Create@CCCheckBox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1112	0x1400066e8
?Create@CCCommandLink@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1113	0x14002e210
?Create@CCCommandLink@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1114	0x1400237ec
?Create@CCHScrollBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1115	0x140012888
?Create@CCHScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1116	0x140036418
?Create@CCListBox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1117	0x14001e064
?Create@CCListBox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1118	0x14003b438
?Create@CCListView@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1119	0x140037ea0
?Create@CCListView@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1120	0x14000b6a8
?Create@CCProgressBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1121	0x14001f2c4
?Create@CCProgressBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1122	0x14002bc4c
?Create@CCPushButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1123	0x1400045a4
?Create@CCPushButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1124	0x140022010
?Create@CCRadioButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1125	0x140001b04
?Create@CCRadioButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1126	0x140039a64
?Create@CCSysLink@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1127	0x14003f6cc
?Create@CCSysLink@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1128	0x14003b720
?Create@CCTrackBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1129	0x14000dca0
?Create@CCTrackBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1130	0x14002680c
?Create@CCTreeView@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1131	0x14000f614
?Create@CCTreeView@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1132	0x14001b0b4
?Create@CCVScrollBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1133	0x14003e2e4
?Create@CCVScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1134	0x14003037c
?Create@CheckBoxGlyph@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1135	0x140040264
?Create@CheckBoxGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1136	0x14000a804
?Create@Clipper@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1137	0x1400208a8
?Create@Combobox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1138	0x14000968c
?Create@Combobox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1139	0x14002affc
?Create@ContextMenuBehavior@DirectUI@@SAJPEAPEAUIDuiBehavior@@@Z	1140	0x14002d348
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z	1141	0x140034594
?Create@DialogElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z	1142	0x140014c9c
?Create@DuiAccessible@DirectUI@@SAJPEAVElement@2@PEAPEAV12@@Z	1143	0x140039f0c
?Create@Edit@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1144	0x140023034
?Create@Edit@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1145	0x14000d060
?Create@Element@DirectUI@@SAJIPEAV12@PEAKPEAPEAV12@@Z	1146	0x1400151a4
?Create@ElementProvider@DirectUI@@SAJPEAVElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z	1147	0x140002fe0
?Create@ElementProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1148	0x140038fd0
?Create@ElementWithHWND@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1149	0x140038aa4
?Create@ExpandCollapseProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1150	0x14001dec4
?Create@Expandable@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1151	0x14001a844
?Create@Expando@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1152	0x1400175fc
?Create@ExpandoButtonGlyph@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1153	0x1400194e0
?Create@ExpandoButtonGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1154	0x140007dbc
?Create@FillLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1155	0x140019b80
?Create@FillLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1156	0x14001046c
?Create@FlowLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1157	0x140026078
?Create@FlowLayout@DirectUI@@SAJ_NIIIPEAPEAVLayout@2@@Z	1158	0x140004adc
?Create@GridItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1159	0x1400250cc
?Create@GridLayout@DirectUI@@SAJHHPEAPEAVLayout@2@@Z	1160	0x14003b16c
?Create@GridLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1161	0x140024864
?Create@GridProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1162	0x14002e0e0
?Create@HWNDElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z	1163	0x140008190
?Create@HWNDElementAccessible@DirectUI@@SAJPEAVHWNDElement@2@PEAPEAVDuiAccessible@2@@Z	1164	0x1400123f0
?Create@HWNDElementProvider@DirectUI@@SAJPEAVHWNDElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z	1165	0x14001bc08
?Create@HWNDElementProxy@DirectUI@@SAPEAV12@PEAVHWNDElement@2@@Z	1166	0x1400242f0
?Create@HWNDHost@DirectUI@@SAJIIPEAVElement@2@PEAKPEAPEAV32@@Z	1167	0x140007ebc
?Create@HWNDHost@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1168	0x140006260
?Create@HWNDHostAccessible@DirectUI@@SAJPEAVElement@2@PEAUIAccessible@@PEAPEAVDuiAccessible@2@@Z	1169	0x1400347cc
?Create@HWNDHostClientAccessible@DirectUI@@SAJPEAVElement@2@PEAUIAccessible@@PEAPEAVDuiAccessible@2@@Z	1170	0x14002b220
?Create@InvokeProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1171	0x140020280
?Create@ItemList@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1172	0x140037d74
?Create@Layout@DirectUI@@SAJPEAPEAV12@@Z	1173	0x140034af8
?Create@Macro@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1174	0x1400369a8
?Create@ModernProgressBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1175	0x140029bc0
?Create@ModernProgressRing@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1176	0x140013038
?Create@Movie@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1177	0x1400304f0
?Create@Movie@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1178	0x1400396ac
?Create@NativeHWNDHost@DirectUI@@SAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@IPEAPEAV12@@Z	1179	0x1400283a4
?Create@NativeHWNDHost@DirectUI@@SAJPEBGPEAUHWND__@@PEAUHICON__@@HHHHHHIPEAPEAV12@@Z	1180	0x140035488
?Create@Navigator@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1181	0x140002b48
?Create@NineGridLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1182	0x140035518
?Create@NineGridLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1183	0x14000b49c
?Create@PText@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1184	0x1400315ec
?Create@Page@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1185	0x140035c10
?Create@Pages@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1186	0x14003d44c
?Create@Progress@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1187	0x14001aea0
?Create@PushButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1188	0x140032440
?Create@RadioButtonGlyph@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1189	0x14000f5ac
?Create@RadioButtonGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1190	0x140037750
?Create@RangeValueProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1191	0x140027474
?Create@RefPointElement@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1192	0x140037100
?Create@RefPointElement@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1193	0x14002bcd8
?Create@RepeatButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1194	0x140024548
?Create@RepeatButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1195	0x140026210
?Create@Repeater@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1196	0x140019390
?Create@RichText@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1197	0x1400292e4
?Create@RowLayout@DirectUI@@SAJHIIPEAPEAVLayout@2@@Z	1198	0x1400124b0
?Create@RowLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1199	0x140023d10
?Create@RowLayout@DirectUI@@SAJIIPEAPEAVLayout@2@@Z	1200	0x140027070
?Create@ScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1201	0x14003b338
?Create@ScrollBar@DirectUI@@SAJ_NPEAVElement@2@PEAKPEAPEAV32@@Z	1202	0x1400399b0
?Create@ScrollItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1203	0x140022ea0
?Create@ScrollProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1204	0x140021030
?Create@ScrollViewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1205	0x140031af0
?Create@ScrubBehavior@@SAJPEAPEAUIDuiBehavior@@@Z	1206	0x140013c10
?Create@SelectionItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1207	0x140006500
?Create@SelectionProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1208	0x140023df4
?Create@Selector@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1209	0x140025af4
?Create@SelectorNoDefault@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1210	0x140024818
?Create@SemanticZoomToggle@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1211	0x140032320
?Create@ShellBorderLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1212	0x14001f66c
?Create@ShellBorderLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1213	0x140022c48
?Create@StyleSheet@DirectUI@@SAJPEAPEAV12@@Z	1214	0x140011508
?Create@StyledScrollViewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1215	0x140033ac4
?Create@TableItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1216	0x140015d74
?Create@TableLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1217	0x14003ace8
?Create@TableProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1218	0x1400210a0
?Create@TextGraphic@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1219	0x140015528
?Create@Thumb@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1220	0x140030344
?Create@Thumb@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1221	0x140039d80
?Create@ToggleProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1222	0x140008930
?Create@TouchButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1223	0x140036310
?Create@TouchButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1224	0x140007750
?Create@TouchCheckBox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1225	0x140030174
?Create@TouchCheckBox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1226	0x140001760
?Create@TouchCheckBoxGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1227	0x140003a0c
?Create@TouchCommandButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1228	0x140012da8
?Create@TouchCommandButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1229	0x140014034
?Create@TouchEdit2@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1230	0x1400083d0
?Create@TouchEditBase@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1231	0x140012b8c
?Create@TouchHWNDElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z	1232	0x14000909c
?Create@TouchHyperLink@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1233	0x14003a924
?Create@TouchHyperLink@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1234	0x14001b464
?Create@TouchRepeatButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1235	0x14002a958
?Create@TouchRepeatButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1236	0x1400271cc
?Create@TouchScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1237	0x14000af48
?Create@TouchScrollViewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1238	0x14001948c
?Create@TouchSelect@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1239	0x140023648
?Create@TouchSelectItem@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1240	0x140017f2c
?Create@TouchSlider@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1241	0x14001d1ec
?Create@TouchSwitch@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1242	0x14001e3d8
?Create@UnknownElement@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1243	0x14001bb50
?Create@UnknownElement@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1244	0x140036f14
?Create@ValueProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1245	0x14002fa40
?Create@VerticalFlowLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1246	0x14001f87c
?Create@VerticalFlowLayout@DirectUI@@SAJ_NIIIPEAPEAVLayout@2@@Z	1247	0x1400357bc
?Create@Viewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1248	0x140016da8
?Create@XBaby@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1249	0x140010534
?Create@XBaby@DirectUI@@SAJPEAVIXElementCP@2@PEAVXProvider@2@PEAUHWND__@@PEAVElement@2@PEAKPEAPEAV62@@Z	1250	0x140003f44
?Create@XElement@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1251	0x1400088b4
?Create@XElement@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1252	0x14003cdac
?Create@XHost@DirectUI@@SAJPEAVIXElementCP@2@PEAPEAV12@@Z	1253	0x14002ef30
?Create@XProvider@DirectUI@@SAJPEAVElement@2@PEAVIXProviderCP@2@PEAPEAV12@@Z	1254	0x14001a11c
?Create@XResourceProvider@DirectUI@@SAJPEAPEAV12@@Z	1255	0x14003f5e0
?Create@XResourceProvider@DirectUI@@SAJPEAUHINSTANCE__@@PEBG11PEAPEAV12@@Z	1256	0x140036334
?CreateAccNameLabel@HWNDHost@DirectUI@@IEAAPEAUHWND__@@PEAU3@@Z	1257	0x14001855c
?CreateAtom@Value@DirectUI@@SAPEAV12@G@Z	1258	0x1400409b0
?CreateAtom@Value@DirectUI@@SAPEAV12@PEBG@Z	1259	0x140012d30
?CreateBool@Value@DirectUI@@SAPEAV12@_N@Z	1260	0x140026524
?CreateButtons@ScrollBar@DirectUI@@MEAAJXZ	1261	0x14002399c
?CreateButtons@TouchScrollBar@DirectUI@@UEAAJXZ	1262	0x14000ddc0
?CreateCache@RichText@DirectUI@@SAJIPEAPEAUIDUIRichTextCache@@@Z	1263	0x140025620
?CreateColor@Value@DirectUI@@SAPEAV12@K@Z	1264	0x140033dac
?CreateColor@Value@DirectUI@@SAPEAV12@KKE@Z	1265	0x140023c5c
?CreateColor@Value@DirectUI@@SAPEAV12@KKKE@Z	1266	0x1400080c8
?CreateCursor@Value@DirectUI@@SAPEAV12@PEAUHICON__@@@Z	1267	0x140029964
?CreateCursor@Value@DirectUI@@SAPEAV12@PEBG@Z	1268	0x14002965c
?CreateDFCFill@Value@DirectUI@@SAPEAV12@II@Z	1269	0x140035c28
?CreateDTBFill@Value@DirectUI@@SAPEAV12@PEBGHH@Z	1270	0x14003f940
?CreateDUI@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAPEAUHWND__@@@Z	1271	0x140028ca8
?CreateDUICP@TaskPage@DirectUI@@EEAAJPEAVHWNDElement@2@PEAUHWND__@@1PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z	1272	0x140005fec
?CreateDUICP@XResourceProvider@DirectUI@@UEAAJPEAVHWNDElement@2@PEAUHWND__@@1PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z	1273	0x14002c420
?CreateDoubleList@Value@DirectUI@@SAPEAV12@PEAV?$DynamicArray@N$0A@@2@@Z	1275	0x14001b578
?CreateDoubleList@Value@DirectUI@@SAPEAV12@PEBNH@Z	1276	0x14001e6d8
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z	1277	0x14001c8e8
?CreateElementList@Value@DirectUI@@SAPEAV12@PEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@@Z	1278	0x14003a064
?CreateElementRef@Value@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1279	0x14002429c
?CreateElementScaledValue@Value@DirectUI@@SAPEAV12@PEAVElement@2@PEAV12@@Z	1280	0x14002df4c
?CreateEncodedString@Value@DirectUI@@SAPEAV12@PEBG@Z	1281	0x14000b308
?CreateExpression@Value@DirectUI@@SAPEAV12@PEAVExpression@2@@Z	1282	0x14002644c
?CreateFill@Value@DirectUI@@SAPEAV12@AEBUFill@2@@Z	1283	0x140020a8c
?CreateFloat@Value@DirectUI@@SAPEAV12@MW4DynamicScaleValue@@@Z	1284	0x14000ea70
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHBITMAP__@@EI_N11@Z	1285	0x140035018
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHENHMETAFILE__@@0@Z	1286	0x140010cfc
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHICON__@@_N11@Z	1287	0x14001593c
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUISharedBitmap@@EI@Z	1288	0x14001c6c4
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEBGEIGGPEAUHINSTANCE__@@_N2@Z	1289	0x14001d434
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEBGGGPEAUHINSTANCE__@@_N2@Z	1290	0x140001a1c
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEBGUScaledSIZE@2@PEAUHINSTANCE__@@_N3@Z	1291	0x1400076f4
?CreateHWND@CCBase@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1292	0x14000b1cc
?CreateHWND@CCBaseScrollBar@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1293	0x140028538
?CreateHWND@Combobox@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1294	0x14002fa28
?CreateHWND@Edit@DirectUI@@MEAAPEAUHWND__@@PEAU3@@Z	1295	0x140007eb8
?CreateHWND@Edit@DirectUI@@MEAAPEAUHWND__@@PEAU3@_N@Z	1296	0x140013a38
?CreateHWND@HWNDHost@DirectUI@@MEAAPEAUHWND__@@PEAU3@@Z	1297	0x140032e44
?CreateHWND@XElement@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1298	0x1400247a8
?CreateHostWindow@NativeHWNDHost@DirectUI@@UEAAPEAUHWND__@@KPEBG0KHHHHPEAU3@PEAUHMENU__@@PEAUHINSTANCE__@@PEAX@Z	1299	0x14000c1d8
?CreateIconGraphicHelper@Value@DirectUI@@CAPEAV12@PEAUHICON__@@_N11@Z	1300	0x140041520
?CreateInstance@CSafeElementProxy@@SAJPEAVElement@DirectUI@@PEAPEAV1@@Z	1301	0x140028860
?CreateInt@Value@DirectUI@@SAPEAV12@HW4DynamicScaleValue@@@Z	1302	0x140031f0c
?CreateLayout@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@P6AJHPEAHPEAPEAVValue@2@@Z@Z	1303	0x1400032a8
?CreateLayout@Value@DirectUI@@SAPEAV12@PEAVLayout@2@@Z	1304	0x140035f48
?CreateParser@DUIFactory@DirectUI@@QEAAJXZ	1305	0x140009d08
?CreateParser@XProvider@DirectUI@@QEAAJPEAPEAVDUIXmlParser@2@@Z	1306	0x1400056f0
?CreateParserCP@TaskPage@DirectUI@@EEAAJPEAPEAVDUIXmlParser@2@@Z	1307	0x14001702c
?CreateParserCP@XResourceProvider@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z	1308	0x1400014d0
?CreatePatternProvider@Schema@DirectUI@@SAJW4Pattern@12@PEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1309	0x1400130c8
?CreatePoint@Value@DirectUI@@SAPEAV12@HHW4DynamicScaleValue@@@Z	1310	0x140040f58
?CreateRect@Value@DirectUI@@SAPEAV12@HHHHW4DynamicScaleValue@@@Z	1311	0x140004c18
?CreateScaledValue@Value@DirectUI@@SAPEAV12@MPEAV12@@Z	1312	0x14002bbd4
?CreateScrollBars@ScrollViewer@DirectUI@@MEAAJXZ	1313	0x14003d3ec
?CreateScrollBars@StyledScrollViewer@DirectUI@@MEAAJXZ	1314	0x1400219f0
?CreateSize@Value@DirectUI@@SAPEAV12@HHW4DynamicScaleValue@@@Z	1315	0x14002935c
?CreateString@Value@DirectUI@@SAPEAV12@PEBGPEAUHINSTANCE__@@@Z	1316	0x1400254e0
?CreateStringRP@Value@DirectUI@@SAPEAV12@PEBGPEAUHINSTANCE__@@@Z	1317	0x140035010
?CreateStyleParser@HWNDElement@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z	1318	0x14003b160
?CreateStyleParser@XBaby@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z	1319	0x140016ab4
?CreateStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBGPEAPEAVStyleSheet@2@@Z	1320	0x14003cefc
?CreateStyleSheet@Value@DirectUI@@SAPEAV12@PEAVStyleSheet@2@@Z	1321	0x14001db2c
?CreateValueList@Value@DirectUI@@SAPEAV12@PEAV12@@Z	1322	0x1400085ac
?CreateValueList@Value@DirectUI@@SAPEAV12@PEAV?$DynamicArray@PEAVValue@DirectUI@@$0A@@2@@Z	1323	0x14003efb0
?CreateXBaby@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAUHWND__@@PEAVElement@2@PEAKPEAPEAUIXBaby@2@@Z	1324	0x140031594
?CreateXmlReader@DUIXmlParser@DirectUI@@IEAAJPEAPEAUIXmlReader@@@Z	1325	0x140021074
?CreateXmlReaderFromHGLOBAL@DUIXmlParser@DirectUI@@IEAAJPEAXPEAPEAUIXmlReader@@@Z	1326	0x140018f0c
?CreateXmlReaderInputWithEncodingName@DUIXmlParser@DirectUI@@IEAAJPEAUIStream@@PEBGPEAPEAUIUnknown@@@Z	1327	0x140023c44
?CtrlSubclassProc@HWNDHost@DirectUI@@KA_JPEAUHWND__@@I_K_J@Z	1328	0x14000a5d0
?CultureProperty@Schema@DirectUI@@2HA	1329	0x1400201f4
?CursorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1330	0x1400124c0
?CustomControlType@Schema@DirectUI@@2HA	1331	0x140017c84
?CustomDragDropScalingHint@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1332	0x140012568
?CustomProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1333	0x140015cc4
?CustomReflowHint@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1334	0x14002c968
?CustomTapHint@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1335	0x140028a6c
?Cut@TouchEditBase@DirectUI@@SA?AVUID@@XZ	1336	0x140005d6c
?DCompDeviceRebuilt@Element@DirectUI@@SA?AVUID@@XZ	1337	0x14003d58c
?DPIProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1338	0x140030d6c
?DUICreatePropertySheetPage@TaskPage@DirectUI@@QEAAJPEAUHINSTANCE__@@@Z	1339	0x1400187a8
?DataGridControlType@Schema@DirectUI@@2HA	1340	0x14001e354
?DataItemControlType@Schema@DirectUI@@2HA	1341	0x140033170
?DefaultAction@Button@DirectUI@@UEAAJXZ	1342	0x140002834
?DefaultAction@CCBase@DirectUI@@UEAAJXZ	1343	0x1400223a4
?DefaultAction@CCPushButton@DirectUI@@UEAAJXZ	1344	0x14001da38
?DefaultAction@Element@DirectUI@@UEAAJXZ	1345	0x140013b6c
?DefaultAction@SemanticZoomToggle@DirectUI@@UEAAJXZ	1346	0x14003de60
?DefaultAction@TouchButton@DirectUI@@UEAAJXZ	1347	0x14000a8e0
?DefaultAction@TouchRepeatButton@DirectUI@@UEAAJXZ	1348	0x140002714
?DefaultButtonTrackingProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	1349	0x140002660
?DelayActivateTooltip@HWNDElement@DirectUI@@QEAAXXZ	1350	0x14002ca28
?DeleteString@CCListBox@DirectUI@@QEAAHH@Z	1351	0x14003e71c
?DesiredSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1352	0x14001f2e4
?Destroy@ClassInfoBase@DirectUI@@UEAAXXZ	1353	0x1400228f0
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ	1354	0x14003f39c
?Destroy@Element@DirectUI@@QEAAJ_N@Z	1355	0x140017fa8
?Destroy@Expression@DirectUI@@QEAAXXZ	1356	0x140008160
?Destroy@Layout@DirectUI@@QEAAXXZ	1357	0x140004454
?Destroy@NativeHWNDHost@DirectUI@@QEAAXXZ	1358	0x14001c3f0
?Destroy@XHost@DirectUI@@QEAAXXZ	1359	0x14001f760
?DestroyAll@Element@DirectUI@@QEAAJ_N@Z	1360	0x14002504c
?DestroyCP@TaskPage@DirectUI@@EEAAXXZ	1361	0x14002f0dc
?DestroyCP@XResourceProvider@DirectUI@@UEAAXXZ	1362	0x1400406d8
?DestroyListener@EventManager@DirectUI@@SAXPEAVElement@2@@Z	1363	0x140013cc4
?DestroyMsg@NativeHWNDHost@DirectUI@@SAIXZ	1364	0x140021d74
?DestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ	1365	0x140038abc
?DestroyWindow@XHost@DirectUI@@QEAAXXZ	1366	0x140014448
?Detach@CSafeElementProxy@@QEAAXXZ	1367	0x140020bc8
?Detach@Element@DirectUI@@QEAAXPEAVDeferCycle@2@@Z	1368	0x14000a0b4
?Detach@HWNDHost@DirectUI@@QEAAXXZ	1369	0x1400407bc
?Detach@Layout@DirectUI@@UEAAXPEAVElement@2@@Z	1370	0x1400217d8
?DetachParser@DUIFactory@DirectUI@@QEAAPEAVDUIXmlParser@2@XZ	1371	0x140009aac
?DeterminateProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	1372	0x14001c108
?DirectionProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1373	0x14000a0d8
?DirtyProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	1374	0x14003edd8
?DisableAccTextExtendProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1375	0x14001d928
?DisableMouseInRectCheckProp@TouchRepeatButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1376	0x14000c4f8
?DisableSelectionHandlesOnEmptyContent@TouchEdit2@DirectUI@@QEAAXXZ	1377	0x140036e38
?Disconnect@DuiAccessible@DirectUI@@UEAAJXZ	1378	0x140013d30
?Disconnect@HWNDElementAccessible@DirectUI@@UEAAJXZ	1379	0x140011cac
?Disconnect@HWNDHostAccessible@DirectUI@@UEAAJXZ	1380	0x14002522c
?DismissIHMAsync@TouchHWNDElement@DirectUI@@QEAAJXZ	1381	0x14003e7e4
?DllsLoaded@CallstackTracker@DirectUI@@CAHXZ	1382	0x14003b32c
?DoInvoke@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@IEAAJHZZ	1383	0x14002bd9c
?DoInvoke@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@IEAAJHZZ	1384	0x1400304f8
?DoInvoke@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@IEAAJHZZ	1385	0x1400211b0
?DoInvoke@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@IEAAJHZZ	1386	0x140021f98
?DoInvoke@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@IEAAJHZZ	1387	0x140029c28
?DoInvoke@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@IEAAJHZZ	1388	0x14002bc54
?DoInvoke@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@IEAAJHZZ	1389	0x14003b310
?DoInvoke@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@IEAAJHZZ	1390	0x140036260
?DoInvoke@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@IEAAJHZZ	1391	0x140013344
?DoInvoke@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@IEAAJHZZ	1392	0x140011e84
?DoInvoke@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@IEAAJHZZ	1393	0x140011a78
?DoInvoke@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@IEAAJHZZ	1394	0x140003350
?DoInvoke@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@IEAAJHZZ	1395	0x14002f5a0
?DoInvoke@ElementProvider@DirectUI@@IEAAJHZZ	1396	0x14002bb30
?DoInvoke@InvokeHelper@DirectUI@@QEAAJHPEAVElementProvider@2@P6APEAVProviderProxy@2@PEAVElement@2@@ZPEAD@Z	1397	0x140011260
?DoInvokeArgs@ElementProvider@DirectUI@@QEAAJHP6APEAVProviderProxy@2@PEAVElement@2@@ZPEAD@Z	1398	0x14003e254
?DoLayout@BorderLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1399	0x1400057e0
?DoLayout@FillLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1400	0x1400380f0
?DoLayout@FlowLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1401	0x140019e54
?DoLayout@GridLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1402	0x14002c040
?DoLayout@Layout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1403	0x1400341e0
?DoLayout@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1404	0x140013660
?DoLayout@RowLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1405	0x140037a44
?DoLayout@TableLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1406	0x1400042ec
?DoLayout@VerticalFlowLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1407	0x140021c38
?DoMethod@BrowserSelectionProxy@DirectUI@@UEAAJHPEAD@Z	1408	0x14003a644
?DoMethod@ElementProxy@DirectUI@@UEAAJHPEAD@Z	1409	0x14002355c
?DoMethod@ExpandCollapseProxy@DirectUI@@UEAAJHPEAD@Z	1410	0x14001dd90
?DoMethod@GridItemProxy@DirectUI@@UEAAJHPEAD@Z	1411	0x140029e68
?DoMethod@GridProxy@DirectUI@@UEAAJHPEAD@Z	1412	0x14003cca0
?DoMethod@HWNDElementProxy@DirectUI@@UEAAJHPEAD@Z	1413	0x14001e9f0
?DoMethod@InvokeProxy@DirectUI@@UEAAJHPEAD@Z	1414	0x14002ad0c
?DoMethod@ModernProgressBarRangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1415	0x140015d1c
?DoMethod@NavigatorSelectionItemProxy@DirectUI@@UEAAJHPEAD@Z	1416	0x140022214
?DoMethod@ProgressRangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1417	0x140035220
?DoMethod@RangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1418	0x14002da34
?DoMethod@ScrollBarRangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1419	0x140028948
?DoMethod@ScrollItemProxy@DirectUI@@UEAAJHPEAD@Z	1420	0x140012e58
?DoMethod@ScrollProxy@DirectUI@@UEAAJHPEAD@Z	1421	0x140006194
?DoMethod@SelectionItemProxy@DirectUI@@UEAAJHPEAD@Z	1422	0x14003ce58
?DoMethod@SelectionProxy@DirectUI@@UEAAJHPEAD@Z	1423	0x14000edc0
?DoMethod@SelectorSelectionItemProxy@DirectUI@@UEAAJHPEAD@Z	1424	0x140018d68
?DoMethod@SelectorSelectionProxy@DirectUI@@UEAAJHPEAD@Z	1425	0x14000e534
?DoMethod@TableItemProxy@DirectUI@@UEAAJHPEAD@Z	1426	0x14000c5b4
?DoMethod@TableProxy@DirectUI@@UEAAJHPEAD@Z	1427	0x140011588
?DoMethod@ToggleProxy@DirectUI@@UEAAJHPEAD@Z	1428	0x140006790
?DoMethod@ValueProxy@DirectUI@@UEAAJHPEAD@Z	1429	0x14003fb04
?DockPattern@Schema@DirectUI@@2HA	1430	0x1400188f0
?DocumentControlType@Schema@DirectUI@@2HA	1431	0x140014198
?DoubleBuffered@Element@DirectUI@@QEAAX_N@Z	1432	0x14001f76c
?Drag@Thumb@DirectUI@@SA?AVUID@@XZ	1433	0x140024e94
?DragDragCancelEvent@Schema@DirectUI@@2HA	1434	0x140006fe0
?DragDragCompleteEvent@Schema@DirectUI@@2HA	1435	0x140011138
?DragDragStartEvent@Schema@DirectUI@@2HA	1436	0x140017428
?DragPattern@Schema@DirectUI@@2HA	1437	0x1400392fc
?Drag_DropEffect_Property@Schema@DirectUI@@2HA	1438	0x140016680
?Drag_DropEffects_Property@Schema@DirectUI@@2HA	1439	0x1400235e4
?Drag_IsGrabbed_Property@Schema@DirectUI@@2HA	1440	0x1400037a8
?DrawOutlinesProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1441	0x140004c74
?DumpDuiProperties@@YAXPEAVElement@DirectUI@@@Z	1443	0x140028894
?DumpDuiTree@@YAXPEAVElement@DirectUI@@H@Z	1444	0x140020238
?EdgeHighlightColorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1445	0x140032634
?EdgeHighlightThicknessProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1446	0x140030598
?EditControlType@Schema@DirectUI@@2HA	1447	0x140023c44
?ElementFromPoint@HWNDElement@DirectUI@@QEAAPEAVElement@2@PEAUtagPOINT@@@Z	1448	0x140009170
?ElementFromPoint@HWNDElementProxy@DirectUI@@IEAAJNNPEAPEAUIRawElementProviderFragment@@@Z	1449	0x140015424
?ElementMovesOnIHMNotifyProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	1450	0x140021984
?ElementProviderFromPoint@HWNDElementProvider@DirectUI@@UEAAJNNPEAPEAUIRawElementProviderFragment@@@Z	1451	0x1400328a4
?EnableDesignMode@DUIXmlParser@DirectUI@@QEAAXXZ	1452	0x14003309c
?EnableUiaEvents@Element@DirectUI@@QEAAX_N@Z	1453	0x14003bcd0
?EnabledProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1454	0x14001d058
?End@BaseScrollBar@DirectUI@@UEAAXXZ	1455	0x140037340
?EndDefer@Element@DirectUI@@QEAAXK@Z	1456	0x140002e98
?EndDefer@EventManager@DirectUI@@SAJPEAVElement@2@@Z	1457	0x14003da10
?EnforceSizeProp@PushButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1458	0x14001cc50
?EnsureVisible@Element@DirectUI@@QEAA_NI@Z	1459	0x1400254cc
?EnsureVisible@Element@DirectUI@@QEAA_NXZ	1460	0x1400268fc
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z	1461	0x14002cd44
?EnsureVisible@Viewer@DirectUI@@UEAA_NHHHH@Z	1462	0x140024b54
?Enter@Edit@DirectUI@@SA?AVUID@@XZ	1463	0x140014334
?Enter@TouchEditBase@DirectUI@@SA?AVUID@@XZ	1464	0x140015bc8
?Entered@Browser@DirectUI@@SA?AVUID@@XZ	1465	0x140013e00
?EnumCallstackFrames@CallstackTracker@DirectUI@@QEAAHP6AXPEBD0KK@Z@Z	1466	0x1400161a4
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z	1467	0x14000d82c
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z	1468	0x14002a4d8
?EraseFeedback@TouchSlider@DirectUI@@QEAAXXZ	1469	0x140038f98
?EstimateContentSize@CCPushButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1470	0x14000d8e4
?EventFromEventId@Schema@DirectUI@@SA?AW4Event@12@H@Z	1471	0x14000c634
?EventListener@EventManager@DirectUI@@SAJPEAVElement@2@PEAUEvent@2@@Z	1472	0x14002e81c
?ExecuteManualSwapDeferredZoomToRect@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	1473	0x140005754
?Expand@ExpandCollapseProvider@DirectUI@@UEAAJXZ	1474	0x14000d654
?ExpandCollapsePattern@Schema@DirectUI@@2HA	1475	0x14000c7c8
?ExpandCollapse_ExpandCollapseState_Property@Schema@DirectUI@@2HA	1476	0x14002e034
?ExpandProp@Macro@DirectUI@@SAPEBUPropertyInfo@2@XZ	1477	0x14003c4fc
?ExpandedProp@Expandable@DirectUI@@SAPEBUPropertyInfo@2@XZ	1478	0x14001b634
?ExtentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1479	0x14001a7e4
?FWantAnyEvent@EventManager@DirectUI@@SA_NPEAVElement@2@@Z	1480	0x14003c8e0
?FillSymbolInfo@CallstackTracker@DirectUI@@AEAAXPEAUSTACK_SYMBOL_INFO@12@_K@Z	1481	0x14003a1d0
?FilterOnPasteProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	1482	0x140036cd0
?FinalizeCurrentIMEComposition@TouchEdit2@DirectUI@@UEAAJXZ	1483	0x140010608
?FinalizeCurrentIMEComposition@TouchEditBase@DirectUI@@UEAAJXZ	1484	0x140004df4
?Find@ElementProviderManager@DirectUI@@SAPEAVElementProvider@2@PEAVElement@2@@Z	1485	0x140005164
?FindAccessibleRole@AccessibleButton@DirectUI@@CAPEBUACCESSIBLEROLE@12@H@Z	1486	0x140008464
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z	1487	0x140010b94
?FindDescendentWorker@Element@DirectUI@@AEAAPEAV12@G@Z	1488	0x140036cbc
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UEAAHGH@Z	1489	0x140015e84
?FindInvokeHelper@InvokeManager@DirectUI@@CAPEAVInvokeHelper@2@PEAI@Z	1490	0x140023d18
?FindProviderCallback@ElementProviderManager@DirectUI@@CA_NPEAVElementProvider@2@PEAX@Z	1491	0x140002698
?FindRefPoint@RefPointElement@DirectUI@@SAPEAVElement@2@PEAV32@PEAUtagPOINT@@@Z	1492	0x14000fcec
?FindShortcut@HWNDElement@DirectUI@@SA_NGPEAVElement@2@PEAPEAV32@PEAH2H@Z	1493	0x14002e4d0
?FindShortcutRecursive@HWNDElement@DirectUI@@KA_NGPEAVElement@2@PEAPEAV32@PEAH2H@Z	1494	0x140028594
?FireAnimationChangeEvent@BaseScrollViewer@DirectUI@@IEAAX_N@Z	1495	0x14000705c
?FireClickEvent@TouchButton@DirectUI@@UEAAXIIW4ClickDevice@12@PEAUtagPOINT@@@Z	1496	0x1400315b4
?FireClickEvent@TouchRepeatButton@DirectUI@@UEAAXIIW4ClickDevice@TouchButton@2@PEAUtagPOINT@@@Z	1497	0x140007438
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z	1498	0x1400152e0
?FireEventOnMouseOrPointerRelease@TouchSlider@DirectUI@@QEAAXXZ	1499	0x14002d9a0
?FireHostEvent@PushButton@DirectUI@@AEAAXPEAVElement@2@_N@Z	1500	0x14002fc5c
?FireNavigate@Browser@DirectUI@@AEAAHG@Z	1501	0x14002d2b4
?FireNavigationEvent@Navigator@DirectUI@@AEAAXXZ	1502	0x140021b28
?FireRightClickEvent@TouchButton@DirectUI@@UEAAXIPEAUtagPOINT@@@Z	1503	0x140017a54
?FireRightClickEvent@TouchRepeatButton@DirectUI@@UEAAXIPEAUtagPOINT@@@Z	1504	0x140034148
?FireStructureChangedEvent@EventManager@DirectUI@@SAJPEAVElement@2@W4StructureChangeType@@@Z	1505	0x14000ba18
?FlagsProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	1506	0x14000ec08
?FlushWorkingSet@HWNDElement@DirectUI@@QEAAXXZ	1507	0x1400382b4
?FontColorRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1508	0x1400360ac
?FontFaceProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1509	0x14001c8c8
?FontProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1510	0x140032080
?FontQualityProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1511	0x140005bd4
?FontSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1512	0x14001b440
?FontSizeRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1513	0x140008340
?FontStyleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1514	0x1400242e8
?FontWeightProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1515	0x1400140b0
?FontWeightRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1516	0x140030584
?ForceEditTextToLTRProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	1517	0x140030c3c
?ForceThemeChange@XBaby@DirectUI@@UEAAX_K_J@Z	1518	0x140019fac
?ForceThemeChange@XProvider@DirectUI@@UEAAJ_K_J@Z	1519	0x14003c6c4
?ForegroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1520	0x140003cbc
?Forward@Movie@DirectUI@@QEAAXXZ	1521	0x140033efc
?ForwardingWindowMessage@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	1522	0x14000ace8
?FrameDurationProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	1523	0x140034828
?FrameIndexProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	1524	0x14003cbcc
?FrameWidthProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	1525	0x14002becc
?FrameworkId@Schema@DirectUI@@2HA	1526	0x140017290
?FreeComCtl32@TaskPage@DirectUI@@AEAAXXZ	1527	0x140022f30
?FreeProvider@XElement@DirectUI@@QEAAXXZ	1528	0x14002b090
?GetAbsorbsShortcut@Element@DirectUI@@QEAA_NXZ	1529	0x140020988
?GetAccDefAction@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1530	0x1400265c0
?GetAccDesc@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1531	0x14001da3c
?GetAccHelp@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1532	0x14002e47c
?GetAccItemStatus@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1533	0x140019dac
?GetAccItemType@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1534	0x140017c98
?GetAccName@DuiAccessible@DirectUI@@IEAAJUtagVARIANT@@HPEAPEAG@Z	1535	0x140006cf8
?GetAccName@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1536	0x14000404c
?GetAccNameAsDisplayed@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1537	0x14002c3d4
?GetAccNameFromContent@DuiAccessible@DirectUI@@IEAAJPEAPEAG@Z	1538	0x14002aac0
?GetAccRole@Element@DirectUI@@QEAAHXZ	1539	0x1400025c4
?GetAccState@Element@DirectUI@@QEAAHXZ	1540	0x140027904
?GetAccValue@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1541	0x14000b2fc
?GetAccessible@Element@DirectUI@@QEAA_NXZ	1542	0x14002c1e8
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1543	0x14001c908
?GetAccessibleImpl@HWNDElement@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1544	0x14002412c
?GetAccessibleImpl@HWNDHost@DirectUI@@AEAAJPEAPEAUIAccessible@@_N@Z	1545	0x140004cd0
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1546	0x140014468
?GetAccessibleImpl@TouchEdit2@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1547	0x14002cda4
?GetAccessibleParent@DuiAccessible@DirectUI@@SAPEAVElement@2@PEAV32@@Z	1548	0x1400288f8
?GetActive@Element@DirectUI@@QEAAHXZ	1549	0x14001d8c4
?GetActiveState@TouchScrollBar@DirectUI@@QEAA?AW4ActiveState@2@XZ	1550	0x14002df38
?GetActualReferencePoint@RefPointElement@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z	1551	0x140019f64
?GetAdjacent@BorderLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1552	0x140011a0c
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z	1553	0x14002d69c
?GetAdjacent@FillLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1554	0x140023c74
?GetAdjacent@FlowLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1555	0x140030560
?GetAdjacent@GridLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1556	0x14002d958
?GetAdjacent@ItemList@DirectUI@@UEAAPEAVElement@2@PEAV32@HPEBUNavReference@2@K@Z	1557	0x140023094
?GetAdjacent@Layout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1558	0x14003c258
?GetAdjacent@NineGridLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1559	0x140030bf8
?GetAdjacent@RowLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1560	0x14001fa54
?GetAdjacent@Selector@DirectUI@@UEAAPEAVElement@2@PEAV32@HPEBUNavReference@2@K@Z	1561	0x140003550
?GetAdjacent@ShellBorderLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1562	0x140023bc8
?GetAdjacent@TableLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1563	0x140024c20
?GetAdjacent@VerticalFlowLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1564	0x140026840
?GetAdjacent@XBaby@DirectUI@@UEAAPEAVElement@2@PEAV32@HPEBUNavReference@2@K@Z	1565	0x14000bbe8
?GetAllowArrowOut@TouchScrollViewer@DirectUI@@QEAA_NXZ	1566	0x140033930
?GetAlpha@Element@DirectUI@@QEAAHXZ	1567	0x14003f1cc
?GetAnimatePopupOnDismiss@TouchSelect@DirectUI@@QEAA_NXZ	1568	0x140021958
?GetAnimation@Element@DirectUI@@QEAAHXZ	1569	0x14001c134
?GetAtom@Value@DirectUI@@QEAAGXZ	1570	0x140015c08
?GetAtomZero@Value@DirectUI@@SAPEAV12@XZ	1571	0x140034110
?GetAutoGrouping@CCRadioButton@DirectUI@@QEAA_NXZ	1572	0x14002f754
?GetAutoStart@Movie@DirectUI@@QEAA_NXZ	1573	0x14002bee0
?GetAutoStop@Movie@DirectUI@@QEAA_NXZ	1574	0x1400085b8
?GetAutomationId@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@@Z	1575	0x1400196a4
?GetBackgroundColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1576	0x140018830
?GetBackgroundOwner@HWNDHost@DirectUI@@IEAAPEAVElement@2@XZ	1577	0x140034c30
?GetBackgroundOwnerID@HWNDHost@DirectUI@@QEAAGXZ	1578	0x14001761c
?GetBackgroundStdColor@Element@DirectUI@@QEAAHXZ	1579	0x14002b144
?GetBool@EventManager@DirectUI@@CAJPEAUtagVARIANT@@PEAVValue@2@@Z	1580	0x140030a88
?GetBool@Value@DirectUI@@QEAA_NXZ	1581	0x140041014
?GetBoolFalse@Value@DirectUI@@SAPEAV12@XZ	1582	0x140038ca0
?GetBoolTrue@Value@DirectUI@@SAPEAV12@XZ	1583	0x14002ec8c
?GetBorderColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1584	0x14000a964
?GetBorderStdColor@Element@DirectUI@@QEAAHXZ	1585	0x140017fe0
?GetBorderStyle@Element@DirectUI@@QEAAHXZ	1586	0x140016770
?GetBorderThickness@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1587	0x14001bf60
?GetBoundingRect@ElementProxy@DirectUI@@IEAAJPEAUUiaRect@@@Z	1588	0x140009abc
?GetBrowser@Navigator@DirectUI@@QEAAPEAVBrowser@2@XZ	1589	0x1400297e8
?GetBuffering@TouchSlider@DirectUI@@QEAAHXZ	1590	0x14001c224
?GetButtonClassAcceptsEnterKey@DialogElement@DirectUI@@UEAA_NXZ	1591	0x14001afa0
?GetButtonColor@CCPushButton@DirectUI@@UEAA_NPEAUHDC__@@PEAPEAUHBRUSH__@@@Z	1592	0x140021998
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z	1593	0x140028bc4
?GetCaptured@Button@DirectUI@@QEAA_NXZ	1594	0x14000da84
?GetCaptured@TouchButton@DirectUI@@QEAA_NXZ	1595	0x1400131e0
?GetCellInfo@TableLayout@DirectUI@@QEAAPEAUCellInfo@2@H@Z	1596	0x14002bd78
?GetCheckedState@TouchCheckBox@DirectUI@@QEAA?AW4CheckedStateFlags@2@XZ	1597	0x14000993c
?GetChildFromLayoutIndex@Layout@DirectUI@@QEAAPEAVElement@2@PEAV32@HPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@@Z	1598	0x14001f354
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ	1599	0x140034f34
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z	1600	0x140002f54
?GetClass@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1601	0x14001c890
?GetClassInfoPtr@AccessibleButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1602	0x140007274
?GetClassInfoPtr@AnimationStrip@DirectUI@@SAPEAUIClassInfo@2@XZ	1603	0x1400119f4
?GetClassInfoPtr@AutoButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1604	0x14000d230
?GetClassInfoPtr@BaseScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1605	0x14000fc44
?GetClassInfoPtr@Bind@DirectUI@@SAPEAUIClassInfo@2@XZ	1606	0x1400387b8
?GetClassInfoPtr@Browser@DirectUI@@SAPEAUIClassInfo@2@XZ	1607	0x1400211f4
?GetClassInfoPtr@Button@DirectUI@@SAPEAUIClassInfo@2@XZ	1608	0x140011e74
?GetClassInfoPtr@CCAVI@DirectUI@@SAPEAUIClassInfo@2@XZ	1609	0x14003b1c0
?GetClassInfoPtr@CCBase@DirectUI@@SAPEAUIClassInfo@2@XZ	1610	0x140038ab8
?GetClassInfoPtr@CCBaseCheckRadioButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1611	0x140033dc0
?GetClassInfoPtr@CCBaseScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1612	0x140024a40
?GetClassInfoPtr@CCCheckBox@DirectUI@@SAPEAUIClassInfo@2@XZ	1613	0x1400177a8
?GetClassInfoPtr@CCCommandLink@DirectUI@@SAPEAUIClassInfo@2@XZ	1614	0x140018f44
?GetClassInfoPtr@CCHScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1615	0x14001522c
?GetClassInfoPtr@CCListBox@DirectUI@@SAPEAUIClassInfo@2@XZ	1616	0x140023240
?GetClassInfoPtr@CCListView@DirectUI@@SAPEAUIClassInfo@2@XZ	1617	0x14001f328
?GetClassInfoPtr@CCProgressBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1618	0x1400075a0
?GetClassInfoPtr@CCPushButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1619	0x14002d254
?GetClassInfoPtr@CCRadioButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1620	0x140008138
?GetClassInfoPtr@CCSysLink@DirectUI@@SAPEAUIClassInfo@2@XZ	1621	0x14001cc18
?GetClassInfoPtr@CCTrackBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1622	0x140005cd8
?GetClassInfoPtr@CCTreeView@DirectUI@@SAPEAUIClassInfo@2@XZ	1623	0x140010fb8
?GetClassInfoPtr@CCVScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1624	0x140022a08
?GetClassInfoPtr@CheckBoxGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1625	0x140033be0
?GetClassInfoPtr@Clipper@DirectUI@@SAPEAUIClassInfo@2@XZ	1626	0x14000676c
?GetClassInfoPtr@Combobox@DirectUI@@SAPEAUIClassInfo@2@XZ	1627	0x140007180
?GetClassInfoPtr@DialogElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1628	0x140035060
?GetClassInfoPtr@Edit@DirectUI@@SAPEAUIClassInfo@2@XZ	1629	0x140039668
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ	1630	0x14000b718
?GetClassInfoPtr@ElementWithHWND@DirectUI@@SAPEAUIClassInfo@2@XZ	1631	0x140011b24
?GetClassInfoPtr@Expandable@DirectUI@@SAPEAUIClassInfo@2@XZ	1632	0x140025a3c
?GetClassInfoPtr@Expando@DirectUI@@SAPEAUIClassInfo@2@XZ	1633	0x1400172f4
?GetClassInfoPtr@ExpandoButtonGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1634	0x14000aaa4
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1635	0x140027ea8
?GetClassInfoPtr@HWNDHost@DirectUI@@SAPEAUIClassInfo@2@XZ	1636	0x140016740
?GetClassInfoPtr@ItemList@DirectUI@@SAPEAUIClassInfo@2@XZ	1637	0x14002e214
?GetClassInfoPtr@Macro@DirectUI@@SAPEAUIClassInfo@2@XZ	1638	0x1400233c8
?GetClassInfoPtr@ModernProgressBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1639	0x14000556c
?GetClassInfoPtr@ModernProgressRing@DirectUI@@SAPEAUIClassInfo@2@XZ	1640	0x14003e178
?GetClassInfoPtr@Movie@DirectUI@@SAPEAUIClassInfo@2@XZ	1641	0x140008940
?GetClassInfoPtr@Navigator@DirectUI@@SAPEAUIClassInfo@2@XZ	1642	0x1400038c4
?GetClassInfoPtr@PText@DirectUI@@SAPEAUIClassInfo@2@XZ	1643	0x140001d84
?GetClassInfoPtr@Page@DirectUI@@SAPEAUIClassInfo@2@XZ	1644	0x1400219f4
?GetClassInfoPtr@Pages@DirectUI@@SAPEAUIClassInfo@2@XZ	1645	0x14000dc44
?GetClassInfoPtr@Progress@DirectUI@@SAPEAUIClassInfo@2@XZ	1646	0x14001e7dc
?GetClassInfoPtr@PushButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1647	0x14001cda4
?GetClassInfoPtr@RadioButtonGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1648	0x1400284f4
?GetClassInfoPtr@RefPointElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1649	0x14003d7dc
?GetClassInfoPtr@RepeatButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1650	0x14001ee1c
?GetClassInfoPtr@Repeater@DirectUI@@SAPEAUIClassInfo@2@XZ	1651	0x140040a88
?GetClassInfoPtr@RichText@DirectUI@@SAPEAUIClassInfo@2@XZ	1652	0x1400027c4
?GetClassInfoPtr@ScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1653	0x140038288
?GetClassInfoPtr@ScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1654	0x14000cd14
?GetClassInfoPtr@Selector@DirectUI@@SAPEAUIClassInfo@2@XZ	1655	0x140032154
?GetClassInfoPtr@SelectorNoDefault@DirectUI@@SAPEAUIClassInfo@2@XZ	1656	0x140018e5c
?GetClassInfoPtr@SemanticZoomToggle@DirectUI@@SAPEAUIClassInfo@2@XZ	1657	0x1400283fc
?GetClassInfoPtr@StyledScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1658	0x1400349a0
?GetClassInfoPtr@TextGraphic@DirectUI@@SAPEAUIClassInfo@2@XZ	1659	0x1400172c8
?GetClassInfoPtr@Thumb@DirectUI@@SAPEAUIClassInfo@2@XZ	1660	0x14002c840
?GetClassInfoPtr@TouchButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1661	0x1400373e4
?GetClassInfoPtr@TouchCheckBox@DirectUI@@SAPEAUIClassInfo@2@XZ	1662	0x14003df30
?GetClassInfoPtr@TouchCheckBoxGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1663	0x14001670c
?GetClassInfoPtr@TouchCommandButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1664	0x140033f80
?GetClassInfoPtr@TouchEdit2@DirectUI@@SAPEAUIClassInfo@2@XZ	1665	0x140032ea4
?GetClassInfoPtr@TouchEditBase@DirectUI@@SAPEAUIClassInfo@2@XZ	1666	0x140024680
?GetClassInfoPtr@TouchHWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1667	0x14001ab4c
?GetClassInfoPtr@TouchHyperLink@DirectUI@@SAPEAUIClassInfo@2@XZ	1668	0x14003a16c
?GetClassInfoPtr@TouchRepeatButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1669	0x1400238d4
?GetClassInfoPtr@TouchScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1670	0x14002ee68
?GetClassInfoPtr@TouchScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1671	0x14000df4c
?GetClassInfoPtr@TouchSelect@DirectUI@@SAPEAUIClassInfo@2@XZ	1672	0x14003747c
?GetClassInfoPtr@TouchSelectItem@DirectUI@@SAPEAUIClassInfo@2@XZ	1673	0x14003b0fc
?GetClassInfoPtr@TouchSlider@DirectUI@@SAPEAUIClassInfo@2@XZ	1674	0x1400407f8
?GetClassInfoPtr@TouchSwitch@DirectUI@@SAPEAUIClassInfo@2@XZ	1675	0x140015a14
?GetClassInfoPtr@UnknownElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1676	0x140010770
?GetClassInfoPtr@Viewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1677	0x140037fe0
?GetClassInfoPtr@XBaby@DirectUI@@SAPEAUIClassInfo@2@XZ	1678	0x140003e8c
?GetClassInfoPtr@XElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1679	0x140041368
?GetClassInfoW@AccessibleButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1680	0x140040c04
?GetClassInfoW@AnimationStrip@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1681	0x140008a58
?GetClassInfoW@AutoButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1682	0x140011f40
?GetClassInfoW@BaseScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1683	0x140010330
?GetClassInfoW@Bind@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1684	0x140011568
?GetClassInfoW@Browser@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1685	0x14000348c
?GetClassInfoW@Button@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1686	0x14000813c
?GetClassInfoW@CCAVI@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1687	0x140021b90
?GetClassInfoW@CCBase@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1688	0x14001cab4
?GetClassInfoW@CCBaseCheckRadioButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1689	0x14001d03c
?GetClassInfoW@CCBaseScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1690	0x14002d7a8
?GetClassInfoW@CCCheckBox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1691	0x140036864
?GetClassInfoW@CCCommandLink@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1692	0x14003c654
?GetClassInfoW@CCHScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1693	0x140035ed4
?GetClassInfoW@CCListBox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1694	0x1400098ec
?GetClassInfoW@CCListView@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1695	0x140005a7c
?GetClassInfoW@CCProgressBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1696	0x140019d94
?GetClassInfoW@CCPushButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1697	0x140015500
?GetClassInfoW@CCRadioButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1698	0x140036920
?GetClassInfoW@CCSysLink@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1699	0x14002cab8
?GetClassInfoW@CCTrackBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1700	0x14002dde4
?GetClassInfoW@CCTreeView@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1701	0x140040ebc
?GetClassInfoW@CCVScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1702	0x140025740
?GetClassInfoW@CheckBoxGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1703	0x1400405f8
?GetClassInfoW@Clipper@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1704	0x1400147d0
?GetClassInfoW@Combobox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1705	0x14000ca7c
?GetClassInfoW@DialogElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1706	0x140001f94
?GetClassInfoW@Edit@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1707	0x14001c408
?GetClassInfoW@Element@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1708	0x14003a5c8
?GetClassInfoW@ElementWithHWND@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1709	0x14002383c
?GetClassInfoW@Expandable@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1710	0x14002525c
?GetClassInfoW@Expando@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1711	0x140010c20
?GetClassInfoW@ExpandoButtonGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1712	0x14002fb10
?GetClassInfoW@HWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1713	0x14000ca50
?GetClassInfoW@HWNDHost@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1714	0x14001fc8c
?GetClassInfoW@ItemList@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1715	0x140014578
?GetClassInfoW@Macro@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1716	0x14000b5e0
?GetClassInfoW@ModernProgressBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1717	0x14004081c
?GetClassInfoW@ModernProgressRing@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1718	0x140019960
?GetClassInfoW@Movie@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1719	0x14002fe44
?GetClassInfoW@Navigator@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1720	0x14001c784
?GetClassInfoW@PText@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1721	0x140027660
?GetClassInfoW@Page@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1722	0x14002faf8
?GetClassInfoW@Pages@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1723	0x14003fe50
?GetClassInfoW@Progress@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1724	0x140008880
?GetClassInfoW@PushButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1725	0x14000dbf0
?GetClassInfoW@RadioButtonGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1726	0x14000163c
?GetClassInfoW@RefPointElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1727	0x140003b24
?GetClassInfoW@RepeatButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1728	0x14003b130
?GetClassInfoW@Repeater@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1729	0x140013328
?GetClassInfoW@RichText@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1730	0x140017918
?GetClassInfoW@ScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1731	0x140037dec
?GetClassInfoW@ScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1732	0x14000a9b4
?GetClassInfoW@Selector@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1733	0x14001d464
?GetClassInfoW@SelectorNoDefault@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1734	0x14000f5f4
?GetClassInfoW@SemanticZoomToggle@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1735	0x14001857c
?GetClassInfoW@StyledScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1736	0x14002cfa8
?GetClassInfoW@TextGraphic@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1737	0x140029990
?GetClassInfoW@Thumb@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1738	0x140040e5c
?GetClassInfoW@TouchButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1739	0x14002f648
?GetClassInfoW@TouchCheckBox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1740	0x140038250
?GetClassInfoW@TouchCheckBoxGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1741	0x140028d80
?GetClassInfoW@TouchCommandButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1742	0x14001934c
?GetClassInfoW@TouchEdit2@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1743	0x14003fb80
?GetClassInfoW@TouchEditBase@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1744	0x140003dec
?GetClassInfoW@TouchHWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1745	0x14003b7d4
?GetClassInfoW@TouchHyperLink@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1746	0x14003bf74
?GetClassInfoW@TouchRepeatButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1747	0x1400058a8
?GetClassInfoW@TouchScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1748	0x14003f344
?GetClassInfoW@TouchScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1749	0x1400379d4
?GetClassInfoW@TouchSelect@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1750	0x14001023c
?GetClassInfoW@TouchSelectItem@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1751	0x14000e6ac
?GetClassInfoW@TouchSlider@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1752	0x14001f39c
?GetClassInfoW@TouchSwitch@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1753	0x14002c408
?GetClassInfoW@UnknownElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1754	0x14002975c
?GetClassInfoW@Viewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1755	0x140014c3c
?GetClassInfoW@XBaby@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1756	0x14001e398
?GetClassInfoW@XElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1757	0x140032720
?GetClickDevice@TouchButton@DirectUI@@QEAA?AW4ClickDevice@12@XZ	1758	0x14003c988
?GetClickablePoint@Element@DirectUI@@QEAA_NPEAUtagPOINT@@@Z	1759	0x1400340e4
?GetClientAccessibleImpl@HWNDHost@DirectUI@@QEAAJPEAPEAUIAccessible@@@Z	1760	0x14001892c
?GetColorFromProperty@DirectUI@@YAJPEAVElement@1@PEBUPropertyInfo@1@HPEAK@Z	1761	0x140031e04
?GetColorFromValue@DirectUI@@YAJPEAVElement@1@PEAVValue@1@PEAK@Z	1762	0x1400220e8
?GetColorTrans@Value@DirectUI@@SAPEAV12@XZ	1763	0x14000928c
?GetColorize@Element@DirectUI@@QEAAHXZ	1764	0x14000757c
?GetColumn@GridItemProxy@DirectUI@@AEAAJPEAH@Z	1765	0x14001d6c8
?GetColumnCount@GridProxy@DirectUI@@AEAAJPEAH@Z	1766	0x14001f4c0
?GetColumnHeaderItems@TableItemProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	1767	0x14001b264
?GetColumnHeaders@TableProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	1768	0x14001b960
?GetCommonDrawTextFlags@Element@DirectUI@@AEAAIH@Z	1769	0x140040f2c
?GetCompositingQuality@Movie@DirectUI@@QEAAHXZ	1770	0x140012934
?GetConnect@Bind@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1771	0x14000b634
?GetContainingGrid@GridItemProxy@DirectUI@@AEAAJPEAPEAUIRawElementProviderSimple@@@Z	1772	0x14003895c
?GetContent@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@PEAUIAccessible@@@Z	1773	0x14001de40
?GetContentAlign@Element@DirectUI@@QEAAHXZ	1774	0x1400316fc
?GetContentCrossfadeOpacity@TouchScrollViewer@DirectUI@@QEAAMXZ	1775	0x140039a08
?GetContentDesiredSize@XBaby@DirectUI@@UEAA?AUtagSIZE@@HH@Z	1776	0x140037120
?GetContentSize@CCBase@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1777	0x140029344
?GetContentSize@CCBaseCheckRadioButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1778	0x1400160ac
?GetContentSize@CCCommandLink@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1779	0x140007d44
?GetContentSize@CCHScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1780	0x140032e44
?GetContentSize@CCListBox@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1781	0x14000faec
?GetContentSize@CCListView@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1782	0x1400089a8
?GetContentSize@CCPushButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1783	0x14003b614
?GetContentSize@CCSysLink@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1784	0x140032498
?GetContentSize@CCTreeView@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1785	0x14002f1dc
?GetContentSize@CCVScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1786	0x140009cd0
?GetContentSize@Combobox@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1787	0x14002f174
?GetContentSize@Edit@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1788	0x140002d98
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1789	0x140036334
?GetContentSize@Progress@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1790	0x140024268
?GetContentSize@PushButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1791	0x14002b604
?GetContentSize@RichText@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1792	0x14001a2d4
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1793	0x14000a06c
?GetContentStringAsDisplayed@Edit@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1794	0x140017678
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1795	0x14004140c
?GetContentStringAsDisplayed@TextGraphic@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1796	0x1400203c4
?GetContentStringAsDisplayed@TouchEditBase@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1797	0x1400149ec
?GetControlType@ElementProxy@DirectUI@@IEAAXPEAUtagVARIANT@@PEAUIAccessible@@@Z	1798	0x14001a93c
?GetControllerFor@TouchEditBase@DirectUI@@UEAAJPEAPEAUIUnknown@@@Z	1799	0x140026304
?GetCount@CCListBox@DirectUI@@QEAAHXZ	1800	0x14003fbfc
?GetCount@Pages@DirectUI@@QEAAIXZ	1801	0x1400375a4
?GetCreationFlags@XElement@DirectUI@@UEAAIXZ	1802	0x140032dd8
?GetCurrentCols@GridLayout@DirectUI@@IEAAIH@Z	1803	0x1400032e0
?GetCurrentCols@GridLayout@DirectUI@@IEAAIPEAVElement@2@@Z	1804	0x1400208ac
?GetCurrentPage@Browser@DirectUI@@QEAAPEAVElement@2@XZ	1805	0x140017cf8
?GetCurrentPageID@Browser@DirectUI@@QEAAGXZ	1806	0x140003500
?GetCurrentRows@GridLayout@DirectUI@@IEAAIH@Z	1807	0x140039038
?GetCurrentRows@GridLayout@DirectUI@@IEAAIPEAVElement@2@@Z	1808	0x140020e5c
?GetCursor@Value@DirectUI@@QEAAPEAUCursor@2@XZ	1809	0x14001db58
?GetCursorNull@Value@DirectUI@@SAPEAV12@XZ	1810	0x140037074
?GetDPI@Element@DirectUI@@QEAAHXZ	1811	0x14000f6f8
?GetDataEntry@Macro@DirectUI@@QEAAPEAUIDataEntry@2@XZ	1812	0x14001b3e4
?GetDblListEmpty@Value@DirectUI@@SAPEAV12@XZ	1813	0x14001bb98
?GetDefaultButton@DialogElement@DirectUI@@UEAAPEAVElement@2@XZ	1814	0x140021d84
?GetDefaultButton@DialogElementCore@DirectUI@@QEAAPEAVElement@2@XZ	1815	0x1400036a8
?GetDefaultButtonTracking@DialogElement@DirectUI@@UEAA_NXZ	1816	0x14000393c
?GetDefaultButtonTracking@XBaby@DirectUI@@UEAA_NXZ	1817	0x140027fd8
?GetDeferObject@Element@DirectUI@@QEAAPEAVDeferCycle@2@XZ	1818	0x140002f58
?GetDesiredSize@Element@DirectUI@@QEAAPEBUtagSIZE@@XZ	1819	0x14003407c
?GetDesiredSize@XProvider@DirectUI@@UEAAJHHPEAUtagSIZE@@@Z	1820	0x14002a0c4
?GetDirection@Element@DirectUI@@QEAAHXZ	1821	0x14002d504
?GetDirty@Edit@DirectUI@@QEAA_NXZ	1822	0x140034578
?GetDisableMouseInRectCheck@TouchRepeatButton@DirectUI@@QEAA_NXZ	1823	0x140008b08
?GetDispatchFromElement@DuiAccessible@DirectUI@@IEAAJPEAVElement@2@PEAPEAUIDispatch@@@Z	1824	0x140003d0c
?GetDisplayNode@Element@DirectUI@@QEAAPEAUHGADGET__@@XZ	1825	0x14001bda0
?GetDoubleList@Value@DirectUI@@QEAAPEAV?$DynamicArray@N$0A@@2@XZ	1826	0x1400196e0
?GetDrawOutlines@Movie@DirectUI@@QEAA_NXZ	1827	0x14001e8d0
?GetEdgeHighlightColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1828	0x140029778
?GetEdgeHighlightThickness@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1829	0x140040f80
?GetElListNull@Value@DirectUI@@SAPEAV12@XZ	1830	0x140017aec
?GetElement@CCBaseScrollBar@DirectUI@@UEAAPEAVElement@2@XZ	1831	0x140025eb4
?GetElement@ElementProvider@DirectUI@@UEAAPEDVElement@2@XZ	1832	0x14001eff4
?GetElement@NativeHWNDHost@DirectUI@@QEAAPEAVElement@2@XZ	1833	0x14003c130
?GetElement@ScrollBar@DirectUI@@UEAAPEAVElement@2@XZ	1834	0x140014b48
?GetElement@TaskPage@DirectUI@@IEAAPEAVElement@2@XZ	1835	0x140032d7c
?GetElement@Value@DirectUI@@QEAAPEAVElement@2@XZ	1836	0x14000eb18
?GetElement@XHost@DirectUI@@QEAAPEAVElement@2@XZ	1837	0x14002eee4
?GetElementKey@ElementProvider@DirectUI@@QEAAPEBVElement@2@XZ	1838	0x14001cdb0
?GetElementList@Value@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@XZ	1839	0x1400294b4
?GetElementMovesOnIHMNotify@TouchEditBase@DirectUI@@QEAA_NXZ	1840	0x14002c010
?GetElementNull@Value@DirectUI@@SAPEAV12@XZ	1841	0x140007a2c
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z	1842	0x14000d3fc
?GetElementProviderImpl@TouchSelect@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z	1843	0x14003c788
?GetElementProviderImpl@XBaby@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z	1844	0x14000d9a8
?GetElementScaleFactor@Element@DirectUI@@QEAAMXZ	1845	0x140016918
?GetElementScaledFloat@Value@DirectUI@@QEAAMPEAVElement@2@@Z	1846	0x140033f08
?GetElementScaledInt@Value@DirectUI@@QEAAHPEAVElement@2@@Z	1847	0x14000ec48
?GetElementScaledPoint@Value@DirectUI@@QEAAXPEAVElement@2@PEAUtagPOINT@@@Z	1848	0x14002e868
?GetElementScaledRect@Value@DirectUI@@QEAAXPEAVElement@2@PEAUtagRECT@@@Z	1849	0x140011708
?GetElementScaledSize@Value@DirectUI@@QEAAXPEAVElement@2@PEAUtagSIZE@@@Z	1850	0x140026fac
?GetEmbeddedFragmentRoots@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	1851	0x1400199f0
?GetEnabled@Element@DirectUI@@QEAA_NXZ	1852	0x14002608c
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z	1853	0x140018c54
?GetEncodedContentStringLength@Element@DirectUI@@QEAA_KXZ	1854	0x14003cdd4
?GetEncodedString@Value@DirectUI@@QEAAJPEAG_K@Z	1855	0x14002e0b4
?GetEncodedStringLength@Value@DirectUI@@QEAA_KXZ	1856	0x14003dec0
?GetEnforceSize@PushButton@DirectUI@@QEAA_NXZ	1857	0x14003bcb4
?GetExpand@Macro@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1858	0x140007f78
?GetExpandCollapseState@EventManager@DirectUI@@CAXPEAUtagVARIANT@@@Z	1859	0x14002e0cc
?GetExpanded@Expandable@DirectUI@@QEAA_NXZ	1860	0x14003a51c
?GetExprNull@Value@DirectUI@@SAPEAV12@XZ	1861	0x14001b678
?GetExpression@Value@DirectUI@@QEAAPEAVExpression@2@XZ	1862	0x140022e24
?GetExtent@Element@DirectUI@@QEAAPEBUtagSIZE@@PEAPEAVValue@2@@Z	1863	0x1400252fc
?GetFactory@RichText@DirectUI@@QEAAPEAUIDWriteFactory@@XZ	1864	0x1400080ec
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ	1865	0x14001f244
?GetFill@Value@DirectUI@@QEAAPEBUFill@2@XZ	1866	0x14001152c
?GetFillpartElement@TouchSlider@DirectUI@@QEAAPEAVElement@2@XZ	1867	0x140020b9c
?GetFilterOnPaste@TouchEditBase@DirectUI@@QEAA_NXZ	1868	0x14003cfe8
?GetFlags@TouchHWNDElement@DirectUI@@QEAA?AW4TouchHWNDElementFlags@2@XZ	1869	0x14002b374
?GetFloat@Value@DirectUI@@QEAAMXZ	1870	0x140022600
?GetFloatOne@Value@DirectUI@@SAPEAV12@XZ	1871	0x140031f14
?GetFloatZero@Value@DirectUI@@SAPEAV12@XZ	1872	0x140015f60
?GetFocus@HWNDElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderFragment@@@Z	1873	0x140011a94
?GetFocus@HWNDElementProxy@DirectUI@@IEAAJPEAPEAUIRawElementProviderFragment@@@Z	1874	0x1400016a0
?GetFocusableElement@XBaby@DirectUI@@UEAAPEAVElement@2@XZ	1875	0x14003718c
?GetFocusedHWNDElement@HWNDElement@DirectUI@@SAPEAV12@XZ	1876	0x1400078d0
?GetFont@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1877	0x140034090
?GetFont@HWNDHost@DirectUI@@IEAAPEAUHFONT__@@XZ	1878	0x140034fc4
?GetFontFace@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1879	0x14003ab84
?GetFontQuality@Element@DirectUI@@QEAAHXZ	1880	0x14001faec
?GetFontSize@Element@DirectUI@@QEAAHXZ	1881	0x1400244a8
?GetFontStyle@Element@DirectUI@@QEAAHXZ	1882	0x14002db78
?GetFontWeight@Element@DirectUI@@QEAAHXZ	1883	0x140033d60
?GetForceEditTextToLTR@TouchEditBase@DirectUI@@QEAA_NXZ	1884	0x140032d1c
?GetForegroundColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1885	0x140025690
?GetForegroundColorRef@RichText@DirectUI@@UEAAJPEAK@Z	1886	0x1400243cc
?GetForegroundColorRef@TouchButton@DirectUI@@UEAAJPEAK@Z	1887	0x14001f3b4
?GetForegroundStdColor@Element@DirectUI@@QEAAHXZ	1888	0x14003f8a0
?GetFragmentRoot@ElementProxy@DirectUI@@IEAAJPEAPEAUIRawElementProviderFragmentRoot@@@Z	1889	0x140028adc
?GetFrameDuration@AnimationStrip@DirectUI@@QEAAHXZ	1890	0x140025b68
?GetFrameIndex@AnimationStrip@DirectUI@@QEAAHXZ	1891	0x140021628
?GetFrameWidth@AnimationStrip@DirectUI@@QEAAHXZ	1892	0x140014610
?GetGetSheetCallback@DUIXmlParser@DirectUI@@QEAAP6APEAVValue@2@PEBGPEAX@ZXZ	1893	0x14002e854
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ	1894	0x140008880
?GetGraphic@Value@DirectUI@@QEAAPEAUGraphic@2@XZ	1895	0x140032248
?GetHDC@DCSurface@DirectUI@@QEAAPEAUHDC__@@XZ	1896	0x14000e20c
?GetHInstance@DUIXmlParser@DirectUI@@QEAAPEAUHINSTANCE__@@XZ	1897	0x140007518
?GetHScroll@ScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	1898	0x14003442c
?GetHScroll@StyledScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	1899	0x1400394b4
?GetHScrollbar@TouchScrollViewer@DirectUI@@QEAAJPEAPEAVElement@2@@Z	1900	0x14003b344
?GetHWND@HWNDElement@DirectUI@@UEAAPEAUHWND__@@XZ	1901	0x140034fc4
?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ	1902	0x140017e0c
?GetHWND@NativeHWNDHost@DirectUI@@QEAAPEAUHWND__@@XZ	1903	0x1400135a4
?GetHWND@XHost@DirectUI@@QEAAPEAUHWND__@@XZ	1904	0x14000969c
?GetHWNDParent@HWNDHost@DirectUI@@QEAAPEAUHWND__@@XZ	1905	0x14002807c
?GetHandle@ResourceModuleHandles@DirectUI@@QEAAJPEBGPEAPEAUHINSTANCE__@@@Z	1906	0x14002d158
?GetHandleEnter@TouchButton@DirectUI@@QEAA_NXZ	1907	0x140038434
?GetHandleEnterKey@DialogElement@DirectUI@@UEAA_NXZ	1908	0x140018578
?GetHandleGlobalEnter@TouchButton@DirectUI@@QEAA_NXZ	1909	0x140021a34
?GetHasShield@CCPushButton@DirectUI@@QEAA_NXZ	1910	0x14003ec78
?GetHeight@Element@DirectUI@@QEAAHXZ	1911	0x140014698
?GetHighDPI@Element@DirectUI@@QEAA_NXZ	1912	0x14000411c
?GetHostedElementID@XBaby@DirectUI@@UEAAJPEAG@Z	1913	0x14000dfb0
?GetHostedElementID@XProvider@DirectUI@@UEAAJPEAG@Z	1914	0x140025e58
?GetHwnd@ElementProxy@DirectUI@@IEAAJPEAPEAUHWND__@@@Z	1915	0x140015150
?GetID@Element@DirectUI@@QEAAGXZ	1916	0x14001dcd0
?GetIDsOfNames@DuiAccessible@DirectUI@@UEAAJAEBU_GUID@@PEAPEAGIKPEAJ@Z	1917	0x14003ba0c
?GetIHMRect@TouchHWNDElement@DirectUI@@QEAAJPEAUtagRECT@@@Z	1918	0x140027a54
?GetIHMState@TouchHWNDElement@DirectUI@@QEAA?AW4IHMState@2@XZ	1919	0x14003d230
?GetIMEComposing@TouchEditBase@DirectUI@@QEAA_NXZ	1920	0x14002c9cc
?GetIdentityString@DuiAccessible@DirectUI@@UEAAJKPEAPEAEPEAK@Z	1921	0x140036788
?GetIdentityString@HWNDHostAccessible@DirectUI@@UEAAJKPEAPEAEPEAK@Z	1922	0x140022bb0
?GetIgnoredKeyCombos@TouchEditBase@DirectUI@@QEAA?AW4TouchEditFilteredKeyComboFlags@2@XZ	1923	0x140035c98
?GetImage@Value@DirectUI@@QEAAPEAX_NM@Z	1924	0x140024de4
?GetImmediateChild@Element@DirectUI@@QEAAPEAV12@PEAV12@@Z	1925	0x14001dc58
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z	1926	0x14000fa90
?GetImmersiveFocusRectOffsets@TouchButton@DirectUI@@UEAAXPEAUtagRECT@@@Z	1927	0x140035cf8
?GetImmersiveFocusRectOffsets@TouchCheckBox@DirectUI@@UEAAXPEAUtagRECT@@@Z	1928	0x14003a9b0
?GetImmersiveFocusRectOffsets@TouchHyperLink@DirectUI@@UEAAXPEAUtagRECT@@@Z	1929	0x14002a328
?GetIndex@Element@DirectUI@@QEAAHXZ	1930	0x140011414
?GetInertiaEndpointVisibleRect@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@@Z	1931	0x1400363f4
?GetInertiaEndpointZoomLevel@TouchScrollViewer@DirectUI@@QEAAMM@Z	1932	0x1400044f4
?GetInnerBorderThickness@TouchEdit2@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1933	0x14003c538
?GetInnerHWND@XElement@DirectUI@@QEAAPEAUHWND__@@XZ	1934	0x1400175d4
?GetInputScope@TouchEdit2@DirectUI@@QEAA?AW4__MIDL___MIDL_itf_inputscope_0000_0000_0001@@XZ	1935	0x14002a370
?GetInt@EventManager@DirectUI@@CAJPEAUtagVARIANT@@PEAVValue@2@@Z	1936	0x14000766c
?GetInt@Value@DirectUI@@QEAAHXZ	1937	0x140033ef4
?GetIntMinusOne@Value@DirectUI@@SAPEAV12@XZ	1938	0x140013848
?GetIntZero@Value@DirectUI@@SAPEAV12@XZ	1939	0x14000e508
?GetIntegrateIMECandidateList@TouchEditBase@DirectUI@@QEAA_NXZ	1940	0x14003ece0
?GetInteractionMode@TouchScrollViewer@DirectUI@@QEAAHXZ	1941	0x14000f8f8
?GetInterpolationMode@Movie@DirectUI@@QEAAHXZ	1942	0x14001cd8c
?GetInvokeHelper@InvokeManager@DirectUI@@SAJPEAPEAVInvokeHelper@2@@Z	1943	0x1400165b4
?GetIsContinuous@TouchSlider@DirectUI@@QEAA_NXZ	1944	0x1400307bc
?GetIsPressed@TouchSlider@DirectUI@@QEAA_NXZ	1945	0x140040a14
?GetIsReadOnly@ValueProxy@DirectUI@@AEAAJPEAH@Z	1946	0x14000498c
?GetIsSelected@NavigatorSelectionItemProxy@DirectUI@@AEAAJPEAVBrowser@2@PEAH@Z	1947	0x14001e6f0
?GetIsSelectionRequired@BrowserSelectionProxy@DirectUI@@AEAAJPEAH@Z	1948	0x140033d18
?GetIsSelectionRequired@SelectorSelectionProxy@DirectUI@@AEAAJPEAH@Z	1949	0x14003505c
?GetIsShowOnOffFeedback@TouchSlider@DirectUI@@QEAA_NXZ	1950	0x14003c454
?GetIsVertical@TouchSlider@DirectUI@@QEAA_NXZ	1951	0x140005960
?GetItem@GridProvider@DirectUI@@UEAAJHHPEAPEAUIRawElementProviderSimple@@@Z	1952	0x140012030
?GetItem@GridProxy@DirectUI@@AEAAJIIPEAPEAUIRawElementProviderSimple@@@Z	1953	0x14003ca0c
?GetItemCount@TouchSelect@DirectUI@@QEAAKXZ	1954	0x140012bd8
?GetItemData@TouchSelect@DirectUI@@QEAAJHPEAPEAUIUnknown@@@Z	1955	0x1400133cc
?GetItemData@TouchSelectItem@DirectUI@@QEAAJPEAPEAUIUnknown@@@Z	1956	0x1400213c4
?GetItemHeightInPopup@TouchSelect@DirectUI@@QEAAHXZ	1957	0x140016db4
?GetItemState@CCTreeView@DirectUI@@QEAAIQEAU_TREEITEM@@@Z	1958	0x140030b3c
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ	1959	0x140007380
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ	1960	0x140039e1c
?GetKeyFocusedElement@DialogElement@DirectUI@@UEAAPEAVElement@2@XZ	1961	0x14000f838
?GetKeyFocusedElement@HWNDElement@DirectUI@@SAPEAVElement@2@XZ	1962	0x14002b930
?GetKeyWithin@Element@DirectUI@@QEAA_NXZ	1963	0x140036168
?GetKeyWithinChild@Element@DirectUI@@QEAAPEAV12@XZ	1964	0x1400321a4
?GetKeyboardNavigationCapture@TouchEditBase@DirectUI@@QEAA?AW4TouchEditKeyboardNavigationCapture@2@XZ	1965	0x140008ec8
?GetLabel@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@@Z	1966	0x140031990
?GetLayout@Element@DirectUI@@QEAAPEAVLayout@2@PEAPEAVValue@2@@Z	1967	0x140017a94
?GetLayout@Value@DirectUI@@QEAAPEAVLayout@2@XZ	1968	0x140010e4c
?GetLayoutChildCount@Layout@DirectUI@@QEAAIPEAVElement@2@@Z	1969	0x14000803c
?GetLayoutIndexFromChild@Layout@DirectUI@@QEAAHPEAVElement@2@0@Z	1970	0x14000e1d4
?GetLayoutNull@Value@DirectUI@@SAPEAV12@XZ	1971	0x14003d880
?GetLayoutPos@Element@DirectUI@@QEAAHXZ	1972	0x14000beac
?GetLightDismissIHM@TouchHWNDElement@DirectUI@@QEAA_NXZ	1973	0x14001ebc0
?GetLine@CCBaseScrollBar@DirectUI@@UEAAHXZ	1974	0x14001ca3c
?GetLine@FlowLayout@DirectUI@@QEAAHPEAVElement@2@0@Z	1975	0x14001c5fc
?GetLine@ScrollBar@DirectUI@@UEAAHXZ	1976	0x140025144
?GetLine@VerticalFlowLayout@DirectUI@@QEAAHPEAVElement@2@0@Z	1977	0x1400126d4
?GetLineCount@RichText@DirectUI@@QEAAKXZ	1978	0x14003cdfc
?GetLineSize@CCTrackBar@DirectUI@@QEAAHXZ	1979	0x14002470c
?GetLinkIndicatorsToContent@TouchScrollViewer@DirectUI@@QEAA_NXZ	1980	0x14003bcf8
?GetLocation@Element@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z	1981	0x14002a434
?GetManipulationCompositor@TouchScrollViewer@DirectUI@@QEAAPEAUIDirectManipulationCompositor@@XZ	1982	0x14002e210
?GetManipulationHorizontalAlignment@TouchScrollViewer@DirectUI@@QEAAHXZ	1983	0x14002a610
?GetManipulationManager@TouchScrollViewer@DirectUI@@QEAAPEAUIDirectManipulationManager@@XZ	1984	0x1400048f0
?GetManipulationVerticalAlignment@TouchScrollViewer@DirectUI@@QEAAHXZ	1985	0x14002fa8c
?GetManipulationViewport@TouchScrollViewer@DirectUI@@QEAAPEAUIDirectManipulationViewport@@_N@Z	1986	0x140030114
?GetMargin@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1987	0x14002c130
?GetMaxLength@Edit@DirectUI@@QEAAHXZ	1988	0x1400157e0
?GetMaxLength@TouchEditBase@DirectUI@@QEAAHXZ	1989	0x14000e100
?GetMaximum@CCBaseScrollBar@DirectUI@@UEAAHXZ	1990	0x140012328
?GetMaximum@ModernProgressBar@DirectUI@@QEAAHXZ	1991	0x14000df34
?GetMaximum@Progress@DirectUI@@QEAAHXZ	1992	0x14003f118
?GetMaximum@ScrollBar@DirectUI@@UEAAHXZ	1993	0x140017a20
?GetMetering@TouchSlider@DirectUI@@QEAAHXZ	1994	0x140032f70
?GetMinSize@Element@DirectUI@@QEAAPEBUtagSIZE@@PEAPEAVValue@2@@Z	1995	0x140012114
?GetMinimum@CCBaseScrollBar@DirectUI@@UEAAHXZ	1996	0x14000eb50
?GetMinimum@ModernProgressBar@DirectUI@@QEAAHXZ	1997	0x140040194
?GetMinimum@Progress@DirectUI@@QEAAHXZ	1998	0x14003fa40
?GetMinimum@ScrollBar@DirectUI@@UEAAHXZ	1999	0x1400148d8
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ	2000	0x14003810c
?GetModuleBase@CallstackTracker@DirectUI@@AEAA_KPEAX_K@Z	2001	0x14001fe34
?GetMouseFocused@Element@DirectUI@@QEAA_NXZ	2002	0x140011440
?GetMouseWithin@Element@DirectUI@@QEAA_NXZ	2003	0x14003e374
?GetMouseWithinChild@Element@DirectUI@@QEAAPEAV12@XZ	2004	0x140037cdc
?GetMouseWithinHorizontalScrollRegion@TouchScrollViewer@DirectUI@@QEAA_NXZ	2005	0x140021464
?GetMoveCaretToEndOnSyncContent@TouchEditBase@DirectUI@@QEAA_NXZ	2006	0x140005ab0
?GetMultiline@Edit@DirectUI@@QEAA_NXZ	2007	0x14002bc30
?GetMultiline@TouchEditBase@DirectUI@@QEAA_NXZ	2008	0x14001c568
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ	2009	0x1400146c0
?GetNote@CCCommandLink@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2010	0x140022908
?GetNotificationSinkHWND@XElement@DirectUI@@UEAAPEAUHWND__@@XZ	2011	0x140038dfc
?GetNull@Value@DirectUI@@SAPEAV12@XZ	2012	0x140003668
?GetOffText@TouchSwitch@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2013	0x140017e6c
?GetOnText@TouchSwitch@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2014	0x14001b95c
?GetOptimizeMove@HWNDHost@DirectUI@@QEAA_NXZ	2015	0x14002c610
?GetOrder@ScrollBar@DirectUI@@QEAAHXZ	2016	0x1400167d0
?GetOverhang@Element@DirectUI@@QEAA_NXZ	2017	0x14003a6b0
?GetOverrideButtonBackground@CCPushButton@DirectUI@@QEAA_NXZ	2018	0x14000e780
?GetOverrideScaleFactor@DUIXmlParser@DirectUI@@QEBA_NPEAM@Z	2019	0x140025c80
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ	2020	0x14002b138
?GetPVLAnimationState@Element@DirectUI@@QEAAHXZ	2021	0x14000147c
?GetPadding@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	2022	0x14002fb58
?GetPage@CCBaseScrollBar@DirectUI@@UEAAHXZ	2023	0x140008acc
?GetPage@Pages@DirectUI@@QEAAPEAVElement@2@I@Z	2024	0x140005eb8
?GetPage@Pages@DirectUI@@QEAAPEAVElement@2@PEBG@Z	2025	0x1400380a8
?GetPage@ScrollBar@DirectUI@@UEAAHXZ	2026	0x14000cf80
?GetPageInc@BaseScrollBar@DirectUI@@QEAAHXZ	2027	0x14001d090
?GetPageRCID@TaskPage@DirectUI@@MEAAIXZ	2028	0x14002c990
?GetPageResID@TaskPage@DirectUI@@MEAAPEBGXZ	2029	0x14003df3c
?GetPages@Browser@DirectUI@@QEAAPEAVPages@2@XZ	2030	0x1400352cc
?GetParent@Element@DirectUI@@QEAAPEAV12@XZ	2031	0x140009244
?GetParentHWND@TaskPage@DirectUI@@QEAAPEAUHWND__@@XZ	2032	0x14002adec
?GetParser@DUIFactory@DirectUI@@QEAAPEAVDUIXmlParser@2@XZ	2033	0x140023684
?GetParserCommon@DUIXmlParser@DirectUI@@IEAAJPEAPEAV12@@Z	2034	0x140008408
?GetPasswordCharacter@Edit@DirectUI@@QEAAHXZ	2035	0x140037938
?GetPasswordCharacter@TouchEditBase@DirectUI@@QEAAHXZ	2036	0x14001d1dc
?GetPasswordRevealMode@TouchEdit2@DirectUI@@QEAA?AW4TouchEditPasswordRevealMode@2@XZ	2037	0x140013340
?GetPath@Movie@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2038	0x1400351fc
?GetPatternProvider@ElementProvider@DirectUI@@UEAAJHPEAPEAUIUnknown@@@Z	2039	0x1400350fc
?GetPinning@BaseScrollViewer@DirectUI@@QEAAHXZ	2040	0x140008e80
?GetPixelOffsetMode@Movie@DirectUI@@QEAAHXZ	2041	0x1400340a0
?GetPlay@AnimationStrip@DirectUI@@QEAA_NXZ	2042	0x14002daf8
?GetPlayAllFramesMode@Movie@DirectUI@@QEAA_NXZ	2043	0x14000e79c
?GetPoint@Value@DirectUI@@QEAAPEBUtagPOINT@@XZ	2044	0x14003124c
?GetPointZero@Value@DirectUI@@SAPEAV12@XZ	2045	0x14001056c
?GetPopupBounds@TouchSelect@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	2046	0x14000ffa8
?GetPosition@CCBaseScrollBar@DirectUI@@UEAAHXZ	2047	0x14003a820
?GetPosition@ModernProgressBar@DirectUI@@QEAAHXZ	2048	0x140015368
?GetPosition@Progress@DirectUI@@QEAAHXZ	2049	0x14003d564
?GetPosition@ScrollBar@DirectUI@@UEAAHXZ	2050	0x14001190c
?GetPredictedVisibleRect@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@@Z	2051	0x140011b70
?GetPreserveAlphaChannel@Element@DirectUI@@QEBA_NXZ	2052	0x14001a0c8
?GetPressed@Button@DirectUI@@QEAA_NXZ	2053	0x140018c30
?GetPressed@TouchButton@DirectUI@@QEAA_NXZ	2054	0x140007488
?GetPreventFormatChangeUpdatingModifiedState@TouchEditBase@DirectUI@@QEAA_NXZ	2055	0x140033cf4
?GetProcs@Schema@DirectUI@@CAJXZ	2056	0x1400071a4
?GetPromptText@TouchEdit2@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2057	0x14003d200
?GetPromptWithCaret@TouchEdit2@DirectUI@@QEAA_NXZ	2058	0x14000fd60
?GetPropValPairInfo@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUIClassInfo@2@PEBG2PEAPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	2059	0x1400264c0
?GetPropValPairInfo@DUIXmlParser@DirectUI@@IEAAJULINEINFO@2@PEAUIClassInfo@2@PEBG2PEAPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	2060	0x14001c45c
?GetProperty@Bind@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2061	0x14001e828
?GetProperty@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@H@Z	2062	0x140028564
?GetPropertyValue@ElementProvider@DirectUI@@UEAAJHPEAUtagVARIANT@@@Z	2063	0x14000f554
?GetProportional@CCBaseScrollBar@DirectUI@@UEAA_NXZ	2064	0x140002844
?GetProportional@ScrollBar@DirectUI@@UEAA_NXZ	2065	0x14003df1c
?GetProvider@XElement@DirectUI@@QEAAPEAUIXProvider@2@XZ	2066	0x14003afd0
?GetProviderOptions@ElementProxy@DirectUI@@IEAAJPEAW4ProviderOptions@@@Z	2067	0x140001530
?GetProxyCreator@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2068	0x1400248d0
?GetProxyCreator@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2069	0x1400114b4
?GetProxyCreator@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2070	0x14001ced8
?GetProxyCreator@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2071	0x140028310
?GetProxyCreator@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2072	0x14002b888
?GetProxyCreator@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2073	0x140027a74
?GetProxyCreator@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2074	0x140015238
?GetProxyCreator@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2075	0x14000874c
?GetProxyCreator@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2076	0x140036b10
?GetProxyCreator@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2077	0x140030adc
?GetProxyCreator@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2078	0x14003998c
?GetProxyCreator@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2079	0x140007168
?GetProxyCreator@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2080	0x140039204
?GetProxyCreator@ElementProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2081	0x14001122c
?GetProxyCreator@ExpandCollapseProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2082	0x140030d9c
?GetProxyCreator@GridItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2083	0x14003da2c
?GetProxyCreator@GridProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2084	0x1400221f0
?GetProxyCreator@HWNDElementProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2085	0x1400255d8
?GetProxyCreator@InvokeProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2086	0x1400370e8
?GetProxyCreator@RangeValueProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2087	0x14002e268
?GetProxyCreator@ScrollItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2088	0x14001e3f0
?GetProxyCreator@ScrollProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2089	0x14001d780
?GetProxyCreator@SelectionItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2090	0x14000ebf0
?GetProxyCreator@SelectionProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2091	0x140012210
?GetProxyCreator@TableItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2092	0x1400045bc
?GetProxyCreator@TableProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2093	0x14003add8
?GetProxyCreator@ToggleProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2094	0x1400031c0
?GetProxyCreator@ValueProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2095	0x14000cf78
?GetRangeMax@CCTrackBar@DirectUI@@QEAAHXZ	2096	0x14000991c
?GetRangeMax@TouchSlider@DirectUI@@QEAAHXZ	2097	0x140023df8
?GetRangeMin@CCTrackBar@DirectUI@@QEAAHXZ	2098	0x14003a48c
?GetRangeMin@TouchSlider@DirectUI@@QEAAHXZ	2099	0x140035698
?GetRawValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z	2100	0x14003a8cc
?GetReadOnly@TouchEditBase@DirectUI@@QEAA_NXZ	2101	0x140002524
?GetRect@Value@DirectUI@@QEAAPEBUtagRECT@@XZ	2102	0x1400296bc
?GetRectZero@Value@DirectUI@@SAPEAV12@XZ	2103	0x140022108
?GetRefCount@Value@DirectUI@@QEBAHXZ	2104	0x140033cc0
?GetReferencePoint@RefPointElement@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z	2105	0x14001165c
?GetRegisteredDefaultButton@DialogElement@DirectUI@@UEAAPEAVElement@2@XZ	2106	0x14001839c
?GetRenderBorderThickness@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2107	0x14000da40
?GetRenderEdgeHighlightThickness@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2108	0x140025024
?GetRenderMargin@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2109	0x140023bcc
?GetRenderMinSize@Element@DirectUI@@QEAAXPEAUtagSIZE@@@Z	2110	0x14000df20
?GetRenderPadding@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2111	0x14001a81c
?GetRepeat@Movie@DirectUI@@QEAA_NXZ	2112	0x14000eed4
?GetResourceHInstance@DUIXmlParser@DirectUI@@QEAAPEAUHINSTANCE__@@XZ	2113	0x14003a5c0
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ	2114	0x14003de50
?GetRoot@XProvider@DirectUI@@IEAAPEAVElement@2@XZ	2115	0x14002084c
?GetRootRelativeBounds@Element@DirectUI@@QEAAJPEAUtagRECT@@@Z	2116	0x140005720
?GetRow@GridItemProxy@DirectUI@@AEAAJPEAH@Z	2117	0x140033274
?GetRowCount@GridProxy@DirectUI@@AEAAJPEAH@Z	2118	0x140031798
?GetRowHeaderItems@TableItemProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2119	0x14000b7dc
?GetRowHeaders@TableProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2120	0x140028794
?GetRuntimeId@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2121	0x14001eea4
?GetRuntimeId@ElementProxy@DirectUI@@IEAAJPEAPEAUtagSAFEARRAY@@@Z	2122	0x140020b68
?GetScaledFloat@Value@DirectUI@@QEAAMM@Z	2123	0x14002e118
?GetScaledInt@Value@DirectUI@@QEAAHM@Z	2124	0x14003fbac
?GetScaledInt@Value@DirectUI@@QEAAPEBUScaledInt@2@XZ	2125	0x14001d8d8
?GetScaledPoint@Value@DirectUI@@QEAAXMPEAUtagPOINT@@@Z	2126	0x140029cfc
?GetScaledRect@Value@DirectUI@@QEAAXMPEAUtagRECT@@@Z	2127	0x140002bbc
?GetScaledSize@Value@DirectUI@@QEAAXMPEAUtagSIZE@@@Z	2128	0x140019194
?GetScrollBar@ScrollProxy@DirectUI@@AEAAPEAVBaseScrollBar@2@_N@Z	2129	0x140005bf4
?GetScrollBarHelper@ScrollProxy@DirectUI@@AEAAPEAVBaseScrollBar@2@PEAVElement@2@_N@Z	2130	0x1400334c0
?GetScrollPadding@TouchScrollViewer@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	2131	0x1400040c8
?GetScrollPercent@ScrollProxy@DirectUI@@AEAAJ_NPEAN@Z	2132	0x14002767c
?GetScrollable@ScrollProxy@DirectUI@@AEAAJ_NPEAH@Z	2133	0x14003fdb0
?GetSelected@Element@DirectUI@@QEAA_NXZ	2134	0x140028554
?GetSelection@BrowserSelectionProxy@DirectUI@@AEAAJPEAPEAUtagSAFEARRAY@@@Z	2135	0x14001f064
?GetSelection@Combobox@DirectUI@@QEAAHXZ	2136	0x14000e56c
?GetSelection@SelectionProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2137	0x14001acb8
?GetSelection@Selector@DirectUI@@QEAAPEAVElement@2@XZ	2138	0x14001bb0c
?GetSelection@TouchEdit2@DirectUI@@QEAAJPEAJ0@Z	2139	0x14002cff0
?GetSelection@TouchSelect@DirectUI@@QEAAPEAVElement@2@XZ	2140	0x140030148
?GetSelectionBackgroundColor@TouchEditBase@DirectUI@@QEAAPEAVValue@2@XZ	2141	0x140040af8
?GetSelectionContainer@SelectorSelectionItemProxy@DirectUI@@AEAAJPEAPEAUIRawElementProviderSimple@@@Z	2142	0x14001026c
?GetSelectionForegroundColor@TouchEditBase@DirectUI@@QEAAPEAVValue@2@XZ	2143	0x1400189e8
?GetSelectionIndex@TouchSelect@DirectUI@@QEAAHXZ	2144	0x140039658
?GetShadowIntensity@Element@DirectUI@@QEAAHXZ	2145	0x140010b28
?GetSheet@DUIXmlParser@DirectUI@@QEAAJPEBGPEAPEAVValue@2@@Z	2146	0x14001b68c
?GetSheet@Element@DirectUI@@QEAAPEAVStyleSheet@2@XZ	2147	0x14003d6bc
?GetSheetContext@DUIXmlParser@DirectUI@@QEAAPEAXXZ	2148	0x14001e71c
?GetSheetNull@Value@DirectUI@@SAPEAV12@XZ	2149	0x140034514
?GetShortcut@Element@DirectUI@@QEAAHXZ	2150	0x14000be4c
?GetShortcutChar@Element@DirectUI@@QEAAGXZ	2151	0x14003fc0c
?GetShortcutChar@RichText@DirectUI@@QEAAGXZ	2152	0x140040274
?GetShowClearButtonMinWidth@TouchEdit2@DirectUI@@QEAAHXZ	2153	0x14002da34
?GetShowKeyFocus@TouchButton@DirectUI@@QEAA_NXZ	2154	0x1400246a4
?GetShowTick@TouchSlider@DirectUI@@QEAA_NXZ	2155	0x14001a2f4
?GetSinkRect@HWNDHost@DirectUI@@AEAAXPEBUtagRECT@@PEAU3@@Z	2156	0x14000f8c0
?GetSize@Value@DirectUI@@QEAAPEBUtagSIZE@@XZ	2157	0x14000fa64
?GetSizeZero@Value@DirectUI@@SAPEAV12@XZ	2158	0x1400255c4
?GetSmoothingMode@Movie@DirectUI@@QEAAHXZ	2159	0x140012c10
?GetSnapIntervalX@TouchScrollViewer@DirectUI@@QEAAMXZ	2160	0x140014298
?GetSnapIntervalY@TouchScrollViewer@DirectUI@@QEAAMXZ	2161	0x140012ce8
?GetSnapMode@TouchScrollViewer@DirectUI@@QEAAHXZ	2162	0x140019880
?GetSnapOffsetX@TouchScrollViewer@DirectUI@@QEAAMXZ	2163	0x1400373d8
?GetSnapOffsetY@TouchScrollViewer@DirectUI@@QEAAMXZ	2164	0x140039824
?GetSnapPointCollectionX@TouchScrollViewer@DirectUI@@QEAAPEAV?$DynamicArray@N$0A@@2@PEAPEAVValue@2@@Z	2165	0x14000c01c
?GetSnapPointCollectionY@TouchScrollViewer@DirectUI@@QEAAPEAV?$DynamicArray@N$0A@@2@PEAPEAVValue@2@@Z	2166	0x140032378
?GetState@ModernProgressBar@DirectUI@@QEAAHXZ	2167	0x140032df8
?GetStaticColor@HWNDHost@DirectUI@@IEAA_NPEAUHDC__@@PEAPEAUHBRUSH__@@@Z	2168	0x14003bb68
?GetStepCount@TouchSlider@DirectUI@@QEAAHXZ	2169	0x1400191c4
?GetString@EventManager@DirectUI@@CAJPEAUtagVARIANT@@PEAVValue@2@@Z	2170	0x140014ce0
?GetString@Value@DirectUI@@QEAAPEBGXZ	2171	0x140038978
?GetStringDynamicScaling@Value@DirectUI@@QEAAPEBGXZ	2172	0x14002ff24
?GetStringNull@Value@DirectUI@@SAPEAV12@XZ	2173	0x14003cb68
?GetStringRPNull@Value@DirectUI@@SAPEAV12@XZ	2174	0x14001b020
?GetStyle@CCTreeView@DirectUI@@QEAAKXZ	2175	0x140023640
?GetStyleSheet@Value@DirectUI@@QEAAPEAVStyleSheet@2@XZ	2176	0x140012c3c
?GetSubContent@TouchCommandButton@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2177	0x14001fb58
?GetSuppressClearButton@TouchEdit2@DirectUI@@QEAA_NXZ	2178	0x14001f264
?GetSurfaceType@Surface@DirectUI@@SA?AW4EType@12@I@Z	2179	0x1400047f0
?GetSurfaceType@Surface@DirectUI@@SAIW4EType@12@@Z	2180	0x1400412fc
?GetSyncContentWhileIMEComposing@TouchEditBase@DirectUI@@QEAA_NXZ	2181	0x14003a444
?GetTargetPage@Navigator@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2182	0x14000ea20
?GetTextContentOverride@TouchSelectItem@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2183	0x14000c804
?GetTextDocument@TouchEdit2@DirectUI@@UEAAJPEAPEAUITextDocument@@@Z	2184	0x1400067fc
?GetTextDocument@TouchEditBase@DirectUI@@UEAAJPEAPEAUITextDocument@@@Z	2185	0x140012540
?GetTextGlowSize@Element@DirectUI@@QEAAHXZ	2186	0x14001fdd8
?GetTextHeight@Edit@DirectUI@@AEAAIXZ	2187	0x14001ae4c
?GetTextHost@TouchEdit2@DirectUI@@QEAAJPEAPEAVITextHost@@@Z	2188	0x14000c050
?GetTextMode@TouchEditBase@DirectUI@@QEAA?AW4TouchEditTextMode@2@XZ	2189	0x14002cff4
?GetTextSelection@TouchEdit2@DirectUI@@QEAAJPEAPEAUITextSelection@@@Z	2190	0x140031468
?GetTextServices@TouchEdit2@DirectUI@@UEAAJPEAPEAVITextServices@@@Z	2191	0x14003fe44
?GetTextServices@TouchEditBase@DirectUI@@UEAAJPEAPEAVITextServices@@@Z	2192	0x140023934
?GetTheme@Element@DirectUI@@AEAAJPEBGPEAPEAX@Z	2193	0x14002eb44
?GetThemeChanged@HWNDHost@DirectUI@@IEAAHXZ	2194	0x14002b00c
?GetThemedBorder@Edit@DirectUI@@QEAA_NXZ	2195	0x14003abc0
?GetThumb@TouchScrollBar@DirectUI@@QEAAPEAVElement@2@XZ	2196	0x14002a4fc
?GetThumbElement@TouchSlider@DirectUI@@QEAAPEAVButton@2@XZ	2197	0x1400230fc
?GetThumbPosition@CCTrackBar@DirectUI@@QEAAHXZ	2198	0x140039e98
?GetThumbValue@TouchSlider@DirectUI@@QEAAHXZ	2199	0x14002e2a8
?GetTickCount@TouchSlider@DirectUI@@QEAAHXZ	2200	0x14000549c
?GetTitleText@TouchSwitch@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2201	0x140041594
?GetToggleOnClick@TouchCheckBox@DirectUI@@QEAA_NXZ	2202	0x140033bac
?GetToggleState@EventManager@DirectUI@@CAXPEAUtagVARIANT@@@Z	2203	0x1400373dc
?GetToggleState@ToggleProxy@DirectUI@@AEAAJPEAW4ToggleState@@@Z	2204	0x14001e86c
?GetToggleValue@TouchSwitch@DirectUI@@QEAAHXZ	2205	0x1400385a0
?GetTooltip@Element@DirectUI@@QEAA_NXZ	2206	0x14001b428
?GetTooltipMaxWidth@Element@DirectUI@@QEAAHXZ	2207	0x14001a654
?GetTooltipMaximumLineCount@TouchHWNDElement@DirectUI@@QEAAHXZ	2208	0x140017cac
?GetTopLevel@Element@DirectUI@@QEAAPEAV12@XZ	2209	0x140037f64
?GetTrackElement@TouchSlider@DirectUI@@QEAAPEAVElement@2@XZ	2210	0x14000f84c
?GetTracking@CCBaseScrollBar@DirectUI@@QEAA_NXZ	2211	0x14003ee04
?GetTranslatedTileRects@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@PEAII@Z	2212	0x140035fe0
?GetTransparent@HWNDHost@DirectUI@@QEAA_NXZ	2213	0x14003ba3c
?GetTreatRightMouseButtonAsLeft@TouchButton@DirectUI@@QEAA_NXZ	2214	0x14003be80
?GetTreeAlphaLevel@Element@DirectUI@@QEAAMXZ	2215	0x14002b774
?GetTrimmedLineCount@RichText@DirectUI@@QEAAKXZ	2216	0x1400151f0
?GetType@DCSurface@DirectUI@@UEBA?AW4EType@Surface@2@XZ	2217	0x14003a984
?GetType@Value@DirectUI@@QEBAHXZ	2218	0x14000fdd4
?GetTypeInfo@DuiAccessible@DirectUI@@UEAAJIKPEAPEAUITypeInfo@@@Z	2219	0x1400306c0
?GetTypeInfoCount@DuiAccessible@DirectUI@@UEAAJPEAI@Z	2220	0x14000a9a8
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	2221	0x140036a6c
?GetUIState@HWNDElement@DirectUI@@QEAAGXZ	2222	0x14001a568
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ	2223	0x140029754
?GetUiaFocusDelegate@TouchEdit2@DirectUI@@UEAAPEAVElement@2@XZ	2224	0x140008128
?GetUnavailable@Value@DirectUI@@SAPEAV12@XZ	2225	0x140023580
?GetUnset@Value@DirectUI@@SAPEAV12@XZ	2226	0x1400288e0
?GetVScroll@ScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	2227	0x14000b100
?GetVScroll@StyledScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	2228	0x140005eec
?GetVScrollbar@TouchScrollViewer@DirectUI@@QEAAJPEAPEAVElement@2@@Z	2229	0x140021da0
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@P6APEBUPropertyInfo@2@XZHPEAUUpdateCache@2@@Z	2230	0x14001ad6c
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z	2231	0x140031658
?GetValue@ValueProxy@DirectUI@@AEAAJPEAPEAG@Z	2232	0x14002f074
?GetValueList@Value@DirectUI@@QEAAPEAV?$DynamicArray@PEAVValue@DirectUI@@$0A@@2@XZ	2233	0x140040e94
?GetValueParser@DUIXmlParser@DirectUI@@IEAAJPEAPEAVValueParser@ParserTools@2@@Z	2234	0x14001e250
?GetVertical@ScrollBar@DirectUI@@QEAA_NXZ	2235	0x140007694
?GetViewSize@ScrollProxy@DirectUI@@AEAAJ_NPEAN@Z	2236	0x1400305f4
?GetViewer@ScrollProxy@DirectUI@@AEAAJPEAPEAVViewer@2@@Z	2237	0x140033230
?GetVisible@Element@DirectUI@@QEAA_NXZ	2238	0x14002c790
?GetVisibleRect@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@@Z	2239	0x14001eec4
?GetVisited@TouchHyperLink@DirectUI@@QEAA_NXZ	2240	0x140012420
?GetVisualState@TouchSlider@DirectUI@@QEAAHXZ	2241	0x14002beb0
?GetWantTabs@Edit@DirectUI@@QEAA_NXZ	2242	0x140028104
?GetWidth@Element@DirectUI@@QEAAHXZ	2243	0x14002870c
?GetWinStyle@CCBase@DirectUI@@QEAAHXZ	2244	0x14001c788
?GetWindow@DuiAccessible@DirectUI@@UEAAJPEAPEAUHWND__@@@Z	2245	0x14002c7c8
?GetWindow@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAUHWND__@@@Z	2246	0x1400196cc
?GetWindowAccessGradientColor@TouchHWNDElement@DirectUI@@QEAAPEAVValue@2@XZ	2247	0x14001bde0
?GetWindowActive@Element@DirectUI@@QEAA_NXZ	2248	0x140021f08
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UEAAXPEAPEBGPEAI@Z	2249	0x14001bfe8
?GetWrapKeyboardNavigate@HWNDElement@DirectUI@@QEAA_NXZ	2250	0x14000b618
?GetX@Element@DirectUI@@QEAAHXZ	2251	0x14003b054
?GetXBabyElement@XBaby@DirectUI@@UEAAPEAVHWNDElement@2@XZ	2252	0x14003fb40
?GetXBarVisibility@BaseScrollViewer@DirectUI@@QEAAHXZ	2253	0x1400049d0
?GetXOffset@BaseScrollViewer@DirectUI@@QEAAHXZ	2254	0x140001918
?GetXOffset@Viewer@DirectUI@@QEAAHXZ	2255	0x140015780
?GetXScrollHeight@BaseScrollViewer@DirectUI@@QEAAHXZ	2256	0x1400349b4
?GetXScrollable@BaseScrollViewer@DirectUI@@QEAA_NXZ	2257	0x140036a04
?GetXScrollable@Viewer@DirectUI@@QEAA_NXZ	2258	0x1400193c8
?GetXmlLiteDll@DUIXmlParser@DirectUI@@KAJPEAPEAUHINSTANCE__@@@Z	2259	0x14000daa0
?GetY@Element@DirectUI@@QEAAHXZ	2260	0x1400057e0
?GetYBarVisibility@BaseScrollViewer@DirectUI@@QEAAHXZ	2261	0x1400145e8
?GetYOffset@BaseScrollViewer@DirectUI@@QEAAHXZ	2262	0x14000e1cc
?GetYOffset@Viewer@DirectUI@@QEAAHXZ	2263	0x1400416c8
?GetYScrollWidth@BaseScrollViewer@DirectUI@@QEAAHXZ	2264	0x140016218
?GetYScrollable@BaseScrollViewer@DirectUI@@QEAA_NXZ	2265	0x14001c800
?GetYScrollable@Viewer@DirectUI@@QEAA_NXZ	2266	0x14001277c
?GetZoomMaximum@TouchScrollViewer@DirectUI@@QEAAMXZ	2267	0x140007bb4
?GetZoomMinimum@TouchScrollViewer@DirectUI@@QEAAMXZ	2268	0x14003f030
?GridItemPattern@Schema@DirectUI@@2HA	2269	0x14003c710
?GridItem_ColumnSpan_Property@Schema@DirectUI@@2HA	2270	0x14001dd80
?GridItem_Column_Property@Schema@DirectUI@@2HA	2271	0x14003eca8
?GridItem_Parent_Property@Schema@DirectUI@@2HA	2272	0x14000dbd4
?GridItem_RowSpan_Property@Schema@DirectUI@@2HA	2273	0x14000d29c
?GridItem_Row_Property@Schema@DirectUI@@2HA	2274	0x14000a810
?GridPattern@Schema@DirectUI@@2HA	2275	0x140024dcc
?Grid_ColumnCount_Property@Schema@DirectUI@@2HA	2276	0x14003018c
?Grid_RowCount_Property@Schema@DirectUI@@2HA	2277	0x14003de30
?GroupControlType@Schema@DirectUI@@2HA	2278	0x14002eec0
?HandleAccChange@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2279	0x14001f484
?HandleAccDesc@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2280	0x14002e410
?HandleAccPatternChange@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@IIHPEAUtagVARIANT@@2P6AX2@Z@Z	2281	0x1400076e8
?HandleAccRoleEvent@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@PEAVValue@2@1@Z	2282	0x140010440
?HandleAccStateChange@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@IIHPEAUtagVARIANT@@1_N@Z	2283	0x140020868
?HandleBoolProp@EventManager@DirectUI@@CAJPEAVElement@2@P6A_N0@ZPEAUIRawElementProviderSimple@@HPEAVValue@2@3@Z	2284	0x140001ff0
?HandleChildrenEvent@EventManager@DirectUI@@CAJPEAVElement@2@PEAVValue@2@1@Z	2285	0x14003e9a0
?HandleEnterKeyProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	2286	0x14003009c
?HandleEnterProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2287	0x14002fd68
?HandleGlobalEnterProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2288	0x14001674c
?HandleRangeValue@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2289	0x1400058e4
?HandleScrollPos@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2290	0x14003f31c
?HandleSelectedChange@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@PEAVValue@2@@Z	2291	0x140026954
?HandleStringProp@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@HPEAVValue@2@1@Z	2292	0x140003258
?HandleToggleValue@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2293	0x140026fdc
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ	2294	0x14003c974
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z	2295	0x140012660
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z	2296	0x14003be44
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2297	0x140024b9c
?HandleVisibilityChange@EventManager@DirectUI@@CAJPEAVElement@2@I@Z	2298	0x14003aac0
?HasAnimation@Element@DirectUI@@QEAA_NXZ	2299	0x14000a588
?HasBorder@Element@DirectUI@@QEAA_NXZ	2300	0x14002866c
?HasChildren@Element@DirectUI@@QEAA_NXZ	2301	0x140028ef0
?HasContent@Element@DirectUI@@QEAA_NXZ	2302	0x140037d80
?HasEdgeHighlight@Element@DirectUI@@QEAA_NXZ	2303	0x14004146c
?HasKeyboardFocusProperty@Schema@DirectUI@@2HA	2304	0x140012a9c
?HasLayout@Element@DirectUI@@QEAA_NXZ	2305	0x140016aa0
?HasMargin@Element@DirectUI@@QEAA_NXZ	2306	0x14000e398
?HasPVLAnimationState@Element@DirectUI@@QEAA_NI@Z	2307	0x140022908
?HasPadding@Element@DirectUI@@QEAA_NXZ	2308	0x140001880
?HasSelection@TouchEdit2@DirectUI@@QEAA_NXZ	2309	0x14003b65c
?HasShieldProp@CCPushButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2310	0x1400296f8
?HaveWin32Focus@HWNDHost@DirectUI@@AEAA_NXZ	2311	0x140032c4c
?HeaderControlType@Schema@DirectUI@@2HA	2312	0x1400034cc
?HeaderItemControlType@Schema@DirectUI@@2HA	2313	0x14000e93c
?HeightProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2314	0x140039734
?HelpTextProperty@Schema@DirectUI@@2HA	2315	0x140035888
?HideTouchTooltip@TouchHWNDElement@DirectUI@@QEAAJXZ	2316	0x14000769c
?HideWindow@NativeHWNDHost@DirectUI@@QEAAXXZ	2317	0x14000958c
?HideWindow@XHost@DirectUI@@QEAAXXZ	2318	0x140006f6c
?HighDPIProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2319	0x14001d944
?Home@BaseScrollBar@DirectUI@@UEAAXXZ	2320	0x14001b9e4
?Host@NativeHWNDHost@DirectUI@@QEAAXPEAVElement@2@@Z	2321	0x14001a118
?Host@XHost@DirectUI@@QEAAXPEAVElement@2@@Z	2322	0x140009494
?Hosted@PushButton@DirectUI@@SA?AVUID@@XZ	2323	0x140007de4
?HyperlinkControlType@Schema@DirectUI@@2HA	2324	0x1400409f0
?IDProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2325	0x14001dbf0
?IHMNotify@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	2326	0x140004430
?IMEComposingProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2327	0x140028ec8
?INITIALSTACKSKIP@CallstackTracker@DirectUI@@0HB	2328	0x14000fdb8
?IgnoredKeyCombosProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2329	0x14000cb2c
?ImageControlType@Schema@DirectUI@@2HA	2330	0x1400349e4
?ImmersiveColorSchemeChange@HWNDElement@DirectUI@@SA?AVUID@@XZ	2331	0x14001aa5c
?Init@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2332	0x140032eb8
?Init@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2333	0x14001d4c8
?Init@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2334	0x140032750
?Init@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2335	0x14002a214
?Init@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2336	0x14002002c
?Init@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2337	0x14002b854
?Init@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2338	0x14000550c
?Init@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2339	0x1400369dc
?Init@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2340	0x14003dae0
?Init@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2341	0x1400057dc
?Init@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2342	0x140032d50
?Init@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2343	0x14000127c
?Init@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2344	0x14002ffb8
?Init@AutoThread@DirectUI@@QEAAJXZ	2345	0x14003b890
?Init@BrowserSelectionProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2346	0x140035370
?Init@CallstackTracker@DirectUI@@SAHXZ	2347	0x1400154ac
?Init@ElementProvider@DirectUI@@MEAAJPEAVElement@2@PEAVInvokeHelper@2@@Z	2348	0x14001f9a8
?Init@ElementProviderManager@DirectUI@@SAJXZ	2349	0x140010214
?Init@ElementProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2350	0x14000cbfc
?Init@EventManager@DirectUI@@SAJXZ	2351	0x140009fd8
?Init@ExpandCollapseProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2352	0x1400140a0
?Init@GridItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2353	0x140031fb4
?Init@GridProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2354	0x140001474
?Init@HWNDElementProvider@DirectUI@@MEAAJPEAVHWNDElement@2@PEAVInvokeHelper@2@@Z	2355	0x140015b08
?Init@HWNDElementProxy@DirectUI@@UEAAXPEAVHWNDElement@2@@Z	2356	0x140018f14
?Init@InvokeHelper@DirectUI@@QEAAHK@Z	2357	0x1400119f0
?Init@InvokeManager@DirectUI@@SAJXZ	2358	0x14002e854
?Init@InvokeProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2359	0x140028530
?Init@ModernProgressBarRangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2360	0x14003d758
?Init@NavReference@DirectUI@@QEAAXPEAVElement@2@PEAUtagRECT@@@Z	2361	0x140006b24
?Init@NavScoring@DirectUI@@QEAAXPEAVElement@2@HPEBUNavReference@2@@Z	2362	0x140020c6c
?Init@NavigatorSelectionItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2363	0x140015308
?Init@ProgressRangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2364	0x140014674
?Init@ProviderProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2365	0x1400106f4
?Init@RangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2366	0x140026ae0
?Init@Schema@DirectUI@@SAJXZ	2367	0x140025c70
?Init@ScrollBarRangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2368	0x14000519c
?Init@ScrollItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2369	0x140033fb4
?Init@ScrollProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2370	0x14002a338
?Init@SelectionItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2371	0x1400094a0
?Init@SelectionProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2372	0x14003711c
?Init@SelectorSelectionItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2373	0x1400405c4
?Init@SelectorSelectionProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2374	0x14003a0c0
?Init@TableItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2375	0x140040c48
?Init@TableProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2376	0x1400248ac
?Init@ToggleProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2377	0x1400065bc
?Init@ValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2378	0x1400105c8
?InitOnceCallback@CallstackTracker@DirectUI@@CAHPEAT_RTL_RUN_ONCE@@PEAXPEAPEAX@Z	2379	0x140026988
?InitProcess@FontCache@DirectUI@@SAJXZ	2380	0x140008498
?InitPropSheetPage@TaskPage@DirectUI@@MEAAXPEAU_PROPSHEETPAGEW@@@Z	2381	0x1400037a4
?InitThread@FontCache@DirectUI@@SAJXZ	2382	0x140025efc
?Initialize@AccessibleButton@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2383	0x14000c6bc
?Initialize@AnimationStrip@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2384	0x1400132b8
?Initialize@AutoButton@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2385	0x140024738
?Initialize@BaseScrollViewer@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2386	0x140017388
?Initialize@Bind@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2387	0x1400410f0
?Initialize@BorderLayout@DirectUI@@QEAAXXZ	2388	0x140001068
?Initialize@Browser@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2389	0x140018a84
?Initialize@Button@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2390	0x14000c3d8
?Initialize@CCBase@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2391	0x1400023a4
?Initialize@CCBaseScrollBar@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2392	0x140027790
?Initialize@CCListView@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2393	0x1400059a8
?Initialize@CCProgressBar@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2394	0x14003e3ec
?Initialize@CSafeElementProxy@@IEAAJPEAVElement@DirectUI@@@Z	2395	0x14003695c
?Initialize@CheckBoxGlyph@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2396	0x14000a164
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z	2397	0x14002d5f8
?Initialize@Clipper@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2398	0x140018990
?Initialize@Combobox@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2399	0x14000627c
?Initialize@DUIXmlParser@DirectUI@@IEAAJXZ	2400	0x140003604
?Initialize@DialogElementCore@DirectUI@@QEAAXPEAUIDialogElement@2@PEAUIElementListener@2@@Z	2401	0x140014b3c
?Initialize@DuiAccessible@DirectUI@@QEAAXPEAVElement@2@@Z	2402	0x14001607c
?Initialize@Edit@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2403	0x1400058b0
?Initialize@Element@DirectUI@@QEAAJIPEAV12@PEAK@Z	2404	0x14002288c
?Initialize@Expando@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2405	0x14002bd5c
?Initialize@ExpandoButtonGlyph@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2406	0x140011660
?Initialize@FillLayout@DirectUI@@QEAAXXZ	2407	0x140018800
?Initialize@FlowLayout@DirectUI@@QEAAX_NIII@Z	2408	0x140034e9c
?Initialize@GridLayout@DirectUI@@QEAAXHH@Z	2409	0x140031c9c
?Initialize@HWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z	2410	0x14003bd24
?Initialize@HWNDElementAccessible@DirectUI@@QEAAJPEAVHWNDElement@2@@Z	2411	0x140029fac
?Initialize@HWNDHost@DirectUI@@QEAAJIIPEAVElement@2@PEAK@Z	2412	0x14002790c
?Initialize@HWNDHostAccessible@DirectUI@@QEAAJPEAVElement@2@PEAUIAccessible@@@Z	2413	0x14001fbac
?Initialize@Layout@DirectUI@@QEAAXXZ	2414	0x140015d4c
?Initialize@Macro@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2415	0x14003a244
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@I@Z	2416	0x140028404
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBGPEAUHWND__@@PEAUHICON__@@HHHHHHI@Z	2417	0x1400075a8
?Initialize@Navigator@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2418	0x140015000
?Initialize@NineGridLayout@DirectUI@@QEAAXXZ	2419	0x140009dd0
?Initialize@PText@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2420	0x14001a38c
?Initialize@Page@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2421	0x1400279cc
?Initialize@Pages@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2422	0x140021758
?Initialize@Progress@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2423	0x140034944
?Initialize@RadioButtonGlyph@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2424	0x140004404
?Initialize@RefPointElement@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2425	0x1400108ec
?Initialize@RepeatButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2426	0x140006d34
?Initialize@Repeater@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2427	0x140032f68
?Initialize@RichText@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2428	0x140010b3c
?Initialize@RowLayout@DirectUI@@QEAAJHII@Z	2429	0x140024fcc
?Initialize@ScrollBar@DirectUI@@QEAAJ_NPEAVElement@2@PEAK@Z	2430	0x140026280
?Initialize@Selector@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2431	0x14000aad8
?Initialize@SelectorNoDefault@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2432	0x14002e9e4
?Initialize@SemanticZoomToggle@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2433	0x14000a778
?Initialize@TableLayout@DirectUI@@QEAAXHHHPEAH@Z	2434	0x14002a6ac
?Initialize@TextGraphic@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2435	0x14001c5e0
?Initialize@Thumb@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2436	0x140026be8
?Initialize@TouchButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2437	0x14000ce90
?Initialize@TouchCheckBox@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2438	0x1400083f0
?Initialize@TouchCheckBoxGlyph@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2439	0x14002cb1c
?Initialize@TouchCommandButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2440	0x140014d64
?Initialize@TouchEdit2@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2441	0x1400374a0
?Initialize@TouchHWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z	2442	0x14003dddc
?Initialize@TouchRepeatButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2443	0x140021104
?Initialize@TouchScrollBar@DirectUI@@QEAAJ_NPEAVElement@2@PEAK@Z	2444	0x14000abac
?Initialize@TouchSelect@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2445	0x1400229a0
?Initialize@TouchSlider@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2446	0x140007c90
?Initialize@TouchSwitch@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2447	0x140011818
?Initialize@UnknownElement@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2448	0x14003b7ac
?Initialize@VerticalFlowLayout@DirectUI@@QEAAX_NIII@Z	2449	0x14001761c
?Initialize@Viewer@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2450	0x14002478c
?Initialize@XBaby@DirectUI@@IEAAJPEAVIXElementCP@2@PEAVXProvider@2@PEAUHWND__@@PEAVElement@2@PEAK@Z	2451	0x14004031c
?Initialize@XElement@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2452	0x1400029cc
?Initialize@XHost@DirectUI@@QEAAJPEAVIXElementCP@2@@Z	2453	0x140034484
?Initialize@XProvider@DirectUI@@QEAAJPEAVElement@2@PEAVIXProviderCP@2@@Z	2454	0x14003ed44
?Initialize@XResourceProvider@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG11@Z	2455	0x14001e64c
?InitializeDllInfo@CallstackTracker@DirectUI@@CAHXZ	2456	0x140038f04
?InitializeParserFromXmlReader@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUHINSTANCE__@@1@Z	2457	0x140001a80
?InitializeSymbols@CallstackTracker@DirectUI@@CAHXZ	2458	0x140005504
?InnerBorderThicknessProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	2459	0x14003b0c4
?Insert@Element@DirectUI@@QEAAJPEAV12@I@Z	2460	0x14001ddf8
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z	2461	0x14000bc3c
?Insert@TouchCheckBox@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2462	0x14003e590
?Insert@TouchCheckBoxGlyph@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2463	0x14001e188
?Insert@TouchCommandButton@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2464	0x140026514
?Insert@TouchEditBase@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2465	0x14002a730
?Insert@TouchSelect@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2466	0x14002f444
?InsertItem@CCTreeView@DirectUI@@QEAAPEAU_TREEITEM@@PEAGIQEAU3@1@Z	2467	0x14001e94c
?InsertItem@CCTreeView@DirectUI@@QEAAPEAU_TREEITEM@@PEBUtagTVINSERTSTRUCTW@@@Z	2468	0x14001737c
?IntegrateIMECandidateListProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2469	0x14001269c
?InteractionEnd@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	2470	0x14000b204
?InteractionStart@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	2471	0x140002434
?InternalCreate@TableLayout@DirectUI@@SAJHHHPEAHPEAPEAVLayout@2@@Z	2472	0x1400150c4
?InterpolationModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	2473	0x140001360
?Invoke@DuiAccessible@DirectUI@@UEAAJJAEBU_GUID@@KGPEAUtagDISPPARAMS@@PEAUtagVARIANT@@PEAUtagEXCEPINFO@@PEAI@Z	2474	0x140014dc8
?Invoke@InvokeProvider@DirectUI@@UEAAJXZ	2475	0x14002e190
?Invoke@Proxy@DirectUI@@IEAAXIPEAX@Z	2476	0x140033a54
?InvokeAnimation@Element@DirectUI@@QEAAXHI@Z	2477	0x14002cc1c
?InvokeAnimation@Element@DirectUI@@QEAAXIIMM_N@Z	2478	0x140007ea8
?InvokeInvokedEvent@Schema@DirectUI@@2HA	2479	0x140016144
?InvokePattern@Schema@DirectUI@@2HA	2480	0x1400354a8
?IsActivityOccuring@ModernProgressBar@DirectUI@@QEAA_NXZ	2481	0x14002af68
?IsActivityOccuring@ModernProgressRing@DirectUI@@QEAA_NXZ	2482	0x14001b48c
?IsAddLayeredRef@ModernProgressBar@DirectUI@@QEAA_NXZ	2483	0x14001a41c
?IsAddLayeredRef@ModernProgressRing@DirectUI@@QEAA_NXZ	2484	0x140010e7c
?IsAutoHeight@ModernProgressBar@DirectUI@@QEAA_NXZ	2485	0x14002898c
?IsBehaviorLayout@Element@DirectUI@@QEBA_NXZ	2486	0x1400411c0
?IsButtonEnabledAndVisible@DialogElementCore@DirectUI@@KA_NPEAVElement@2@@Z	2487	0x140010064
?IsCacheDirty@Layout@DirectUI@@IEAA_NXZ	2488	0x14003f77c
?IsCompositedText@Element@DirectUI@@QEAA_NXZ	2489	0x14003f7cc
?IsContentElementProperty@Schema@DirectUI@@2HA	2490	0x1400091e4
?IsContentProtected@Edit@DirectUI@@UEAA_NXZ	2491	0x14000f2b4
?IsContentProtected@Element@DirectUI@@UEAA_NXZ	2492	0x140038c20
?IsContentProtected@TouchEditBase@DirectUI@@UEAA_NXZ	2493	0x14001d6f4
?IsContinuousProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2494	0x1400372b8
?IsControlElementProperty@Schema@DirectUI@@2HA	2495	0x1400179b8
?IsCorrectImageHlpVersion@CallstackTracker@DirectUI@@CAHXZ	2496	0x140010bcc
?IsCrossfadeInProgress@TouchScrollViewer@DirectUI@@QEAA_NXZ	2497	0x14001d7c0
?IsDefaultCAlign@Element@DirectUI@@QEAA_NXZ	2498	0x140028778
?IsDefaultCursor@Element@DirectUI@@QEAA_NXZ	2499	0x14003ee88
?IsDescendent@Element@DirectUI@@QEAA_NPEAV12@@Z	2500	0x140034930
?IsDescendent@XElement@DirectUI@@QEAA_NPEAVElement@2@@Z	2501	0x14000c078
?IsDescendent@XProvider@DirectUI@@UEAAJPEAVElement@2@PEA_N@Z	2502	0x14000c1e8
?IsDestroyed@Element@DirectUI@@QEAA_NXZ	2503	0x140030ae8
?IsDeterminate@ModernProgressBar@DirectUI@@QEAA_NXZ	2504	0x1400237f4
?IsDynamicScaled@Value@DirectUI@@QEAA_NXZ	2505	0x14000da20
?IsDynamicScaling@DUIXmlParser@DirectUI@@QEAA_NXZ	2506	0x140007174
?IsEnabledProperty@Schema@DirectUI@@2HA	2507	0x1400398c4
?IsEqual@Value@DirectUI@@QEAA_NPEAV12@@Z	2508	0x14002ea6c
?IsFirstElement@HWNDElement@DirectUI@@QEAA_NPEAVElement@2@@Z	2509	0x1400398bc
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ	2510	0x140001870
?IsHosted@Element@DirectUI@@QEAA_NXZ	2511	0x140023d8c
?IsIndependentAnimations@ModernProgressBar@DirectUI@@QEAA_NXZ	2512	0x140008998
?IsKeyboardFocusableProperty@Schema@DirectUI@@2HA	2513	0x14003b418
?IsLastElement@HWNDElement@DirectUI@@QEAA_NPEAVElement@2@@Z	2514	0x14001252c
?IsMSAAEnabled@HWNDElement@DirectUI@@UEAA_NXZ	2515	0x140007440
?IsMSAAEnabled@TouchHWNDElement@DirectUI@@UEAA_NXZ	2516	0x14001ddd0
?IsManualVisualSwapInProgress@TouchScrollViewer@DirectUI@@QEAA_NXZ	2517	0x14002cda8
?IsMoveDeferred@HWNDHost@DirectUI@@IEAA_NXZ	2518	0x1400160bc
?IsOffscreen@Schema@DirectUI@@2HA	2519	0x140015330
?IsPasswordProperty@Schema@DirectUI@@2HA	2520	0x140020ffc
?IsPatternSupported@ElementProxy@DirectUI@@IEAAJW4Pattern@Schema@2@PEA_N@Z	2521	0x14000e1c0
?IsPatternSupported@ExpandCollapseProxy@DirectUI@@SA_NPEAVElement@2@@Z	2522	0x14002b238
?IsPatternSupported@GridItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2523	0x14004107c
?IsPatternSupported@GridProxy@DirectUI@@SA_NPEAVElement@2@@Z	2524	0x14000ebf0
?IsPatternSupported@InvokeProxy@DirectUI@@SA_NPEAVElement@2@@Z	2525	0x140039674
?IsPatternSupported@RangeValueProxy@DirectUI@@SA_NPEAVElement@2@@Z	2526	0x140006b3c
?IsPatternSupported@ScrollItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2527	0x14000e384
?IsPatternSupported@ScrollProxy@DirectUI@@SA_NPEAVElement@2@@Z	2528	0x14000e324
?IsPatternSupported@SelectionItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2529	0x14001c770
?IsPatternSupported@SelectionProxy@DirectUI@@SA_NPEAVElement@2@@Z	2530	0x14002acd4
?IsPatternSupported@TableItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2531	0x140034cfc
?IsPatternSupported@TableProxy@DirectUI@@SA_NPEAVElement@2@@Z	2532	0x14003d784
?IsPatternSupported@ToggleProxy@DirectUI@@SA_NPEAVElement@2@@Z	2533	0x14002e614
?IsPatternSupported@ValueProxy@DirectUI@@SA_NPEAVElement@2@@Z	2534	0x140009f8c
?IsPeripheral@Schema@DirectUI@@2HA	2535	0x14003fa20
?IsPinned@BaseScrollBar@DirectUI@@QEAA_NXZ	2536	0x14002f89c
?IsPointValid@Element@DirectUI@@AEAA_NNN@Z	2537	0x14002d058
?IsPopupOpen@TouchSelect@DirectUI@@QEAA_NXZ	2538	0x140007610
?IsPressedProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2539	0x1400395b8
?IsRTL@Element@DirectUI@@QEAA_NXZ	2540	0x140027bdc
?IsRTLReading@Element@DirectUI@@UEAA_NXZ	2541	0x14000af6c
?IsRegisteredForAnimationStatusChanges@TouchHWNDElement@DirectUI@@QEAA_NXZ	2542	0x140019114
?IsReorderable@ItemList@DirectUI@@QEAA_NXZ	2543	0x14001a174
?IsRoot@Element@DirectUI@@QEAAHXZ	2544	0x14001bc24
?IsScrollable@BaseScrollBar@DirectUI@@QEAA_NXZ	2545	0x140003514
?IsSelfLayout@Element@DirectUI@@QEAA_NXZ	2546	0x140032208
?IsShowOnOffFeedbackProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2547	0x140018170
?IsSmoothFillAnimation@ModernProgressBar@DirectUI@@QEAA_NXZ	2548	0x1400019d4
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z	2549	0x140039c98
?IsThemeClassName@DUIXmlParser@DirectUI@@KA_NPEBUExprNode@ParserTools@2@@Z	2550	0x14003ced0
?IsThumbActive@TouchScrollBar@DirectUI@@QEAA_NXZ	2551	0x140009784
?IsTileMember@TouchScrollViewer@DirectUI@@QEAA_NIPEAVElement@2@@Z	2552	0x1400104dc
?IsValidAccessor@Element@DirectUI@@QEAA_NPEBUPropertyInfo@2@H_N@Z	2553	0x14003c240
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z	2554	0x14002fe5c
?IsValidValue@Element@DirectUI@@SA_NPEBUPropertyInfo@2@PEAVValue@2@@Z	2555	0x1400017f8
?IsVerticalProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2556	0x140040870
?IsWordWrap@Element@DirectUI@@QEAA_NXZ	2557	0x140016c10
?ItemContainerPattern@Schema@DirectUI@@2HA	2558	0x14001028c
?ItemHeightInPopupProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	2559	0x1400048b4
?ItemStatusProperty@Schema@DirectUI@@2HA	2560	0x14001f478
?ItemTypeProperty@Schema@DirectUI@@2HA	2561	0x14001437c
?KeyFocusedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2562	0x14000cd34
?KeyWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2563	0x140008e10
?KeyboardNavigate@Element@DirectUI@@SA?AVUID@@XZ	2564	0x14003b2e0
?KeyboardNavigationCaptureProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2565	0x14002c9c4
?LabeledByProperty@Schema@DirectUI@@2HA	2566	0x140017f00
?LastDSConstProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2567	0x14002e238
?LayoutInvalidatedEvent@Schema@DirectUI@@2HA	2568	0x14002e9c4
?LayoutPosProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2569	0x14002c058
?LayoutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2570	0x14000a590
?Leaving@Browser@DirectUI@@SA?AVUID@@XZ	2571	0x14001af20
?LightDismissIHMProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	2572	0x14003fe1c
?LineDown@BaseScrollBar@DirectUI@@UEAAXI@Z	2573	0x140007034
?LineDown@TouchScrollBar@DirectUI@@UEAAXI@Z	2574	0x1400227dc
?LineProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2575	0x14001cc6c
?LineProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2576	0x140015ec4
?LineSizeProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2577	0x14001bc28
?LineSpacingProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2578	0x1400147c0
?LineUp@BaseScrollBar@DirectUI@@UEAAXI@Z	2579	0x14003f530
?LineUp@TouchScrollBar@DirectUI@@UEAAXI@Z	2580	0x14002a428
?ListControlType@Schema@DirectUI@@2HA	2581	0x140032a98
?ListItemControlType@Schema@DirectUI@@2HA	2582	0x14001dcd4
?LoadComCtl32@TaskPage@DirectUI@@AEAAJXZ	2583	0x140014c78
?LoadCommonControlExports@AnimationStrip@DirectUI@@AEAAJXZ	2584	0x140036754
?LoadFromBuffer@DUIFactory@DirectUI@@QEAAJPEBG_K0PEAVElement@2@PEAKPEAPEAV32@@Z	2585	0x140030024
?LoadFromFile@DUIFactory@DirectUI@@QEAAJPEBG0PEAVElement@2@PEAKPEAPEAV32@@Z	2586	0x14003d458
?LoadFromPath@Movie@DirectUI@@QEAAJPEBG@Z	2587	0x140018898
?LoadFromResource@DUIFactory@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG1PEAVElement@2@PEAKPEAPEAV42@1@Z	2588	0x140017e8c
?LoadFromResource@Movie@DirectUI@@QEAAJPEAUHINSTANCE__@@H@Z	2589	0x14003ce50
?LoadImagesIntoAnimationStrip@AnimationStrip@DirectUI@@IEAAJXZ	2590	0x140040dd0
?LoadPage@TaskPage@DirectUI@@AEAAJPEAPEAVElement@2@PEAV32@PEAPEAVDUIXmlParser@2@@Z	2591	0x14002c1bc
?LoadPage@TaskPage@DirectUI@@MEAAJPEAVHWNDElement@2@PEAUHINSTANCE__@@PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z	2592	0x1400031b0
?LoadParser@TaskPage@DirectUI@@MEAAJPEAPEAVDUIXmlParser@2@@Z	2593	0x140016320
?LocaleProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2594	0x14001a1b0
?LocalizedControlTypeProperty@Schema@DirectUI@@2HA	2595	0x140027d48
?Locate@RefPointElement@DirectUI@@SAPEAV12@PEAVElement@2@@Z	2596	0x140001e94
?LocationProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2597	0x140013604
?LookupAccessibleRole@Schema@DirectUI@@SAHHPEA_N@Z	2598	0x14001a6a4
?LookupControlInfos@Schema@DirectUI@@CAJXZ	2599	0x140018e6c
?LookupElement@DUIXmlParser@DirectUI@@QEAAJPEAUIXmlReader@@PEBGPEAUHINSTANCE__@@PEAPEAUIClassInfo@2@@Z	2600	0x14003aff0
?LookupElement@DUIXmlParser@DirectUI@@QEAAJULINEINFO@2@PEBGPEAUHINSTANCE__@@PEAPEAUIClassInfo@2@@Z	2601	0x140039748
?LookupEventInfos@Schema@DirectUI@@CAJXZ	2602	0x140038200
?LookupPatternInfos@Schema@DirectUI@@CAJXZ	2603	0x140006fcc
?LookupPropertyInfos@Schema@DirectUI@@CAJXZ	2604	0x14000cb38
?ManipulationCompleted@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2605	0x14002f918
?ManipulationDelta@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2606	0x140001494
?ManipulationHorizontalAlignmentProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	2607	0x140022cec
?ManipulationStarted@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2608	0x14000f174
?ManipulationStarting@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2609	0x14002023c
?ManipulationVerticalAlignmentProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	2610	0x14000816c
?ManualStoryboardVerify@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2611	0x14000aa70
?MapContentVisuals@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2612	0x14002bfe4
?MapElementPoint@Element@DirectUI@@QEAAXPEAV12@PEBUtagPOINT@@PEAU3@@Z	2613	0x140019bb0
?MapPropertyEnumValue@DUIXmlParser@DirectUI@@IEAAJPEBUEnumMap@2@PEBGPEAH@Z	2614	0x140008a14
?MapPropertyNameToPropertyInfo@DUIXmlParser@DirectUI@@IEAAJULINEINFO@2@PEAUIClassInfo@2@PEBGPEAPEBUPropertyInfo@2@@Z	2615	0x140002468
?MapRunsToClustersProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2616	0x14003b874
?MarginProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2617	0x14001ab04
?MarkHosted@Element@DirectUI@@IEAAXXZ	2618	0x140041124
?MarkNeedsDSUpdate@Element@DirectUI@@QEAAXXZ	2619	0x1400087ec
?MarkSelfLayout@Element@DirectUI@@IEAAXXZ	2620	0x1400116c0
?MaxLengthProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	2621	0x14002bdf4
?MaxLengthProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2622	0x14003690c
?MaximumProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2623	0x14003f964
?MaximumProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2624	0x14000642c
?MaximumProp@Progress@DirectUI@@SAPEBUPropertyInfo@2@XZ	2625	0x14002e300
?MaximumProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2626	0x14001a1b8
?MenuBarControlType@Schema@DirectUI@@2HA	2627	0x14002c378
?MenuClosedEvent@Schema@DirectUI@@2HA	2628	0x140024430
?MenuControlType@Schema@DirectUI@@2HA	2629	0x140009c1c
?MenuItemControlType@Schema@DirectUI@@2HA	2630	0x140024a0c
?MenuOpenedEvent@Schema@DirectUI@@2HA	2631	0x14002649c
?MessageCallback@Edit@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2632	0x1400359cc
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2633	0x140023d2c
?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2634	0x140024fac
?MessageCallback@TouchHWNDElement@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2635	0x14000df3c
?MeteringProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2636	0x140007cb8
?MinSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2637	0x1400352f0
?MinimumProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2638	0x140015c28
?MinimumProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2639	0x14000368c
?MinimumProp@Progress@DirectUI@@SAPEBUPropertyInfo@2@XZ	2640	0x1400407a0
?MinimumProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2641	0x14000c5fc
?MonitorPowerSettingsChange@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	2642	0x140032720
?MouseFocusedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2643	0x14003f8c4
?MouseOrPointerReleased@TouchSlider@DirectUI@@SA?AVUID@@XZ	2644	0x14001dd40
?MouseWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2645	0x140014f48
?MoveCaretToEndOnSyncContentProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2646	0x140001354
?MultilineProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	2647	0x140003818
?MultilineProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2648	0x1400319b0
?MultipleClick@TouchButton@DirectUI@@SA?AVUID@@XZ	2649	0x1400258d4
?MultipleViewPattern@Schema@DirectUI@@2HA	2650	0x14003db14
?NameProperty@Schema@DirectUI@@2HA	2651	0x140005140
?Navigate@DuiNavigate@DirectUI@@SAPEAVElement@2@PEAV32@PEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@H@Z	2652	0x140020990
?Navigate@ElementProvider@DirectUI@@UEAAJW4NavigateDirection@@PEAPEAUIRawElementProviderFragment@@@Z	2653	0x140039f70
?Navigate@ElementProxy@DirectUI@@IEAAJW4NavigateDirection@@PEAPEAUIRawElementProviderFragment@@@Z	2654	0x140014fa0
?Navigate@XProvider@DirectUI@@UEAAJHPEA_N@Z	2655	0x14002bf28
?NeedsDSUpdate@Element@DirectUI@@QEAA_NXZ	2656	0x140008bc8
?NewChildElementsAdded@TouchScrollViewer@DirectUI@@QEAAXXZ	2657	0x140004800
?NewNativeWindowHandleProperty@Schema@DirectUI@@2HA	2658	0x140011ff0
?Next@DuiAccessible@DirectUI@@UEAAJKPEAUtagVARIANT@@PEAK@Z	2659	0x140038ec8
?Next@HWNDHostAccessible@DirectUI@@UEAAJKPEAUtagVARIANT@@PEAK@Z	2660	0x14002fe1c
?NoteProp@CCCommandLink@DirectUI@@SAPEBUPropertyInfo@2@XZ	2661	0x140031dd0
?NotifyComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2662	0x140003b08
?NotifyImplicit@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2663	0x140003acc
?NotifyStart@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2664	0x14000275c
?NotifyStoryboardComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2665	0x140033560
?NullControlType@Schema@DirectUI@@2HA	2666	0x14003aa68
?OffTextProp@TouchSwitch@DirectUI@@SAPEBUPropertyInfo@2@XZ	2667	0x140007ba4
?OnAction@AnimationStrip@DirectUI@@IEAAXPEAUGMA_ACTIONINFO@@@Z	2668	0x14003b2a8
?OnAdd@BorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2669	0x140014a10
?OnAdd@Layout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2670	0x14000c48c
?OnAdd@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2671	0x140037014
?OnAdd@ShellBorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2672	0x1400087dc
?OnAdjustWindowSize@Combobox@DirectUI@@UEAAHHHI@Z	2673	0x1400375d4
?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z	2674	0x140004dd8
?OnChildLostFocus@DialogElement@DirectUI@@UEAA_NPEAVElement@2@@Z	2675	0x14000f8e4
?OnChildLostFocus@DialogElementCore@DirectUI@@QEAA_NPEAVElement@2@@Z	2676	0x14001c6f8
?OnChildLostFocus@XBaby@DirectUI@@UEAA_NPEAVElement@2@@Z	2677	0x140026844
?OnChildReceivedFocus@DialogElement@DirectUI@@UEAA_NPEAVElement@2@@Z	2678	0x1400151e0
?OnChildReceivedFocus@DialogElementCore@DirectUI@@QEAA_NPEAVElement@2@@Z	2679	0x1400259f4
?OnChildReceivedFocus@XBaby@DirectUI@@UEAA_NPEAVElement@2@@Z	2680	0x140029c74
?OnCompositionChanged@HWNDElement@DirectUI@@UEAAXXZ	2681	0x140008b88
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2682	0x1400321b8
?OnCustomDraw@CCBase@DirectUI@@UEAA_NPEAUtagNMCUSTOMDRAWINFO@@PEA_J@Z	2683	0x14001c954
?OnDefaultButtonTrackingChanged@DialogElementCore@DirectUI@@QEAAXPEAVValue@2@@Z	2684	0x14001a850
?OnDestroy@AnimationStrip@DirectUI@@MEAAXXZ	2685	0x14003d4ac
?OnDestroy@DialogElement@DirectUI@@UEAAXXZ	2686	0x140014e7c
?OnDestroy@DialogElementCore@DirectUI@@QEAAXXZ	2687	0x140021984
?OnDestroy@Element@DirectUI@@UEAAXXZ	2688	0x140009a08
?OnDestroy@HWNDElement@DirectUI@@UEAAXXZ	2689	0x14002e99c
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ	2690	0x140008898
?OnDestroy@ModernProgressBar@DirectUI@@MEAAXXZ	2691	0x1400358f0
?OnDestroy@ModernProgressRing@DirectUI@@MEAAXXZ	2692	0x140013c14
?OnDestroy@Movie@DirectUI@@UEAAXXZ	2693	0x14000a4d0
?OnDestroy@TouchHWNDElement@DirectUI@@UEAAXXZ	2694	0x14001938c
?OnEvent@AutoButton@DirectUI@@UEAAXPEAUEvent@2@@Z	2695	0x140006b10
?OnEvent@BaseScrollViewer@DirectUI@@UEAAXPEAUEvent@2@@Z	2696	0x140007860
?OnEvent@Browser@DirectUI@@UEAAXPEAUEvent@2@@Z	2697	0x140037340
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z	2698	0x14002e370
?OnEvent@Expando@DirectUI@@UEAAXPEAUEvent@2@@Z	2699	0x140020864
?OnEvent@HWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z	2700	0x14001d504
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z	2701	0x14002ab88
?OnEvent@Movie@DirectUI@@UEAAXPEAUEvent@2@@Z	2702	0x14003afa8
?OnEvent@Navigator@DirectUI@@UEAAXPEAUEvent@2@@Z	2703	0x1400053d8
?OnEvent@RichText@DirectUI@@UEAAXPEAUEvent@2@@Z	2704	0x14002acb8
?OnEvent@ScrollBar@DirectUI@@UEAAXPEAUEvent@2@@Z	2705	0x14001177c
?OnEvent@Selector@DirectUI@@UEAAXPEAUEvent@2@@Z	2706	0x140018240
?OnEvent@SelectorNoDefault@DirectUI@@UEAAXPEAUEvent@2@@Z	2707	0x14003ee80
?OnEvent@TouchButton@DirectUI@@UEAAXPEAUEvent@2@@Z	2708	0x14003f508
?OnEvent@TouchCheckBox@DirectUI@@UEAAXPEAUEvent@2@@Z	2709	0x14000e730
?OnEvent@TouchEdit2@DirectUI@@UEAAXPEAUEvent@2@@Z	2710	0x14002a3a0
?OnEvent@TouchHWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z	2711	0x14003d20c
?OnEvent@TouchScrollBar@DirectUI@@UEAAXPEAUEvent@2@@Z	2712	0x140034fc0
?OnEvent@TouchSelect@DirectUI@@UEAAXPEAUEvent@2@@Z	2713	0x14002c4b0
?OnEvent@Viewer@DirectUI@@UEAAXPEAUEvent@2@@Z	2714	0x140004d9c
?OnEvent@XBaby@DirectUI@@UEAAXPEAUEvent@2@@Z	2715	0x14001ec20
?OnEvent@XElement@DirectUI@@UEAAXPEAUEvent@2@@Z	2716	0x1400234b0
?OnGetDlgCode@DialogElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z	2717	0x14003cf58
?OnGetDlgCode@DialogElementCore@DirectUI@@QEAAXPEAUtagMSG@@PEA_J@Z	2718	0x14001b5a8
?OnGetDlgCode@HWNDElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z	2719	0x14001e4cc
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z	2720	0x140001bb8
?OnGroupChanged@HWNDElement@DirectUI@@UEAAXH_N@Z	2721	0x14000bbf8
?OnHosted@Combobox@DirectUI@@UEAAXPEAVElement@2@@Z	2722	0x1400065d0
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z	2723	0x140031874
?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z	2724	0x1400088f8
?OnHosted@ModernProgressBar@DirectUI@@MEAAXPEAVElement@2@@Z	2725	0x1400307d0
?OnHosted@ModernProgressRing@DirectUI@@MEAAXPEAVElement@2@@Z	2726	0x140019a7c
?OnHosted@Movie@DirectUI@@UEAAXPEAVElement@2@@Z	2727	0x1400094bc
?OnHosted@PushButton@DirectUI@@UEAAXPEAVElement@2@@Z	2728	0x1400059ec
?OnHosted@RichText@DirectUI@@UEAAXPEAVElement@2@@Z	2729	0x140013940
?OnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z	2730	0x140018f44
?OnHosted@TouchEdit2@DirectUI@@UEAAXPEAVElement@2@@Z	2731	0x1400111ec
?OnHosted@TouchScrollBar@DirectUI@@UEAAXPEAVElement@2@@Z	2732	0x140002b98
?OnHosted@TouchSelect@DirectUI@@UEAAXPEAVElement@2@@Z	2733	0x140023e70
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UEAAXXZ	2734	0x140028bb4
?OnInput@BaseScrollViewer@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2735	0x140014038
?OnInput@Button@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2736	0x140016cb0
?OnInput@CCBase@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2737	0x140001c2c
?OnInput@CCCheckBox@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2738	0x14000bcac
?OnInput@CCProgressBar@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2739	0x140040ba4
?OnInput@CCPushButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2740	0x14000bc20
?OnInput@CCRadioButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2741	0x140011498
?OnInput@CCSysLink@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2742	0x1400244a8
?OnInput@Combobox@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2743	0x140015a68
?OnInput@DialogElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2744	0x140017e94
?OnInput@DialogElementCore@DirectUI@@QEAAXPEAUInputEvent@2@@Z	2745	0x14002ef30
?OnInput@Edit@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2746	0x140009b1c
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2747	0x140007ea8
?OnInput@HWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2748	0x140016be4
?OnInput@HWNDHost@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2749	0x14003e088
?OnInput@RepeatButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2750	0x140006a50
?OnInput@Selector@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2751	0x140032728
?OnInput@Thumb@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2752	0x140034280
?OnInput@TouchButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2753	0x140038e7c
?OnInput@TouchEdit2@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2754	0x140034ee4
?OnInput@TouchHWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2755	0x140028b54
?OnInput@TouchScrollBar@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2756	0x140024664
?OnInput@TouchSelect@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2757	0x140036700
?OnInput@Viewer@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2758	0x140019d74
?OnInput@XElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2759	0x1400120bc
?OnInvoke@InvokeHelper@DirectUI@@AEAAXPEAUInvokeArgs@12@@Z	2760	0x14000a660
?OnInvoke@Proxy@DirectUI@@MEAAXIPEAX@Z	2761	0x1400415c4
?OnKeyFocusMoved@DialogElement@DirectUI@@UEAAXPEAVElement@2@0@Z	2762	0x140028054
?OnKeyFocusMoved@DialogElementCore@DirectUI@@QEAAXPEAVElement@2@0@Z	2763	0x14001fae8
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z	2764	0x140027fb8
?OnKeyFocusMoved@Selector@DirectUI@@UEAAXPEAVElement@2@0@Z	2765	0x1400018a0
?OnKeyFocusMoved@SelectorNoDefault@DirectUI@@UEAAXPEAVElement@2@0@Z	2766	0x14002727c
?OnKeyFocusMoved@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@0@Z	2767	0x140016930
?OnKillActive@TaskPage@DirectUI@@MEAA_JXZ	2768	0x14000b364
?OnLayoutPosChanged@BorderLayout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2769	0x140037fcc
?OnLayoutPosChanged@Layout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2770	0x14001dcf0
?OnLayoutPosChanged@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2771	0x1400384c0
?OnLayoutPosChanged@ShellBorderLayout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2772	0x14000baa0
?OnListenedEvent@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEAUEvent@2@@Z	2773	0x140006ce0
?OnListenedEvent@DialogElement@DirectUI@@UEAAXPEAVElement@2@PEAUEvent@2@@Z	2774	0x14003d7d8
?OnListenedEvent@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEAUEvent@2@@Z	2775	0x1400240b4
?OnListenedInput@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEAUInputEvent@2@@Z	2776	0x140004154
?OnListenedInput@DialogElement@DirectUI@@UEAAXPEAVElement@2@PEAUInputEvent@2@@Z	2777	0x14001398c
?OnListenedInput@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEAUInputEvent@2@@Z	2778	0x1400054a8
?OnListenedPropertyChanged@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2779	0x140025a88
?OnListenedPropertyChanged@DialogElement@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2780	0x14000d0d4
?OnListenedPropertyChanged@ScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2781	0x14001a368
?OnListenedPropertyChanged@StyledScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2782	0x14002cfe8
?OnListenedPropertyChanged@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2783	0x14003d834
?OnListenedPropertyChanged@TouchEdit2@DirectUI@@EEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2784	0x1400253a8
?OnListenedPropertyChanging@BaseScrollViewer@DirectUI@@UEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2785	0x14000271c
?OnListenedPropertyChanging@DialogElement@DirectUI@@UEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2786	0x1400203e4
?OnListenedPropertyChanging@TaskPage@DirectUI@@MEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2787	0x14002d094
?OnListenerAttach@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@@Z	2788	0x14002e064
?OnListenerAttach@DialogElement@DirectUI@@UEAAXPEAVElement@2@@Z	2789	0x140041640
?OnListenerAttach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z	2790	0x14002dbd8
?OnListenerDetach@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@@Z	2791	0x140020770
?OnListenerDetach@DialogElement@DirectUI@@UEAAXPEAVElement@2@@Z	2792	0x140026f64
?OnListenerDetach@DialogElementCore@DirectUI@@QEAAXPEAVElement@2@@Z	2793	0x140007a1c
?OnListenerDetach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z	2794	0x14002e4cc
?OnListenerDetach@TouchEdit2@DirectUI@@EEAAXPEAVElement@2@@Z	2795	0x1400171e8
?OnLostDialogFocus@Button@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2796	0x14002f27c
?OnLostDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2797	0x14003e0e0
?OnLostDialogFocus@CCBaseCheckRadioButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2798	0x14003ab38
?OnLostDialogFocus@CCPushButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2799	0x140026584
?OnLostDialogFocus@CCSysLink@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2800	0x140001024
?OnLostDialogFocus@CheckBoxGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2801	0x14002767c
?OnLostDialogFocus@ExpandoButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2802	0x1400116dc
?OnLostDialogFocus@RadioButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2803	0x14002fb80
?OnMaximumChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2804	0x14002bd78
?OnMessage@CCBaseScrollBar@DirectUI@@UEAA_NI_K_JPEA_J@Z	2805	0x140018f80
?OnMessage@CCPushButton@DirectUI@@UEAA_NI_K_JPEA_J@Z	2806	0x1400107dc
?OnMessage@CCTrackBar@DirectUI@@UEAA_NI_K_JPEA_J@Z	2807	0x1400137d0
?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2808	0x14002e900
?OnMessage@NativeHWNDHost@DirectUI@@UEAAJI_K_JPEA_J@Z	2809	0x14001ac34
?OnMessage@TaskPage@DirectUI@@MEAA_NI_K_JPEA_J@Z	2810	0x14003e664
?OnMessage@XElement@DirectUI@@UEAA_NI_K_JPEA_J@Z	2811	0x14003a16c
?OnMinimumChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2812	0x140004aac
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z	2813	0x140031fb4
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z	2814	0x140005128
?OnNoChildWithShortcutFound@XBaby@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z	2815	0x140035e0c
?OnNotify@CCBase@DirectUI@@UEAA_NI_K_JPEA_J@Z	2816	0x1400017ac
?OnNotify@CCCheckBox@DirectUI@@UEAA_NI_K_JPEA_J@Z	2817	0x14002ea80
?OnNotify@CCPushButton@DirectUI@@UEAA_NI_K_JPEA_J@Z	2818	0x140004590
?OnNotify@CCRadioButton@DirectUI@@UEAA_NI_K_JPEA_J@Z	2819	0x140037140
?OnNotify@CCTreeView@DirectUI@@UEAA_NI_K_JPEA_J@Z	2820	0x140029e64
?OnNotify@Combobox@DirectUI@@UEAA_NI_K_JPEA_J@Z	2821	0x14002009c
?OnNotify@Edit@DirectUI@@UEAA_NI_K_JPEA_J@Z	2822	0x140015714
?OnNotify@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2823	0x14003c658
?OnPageChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2824	0x1400016c8
?OnPageChanging@BaseScrollBar@DirectUI@@QEAA_NPEAVValue@2@@Z	2825	0x140012cb0
?OnPositionChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2826	0x140015350
?OnPositionChanging@BaseScrollBar@DirectUI@@QEAA_NPEAVValue@2@@Z	2827	0x140036000
?OnPropertyChanged@AccessibleButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2828	0x140026f0c
?OnPropertyChanged@AnimationStrip@DirectUI@@MEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2829	0x1400159c4
?OnPropertyChanged@BaseScrollViewer@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2830	0x14003b1a8
?OnPropertyChanged@Browser@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2831	0x14000b78c
?OnPropertyChanged@Button@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2832	0x140015830
?OnPropertyChanged@CCBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2833	0x14000eeb8
?OnPropertyChanged@CCBaseCheckRadioButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2834	0x14002df18
?OnPropertyChanged@CCBaseScrollBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2835	0x140011e54
?OnPropertyChanged@CCCommandLink@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2836	0x14001ef8c
?OnPropertyChanged@CCPushButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2837	0x14000341c
?OnPropertyChanged@CCTrackBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2838	0x14000b238
?OnPropertyChanged@Combobox@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2839	0x14000ea64
?OnPropertyChanged@DialogElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2840	0x140022b70
?OnPropertyChanged@Edit@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2841	0x140028158
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z	2842	0x14000fadc
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2843	0x140029ed0
?OnPropertyChanged@Expando@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2844	0x14002436c
?OnPropertyChanged@HWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2845	0x14002c148
?OnPropertyChanged@HWNDHost@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2846	0x140039e60
?OnPropertyChanged@ItemList@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2847	0x140010178
?OnPropertyChanged@Macro@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2848	0x1400268d8
?OnPropertyChanged@ModernProgressBar@DirectUI@@MEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2849	0x1400317d0
?OnPropertyChanged@ModernProgressRing@DirectUI@@MEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2850	0x14001e744
?OnPropertyChanged@RefPointElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2851	0x1400123f0
?OnPropertyChanged@RichText@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2852	0x1400241a8
?OnPropertyChanged@ScrollBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2853	0x14001c5d8
?OnPropertyChanged@ScrollViewer@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2854	0x14002e4e0
?OnPropertyChanged@Selector@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2855	0x140014734
?OnPropertyChanged@TextGraphic@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2856	0x14000b4bc
?OnPropertyChanged@TouchButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2857	0x14000686c
?OnPropertyChanged@TouchCheckBox@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2858	0x14001cf00
?OnPropertyChanged@TouchCommandButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2859	0x140010214
?OnPropertyChanged@TouchEdit2@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2860	0x1400372c4
?OnPropertyChanged@TouchEditBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2861	0x14003ebf0
?OnPropertyChanged@TouchHWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2862	0x1400139a8
?OnPropertyChanged@TouchHyperLink@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2863	0x140023224
?OnPropertyChanged@TouchRepeatButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2864	0x14000f490
?OnPropertyChanged@TouchScrollBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2865	0x140023c48
?OnPropertyChanged@TouchSelect@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2866	0x140017c24
?OnPropertyChanged@Viewer@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2867	0x140039d38
?OnPropertyChanging@BaseScrollViewer@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2868	0x140026db8
?OnPropertyChanging@CCBaseScrollBar@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2869	0x14001a0c8
?OnPropertyChanging@CCTrackBar@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2870	0x1400102a4
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z	2871	0x140019b04
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2872	0x14000cabc
?OnPropertyChanging@PText@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2873	0x140038088
?OnPropertyChanging@ScrollBar@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2874	0x140039808
?OnPropertyChanging@TextGraphic@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2875	0x1400080f0
?OnPropertyChanging@TouchCheckBox@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2876	0x140025cc0
?OnPropertyChanging@TouchCheckBoxGlyph@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2877	0x14002bda8
?OnPropertyChanging@TouchCommandButton@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2878	0x14000a680
?OnPropertyChanging@TouchEdit2@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2879	0x14001caac
?OnPropertyChanging@TouchEditBase@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2880	0x1400126bc
?OnPropertyChanging@TouchSelect@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2881	0x14002ad1c
?OnPropertyChanging@Viewer@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2882	0x140019780
?OnQueryCancel@TaskPage@DirectUI@@MEAA_JXZ	2883	0x14003f850
?OnQueryInitialFocus@TaskPage@DirectUI@@MEAAPEAVElement@2@XZ	2884	0x14000e010
?OnReceivedDialogFocus@Button@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2885	0x140022170
?OnReceivedDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2886	0x140016c14
?OnReceivedDialogFocus@CCBaseCheckRadioButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2887	0x1400054ec
?OnReceivedDialogFocus@CCPushButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2888	0x1400012e8
?OnReceivedDialogFocus@CCSysLink@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2889	0x14002cd1c
?OnReceivedDialogFocus@CheckBoxGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2890	0x140001914
?OnReceivedDialogFocus@ExpandoButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2891	0x140035160
?OnReceivedDialogFocus@RadioButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2892	0x1400062a0
?OnRegisteredDefaultButtonChanged@DialogElementCore@DirectUI@@QEAAXPEAVValue@2@0@Z	2893	0x14003ee80
?OnRemove@BorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2894	0x14003e2bc
?OnRemove@Layout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2895	0x140023958
?OnRemove@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2896	0x1400141c4
?OnRemove@ShellBorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2897	0x1400073e8
?OnReset@TaskPage@DirectUI@@MEAA_JXZ	2898	0x14002a65c
?OnSelectedPropertyChanged@CCCommandLink@DirectUI@@UEAAXXZ	2899	0x14003e624
?OnSelectedPropertyChanged@CCPushButton@DirectUI@@UEAAXXZ	2900	0x14000c1e8
?OnSetActive@TaskPage@DirectUI@@MEAA_JXZ	2901	0x1400010b4
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2902	0x1400068c4
?OnSinkThemeChanged@XElement@DirectUI@@UEAA_NI_K_JPEA_J@Z	2903	0x1400011f4
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z	2904	0x140001e40
?OnSysChar@XElement@DirectUI@@UEAA_NG@Z	2905	0x140034990
?OnTextProp@TouchSwitch@DirectUI@@SAPEBUPropertyInfo@2@XZ	2906	0x140022288
?OnThemeChanged@HWNDElement@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z	2907	0x140039b74
?OnThemeChanged@XBaby@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z	2908	0x140029e78
?OnToolTip@EventManager@DirectUI@@SAJPEAVElement@2@K@Z	2909	0x140001bd4
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z	2910	0x140030078
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z	2911	0x14003a4d4
?OnUnHosted@ModernProgressBar@DirectUI@@MEAAXPEAVElement@2@@Z	2912	0x14000c96c
?OnUnHosted@ModernProgressRing@DirectUI@@MEAAXPEAVElement@2@@Z	2913	0x140035380
?OnUnHosted@PushButton@DirectUI@@UEAAXPEAVElement@2@@Z	2914	0x14000dcec
?OnUnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z	2915	0x14001a2dc
?OnUnHosted@TouchSelect@DirectUI@@UEAAXPEAVElement@2@@Z	2916	0x140033e40
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z	2917	0x1400262cc
?OnWizBack@TaskPage@DirectUI@@MEAA_JXZ	2918	0x140037f7c
?OnWizFinish@TaskPage@DirectUI@@MEAA_JXZ	2919	0x14003ab40
?OnWizNext@TaskPage@DirectUI@@MEAA_JXZ	2920	0x140034df8
?OnWmSettingChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z	2921	0x140009bd0
?OnWmThemeChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z	2922	0x14003fafc
?OnWmThemeChanged@XBaby@DirectUI@@UEAAX_K_J@Z	2923	0x14003f0e0
?OnWndMsg@TaskPage@DirectUI@@AEAAHI_K_JPEA_J@Z	2924	0x1400043b8
?OpenAnimation@CCAVI@DirectUI@@AEAAXPEAUHWND__@@@Z	2925	0x140026264
?OpenPopup@TouchSelect@DirectUI@@QEAAJXZ	2926	0x1400105cc
?OptimizeMoveProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	2927	0x140030e78
?OrderProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2928	0x1400042a8
?Orientation@Schema@DirectUI@@2HA	2929	0x140013290
?OverhangOffsetProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2930	0x140010520
?OverhangProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2931	0x14000eabc
?OverrideButtonBackgroundProp@CCPushButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2932	0x14001a444
?OverrideZoomThreshold@TouchScrollViewer@DirectUI@@QEAAJMMH@Z	2933	0x14001f5ec
?PaddingProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2934	0x1400327d0
?PageDown@BaseScrollBar@DirectUI@@UEAAXI@Z	2935	0x140003dec
?PageDown@TouchScrollBar@DirectUI@@UEAAXI@Z	2936	0x140033020
?PageProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2937	0x1400031fc
?PageProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2938	0x140008db8
?PageUp@BaseScrollBar@DirectUI@@UEAAXI@Z	2939	0x14002131c
?PageUp@TouchScrollBar@DirectUI@@UEAAXI@Z	2940	0x1400132d0
?Paint@AnimationStrip@DirectUI@@MEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2941	0x14001d1e0
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2942	0x14000dd58
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2943	0x1400319a8
?Paint@ModernProgressBar@DirectUI@@MEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2944	0x140005b3c
?Paint@ModernProgressRing@DirectUI@@MEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2945	0x14000dc78
?Paint@Movie@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2946	0x140009d1c
?Paint@Progress@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2947	0x14001ccc4
?Paint@RichText@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2948	0x140029114
?Paint@TouchCheckBox@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2949	0x14003559c
?Paint@TouchCheckBoxGlyph@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2950	0x140017568
?Paint@TouchCommandButton@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2951	0x140018a2c
?Paint@TouchEdit2@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2952	0x140023f18
?PaintBackground@Element@DirectUI@@QEAAXPEAUHDC__@@PEAVValue@2@AEBUtagRECT@@222@Z	2953	0x14000d9a0
?PaintBorder@Element@DirectUI@@QEAAXPEAUHDC__@@PEAVValue@2@PEAUtagRECT@@AEBU5@@Z	2954	0x140029d84
?PaintContent@Element@DirectUI@@QEAAXPEAUHDC__@@PEBUtagRECT@@@Z	2955	0x140036230
?PaintEdgeHighlight@Element@DirectUI@@QEAAXPEAUHDC__@@AEBUtagRECT@@1@Z	2956	0x14002c06c
?PaintFocusRect@Element@DirectUI@@QEAAXPEAUHDC__@@PEBUtagRECT@@1@Z	2957	0x140013690
?PaintStringContent@Element@DirectUI@@QEAAXPEAUHDC__@@PEBUtagRECT@@PEAVValue@2@H@Z	2958	0x14000cdfc
?PaneControlType@Schema@DirectUI@@2HA	2959	0x14000a3f4
?ParentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2960	0x14001ad70
?ParseARGBColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAKPEA_N@Z	2961	0x140002e30
?ParseArgs@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEATParsedArg@12@IPEBD@Z	2962	0x14002ce54
?ParseAtomValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2963	0x1400352c8
?ParseBehavior@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@@Z	2964	0x14000d1e8
?ParseBehaviorArgValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2965	0x14002854c
?ParseBoolValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2966	0x140002768
?ParseColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAK@Z	2967	0x14000e348
?ParseDFCFill@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2968	0x1400279c4
?ParseDTBFill@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2969	0x14003b390
?ParseDoubleListValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2970	0x140035208
?ParseFillValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2971	0x14002a6e4
?ParseFloat@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAMPEA_N@Z	2972	0x140033f74
?ParseFloatValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2973	0x140011648
?ParseFunction@DUIXmlParser@DirectUI@@IEAAJPEBGPEBUExprNode@ParserTools@2@PEATParsedArg@12@IPEBD@Z	2974	0x140019cec
?ParseGTCColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAKPEA_N@Z	2975	0x14002f6c0
?ParseGTFStr@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2976	0x14001bf8c
?ParseGTMarRect@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledRECT@2@PEA_N@Z	2977	0x14003a400
?ParseGTMetInt@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAHPEA_N@Z	2978	0x140013914
?ParseGTPartSize@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledSIZE@2@PEA_N@Z	2979	0x14001b028
?ParseGradientFill@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2980	0x14002d2d0
?ParseGraphicGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2981	0x14001bad8
?ParseGraphicHelper@DUIXmlParser@DirectUI@@IEAAJ_NPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2982	0x14001b9d4
?ParseGraphicValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2983	0x140030824
?ParseIconGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2984	0x1400176e0
?ParseImageGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2985	0x14001722c
?ParseIntValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2986	0x140009378
?ParseLayoutValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@@Z	2987	0x14002a9d8
?ParseLibrary@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAUHINSTANCE__@@@Z	2988	0x140040be0
?ParseLiteral@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEBG@Z	2989	0x140020ff4
?ParseLiteralColor@DUIXmlParser@DirectUI@@IEAAJPEBGPEAK@Z	2990	0x140015178
?ParseLiteralColorInt@DUIXmlParser@DirectUI@@IEAAJPEBGPEAH@Z	2991	0x14003befc
?ParseLiteralNumber@DUIXmlParser@DirectUI@@IEAAJPEBGPEAHPEA_N@Z	2992	0x140010248
?ParseMagnitude@DUIXmlParser@DirectUI@@IEAAJPEBGPEAHPEA_N@Z	2993	0x140010414
?ParseMagnitudeFloat@DUIXmlParser@DirectUI@@IEAAJPEBGPEAMPEA_N@Z	2994	0x140002358
?ParseNumber@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAHPEA_N@Z	2995	0x140006420
?ParsePointValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2996	0x140035b54
?ParseQuotedString@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEBG@Z	2997	0x14003152c
?ParseRGBColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAKPEA_N@Z	2998	0x140005614
?ParseRect@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledRECT@2@@Z	2999	0x14001050c
?ParseRectRect@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledRECT@2@PEA_N@Z	3000	0x140018f0c
?ParseRectValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3001	0x1400414b0
?ParseResStr@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	3002	0x14001c328
?ParseResid@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEBG@Z	3003	0x14000fb04
?ParseSGraphicGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	3004	0x14003d9ac
?ParseSGraphicHelper@DUIXmlParser@DirectUI@@IEAAJ_NPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3005	0x14002ae58
?ParseSize@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledSIZE@2@@Z	3006	0x14000d224
?ParseSizeSize@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledSIZE@2@PEA_N@Z	3007	0x1400222ec
?ParseSizeValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3008	0x14003944c
?ParseStringValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3009	0x140016414
?ParseStyleSheets@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	3010	0x140001860
?ParseSysMetricInt@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAHPEA_N@Z	3011	0x140013808
?ParseSysMetricStr@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	3012	0x14002ac50
?ParseTheme@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@_NPEAPEAX@Z	3013	0x14002e7a8
?PasswordCharacterProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	3014	0x14000369c
?PasswordCharacterProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3015	0x140027100
?PasswordRevealModeProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3016	0x1400091c4
?Paste@TouchEditBase@DirectUI@@SA?AVUID@@XZ	3017	0x140033660
?PasteText@TouchEdit2@DirectUI@@QEAAJPEBG@Z	3018	0x1400208e0
?PathProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3019	0x14001951c
?PatternFromPatternId@Schema@DirectUI@@SA?AW4Pattern@12@H@Z	3020	0x140027bbc
?Pause@Movie@DirectUI@@QEAAXXZ	3021	0x140010808
?PfnIsSupportedFromPattern@Schema@DirectUI@@SAP6A_NPEAVElement@2@@ZW4Pattern@12@@Z	3022	0x140008658
?PinningProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3023	0x140041614
?PixelOffsetModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3024	0x140034b30
?Play@CCAVI@DirectUI@@QEAAXPEAUHWND__@@@Z	3025	0x14002e664
?Play@Movie@DirectUI@@QEAAXXZ	3026	0x140006d1c
?PlayAllFramesModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3027	0x14000bce4
?PlayProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	3028	0x14000c824
?PopupBoundsProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	3029	0x140038874
?PopupChange@TouchSelect@DirectUI@@SA?AVUID@@XZ	3030	0x140026780
?PosInLayoutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3031	0x140005454
?PositionProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3032	0x140034438
?PositionProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3033	0x1400049fc
?PositionProp@Progress@DirectUI@@SAPEBUPropertyInfo@2@XZ	3034	0x1400164b0
?PositionProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3035	0x14001587c
?PostCreate@CCAVI@DirectUI@@MEAAXPEAUHWND__@@@Z	3036	0x1400015a4
?PostCreate@CCBase@DirectUI@@MEAAXPEAUHWND__@@@Z	3037	0x14001bb00
?PostCreate@CCBaseCheckRadioButton@DirectUI@@MEAAXPEAUHWND__@@@Z	3038	0x1400244c4
?PostCreate@CCCommandLink@DirectUI@@MEAAXPEAUHWND__@@@Z	3039	0x1400263d0
?PostCreate@CCTrackBar@DirectUI@@MEAAXPEAUHWND__@@@Z	3040	0x1400358e4
?PrepareManualSwapDeferredZoomToRect@TouchScrollViewer@DirectUI@@QEAAJPEBUtagRECT@@PEBM1PEAM2M@Z	3041	0x140011cd4
?PressedProp@Button@DirectUI@@SAPEBUPropertyInfo@2@XZ	3042	0x14003d424
?PressedProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3043	0x14001b63c
?PreventFormatChangeUpdatingModifiedStateProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3044	0x1400102f0
?PrintRTLControl@HWNDHost@DirectUI@@IEAAXPEAUHDC__@@0AEBUtagRECT@@@Z	3045	0x1400264a8
?ProcessIdProperty@Schema@DirectUI@@2HA	3046	0x1400116e4
?ProcessingKeyboardNavigation@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3047	0x14000d0cc
?ProgressBarControlType@Schema@DirectUI@@2HA	3048	0x140036730
?PromptTextProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3049	0x1400088f8
?PromptWithCaretProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3050	0x140012244
?PropSheet_SendMessage@TaskPage@DirectUI@@IEAA_JI_K_J@Z	3051	0x140004dbc
?PropertyChangedCore@Edit@DirectUI@@AEAAXPEBUPropertyInfo@2@HPEAVValue@2@PEAUHWND__@@@Z	3052	0x140011ae0
?PropertyChangingListener@EventManager@DirectUI@@SAJPEAVElement@2@PEBUPropertyInfo@2@PEA_N@Z	3053	0x14002dc38
?PropertyListener@EventManager@DirectUI@@SAJPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	3054	0x140003e80
?PropertyProp@Bind@DirectUI@@SAPEBUPropertyInfo@2@XZ	3055	0x14002e32c
?ProportionalProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3056	0x140001f00
?QueryInterface@DuiAccessible@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3057	0x140034c84
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3058	0x14000bbd8
?QueryInterface@ElementProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3059	0x1400241fc
?QueryInterface@ExpandCollapseProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3060	0x140015ec0
?QueryInterface@GridItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3061	0x14002d44c
?QueryInterface@GridProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3062	0x14001fd2c
?QueryInterface@HWNDElementProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3063	0x1400169ac
?QueryInterface@HWNDHostAccessible@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3064	0x14000879c
?QueryInterface@InvokeProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3065	0x1400200bc
?QueryInterface@RangeValueProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3066	0x1400084dc
?QueryInterface@ScrollItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3067	0x140004624
?QueryInterface@ScrollProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3068	0x140016868
?QueryInterface@SelectionItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3069	0x140034d80
?QueryInterface@SelectionProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3070	0x14003008c
?QueryInterface@TableItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3071	0x140023724
?QueryInterface@TableProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3072	0x14002c294
?QueryInterface@ToggleProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3073	0x140007eb8
?QueryInterface@ValueProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3074	0x14002aa58
?QueryInterface@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3075	0x1400110f8
?QueryService@DuiAccessible@DirectUI@@UEAAJAEBU_GUID@@0PEAPEAX@Z	3076	0x14001913c
?QueryService@HWNDHostAccessible@DirectUI@@UEAAJAEBU_GUID@@0PEAPEAX@Z	3077	0x14001d898
?QuerySysMetric@DUIXmlParser@DirectUI@@IEAAHHPEA_N@Z	3078	0x1400151e4
?QuerySysMetricStr@DUIXmlParser@DirectUI@@IEAAPEBGHPEAGI@Z	3079	0x14003d0e8
?QueueDefaultAction@Element@DirectUI@@QEAAJXZ	3080	0x14002b6c0
?RadioButtonControlType@Schema@DirectUI@@2HA	3081	0x140003a74
?RaiseChildRemovedEvent@EventManager@DirectUI@@CAJAEBUElementRuntimeId@2@PEAVElement@2@@Z	3082	0x1400255b4
?RaiseGeometryEventWorker@EventManager@DirectUI@@CAJPEAURectangleChange@2@_N111@Z	3083	0x140026440
?RaiseGeometryEvents@EventManager@DirectUI@@CAJXZ	3084	0x1400091e8
?RaiseStructureChangedEvent@EventManager@DirectUI@@CAJPEAVElement@2@W4StructureChangeType@@@Z	3085	0x14001c0a8
?RaiseStructureEvents@EventManager@DirectUI@@CAJXZ	3086	0x14003ab08
?RaiseVisibilityEvents@EventManager@DirectUI@@CAJXZ	3087	0x140031dcc
?RangeMaxProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3088	0x14001c244
?RangeMinProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3089	0x14003d358
?RangeValuePattern@Schema@DirectUI@@2HA	3090	0x1400101c8
?RangeValue_IsReadOnly_Property@Schema@DirectUI@@2HA	3091	0x140007acc
?RangeValue_LargeChange_Property@Schema@DirectUI@@2HA	3092	0x14001ba24
?RangeValue_Maximum_Property@Schema@DirectUI@@2HA	3093	0x14002ae84
?RangeValue_Minimum_Property@Schema@DirectUI@@2HA	3094	0x14001f7d0
?RangeValue_SmallChange_Property@Schema@DirectUI@@2HA	3095	0x14000a308
?RangeValue_Value_Property@Schema@DirectUI@@2HA	3096	0x14002729c
?RawActionProc@AnimationStrip@DirectUI@@KAXPEAUGMA_ACTIONINFO@@@Z	3097	0x14002c7b0
?RawActionProc@Movie@DirectUI@@SAXPEAUGMA_ACTIONINFO@@@Z	3098	0x14002d294
?ReadOnlyProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3099	0x140005d44
?Recalc@AccessibleButton@DirectUI@@QEAAXXZ	3100	0x140002ca8
?ReferencePointProp@RefPointElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3101	0x140023150
?ReflowStyle@PVLAnimation@DirectUI@@SA?AVUID@@XZ	3102	0x14000db38
?RefreshContent@TouchEdit2@DirectUI@@UEAAJXZ	3103	0x1400380fc
?RefreshContent@TouchEditBase@DirectUI@@UEAAJXZ	3104	0x1400085dc
?Register@AccessibleButton@DirectUI@@SAJXZ	3105	0x140010048
?Register@AnimationStrip@DirectUI@@SAJXZ	3106	0x14001892c
?Register@AutoButton@DirectUI@@SAJXZ	3107	0x140023ad8
?Register@BaseScrollViewer@DirectUI@@SAJXZ	3108	0x14000b0d4
?Register@Bind@DirectUI@@SAJXZ	3109	0x14000667c
?Register@Browser@DirectUI@@SAJXZ	3110	0x14001d954
?Register@Button@DirectUI@@SAJXZ	3111	0x14002e640
?Register@CCAVI@DirectUI@@SAJXZ	3112	0x14003233c
?Register@CCBase@DirectUI@@SAJXZ	3113	0x140006640
?Register@CCBaseCheckRadioButton@DirectUI@@SAJXZ	3114	0x140032b70
?Register@CCBaseScrollBar@DirectUI@@SAJXZ	3115	0x14003afb0
?Register@CCCheckBox@DirectUI@@SAJXZ	3116	0x1400281cc
?Register@CCCommandLink@DirectUI@@SAJXZ	3117	0x14001217c
?Register@CCHScrollBar@DirectUI@@SAJXZ	3118	0x140009f0c
?Register@CCListBox@DirectUI@@SAJXZ	3119	0x14002f048
?Register@CCListView@DirectUI@@SAJXZ	3120	0x140029f54
?Register@CCProgressBar@DirectUI@@SAJXZ	3121	0x14000e184
?Register@CCPushButton@DirectUI@@SAJXZ	3122	0x140017470
?Register@CCRadioButton@DirectUI@@SAJXZ	3123	0x14002d424
?Register@CCSysLink@DirectUI@@SAJXZ	3124	0x140017ca8
?Register@CCTrackBar@DirectUI@@SAJXZ	3125	0x14002bf1c
?Register@CCTreeView@DirectUI@@SAJXZ	3126	0x14003cda0
?Register@CCVScrollBar@DirectUI@@SAJXZ	3127	0x14001f440
?Register@CheckBoxGlyph@DirectUI@@SAJXZ	3128	0x1400055d4
?Register@ClassInfoBase@DirectUI@@QEAAJXZ	3129	0x140011470
?Register@Clipper@DirectUI@@SAJXZ	3130	0x14001d474
?Register@Combobox@DirectUI@@SAJXZ	3131	0x140018f8c
?Register@DialogElement@DirectUI@@SAJXZ	3132	0x14003281c
?Register@Edit@DirectUI@@SAJXZ	3133	0x14003e884
?Register@Element@DirectUI@@SAJXZ	3134	0x14000f6c8
?Register@ElementWithHWND@DirectUI@@SAJXZ	3135	0x1400168a4
?Register@Expandable@DirectUI@@SAJXZ	3136	0x140014f1c
?Register@Expando@DirectUI@@SAJXZ	3137	0x14003a7cc
?Register@ExpandoButtonGlyph@DirectUI@@SAJXZ	3138	0x14000d6a0
?Register@HWNDElement@DirectUI@@SAJXZ	3139	0x14003824c
?Register@HWNDHost@DirectUI@@SAJXZ	3140	0x14000e124
?Register@ItemList@DirectUI@@SAJXZ	3141	0x1400393bc
?Register@Macro@DirectUI@@SAJXZ	3142	0x14003bac0
?Register@ModernProgressBar@DirectUI@@SAJXZ	3143	0x140005be8
?Register@ModernProgressRing@DirectUI@@SAJXZ	3144	0x14003b324
?Register@Movie@DirectUI@@SAJXZ	3145	0x14001ba54
?Register@Navigator@DirectUI@@SAJXZ	3146	0x14002b228
?Register@PText@DirectUI@@SAJXZ	3147	0x140034f90
?Register@Page@DirectUI@@SAJXZ	3148	0x14001c1b0
?Register@Pages@DirectUI@@SAJXZ	3149	0x14000ff68
?Register@Progress@DirectUI@@SAJXZ	3150	0x14003f604
?Register@PushButton@DirectUI@@SAJXZ	3151	0x14003906c
?Register@RadioButtonGlyph@DirectUI@@SAJXZ	3152	0x140035264
?Register@RefPointElement@DirectUI@@SAJXZ	3153	0x14002ee10
?Register@RepeatButton@DirectUI@@SAJXZ	3154	0x1400382bc
?Register@Repeater@DirectUI@@SAJXZ	3155	0x14002acf4
?Register@RichText@DirectUI@@SAJXZ	3156	0x140041680
?Register@ScrollBar@DirectUI@@SAJXZ	3157	0x140004f6c
?Register@ScrollViewer@DirectUI@@SAJXZ	3158	0x14000cc70
?Register@Selector@DirectUI@@SAJXZ	3159	0x14000f814
?Register@SelectorNoDefault@DirectUI@@SAJXZ	3160	0x14000903c
?Register@SemanticZoomToggle@DirectUI@@SAJXZ	3161	0x140026c94
?Register@StyledScrollViewer@DirectUI@@SAJXZ	3162	0x1400413e8
?Register@TextGraphic@DirectUI@@SAJXZ	3163	0x140008278
?Register@Thumb@DirectUI@@SAJXZ	3164	0x14002c3a0
?Register@TouchButton@DirectUI@@SAJXZ	3165	0x140013818
?Register@TouchCheckBox@DirectUI@@SAJXZ	3166	0x1400332e8
?Register@TouchCheckBoxGlyph@DirectUI@@SAJXZ	3167	0x14000b684
?Register@TouchCommandButton@DirectUI@@SAJXZ	3168	0x140025890
?Register@TouchEdit2@DirectUI@@SAJXZ	3169	0x14003a51c
?Register@TouchEditBase@DirectUI@@SAJXZ	3170	0x14001169c
?Register@TouchHWNDElement@DirectUI@@SAJXZ	3171	0x140019d68
?Register@TouchHyperLink@DirectUI@@SAJXZ	3172	0x140005ffc
?Register@TouchRepeatButton@DirectUI@@SAJXZ	3173	0x140008044
?Register@TouchScrollBar@DirectUI@@SAJXZ	3174	0x14001f894
?Register@TouchSelect@DirectUI@@SAJXZ	3175	0x140010ff4
?Register@TouchSelectItem@DirectUI@@SAJXZ	3176	0x140012e34
?Register@TouchSlider@DirectUI@@SAJXZ	3177	0x140039aac
?Register@TouchSwitch@DirectUI@@SAJXZ	3178	0x14001ec08
?Register@UnknownElement@DirectUI@@SAJXZ	3179	0x14003b69c
?Register@Viewer@DirectUI@@SAJXZ	3180	0x14001e80c
?Register@XBaby@DirectUI@@SAJXZ	3181	0x14001f9cc
?Register@XElement@DirectUI@@SAJXZ	3182	0x14001f01c
?RegisterForAnimationStatusChanges@TouchHWNDElement@DirectUI@@QEAAXXZ	3183	0x140037408
?RegisterForIHMChanges@TouchHWNDElement@DirectUI@@QEAAJXZ	3184	0x14000c7e8
?RegisterForMonitorPowerChanges@TouchHWNDElement@DirectUI@@QEAAJXZ	3185	0x14004165c
?RegisteredDefaultButtonProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3186	0x1400244a4
?Release@ClassInfoBase@DirectUI@@UEAAHXZ	3187	0x14003d674
?Release@DuiAccessible@DirectUI@@UEAAKXZ	3188	0x1400215f0
?Release@Element@DirectUI@@QEAAKXZ	3189	0x1400096c8
?Release@ElementProvider@DirectUI@@UEAAKXZ	3190	0x1400278e8
?Release@ExpandCollapseProvider@DirectUI@@UEAAKXZ	3191	0x140041058
?Release@GridItemProvider@DirectUI@@UEAAKXZ	3192	0x1400108f4
?Release@GridProvider@DirectUI@@UEAAKXZ	3193	0x140027a74
?Release@HWNDElementProvider@DirectUI@@UEAAKXZ	3194	0x1400344bc
?Release@InvokeProvider@DirectUI@@UEAAKXZ	3195	0x140003770
?Release@RangeValueProvider@DirectUI@@UEAAKXZ	3196	0x14003cf04
?Release@RefcountBase@DirectUI@@QEAAJXZ	3197	0x14001a58c
?Release@ScrollItemProvider@DirectUI@@UEAAKXZ	3198	0x14000fefc
?Release@ScrollProvider@DirectUI@@UEAAKXZ	3199	0x140001620
?Release@SelectionItemProvider@DirectUI@@UEAAKXZ	3200	0x1400030e8
?Release@SelectionProvider@DirectUI@@UEAAKXZ	3201	0x140035328
?Release@TableItemProvider@DirectUI@@UEAAKXZ	3202	0x1400239b0
?Release@TableProvider@DirectUI@@UEAAKXZ	3203	0x14000d2f0
?Release@ToggleProvider@DirectUI@@UEAAKXZ	3204	0x1400311b0
?Release@Value@DirectUI@@QEAAXXZ	3205	0x140009c78
?Release@ValueProvider@DirectUI@@UEAAKXZ	3206	0x140036420
?Release@XProvider@DirectUI@@UEAAKXZ	3207	0x140011298
?ReleaseSnapshot@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3208	0x140014a98
?ReloadIcon@Value@DirectUI@@CAPEAUHICON__@@PEAUGraphic@2@M@Z	3209	0x14002cab0
?Remove@Element@DirectUI@@QEAAJPEAV12@@Z	3210	0x1400387a4
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z	3211	0x1400058c0
?Remove@ElementProviderManager@DirectUI@@SAXPEAVElementProvider@2@@Z	3212	0x140007f54
?Remove@LinkedList@DirectUI@@QEAAXPEAVLinkedListNode@2@@Z	3213	0x140009dfc
?RemoveAll@Element@DirectUI@@QEAAJXZ	3214	0x140001e20
?RemoveAll@TouchSelect@DirectUI@@QEAAXXZ	3215	0x14002bb5c
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z	3216	0x14003b700
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ	3217	0x14002f560
?RemoveFromSelection@SelectionItemProvider@DirectUI@@UEAAJXZ	3218	0x140035198
?RemoveItem@TouchSelect@DirectUI@@QEAAJH@Z	3219	0x140001a00
?RemoveListener@Element@DirectUI@@QEAAXPEAUIElementListener@2@@Z	3220	0x140024fcc
?RemoveLocalValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZ@Z	3221	0x140011520
?RemoveLocalValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@@Z	3222	0x14004111c
?RemoveRichDuiTooltip@TouchSlider@DirectUI@@QEAAXXZ	3223	0x1400197e8
?RemoveShortcutFromName@Element@DirectUI@@AEAAPEAGPEBG@Z	3224	0x14003dd74
?RemoveTail@LinkedList@DirectUI@@QEAAPEAVLinkedListNode@2@XZ	3225	0x1400133bc
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z	3226	0x1400214b0
?RemoveTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3227	0x140027680
?RemoveTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3228	0x1400260c4
?RepeatClick@TouchRepeatButton@DirectUI@@SA?AVUID@@XZ	3229	0x140034e14
?RepeatProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3230	0x14003b0cc
?Reset@DuiAccessible@DirectUI@@UEAAJXZ	3231	0x14002ba84
?Reset@HWNDHostAccessible@DirectUI@@UEAAJXZ	3232	0x14001ac8c
?ResetInputState@TouchScrollViewer@DirectUI@@QEAAJXZ	3233	0x14000f1e4
?ResetManipulations@TouchScrollViewer@DirectUI@@QEAAJXZ	3234	0x140003edc
?ResolveBindings@Macro@DirectUI@@IEAAXXZ	3235	0x140032c8c
?RestoreFocus@NativeHWNDHost@DirectUI@@QEAAHXZ	3236	0x140009970
?Resume@Movie@DirectUI@@QEAAXXZ	3237	0x14003357c
?ReturnValueParser@DUIXmlParser@DirectUI@@IEAAXPEAVValueParser@ParserTools@2@@Z	3238	0x1400367d0
?Rewind@Movie@DirectUI@@QEAAXXZ	3239	0x140006a6c
?RichTooltipShowing@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3240	0x14002cfc4
?RightClick@TouchButton@DirectUI@@SA?AVUID@@XZ	3241	0x14003d2a8
?RuntimeIdProperty@Schema@DirectUI@@2HA	3242	0x14000150c
?STACKDEPTH@CallstackTracker@DirectUI@@0HB	3243	0x14003c6dc
?SaveFocus@NativeHWNDHost@DirectUI@@QEAAXXZ	3244	0x14003fe4c
?ScaleChanged@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3245	0x140010d38
?ScaleFactorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3246	0x14003d814
?Scroll@BaseScrollBar@DirectUI@@SA?AVUID@@XZ	3247	0x14000e658
?Scroll@ScrollProvider@DirectUI@@UEAAJW4ScrollAmount@@0@Z	3248	0x1400058a0
?Scroll@ScrollProxy@DirectUI@@AEAAJW4ScrollAmount@@0@Z	3249	0x140027310
?ScrollBarControlType@Schema@DirectUI@@2HA	3250	0x140028108
?ScrollIntoView@ScrollItemProvider@DirectUI@@UEAAJXZ	3251	0x140007cfc
?ScrollItemPattern@Schema@DirectUI@@2HA	3252	0x140008b6c
?ScrollLine@ScrollProxy@DirectUI@@AEAAJ_N0@Z	3253	0x140007004
?ScrollPaddingProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3254	0x14003efe8
?ScrollPage@ScrollProxy@DirectUI@@AEAAJ_N0@Z	3255	0x14002c62c
?ScrollPattern@Schema@DirectUI@@2HA	3256	0x140039838
?ScrollToHorizontalPosition@ScrollProxy@DirectUI@@AEAAJH_N@Z	3257	0x14000c568
?ScrollToVerticalPosition@ScrollProxy@DirectUI@@AEAAJH_N@Z	3258	0x14002cfb8
?Scroll_HorizontalScrollPercent_Property@Schema@DirectUI@@2HA	3259	0x14001aa30
?Scroll_HorizontalViewSize_Property@Schema@DirectUI@@2HA	3260	0x140032dbc
?Scroll_HorizontallyScrollable_Property@Schema@DirectUI@@2HA	3261	0x1400214e0
?Scroll_VerticalScrollPercent_Property@Schema@DirectUI@@2HA	3262	0x14003e1f4
?Scroll_VerticalViewSize_Property@Schema@DirectUI@@2HA	3263	0x140009a30
?Scroll_VerticallyScrollable_Property@Schema@DirectUI@@2HA	3264	0x14002a2f0
?Select@SelectionItemProvider@DirectUI@@UEAAJXZ	3265	0x14002e084
?Select@SelectorSelectionItemProxy@DirectUI@@AEAAJXZ	3266	0x14002f038
?SelectAll@TouchEdit2@DirectUI@@QEAAJXZ	3267	0x14000521c
?SelectNone@TouchEdit2@DirectUI@@QEAAJXZ	3268	0x140001854
?SelectedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3269	0x140006364
?SelectionBackgroundColorProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3270	0x1400082ec
?SelectionChange@Combobox@DirectUI@@SA?AVUID@@XZ	3271	0x14001e9e0
?SelectionChange@Selector@DirectUI@@SA?AVUID@@XZ	3272	0x140032edc
?SelectionChange@TouchSelect@DirectUI@@SA?AVUID@@XZ	3273	0x1400178ac
?SelectionForegroundColorProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3274	0x140027690
?SelectionInvalidatedEvent@Schema@DirectUI@@2HA	3275	0x14000ec68
?SelectionItemElementAddedToSelectionEvent@Schema@DirectUI@@2HA	3276	0x1400394e0
?SelectionItemElementRemovedFromSelectionEvent@Schema@DirectUI@@2HA	3277	0x140038044
?SelectionItemElementSelectedEvent@Schema@DirectUI@@2HA	3278	0x14002097c
?SelectionItemPattern@Schema@DirectUI@@2HA	3279	0x1400348b4
?SelectionItem_IsSelected_Property@Schema@DirectUI@@2HA	3280	0x14001da78
?SelectionItem_SelectionContainer_Property@Schema@DirectUI@@2HA	3281	0x14001ea44
?SelectionPattern@Schema@DirectUI@@2HA	3282	0x14001a2e8
?SelectionProp@Combobox@DirectUI@@SAPEBUPropertyInfo@2@XZ	3283	0x14000a640
?SelectionProp@Selector@DirectUI@@SAPEBUPropertyInfo@2@XZ	3284	0x140040254
?SelectionProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	3285	0x140013b34
?Selection_CanSelectMultiple_Property@Schema@DirectUI@@2HA	3286	0x14000f8a0
?Selection_IsSelectionRequired_Property@Schema@DirectUI@@2HA	3287	0x140036f7c
?Selection_Selection_Property@Schema@DirectUI@@2HA	3288	0x140020e94
?SemanticChange@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3289	0x14002a6f8
?SemanticZoomControlType@Schema@DirectUI@@2HA	3290	0x140028de4
?SendParseError@DUIXmlParser@DirectUI@@IEAAXPEBG0HHJ@Z	3291	0x1400377f4
?SendParseError@DUIXmlParser@DirectUI@@IEAAXPEBG0PEAUIXmlReader@@J@Z	3292	0x14000d740
?SeparatorControlType@Schema@DirectUI@@2HA	3293	0x140028788
?SetAbsorbsShortcut@Element@DirectUI@@QEAAJ_N@Z	3294	0x140026e48
?SetAccDefAction@Element@DirectUI@@QEAAJPEBG@Z	3295	0x140010dd0
?SetAccDesc@Element@DirectUI@@QEAAJPEBG@Z	3296	0x140038fc0
?SetAccHelp@Element@DirectUI@@QEAAJPEBG@Z	3297	0x140033ef8
?SetAccItemStatus@Element@DirectUI@@QEAAJPEBG@Z	3298	0x140017294
?SetAccItemType@Element@DirectUI@@QEAAJPEBG@Z	3299	0x14002eac4
?SetAccName@Element@DirectUI@@QEAAJPEBG@Z	3300	0x14003d05c
?SetAccRole@Element@DirectUI@@QEAAJH@Z	3301	0x14000f878
?SetAccState@Element@DirectUI@@QEAAJH@Z	3302	0x14003259c
?SetAccValue@Element@DirectUI@@QEAAJPEBG@Z	3303	0x140009e2c
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z	3304	0x140039348
?SetActive@Element@DirectUI@@QEAAJH@Z	3305	0x1400411cc
?SetActiveState@TouchScrollBar@DirectUI@@QEAAXW4ActiveState@2@_N@Z	3306	0x14000fcd8
?SetActivityOccuring@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3307	0x140023698
?SetActivityOccuring@ModernProgressRing@DirectUI@@QEAAJ_N@Z	3308	0x1400209e0
?SetAddLayeredRef@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3309	0x14002114c
?SetAddLayeredRef@ModernProgressRing@DirectUI@@QEAAJ_N@Z	3310	0x14000385c
?SetAliasedRendering@RichText@DirectUI@@QEAAJ_N@Z	3311	0x14000e138
?SetAllowArrowOut@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3312	0x14000d2dc
?SetAlpha@Element@DirectUI@@QEAAJH@Z	3313	0x140035164
?SetAnimatePopupOnDismiss@TouchSelect@DirectUI@@QEAAJ_N@Z	3314	0x14000a9dc
?SetAnimation@Element@DirectUI@@QEAAJH@Z	3315	0x140041050
?SetAutoGrouping@CCRadioButton@DirectUI@@QEAAJ_N@Z	3316	0x140024d48
?SetAutoHeight@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3317	0x140021880
?SetAutoStart@Movie@DirectUI@@QEAAJ_N@Z	3318	0x14000bd80
?SetAutoStop@Movie@DirectUI@@QEAAJ_N@Z	3319	0x14003fbd4
?SetBackgroundColor@Element@DirectUI@@QEAAJAEBUFill@2@@Z	3320	0x14001ecd0
?SetBackgroundColor@Element@DirectUI@@QEAAJK@Z	3321	0x140022688
?SetBackgroundColor@Element@DirectUI@@QEAAJKKE@Z	3322	0x1400070d4
?SetBackgroundColor@Element@DirectUI@@QEAAJKKKE@Z	3323	0x14001a21c
?SetBackgroundColor@Element@DirectUI@@QEAAJPEBGHH@Z	3324	0x14001a2f4
?SetBackgroundOwnerID@HWNDHost@DirectUI@@QEAAJPEBG@Z	3325	0x14000f3a4
?SetBackgroundStdColor@Element@DirectUI@@QEAAJH@Z	3326	0x14002d34c
?SetBaseline@RichText@DirectUI@@QEAAJH@Z	3327	0x140024b24
?SetBorderColor@Element@DirectUI@@QEAAJK@Z	3328	0x1400214b0
?SetBorderGradientColor@Element@DirectUI@@QEAAJKKE@Z	3329	0x140028804
?SetBorderStdColor@Element@DirectUI@@QEAAJH@Z	3330	0x14003dbcc
?SetBorderStyle@Element@DirectUI@@QEAAJH@Z	3331	0x140002eb0
?SetBorderThickness@Element@DirectUI@@QEAAJHHHH@Z	3332	0x140009d00
?SetBuffering@TouchSlider@DirectUI@@QEAAJH@Z	3333	0x14001c608
?SetButtonClassAcceptsEnterKey@DialogElement@DirectUI@@QEAAJ_N@Z	3334	0x140017ab0
?SetButtonClassAcceptsEnterKey@XBaby@DirectUI@@UEAAJ_N@Z	3335	0x140009964
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UEAAJ_N@Z	3336	0x140031714
?SetCache@RichText@DirectUI@@QEAAXKPEAUIDUIRichTextCache@@@Z	3337	0x14002f378
?SetCacheDirty@Layout@DirectUI@@IEAAXXZ	3338	0x140021f1c
?SetCaptured@Button@DirectUI@@QEAAJ_N@Z	3339	0x140006ca0
?SetCaptured@TouchButton@DirectUI@@QEAAJ_N@Z	3340	0x140025430
?SetCaretPosition@TouchEdit2@DirectUI@@QEAAJJ@Z	3341	0x14002520c
?SetCheckedState@TouchCheckBox@DirectUI@@QEAAJW4CheckedStateFlags@2@@Z	3342	0x140007b98
?SetClass@Element@DirectUI@@QEAAJPEBG@Z	3343	0x14001244c
?SetClassInfoPtr@AccessibleButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3344	0x14002a930
?SetClassInfoPtr@AnimationStrip@DirectUI@@SAXPEAUIClassInfo@2@@Z	3345	0x14003db04
?SetClassInfoPtr@AutoButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3346	0x140006494
?SetClassInfoPtr@BaseScrollViewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3347	0x14002d5ec
?SetClassInfoPtr@Bind@DirectUI@@SAXPEAUIClassInfo@2@@Z	3348	0x14000b15c
?SetClassInfoPtr@Browser@DirectUI@@SAXPEAUIClassInfo@2@@Z	3349	0x140011998
?SetClassInfoPtr@Button@DirectUI@@SAXPEAUIClassInfo@2@@Z	3350	0x14000fd34
?SetClassInfoPtr@CCAVI@DirectUI@@SAXPEAUIClassInfo@2@@Z	3351	0x140011e64
?SetClassInfoPtr@CCBase@DirectUI@@SAXPEAUIClassInfo@2@@Z	3352	0x14003fe20
?SetClassInfoPtr@CCBaseCheckRadioButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3353	0x1400026b4
?SetClassInfoPtr@CCBaseScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3354	0x140026f18
?SetClassInfoPtr@CCCheckBox@DirectUI@@SAXPEAUIClassInfo@2@@Z	3355	0x14001b2a4
?SetClassInfoPtr@CCCommandLink@DirectUI@@SAXPEAUIClassInfo@2@@Z	3356	0x14000a044
?SetClassInfoPtr@CCHScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3357	0x14003ce94
?SetClassInfoPtr@CCListBox@DirectUI@@SAXPEAUIClassInfo@2@@Z	3358	0x14002984c
?SetClassInfoPtr@CCListView@DirectUI@@SAXPEAUIClassInfo@2@@Z	3359	0x14002caf0
?SetClassInfoPtr@CCProgressBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3360	0x14002a180
?SetClassInfoPtr@CCPushButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3361	0x140038a6c
?SetClassInfoPtr@CCRadioButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3362	0x140037738
?SetClassInfoPtr@CCSysLink@DirectUI@@SAXPEAUIClassInfo@2@@Z	3363	0x140030350
?SetClassInfoPtr@CCTrackBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3364	0x1400126f4
?SetClassInfoPtr@CCTreeView@DirectUI@@SAXPEAUIClassInfo@2@@Z	3365	0x14002ebd4
?SetClassInfoPtr@CCVScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3366	0x140019d88
?SetClassInfoPtr@CheckBoxGlyph@DirectUI@@SAXPEAUIClassInfo@2@@Z	3367	0x14001780c
?SetClassInfoPtr@Clipper@DirectUI@@SAXPEAUIClassInfo@2@@Z	3368	0x14003bae8
?SetClassInfoPtr@Combobox@DirectUI@@SAXPEAUIClassInfo@2@@Z	3369	0x140004b0c
?SetClassInfoPtr@DialogElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3370	0x140007a08
?SetClassInfoPtr@Edit@DirectUI@@SAXPEAUIClassInfo@2@@Z	3371	0x1400394e8
?SetClassInfoPtr@Element@DirectUI@@SAXPEAUIClassInfo@2@@Z	3372	0x140032ed4
?SetClassInfoPtr@ElementWithHWND@DirectUI@@SAXPEAUIClassInfo@2@@Z	3373	0x1400333e0
?SetClassInfoPtr@Expandable@DirectUI@@SAXPEAUIClassInfo@2@@Z	3374	0x140004570
?SetClassInfoPtr@Expando@DirectUI@@SAXPEAUIClassInfo@2@@Z	3375	0x14002d78c
?SetClassInfoPtr@ExpandoButtonGlyph@DirectUI@@SAXPEAUIClassInfo@2@@Z	3376	0x140014d68
?SetClassInfoPtr@HWNDElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3377	0x14001f3b8
?SetClassInfoPtr@HWNDHost@DirectUI@@SAXPEAUIClassInfo@2@@Z	3378	0x140038598
?SetClassInfoPtr@Macro@DirectUI@@SAXPEAUIClassInfo@2@@Z	3379	0x140010ba0
?SetClassInfoPtr@Movie@DirectUI@@SAXPEAUIClassInfo@2@@Z	3380	0x14003f284
?SetClassInfoPtr@Navigator@DirectUI@@SAXPEAUIClassInfo@2@@Z	3381	0x14000e220
?SetClassInfoPtr@PText@DirectUI@@SAXPEAUIClassInfo@2@@Z	3382	0x14001ec90
?SetClassInfoPtr@Page@DirectUI@@SAXPEAUIClassInfo@2@@Z	3383	0x14001d534
?SetClassInfoPtr@Pages@DirectUI@@SAXPEAUIClassInfo@2@@Z	3384	0x14001e464
?SetClassInfoPtr@Progress@DirectUI@@SAXPEAUIClassInfo@2@@Z	3385	0x140007500
?SetClassInfoPtr@PushButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3386	0x1400273c4
?SetClassInfoPtr@RadioButtonGlyph@DirectUI@@SAXPEAUIClassInfo@2@@Z	3387	0x140007a34
?SetClassInfoPtr@RefPointElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3388	0x140010870
?SetClassInfoPtr@RepeatButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3389	0x14000385c
?SetClassInfoPtr@Repeater@DirectUI@@SAXPEAUIClassInfo@2@@Z	3390	0x14002fcd4
?SetClassInfoPtr@ScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3391	0x14001da9c
?SetClassInfoPtr@ScrollViewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3392	0x14000c56c
?SetClassInfoPtr@Selector@DirectUI@@SAXPEAUIClassInfo@2@@Z	3393	0x140030db4
?SetClassInfoPtr@SelectorNoDefault@DirectUI@@SAXPEAUIClassInfo@2@@Z	3394	0x14003c208
?SetClassInfoPtr@StyledScrollViewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3395	0x140005d28
?SetClassInfoPtr@TextGraphic@DirectUI@@SAXPEAUIClassInfo@2@@Z	3396	0x14003744c
?SetClassInfoPtr@Thumb@DirectUI@@SAXPEAUIClassInfo@2@@Z	3397	0x140008384
?SetClassInfoPtr@UnknownElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3398	0x14003c024
?SetClassInfoPtr@Viewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3399	0x140007718
?SetClassInfoPtr@XBaby@DirectUI@@SAXPEAUIClassInfo@2@@Z	3400	0x14003bf2c
?SetClassInfoPtr@XElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3401	0x14001fbfc
?SetClient@BorderLayout@DirectUI@@AEAAXPEAVElement@2@@Z	3402	0x14003ab10
?SetColorFontPaletteIndex@RichText@DirectUI@@QEAAJH@Z	3403	0x140016628
?SetCompositedText@Element@DirectUI@@QEAAJ_N@Z	3404	0x140031944
?SetCompositingQuality@Movie@DirectUI@@QEAAJH@Z	3405	0x140033594
?SetConnect@Bind@DirectUI@@QEAAJPEBG@Z	3406	0x140030794
?SetConstrainLayout@RichText@DirectUI@@QEAAJH@Z	3407	0x14000e968
?SetContact@TouchScrollViewer@DirectUI@@QEAAJI_N@Z	3408	0x140017e20
?SetContactNeeded@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3409	0x140014b3c
?SetContactNotify@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3410	0x140018428
?SetContentAlign@Element@DirectUI@@QEAAJH@Z	3411	0x140011abc
?SetContentGraphic@Element@DirectUI@@QEAAJPEBGEI@Z	3412	0x14002e008
?SetContentGraphic@Element@DirectUI@@QEAAJPEBGGG@Z	3413	0x14002f0b0
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z	3414	0x140011064
?SetCursor@Element@DirectUI@@QEAAJPEBG@Z	3415	0x140026198
?SetCursorHandle@Element@DirectUI@@QEAAJPEAUHICON__@@@Z	3416	0x14003aea4
?SetDWriteFontCollection@RichText@DirectUI@@QEAAXPEAUIDWriteFontCollection@@@Z	3417	0x14002d0a4
?SetDWriteTextLayout@RichText@DirectUI@@QEAAXPEAUIDWriteTextLayout@@@Z	3418	0x14001cf7c
?SetDataEngine@Repeater@DirectUI@@QEAAXPEAUIDataEngine@2@@Z	3419	0x140026ac8
?SetDataEntry@Macro@DirectUI@@QEAAXPEAUIDataEntry@2@PEAVElement@2@@Z	3420	0x140032370
?SetDataEntry@PText@DirectUI@@QEAAXPEAUIDataEntry@2@@Z	3421	0x14003b454
?SetDefaultButtonTracking@DialogElement@DirectUI@@UEAAJ_N@Z	3422	0x14002ef54
?SetDefaultButtonTracking@XBaby@DirectUI@@UEAAJ_N@Z	3423	0x1400404fc
?SetDefaultButtonTracking@XProvider@DirectUI@@UEAAJ_N@Z	3424	0x140031944
?SetDefaultFocusID@NativeHWNDHost@DirectUI@@QEAAXPEBG@Z	3425	0x14002760c
?SetDefaultGraphicType@Macro@DirectUI@@QEAAXE_N@Z	3426	0x14003dae0
?SetDefaultHInstance@DUIXmlParser@DirectUI@@QEAAXPEAUHINSTANCE__@@@Z	3427	0x140032f40
?SetDefaultState@CCPushButton@DirectUI@@IEAAXKK@Z	3428	0x140018bdc
?SetDelegateEventHandler@TouchScrollViewer@DirectUI@@QEAAJPEAUIUnknown@@@Z	3429	0x1400059a0
?SetDeterminate@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3430	0x14001feec
?SetDirection@Element@DirectUI@@QEAAJH@Z	3431	0x14002e36c
?SetDirty@Edit@DirectUI@@QEAAJ_N@Z	3432	0x14000b800
?SetDisableAccTextExtend@RichText@DirectUI@@QEAAJ_N@Z	3433	0x14002f8b0
?SetDisableMouseInRectCheck@TouchRepeatButton@DirectUI@@QEAAJ_N@Z	3434	0x140024f98
?SetDisableOffscreenCaching@TouchScrollViewer@DirectUI@@QEAAX_N@Z	3435	0x14003e2cc
?SetDrawOutlines@Movie@DirectUI@@QEAAJ_N@Z	3436	0x14003a118
?SetDynamicScaling@DUIXmlParser@DirectUI@@QEAAXW4DynamicScaleParsing@2@@Z	3437	0x1400357b4
?SetEdgeHighlightColor@Element@DirectUI@@QEAAJK@Z	3438	0x14000f5c8
?SetEdgeHighlightThickness@Element@DirectUI@@QEAAJHHHH@Z	3439	0x14000dafc
?SetElementMovesOnIHMNotify@TouchEditBase@DirectUI@@QEAAJ_N@Z	3440	0x14001d1a4
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z	3441	0x140005db8
?SetEncodedContentString@Element@DirectUI@@QEAAJPEBG@Z	3442	0x140032a70
?SetEnforceSize@PushButton@DirectUI@@QEAAJ_N@Z	3443	0x1400081d8
?SetEnsureVisibleUseLayoutCoordinates@Viewer@DirectUI@@QEAAX_N@Z	3444	0x14000eee4
?SetError@DUIFactory@DirectUI@@QEAAXPEBGZZ	3445	0x140031b8c
?SetExpand@Macro@DirectUI@@QEAAJPEBG@Z	3446	0x140033d58
?SetExpanded@Expandable@DirectUI@@QEAAJ_N@Z	3447	0x14001264c
?SetFilterOnPaste@TouchEditBase@DirectUI@@QEAAJ_N@Z	3448	0x14000ae24
?SetFireContinuousSliderEvent@TouchSlider@DirectUI@@QEAAX_N@Z	3449	0x14003db94
?SetFlags@TouchHWNDElement@DirectUI@@QEAAJW4TouchHWNDElementFlags@2@0@Z	3450	0x14001be88
?SetFocus@ElementProvider@DirectUI@@UEAAJXZ	3451	0x140002988
?SetFocus@HWNDElement@DirectUI@@QEAAX_N@Z	3452	0x14003eb8c
?SetFocus@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z	3453	0x14001fb0c
?SetFont@Element@DirectUI@@QEAAJPEBG@Z	3454	0x140030720
?SetFontColorRuns@RichText@DirectUI@@QEAAJPEBG@Z	3455	0x14002534c
?SetFontFace@Element@DirectUI@@QEAAJPEBG@Z	3456	0x14003ef80
?SetFontQuality@Element@DirectUI@@QEAAJH@Z	3457	0x140002448
?SetFontSize@Element@DirectUI@@QEAAJH@Z	3458	0x140019318
?SetFontSizeRuns@RichText@DirectUI@@QEAAJPEBG@Z	3459	0x140015df8
?SetFontStyle@Element@DirectUI@@QEAAJH@Z	3460	0x14001c42c
?SetFontWeight@Element@DirectUI@@QEAAJH@Z	3461	0x14000f030
?SetFontWeightRuns@RichText@DirectUI@@QEAAJPEBG@Z	3462	0x14002db24
?SetForceEditTextToLTR@TouchEditBase@DirectUI@@QEAAJ_N@Z	3463	0x1400140f4
?SetForegroundColor@Element@DirectUI@@QEAAJK@Z	3464	0x1400280b4
?SetForegroundColor@Element@DirectUI@@QEAAJKKE@Z	3465	0x14003a3b4
?SetForegroundColor@Element@DirectUI@@QEAAJKKKE@Z	3466	0x140015408
?SetForegroundStdColor@Element@DirectUI@@QEAAJH@Z	3467	0x14000319c
?SetFrameDuration@AnimationStrip@DirectUI@@QEAAJH@Z	3468	0x1400263a8
?SetFrameIndex@AnimationStrip@DirectUI@@QEAAJH@Z	3469	0x1400195f8
?SetFrameWidth@AnimationStrip@DirectUI@@QEAAJH@Z	3470	0x14001cba0
?SetGetSheetCallback@DUIXmlParser@DirectUI@@QEAAXP6APEAVValue@2@PEBGPEAX@Z1@Z	3471	0x1400283a4
?SetGraphicType@Repeater@DirectUI@@QEAAXE@Z	3472	0x140005c4c
?SetHandleEnter@TouchButton@DirectUI@@QEAAJ_N@Z	3473	0x14002c784
?SetHandleEnterKey@DialogElement@DirectUI@@QEAAJ_N@Z	3474	0x140003c1c
?SetHandleEnterKey@XBaby@DirectUI@@UEAAJ_N@Z	3475	0x140012b78
?SetHandleEnterKey@XProvider@DirectUI@@IEAAX_N@Z	3476	0x14002c614
?SetHandleGlobalEnter@TouchButton@DirectUI@@QEAAJ_N@Z	3477	0x14000aef8
?SetHeight@Element@DirectUI@@QEAAJH@Z	3478	0x140016800
?SetID@Element@DirectUI@@QEAAJPEBG@Z	3479	0x14000fd68
?SetIMEComposing@TouchEditBase@DirectUI@@QEAAJ_N@Z	3480	0x14000672c
?SetIgnoredKeyCombos@TouchEditBase@DirectUI@@QEAAJW4TouchEditFilteredKeyComboFlags@2@0@Z	3481	0x14002df28
?SetIndependentAnimations@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3482	0x14002e948
?SetInnerBorderThickness@TouchEdit2@DirectUI@@QEAAJHHHH@Z	3483	0x1400054e8
?SetInputScope@TouchEdit2@DirectUI@@QEAAJW4__MIDL___MIDL_itf_inputscope_0000_0000_0001@@@Z	3484	0x140014bc4
?SetIntegrateIMECandidateList@TouchEditBase@DirectUI@@QEAAJ_N@Z	3485	0x140016c00
?SetInteractionMode@TouchScrollViewer@DirectUI@@QEAAJH@Z	3486	0x140021b84
?SetInterpolationMode@Movie@DirectUI@@QEAAJH@Z	3487	0x14002748c
?SetIsContinuous@TouchSlider@DirectUI@@QEAAJ_N@Z	3488	0x14003aec4
?SetIsPressed@TouchSlider@DirectUI@@QEAAJ_N@Z	3489	0x14003942c
?SetIsShowOnOffFeedback@TouchSlider@DirectUI@@QEAAJ_N@Z	3490	0x140018bd4
?SetIsVertical@TouchSlider@DirectUI@@QEAAJ_N@Z	3491	0x140006318
?SetItemData@TouchSelect@DirectUI@@QEAAJHPEAUIUnknown@@@Z	3492	0x14000e714
?SetItemData@TouchSelectItem@DirectUI@@QEAAJPEAUIUnknown@@@Z	3493	0x140026828
?SetItemHeightInPopup@TouchSelect@DirectUI@@QEAAJH@Z	3494	0x14003833c
?SetItemState@CCTreeView@DirectUI@@QEAAXPEAU_TREEITEM@@I@Z	3495	0x1400410cc
?SetKeyFocus@Element@DirectUI@@UEAAXXZ	3496	0x140037048
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ	3497	0x14001aa2c
?SetKeyFocus@TouchEditBase@DirectUI@@UEAAXXZ	3498	0x140019790
?SetKeyFocus@XBaby@DirectUI@@UEAAXXZ	3499	0x140018c40
?SetKeyFocus@XElement@DirectUI@@UEAAXXZ	3500	0x140011474
?SetKeyboardNavigationCapture@TouchEditBase@DirectUI@@QEAAJW4TouchEditKeyboardNavigationCapture@2@@Z	3501	0x1400211ec
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z	3502	0x14003f0fc
?SetLayoutCompletionNotify@Element@DirectUI@@QEAAX_N@Z	3503	0x14002cfac
?SetLayoutPointerToNull@Value@DirectUI@@QEAAXXZ	3504	0x14000cfbc
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z	3505	0x140024678
?SetLightDismissIHM@TouchHWNDElement@DirectUI@@QEAAJ_N@Z	3506	0x140039ad4
?SetLine@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3507	0x140018a70
?SetLine@ScrollBar@DirectUI@@UEAAJH@Z	3508	0x1400139e0
?SetLineSize@CCTrackBar@DirectUI@@QEAAJH@Z	3509	0x14003fc04
?SetLineSpacing@RichText@DirectUI@@QEAAJH@Z	3510	0x14000d0f8
?SetLinkIndicatorsToContent@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3511	0x14001bb8c
?SetLocale@RichText@DirectUI@@QEAAJPEBG@Z	3512	0x140018008
?SetManipulationHorizontalAlignment@TouchScrollViewer@DirectUI@@QEAAJH@Z	3513	0x14002fc9c
?SetManipulationVerticalAlignment@TouchScrollViewer@DirectUI@@QEAAJH@Z	3514	0x1400308ec
?SetMapRunsToClusters@RichText@DirectUI@@QEAAJ_N@Z	3515	0x140009250
?SetMargin@Element@DirectUI@@QEAAJHHHH@Z	3516	0x14003837c
?SetMaxLength@Edit@DirectUI@@QEAAJH@Z	3517	0x140026f34
?SetMaxLength@TouchEditBase@DirectUI@@QEAAJH@Z	3518	0x14003fe18
?SetMaxLineCount@RichText@DirectUI@@QEAAXI@Z	3519	0x140009a70
?SetMaximum@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3520	0x140019c50
?SetMaximum@ModernProgressBar@DirectUI@@QEAAJH@Z	3521	0x14001b4dc
?SetMaximum@Progress@DirectUI@@QEAAJH@Z	3522	0x14002da00
?SetMaximum@ScrollBar@DirectUI@@UEAAJH@Z	3523	0x140002d5c
?SetMetering@TouchSlider@DirectUI@@QEAAJH@Z	3524	0x14003ad98
?SetMinSize@Element@DirectUI@@QEAAJHH@Z	3525	0x1400314fc
?SetMinimum@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3526	0x14002504c
?SetMinimum@ModernProgressBar@DirectUI@@QEAAJH@Z	3527	0x140031ac4
?SetMinimum@Progress@DirectUI@@QEAAJH@Z	3528	0x140020004
?SetMinimum@ScrollBar@DirectUI@@UEAAJH@Z	3529	0x14003988c
?SetMoveCaretToEndOnSyncContent@TouchEditBase@DirectUI@@QEAAJ_N@Z	3530	0x1400262f0
?SetMultiline@Edit@DirectUI@@QEAAJ_N@Z	3531	0x14003f34c
?SetMultiline@TouchEditBase@DirectUI@@QEAAJ_N@Z	3532	0x140016eac
?SetNoBrowseOnFirstAdd@Pages@DirectUI@@QEAAXXZ	3533	0x140033d6c
?SetNote@CCCommandLink@DirectUI@@QEAAJPEBG@Z	3534	0x140028850
?SetNotifyHandler@CCBase@DirectUI@@QEAAXP6AHI_K_JPEA_JPEAX@Z3@Z	3535	0x14002bdc0
?SetOffText@TouchSwitch@DirectUI@@QEAAJPEBG@Z	3536	0x140013680
?SetOnOffText@TouchSwitch@DirectUI@@QEAAXPEBG0@Z	3537	0x140010cd4
?SetOnText@TouchSwitch@DirectUI@@QEAAJPEBG@Z	3538	0x14000fb80
?SetOptimizeMove@HWNDHost@DirectUI@@QEAAJ_N@Z	3539	0x14001a0d0
?SetOrder@ScrollBar@DirectUI@@QEAAJH@Z	3540	0x1400256f4
?SetOverhang@Element@DirectUI@@QEAAJ_N@Z	3541	0x140040150
?SetOverhangOffset@RichText@DirectUI@@QEAAJH@Z	3542	0x140033048
?SetOverrideButtonBackground@CCPushButton@DirectUI@@QEAAJ_N@Z	3543	0x140022fac
?SetOverrideScaleFactor@DUIXmlParser@DirectUI@@QEAAXM@Z	3544	0x14003f024
?SetOverrideScaleFactor@Element@DirectUI@@QEAAXM@Z	3545	0x140041624
?SetPVLAnimationState@Element@DirectUI@@QEAAXH@Z	3546	0x14002ed4c
?SetPadding@Element@DirectUI@@QEAAJHHHH@Z	3547	0x1400200d8
?SetPage@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3548	0x14003ff34
?SetPage@ScrollBar@DirectUI@@UEAAJH@Z	3549	0x14003dc54
?SetParameter@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAX@Z	3550	0x140015538
?SetParentSizeControl@HWNDElement@DirectUI@@QEAAX_N@Z	3551	0x14001e220
?SetParseErrorCallback@DUIXmlParser@DirectUI@@QEAAXP6AXPEBG0HPEAX@Z1@Z	3552	0x140015194
?SetParseState@DUIXmlParser@DirectUI@@AEAAXW4_DUI_PARSE_STATE@2@@Z	3553	0x140010460
?SetParser@Macro@DirectUI@@QEAAXPEAVDUIXmlParser@2@@Z	3554	0x140025164
?SetPasswordCharacter@Edit@DirectUI@@QEAAJH@Z	3555	0x140009244
?SetPasswordCharacter@TouchEditBase@DirectUI@@QEAAJH@Z	3556	0x14000f9dc
?SetPasswordRevealMode@TouchEdit2@DirectUI@@QEAAJW4TouchEditPasswordRevealMode@2@@Z	3557	0x14003863c
?SetPath@Movie@DirectUI@@QEAAJPEBG@Z	3558	0x140020e74
?SetPercent@ScrollProxy@DirectUI@@AEAAJPEAVBaseScrollBar@2@N@Z	3559	0x14002e69c
?SetPinned@BaseScrollBar@DirectUI@@QEAAX_N@Z	3560	0x14000d8f8
?SetPinning@BaseScrollViewer@DirectUI@@QEAAJH@Z	3561	0x140036054
?SetPixelOffsetMode@Movie@DirectUI@@QEAAJH@Z	3562	0x140033b44
?SetPlay@AnimationStrip@DirectUI@@QEAAJ_N@Z	3563	0x14003861c
?SetPlayAllFramesMode@Movie@DirectUI@@QEAAJ_N@Z	3564	0x140038ab0
?SetPopupBounds@TouchSelect@DirectUI@@QEAAJHHHH@Z	3565	0x140008fa8
?SetPosition@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3566	0x14003ffc8
?SetPosition@ModernProgressBar@DirectUI@@QEAAJH@Z	3567	0x14003b068
?SetPosition@Progress@DirectUI@@QEAAJH@Z	3568	0x140019678
?SetPosition@ScrollBar@DirectUI@@UEAAJH@Z	3569	0x14002aa00
?SetPreprocessedXML@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z	3570	0x14002c1b0
?SetPreserveAlphaChannel@Element@DirectUI@@QEAAX_N@Z	3571	0x140033c50
?SetPressed@Button@DirectUI@@QEAAJ_N@Z	3572	0x14001d2b4
?SetPressed@TouchButton@DirectUI@@QEAAJ_N@Z	3573	0x1400355e8
?SetPreventFormatChangeUpdatingModifiedState@TouchEditBase@DirectUI@@QEAAJ_N@Z	3574	0x1400389ec
?SetPromptText@TouchEdit2@DirectUI@@QEAAJPEBG@Z	3575	0x140034f94
?SetPromptWithCaret@TouchEdit2@DirectUI@@QEAAJ_N@Z	3576	0x14002aa18
?SetProperty@Bind@DirectUI@@QEAAJPEBG@Z	3577	0x14001d11c
?SetProportional@ScrollBar@DirectUI@@QEAAJ_N@Z	3578	0x140018b54
?SetProvider@XElement@DirectUI@@QEAAJPEAUIUnknown@@@Z	3579	0x14000ccb8
?SetRangeMax@CCTrackBar@DirectUI@@QEAAJH@Z	3580	0x140007f14
?SetRangeMax@TouchSlider@DirectUI@@QEAAXH@Z	3581	0x14001cd08
?SetRangeMin@CCTrackBar@DirectUI@@QEAAJH@Z	3582	0x140017630
?SetRangeMin@TouchSlider@DirectUI@@QEAAXH@Z	3583	0x14000ae98
?SetRangeMinAndRangeMax@TouchSlider@DirectUI@@QEAAXHH@Z	3584	0x1400068f4
?SetReadOnly@TouchEditBase@DirectUI@@QEAAJ_N@Z	3585	0x14000b1d8
?SetReferencePoint@RefPointElement@DirectUI@@QEAAJHH@Z	3586	0x14001405c
?SetRegisteredDefaultButton@DialogElement@DirectUI@@QEAAJPEAVElement@2@@Z	3587	0x14001ed64
?SetRegisteredDefaultButton@XBaby@DirectUI@@UEAAJPEAVElement@2@@Z	3588	0x14001bf34
?SetRegisteredDefaultButton@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z	3589	0x1400059d8
?SetRegisteredDefaultButtonSelectedState@DialogElementCore@DirectUI@@IEAAX_N@Z	3590	0x14001f0cc
?SetRelPixHeight@Element@DirectUI@@QEAAJH@Z	3591	0x140008c88
?SetRelPixMargin@Element@DirectUI@@QEAAJHHHH@Z	3592	0x1400059fc
?SetRelPixPadding@Element@DirectUI@@QEAAJHHHH@Z	3593	0x140035ebc
?SetRelPixWidth@Element@DirectUI@@QEAAJH@Z	3594	0x1400401e0
?SetReorderable@ItemList@DirectUI@@QEAAJ_N@Z	3595	0x140026898
?SetRepeat@Movie@DirectUI@@QEAAJ_N@Z	3596	0x14000c76c
?SetRespectLanguageDirection@TouchSlider@DirectUI@@QEAAX_N@Z	3597	0x140028324
?SetRespondToMouseScroll@TouchSlider@DirectUI@@QEAAX_N@Z	3598	0x1400312c8
?SetRootWindowForTheming@DUIXmlParser@DirectUI@@QEAAXPEAUHWND__@@@Z	3599	0x1400144b8
?SetScaleFactor@DUIXmlParser@DirectUI@@QEAAXM@Z	3600	0x14000c8b8
?SetScreenCenter@HWNDElement@DirectUI@@QEAAX_N@Z	3601	0x140028ff4
?SetScrollControlHost@TouchScrollViewer@DirectUI@@QEAAJPEAVElement@2@@Z	3602	0x1400188b4
?SetScrollPadding@TouchScrollViewer@DirectUI@@QEAAJHHHH@Z	3603	0x1400265e8
?SetScrollPercent@ScrollProvider@DirectUI@@UEAAJNN@Z	3604	0x14000c744
?SetScrollPercent@ScrollProxy@DirectUI@@AEAAJNN@Z	3605	0x14000bf4c
?SetSelected@Element@DirectUI@@QEAAJ_N@Z	3606	0x14002d504
?SetSelection@Combobox@DirectUI@@QEAAJH@Z	3607	0x140016d3c
?SetSelection@Selector@DirectUI@@UEAAJPEAVElement@2@@Z	3608	0x140010074
?SetSelection@SelectorNoDefault@DirectUI@@UEAAJPEAVElement@2@@Z	3609	0x14002230c
?SetSelection@TouchEdit2@DirectUI@@QEAAJJJ@Z	3610	0x14003269c
?SetSelection@TouchSelect@DirectUI@@QEAAJPEAVElement@2@@Z	3611	0x140036bd4
?SetSelectionBackgroundColor@TouchEditBase@DirectUI@@QEAAJPEAVValue@2@@Z	3612	0x14002ecd0
?SetSelectionForegroundColor@TouchEditBase@DirectUI@@QEAAJPEAVValue@2@@Z	3613	0x14001b590
?SetSelectionIndex@TouchSelect@DirectUI@@QEAAJH@Z	3614	0x1400175f0
?SetShadowIntensity@Element@DirectUI@@QEAAJH@Z	3615	0x140033584
?SetSheet@Element@DirectUI@@QEAAJPEAVStyleSheet@2@@Z	3616	0x14000e7a0
?SetShortcut@Element@DirectUI@@QEAAJH@Z	3617	0x140032598
?SetShowClearButtonMinWidth@TouchEdit2@DirectUI@@QEAAJH@Z	3618	0x14002bf0c
?SetShowKeyFocus@TouchButton@DirectUI@@QEAAJ_N@Z	3619	0x140028120
?SetShowTick@TouchSlider@DirectUI@@QEAAJ_N@Z	3620	0x140024288
?SetSmoothFillAnimation@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3621	0x1400047ec
?SetSmoothingMode@Movie@DirectUI@@QEAAJH@Z	3622	0x14001da1c
?SetSnapIntervalX@TouchScrollViewer@DirectUI@@QEAAJM@Z	3623	0x14002c25c
?SetSnapIntervalY@TouchScrollViewer@DirectUI@@QEAAJM@Z	3624	0x140031604
?SetSnapMode@TouchScrollViewer@DirectUI@@QEAAJH@Z	3625	0x14000c7e4
?SetSnapOffsetX@TouchScrollViewer@DirectUI@@QEAAJM@Z	3626	0x1400243e8
?SetSnapOffsetY@TouchScrollViewer@DirectUI@@QEAAJM@Z	3627	0x14003d328
?SetSnapPointCollectionX@TouchScrollViewer@DirectUI@@QEAAJPEAV?$DynamicArray@N$0A@@2@@Z	3628	0x14002e874
?SetSnapPointCollectionX@TouchScrollViewer@DirectUI@@QEAAJPEBNH@Z	3629	0x1400160b8
?SetSnapPointCollectionY@TouchScrollViewer@DirectUI@@QEAAJPEAV?$DynamicArray@N$0A@@2@@Z	3630	0x140032fbc
?SetSnapPointCollectionY@TouchScrollViewer@DirectUI@@QEAAJPEBNH@Z	3631	0x140014bb0
?SetState@ModernProgressBar@DirectUI@@QEAAJH@Z	3632	0x14002f7e0
?SetStdCursor@Element@DirectUI@@QEAAJH@Z	3633	0x140034204
?SetStepCount@TouchSlider@DirectUI@@QEAAXH@Z	3634	0x1400406dc
?SetStopThumbBehavior@RepeatButton@DirectUI@@QEAAXXZ	3635	0x140008d78
?SetString@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@P8Element@2@EAAPEBGPEAPEAVValue@2@@Z@Z	3636	0x140015c80
?SetStyle@CCTreeView@DirectUI@@QEAAKK@Z	3637	0x1400309f0
?SetSubContent@TouchCommandButton@DirectUI@@QEAAJPEBG@Z	3638	0x140019f4c
?SetSuppressClearButton@TouchEdit2@DirectUI@@QEAAJ_N@Z	3639	0x140030734
?SetSuppressSetContact@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3640	0x14000a05c
?SetSyncContentWhileIMEComposing@TouchEditBase@DirectUI@@QEAAJ_N@Z	3641	0x140013cf0
?SetTargetPage@Navigator@DirectUI@@QEAAJPEBG@Z	3642	0x14001ac64
?SetTextContentOverride@TouchSelectItem@DirectUI@@QEAAJPEBG@Z	3643	0x14003db80
?SetTextGlowSize@Element@DirectUI@@QEAAJH@Z	3644	0x14003d4ec
?SetTextMode@TouchEditBase@DirectUI@@QEAAJW4TouchEditTextMode@2@@Z	3645	0x14002b4ac
?SetThemeChanged@HWNDHost@DirectUI@@IEAAJH@Z	3646	0x140020368
?SetThemedBorder@Edit@DirectUI@@QEAAJ_N@Z	3647	0x14001d894
?SetThumbPosition@CCTrackBar@DirectUI@@QEAAJH@Z	3648	0x14001f230
?SetThumbValue@TouchSlider@DirectUI@@QEAAXH_N0@Z	3649	0x140005df0
?SetThumbValue@TouchSlider@DirectUI@@QEAAXH_N@Z	3650	0x140012348
?SetTickCount@TouchSlider@DirectUI@@QEAAJH@Z	3651	0x14003817c
?SetTitleText@TouchSwitch@DirectUI@@QEAAJPEBG@Z	3652	0x14002d8b0
?SetToHost@XBaby@DirectUI@@UEAAJPEAVElement@2@@Z	3653	0x140007874
?SetToggleOnClick@TouchCheckBox@DirectUI@@QEAAJ_N@Z	3654	0x14002903c
?SetToggleSwitchText@TouchSwitch@DirectUI@@QEAAXPEBG@Z	3655	0x14003dff4
?SetToggleValue@TouchSwitch@DirectUI@@QEAAXH@Z	3656	0x140017020
?SetToggleValue@TouchSwitch@DirectUI@@QEAAXH_N0@Z	3657	0x14002b5f8
?SetToggleValue@TouchSwitch@DirectUI@@QEAAXH_N@Z	3658	0x140030514
?SetTooltip@Element@DirectUI@@QEAAJ_N@Z	3659	0x14003fc8c
?SetTooltipMaxWidth@Element@DirectUI@@QEAAJH@Z	3660	0x140029dc0
?SetTooltipMaximumLineCount@TouchHWNDElement@DirectUI@@QEAAJH@Z	3661	0x14000a604
?SetTooltipText@TouchSlider@DirectUI@@QEAAXPEBG@Z	3662	0x140029ed8
?SetTracking@CCBaseScrollBar@DirectUI@@QEAAJ_N@Z	3663	0x140033840
?SetTransparent@HWNDHost@DirectUI@@QEAAJ_N@Z	3664	0x140024bf4
?SetTreatRightMouseButtonAsLeft@TouchButton@DirectUI@@QEAAJ_N@Z	3665	0x14001d514
?SetTypography@RichText@DirectUI@@QEAAJPEBG@Z	3666	0x140039270
?SetTypographyRuns@RichText@DirectUI@@QEAAJPEBG@Z	3667	0x140001860
?SetUnavailableIcon@DUIXmlParser@DirectUI@@QEAAXPEAUHICON__@@@Z	3668	0x14000bafc
?SetUnknownAttrCallback@DUIXmlParser@DirectUI@@QEAAXP6A_NPEBGPEAX@Z1@Z	3669	0x14003a224
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z	3670	0x14001d198
?SetValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@HPEAVValue@2@@Z	3671	0x14002fc5c
?SetValue@RangeValueProvider@DirectUI@@UEAAJN@Z	3672	0x140013128
?SetValue@ValueProvider@DirectUI@@UEAAJPEBG@Z	3673	0x140001e70
?SetValue@ValueProxy@DirectUI@@AEAAJPEBG@Z	3674	0x1400175e0
?SetVertical@ScrollBar@DirectUI@@QEAAJ_N@Z	3675	0x14001c860
?SetVerticalScript@RichText@DirectUI@@QEAAJ_N@Z	3676	0x14002279c
?SetVirtualizeElements@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3677	0x14002e17c
?SetVisible@Element@DirectUI@@QEAAJ_N@Z	3678	0x140027698
?SetVisited@TouchHyperLink@DirectUI@@QEAAJ_N@Z	3679	0x14000b69c
?SetWantTabs@Edit@DirectUI@@QEAAJ_N@Z	3680	0x14002ce44
?SetWidth@Element@DirectUI@@QEAAJH@Z	3681	0x14001e2ac
?SetWinStyle@CCBase@DirectUI@@QEAAJH@Z	3682	0x140003a80
?SetWindowAccessGradientColor@TouchHWNDElement@DirectUI@@QEAAJPEAVValue@2@@Z	3683	0x14002e5fc
?SetWindowActive@Element@DirectUI@@QEAAJ_N@Z	3684	0x14002647c
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z	3685	0x14003cce4
?SetWrapKeyboardNavigate@HWNDElement@DirectUI@@QEAAJ_N@Z	3686	0x140004940
?SetX@Element@DirectUI@@QEAAJH@Z	3687	0x14002806c
?SetXBarVisibility@BaseScrollViewer@DirectUI@@QEAAJH@Z	3688	0x140018248
?SetXML@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z	3689	0x14002f044
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z	3690	0x14003a0f0
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEBGPEAUHINSTANCE__@@1@Z	3691	0x1400240d8
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJPEBG0PEAUHINSTANCE__@@1@Z	3692	0x1400080f0
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z	3693	0x14001e3dc
?SetXMLFromResourceWithTheme@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@00@Z	3694	0x1400107b4
?SetXOffset@BaseScrollViewer@DirectUI@@QEAAJH@Z	3695	0x140039328
?SetXOffset@Viewer@DirectUI@@QEAAJH@Z	3696	0x14000ffdc
?SetXScrollable@BaseScrollViewer@DirectUI@@QEAAJ_N@Z	3697	0x140015a20
?SetXScrollable@Viewer@DirectUI@@QEAAJ_N@Z	3698	0x14002d980
?SetY@Element@DirectUI@@QEAAJH@Z	3699	0x14000a9c0
?SetYBarVisibility@BaseScrollViewer@DirectUI@@QEAAJH@Z	3700	0x140001d80
?SetYOffset@BaseScrollViewer@DirectUI@@QEAAJH@Z	3701	0x140037528
?SetYOffset@Viewer@DirectUI@@QEAAJH@Z	3702	0x14001b54c
?SetYScrollable@BaseScrollViewer@DirectUI@@QEAAJ_N@Z	3703	0x14000b7b4
?SetYScrollable@Viewer@DirectUI@@QEAAJ_N@Z	3704	0x14003d680
?SetZoomMaximum@TouchScrollViewer@DirectUI@@QEAAJM@Z	3705	0x14001c008
?SetZoomMinimum@TouchScrollViewer@DirectUI@@QEAAJM@Z	3706	0x14002e2f8
?ShadowIntensityProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3707	0x140026b58
?SheetProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3708	0x140034e20
?ShiftChild@Element@DirectUI@@QEAAJII@Z	3709	0x140011cd0
?ShortcutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3710	0x14003d7bc
?ShouldUseDesktopPerMonitorScaling@HWNDElement@DirectUI@@QEAA_NXZ	3711	0x140020d88
?ShouldUsePerMonitorScaling@TouchHWNDElement@DirectUI@@QEAA_NXZ	3712	0x14003b034
?ShowAccel@HWNDElement@DirectUI@@QEAA_NXZ	3713	0x14000eb10
?ShowClearButtonMinWidthProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3714	0x1400072bc
?ShowContextMenu@ElementProvider@DirectUI@@UEAAJXZ	3715	0x14000d4e0
?ShowFocus@HWNDElement@DirectUI@@QEAA_NXZ	3716	0x140036670
?ShowKeyFocusProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3717	0x14003e7cc
?ShowRichTooltip@TouchHWNDElement@DirectUI@@QEAAJW4TOUCHTOOLTIP_INPUT@@W4TOUCHTOOLTIP_OPTION_FLAGS@@PEAVElement@2@@Z	3718	0x140040a00
?ShowTickProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3719	0x140037fdc
?ShowTooltipOnRightForLTRBuild@TouchSlider@DirectUI@@QEAAXXZ	3720	0x14003f9b8
?ShowUIState@HWNDElement@DirectUI@@QEAAX_N0@Z	3721	0x140010360
?ShowWindow@NativeHWNDHost@DirectUI@@QEAAXH@Z	3722	0x140005b2c
?ShowWindow@XHost@DirectUI@@QEAAXH@Z	3723	0x1400073e8
?SideGraphicProp@TextGraphic@DirectUI@@SAPEBUPropertyInfo@2@XZ	3724	0x14003c180
?SizeInLayoutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3725	0x140002ca0
?SizeZero@FlowLayout@DirectUI@@KA?AUtagSIZE@@XZ	3726	0x140010108
?SizeZero@VerticalFlowLayout@DirectUI@@KA?AUtagSIZE@@XZ	3727	0x140027b44
?Skip@DuiAccessible@DirectUI@@UEAAJK@Z	3728	0x14000f874
?Skip@HWNDHostAccessible@DirectUI@@UEAAJK@Z	3729	0x1400064f0
?SliderControlType@Schema@DirectUI@@2HA	3730	0x140029ed4
?SliderUpdated@TouchSlider@DirectUI@@SA?AVUID@@XZ	3731	0x140032458
?SmoothingModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3732	0x140008068
?SnapIntervalXProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3733	0x14001b820
?SnapIntervalYProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3734	0x1400290c4
?SnapModeProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3735	0x140034908
?SnapOffsetXProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3736	0x140034fb0
?SnapOffsetYProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3737	0x140022940
?SnapPointCollectionXProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3738	0x1400139b8
?SnapPointCollectionYProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3739	0x14003ef54
?SnapshotTransformElement@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3740	0x140017994
?SortChildren@Element@DirectUI@@QEAAJP6AHPEBX0@Z@Z	3741	0x1400179b0
?SpinnerControlType@Schema@DirectUI@@2HA	3742	0x14003f324
?SplitButtonControlType@Schema@DirectUI@@2HA	3743	0x140033f64
?Start@AnimationStrip@DirectUI@@AEAAJXZ	3744	0x1400407f0
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z	3745	0x140002b20
?StartNavigate@Browser@DirectUI@@SA?AVUID@@XZ	3746	0x14003c03c
?StartRichTooltipTimer@TouchHWNDElement@DirectUI@@QEAAJW4TOUCHTOOLTIP_INPUT@@@Z	3747	0x14002527c
?StateProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3748	0x1400401b4
?StaticWndProc@HWNDElement@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z	3749	0x1400264ac
?StaticXHostSubclassProc@TaskPage@DirectUI@@CA_JPEAUHWND__@@I_K_J@Z	3750	0x14001dda0
?StaticXmlParserError@TaskPage@DirectUI@@CAXPEBG0HPEAX@Z	3751	0x140023cd0
?StatusBarControlType@Schema@DirectUI@@2HA	3752	0x14000d3d4
?Stop@AnimationStrip@DirectUI@@AEAAXXZ	3753	0x1400157bc
?Stop@CCAVI@DirectUI@@QEAAXXZ	3754	0x140014cc8
?StopAnimation@Element@DirectUI@@QEAAXI@Z	3755	0x14003daac
?StopUsingCache@RichText@DirectUI@@QEAAXXZ	3756	0x140011a1c
?StrDupW@Value@DirectUI@@CAJPEBGPEAPEAG@Z	3757	0x14001bb5c
?StructureChangedEvent@Schema@DirectUI@@2HA	3758	0x14003c3dc
?SubContentProp@TouchCommandButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3759	0x14000c5d8
?SuppressClearButtonProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3760	0x14003122c
?SupressRightButtonDrag@Thumb@DirectUI@@QEAAX_N@Z	3761	0x14002e60c
?SyncBackground@HWNDHost@DirectUI@@IEAAXXZ	3762	0x140036330
?SyncCallback@Proxy@DirectUI@@SAJPEAUHGADGET__@@PEAXPEAUEventMsg@@@Z	3763	0x140038118
?SyncColorsAndFonts@HWNDHost@DirectUI@@AEAAXXZ	3764	0x1400231f8
?SyncContentWhileIMEComposingProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3765	0x14000c288
?SyncDestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ	3766	0x140001cd4
?SyncDirection@HWNDHost@DirectUI@@IEAAXXZ	3767	0x1400080b4
?SyncElementAlphaFromForegroundAlpha@DirectUI@@YAXPEAVElement@1@@Z	3768	0x14000e4c8
?SyncFont@HWNDHost@DirectUI@@IEAAXXZ	3769	0x140002458
?SyncForeground@HWNDHost@DirectUI@@IEAAXXZ	3770	0x140023d74
?SyncNoteAndGlyph@CCCommandLink@DirectUI@@IEAAXPEAUHWND__@@@Z	3771	0x14000ee0c
?SyncParent@HWNDHost@DirectUI@@IEAAXXZ	3772	0x140034b50
?SyncRect@HWNDHost@DirectUI@@IEAAXI_N@Z	3773	0x140016f30
?SyncScrollBar@CCBaseScrollBar@DirectUI@@QEAAXXZ	3774	0x14002957c
?SyncStyle@HWNDHost@DirectUI@@IEAAXXZ	3775	0x14002bf8c
?SyncText@HWNDHost@DirectUI@@IEAAXXZ	3776	0x1400206bc
?SyncVisible@HWNDHost@DirectUI@@IEAAXXZ	3777	0x1400027dc
?SystemAlertEvent@Schema@DirectUI@@2HA	3778	0x14003727c
?TabControlType@Schema@DirectUI@@2HA	3779	0x140039070
?TabItemControlType@Schema@DirectUI@@2HA	3780	0x140018b70
?TableControlType@Schema@DirectUI@@2HA	3781	0x140010f5c
?TableItemPattern@Schema@DirectUI@@2HA	3782	0x14003df6c
?TableItem_ColumnHeaderItems_Property@Schema@DirectUI@@2HA	3783	0x14003cddc
?TableItem_RowHeaderItems_Property@Schema@DirectUI@@2HA	3784	0x140014868
?TablePattern@Schema@DirectUI@@2HA	3785	0x14002c3c0
?Table_ColumnHeaders_Property@Schema@DirectUI@@2HA	3786	0x1400179e4
?Table_RowHeaders_Property@Schema@DirectUI@@2HA	3787	0x1400390a0
?Table_RowOrColumnMajor_Property@Schema@DirectUI@@2HA	3788	0x14003c424
?TargetPageProp@Navigator@DirectUI@@SAPEBUPropertyInfo@2@XZ	3789	0x14003ea28
?TelemetrySetDescription@TouchScrollViewer@DirectUI@@QEAAJPEBG@Z	3790	0x14000c830
?TestDeferObject@Element@DirectUI@@QEAAPEAVDeferCycle@2@XZ	3791	0x14000184c
?TextContentOverrideProp@TouchSelectItem@DirectUI@@SAPEBUPropertyInfo@2@XZ	3792	0x1400282d4
?TextControlType@Schema@DirectUI@@2HA	3793	0x14002ebe8
?TextGlowSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3794	0x14001d5d0
?TextModeProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3795	0x140014858
?TextPattern@Schema@DirectUI@@2HA	3796	0x14003c580
?TextTextSelectionChangedEvent@Schema@DirectUI@@2HA	3797	0x140013668
?TextTooltipShowing@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3798	0x1400296a4
?ThemeChange@HWNDElement@DirectUI@@SA?AVUID@@XZ	3799	0x140003728
?ThemeChangedProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	3800	0x140027878
?ThemedBorderProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	3801	0x1400046d4
?ThumbControlType@Schema@DirectUI@@2HA	3802	0x1400249dc
?ThumbPositionProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3803	0x1400148d0
?ThumbPositionProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3804	0x1400278e8
?TickCountProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3805	0x14000e2a4
?TitleBarControlType@Schema@DirectUI@@2HA	3806	0x140022530
?TitleTextProp@TouchSwitch@DirectUI@@SAPEBUPropertyInfo@2@XZ	3807	0x14001b554
?ToString@Value@DirectUI@@QEBAPEAGPEAGI@Z	3808	0x140030248
?Toggle@AutoButton@DirectUI@@SA?AVUID@@XZ	3809	0x140025000
?Toggle@SemanticZoomToggle@DirectUI@@SA?AVUID@@XZ	3810	0x1400092e8
?Toggle@ToggleProvider@DirectUI@@UEAAJXZ	3811	0x1400335a8
?ToggleOnClickProp@TouchCheckBox@DirectUI@@SAPEBUPropertyInfo@2@XZ	3812	0x1400155d8
?TogglePattern@Schema@DirectUI@@2HA	3813	0x14002e5f8
?ToggleUIState@HWNDElement@DirectUI@@QEAAX_N0@Z	3814	0x14003528c
?Toggle_ToggleState_Property@Schema@DirectUI@@2HA	3815	0x140009b14
?ToolBarControlType@Schema@DirectUI@@2HA	3816	0x14000bcd0
?ToolTipClosedEvent@Schema@DirectUI@@2HA	3817	0x1400026f4
?ToolTipControlType@Schema@DirectUI@@2HA	3818	0x14003cef0
?ToolTipOpenedEvent@Schema@DirectUI@@2HA	3819	0x140030cc8
?TooltipMaxWidthProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3820	0x140033dac
?TooltipMaximumLineCountProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3821	0x140011c34
?TooltipProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3822	0x140024278
?TooltipTimerStarting@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3823	0x140010ac4
?TossElement@ElementProvider@DirectUI@@UEAAXXZ	3824	0x140005e0c
?TossPatternProvider@ElementProvider@DirectUI@@QEAAXW4Pattern@Schema@2@@Z	3825	0x140030ea4
?TrackScore@NavScoring@DirectUI@@QEAAHPEAVElement@2@0@Z	3826	0x140018b68
?TrackingProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3827	0x140005774
?TransformPattern@Schema@DirectUI@@2HA	3828	0x140015684
?TranslateThumbPositionToThumbValue@TouchSlider@DirectUI@@QEAAHH@Z	3829	0x14002f3e0
?TransparentProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	3830	0x140027a24
?TreatRightMouseButtonAsLeftProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3831	0x14002a438
?TreeControlType@Schema@DirectUI@@2HA	3832	0x140036220
?TreeItemControlType@Schema@DirectUI@@2HA	3833	0x1400100f0
?TriggeredAnimationComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ	3834	0x140015320
?Try@NavScoring@DirectUI@@QEAAHPEAVElement@2@HPEBUNavReference@2@K@Z	3835	0x140032c80
?TryLinePattern@Element@DirectUI@@AEAA_NPEAUtagPOINT@@AEBUtagRECT@@@Z	3836	0x14002b1b8
?TryPattern@Element@DirectUI@@AEAA_NNNPEAUtagPOINT@@AEBUtagRECT@@@Z	3837	0x1400190d8
?TrySparsePattern@Element@DirectUI@@AEAA_NPEAUtagPOINT@@AEBUtagRECT@@@Z	3838	0x14001bcac
?TypographyProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	3839	0x14000ac04
?TypographyRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	3840	0x14001725c
?UiaEvents@Element@DirectUI@@QEAA_NXZ	3841	0x140040aa0
?UiaHostProviderFromHwnd@Schema@DirectUI@@2P6AJPEAUHWND__@@PEAPEAUIRawElementProviderSimple@@@ZEA	3842	0x140029514
?UiaLookupId@Schema@DirectUI@@2P6AHW4AutomationIdentifierType@@PEBU_GUID@@@ZEA	3843	0x140029b1c
?UiaRaiseAutomationEvent@Schema@DirectUI@@2P6AJPEAUIRawElementProviderSimple@@H@ZEA	3844	0x14000c38c
?UiaRaiseAutomationPropertyChangedEvent@Schema@DirectUI@@2P6AJPEAUIRawElementProviderSimple@@HUtagVARIANT@@1@ZEA	3845	0x140021258
?UiaRaiseStructureChangedEvent@Schema@DirectUI@@2P6AJPEAUIRawElementProviderSimple@@W4StructureChangeType@@PEAHH@ZEA	3846	0x14003710c
?UiaReturnRawElementProvider@Schema@DirectUI@@2P6A_JPEAUHWND__@@_K_JPEAUIRawElementProviderSimple@@@ZEA	3847	0x140034130
?UnRegister@Element@DirectUI@@SAJPEAPEAUIClassInfo@2@@Z	3848	0x14003eb98
?UnhandledSyschar@XElement@DirectUI@@SA?AVUID@@XZ	3849	0x1400164c0
?Uninit@CallstackTracker@DirectUI@@SAXXZ	3850	0x14001b320
?Uninit@InvokeHelper@DirectUI@@QEAAXXZ	3851	0x140029a6c
?UninitProcess@FontCache@DirectUI@@SAXXZ	3852	0x1400392d4
?UninitThread@FontCache@DirectUI@@SAXXZ	3853	0x140036a64
?UnloadCommonControlExports@AnimationStrip@DirectUI@@AEAAXXZ	3854	0x14000aa3c
?Unlock@CritSecLock@DirectUI@@QEAAXXZ	3855	0x14003ae44
?UnregisterForAnimationStatusChanges@TouchHWNDElement@DirectUI@@QEAAXXZ	3856	0x14003d1ec
?UnregisterForIHMChanges@TouchHWNDElement@DirectUI@@QEAAXXZ	3857	0x140024f54
?UnregisterForMonitorPowerChanges@TouchHWNDElement@DirectUI@@QEAAJXZ	3858	0x14001bc74
?UnvirtualizePosition@HWNDHost@DirectUI@@AEAAXXZ	3859	0x140039e98
?UpdateChildFocus@DialogElementCore@DirectUI@@QEAAXPEAVElement@2@0@Z	3860	0x140038838
?UpdateChildren@Expando@DirectUI@@IEAAXPEAVValue@2@@Z	3861	0x14003db58
?UpdateContentSize@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3862	0x14000a97c
?UpdateDesiredSize@BorderLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3863	0x140040c94
?UpdateDesiredSize@FillLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3864	0x14001cbec
?UpdateDesiredSize@FlowLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3865	0x140031ad0
?UpdateDesiredSize@GridLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3866	0x14002e72c
?UpdateDesiredSize@Layout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3867	0x140027b74
?UpdateDesiredSize@NineGridLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3868	0x14003adec
?UpdateDesiredSize@RowLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3869	0x140026698
?UpdateDesiredSize@TableLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3870	0x140014be4
?UpdateDesiredSize@VerticalFlowLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3871	0x14003c258
?UpdateElement@TouchSelect@DirectUI@@QEAAJHPEAVElement@2@PEBG@Z	3872	0x14000de68
?UpdateLayout@Element@DirectUI@@QEAAXXZ	3873	0x140006168
?UpdateLayoutRect@Layout@DirectUI@@SAXPEAVElement@2@HH0HHHH@Z	3874	0x14003d804
?UpdateSheets@DUIXmlParser@DirectUI@@QEAAJPEAVElement@2@@Z	3875	0x1400388e0
?UpdateString@TouchSelect@DirectUI@@QEAAJHPEBG@Z	3876	0x14003a0ac
?UpdateStyleSheets@HWNDElement@DirectUI@@IEAAXXZ	3877	0x14000c744
?UpdateToggleState@SemanticZoomToggle@DirectUI@@QEAAXW4SemanticZoomToggleState@@_N@Z	3878	0x14000e6dc
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z	3879	0x1400142b8
?UpdateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3880	0x14003dc18
?UpdateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3881	0x140038970
?UpdateView@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3882	0x140037050
?UseFixedTooltipOffset@TouchSlider@DirectUI@@QEAAXXZ	3883	0x140029644
?UsePerMonitorScaling@TouchHWNDElement@DirectUI@@QEAAXPEAUHMONITOR__@@@Z	3884	0x14002b498
?UserTextChanged@TouchEditBase@DirectUI@@SA?AVUID@@XZ	3885	0x14003d6f8
?UserTextUpdateNoChange@TouchEditBase@DirectUI@@SA?AVUID@@XZ	3886	0x14000b0c8
?UsesDesktopPerMonitorScalingProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3887	0x1400196cc
?ValuePattern@Schema@DirectUI@@2HA	3888	0x14001594c
?Value_IsReadOnly_Property@Schema@DirectUI@@2HA	3889	0x140003cf4
?Value_Value_Property@Schema@DirectUI@@2HA	3890	0x1400088a4
?VerifyParentage@HWNDHost@DirectUI@@IEAAHXZ	3891	0x14001be2c
?VerticalProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3892	0x14001ab60
?VerticalScriptProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	3893	0x140015518
?VirtualizedItemPattern@Schema@DirectUI@@2HA	3894	0x1400059fc
?VisibleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3895	0x14001b3d8
?VisitedProp@TouchHyperLink@DirectUI@@SAPEBUPropertyInfo@2@XZ	3896	0x14000a7b0
?VisualStateProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3897	0x140036754
?WantEvent@EventManager@DirectUI@@CA_NW4Event@Schema@2@H@Z	3898	0x14001194c
?WantEvent@EventManager@DirectUI@@SA_NW4Event@Schema@2@@Z	3899	0x14000bf70
?WantPropertyEvent@EventManager@DirectUI@@SA_NH@Z	3900	0x14001f924
?WantTabsProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	3901	0x14000fe48
?WidthProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3902	0x14000df70
?WinStyleProp@CCBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3903	0x14003fa14
?WindowAccessGradientColorProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3904	0x140020d30
?WindowActiveProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3905	0x140003fdc
?WindowControlType@Schema@DirectUI@@2HA	3906	0x14000728c
?WindowDpiChanged@HWNDElement@DirectUI@@SA?AVUID@@XZ	3907	0x140028028
?WindowPattern@Schema@DirectUI@@2HA	3908	0x14002e5bc
?WindowWindowClosedEvent@Schema@DirectUI@@2HA	3909	0x1400091d4
?WindowWindowOpenedEvent@Schema@DirectUI@@2HA	3910	0x1400302e0
?WndProc@HWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z	3911	0x140039768
?WndProc@NativeHWNDHost@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z	3912	0x1400326f4
?WndProc@TouchHWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z	3913	0x14001101c
?WndProc@XHost@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z	3914	0x14001520c
?WrapKeyboardNavigateProp@HWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3915	0x140007f64
?XBarVisibilityProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3916	0x14001feb8
?XOffsetProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3917	0x14001930c
?XOffsetProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3918	0x14001c0fc
?XProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3919	0x140013770
?XScrollableProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3920	0x14003ad80
?XScrollableProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3921	0x140038958
?YBarVisibilityProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3922	0x14002298c
?YOffsetProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3923	0x14002fac8
?YOffsetProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3924	0x1400023b4
?YProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3925	0x14003bc8c
?YScrollableProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3926	0x140036cb8
?YScrollableProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3927	0x140015158
?ZoomToRect@TouchScrollViewer@DirectUI@@QEAAJPEBUtagRECT@@_N@Z	3928	0x1400312c0
?ZoomToRectManualVisualSwap@TouchScrollViewer@DirectUI@@QEAAJMMMMPEBHMMM_N@Z	3929	0x1400323e0
?_AddDependency@Element@DirectUI@@SAXPEAV12@PEBUPropertyInfo@2@HPEAUDepRecs@2@PEAVDeferCycle@2@PEAJ@Z	3930	0x14002f9b8
?_BitAccurateFillRect@Macro@DirectUI@@KAXPEAUHDC__@@HHHHEEEEK@Z	3931	0x14003e11c
?_BroadcastEventWorker@Element@DirectUI@@AEAAXPEAUEvent@2@@Z	3932	0x14000d830
?_BuildChildren@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAVElement@2@@Z	3933	0x14001cad0
?_BuildElement@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAVElement@2@PEAPEAV42@@Z	3934	0x14002a474
?_BuildFromBinary@DUIXmlParser@DirectUI@@IEAAJPEAVElement@2@0PEBGPEAKPEAPEAV32@@Z	3935	0x140024d50
?_BuildStyles@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	3936	0x140022870
?_CachedValueIsEqual@Element@DirectUI@@AEAAHPEBUPropertyInfo@2@PEAV12@@Z	3937	0x1400275e8
?_CalcTabOrder@ShellBorderLayout@DirectUI@@AEAAJPEAVElement@2@@Z	3938	0x14001c23c
?_ClearNeedsLayout@Element@DirectUI@@QEAAXXZ	3939	0x14003392c
?_ClearTooltipState@TouchHWNDElement@DirectUI@@IEAAXXZ	3940	0x1400157b4
?_CreateAndSetLayout@DirectUI@@YAJPEAVElement@1@P6AJHPEAHPEAPEAVValue@1@@ZH1@Z	3941	0x1400269e4
?_CreateValue@DUIXmlParser@DirectUI@@IEAAJPEBGPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	3942	0x14003d3f0
?_CtrlWndProc@HWNDHost@DirectUI@@CAHPEAXPEAUHWND__@@I_K_JPEA_J@Z	3943	0x140029778
?_DeleteCtrlWnd@HWNDHost@DirectUI@@AEAAXXZ	3944	0x140015204
?_DestroyTables@DUIXmlParser@DirectUI@@QEAAXXZ	3945	0x1400287a8
?_DestroyTooltip@TouchHWNDElement@DirectUI@@IEAAXXZ	3946	0x140011898
?_DisplayNodeCallback@Element@DirectUI@@SAJPEAUHGADGET__@@PEAXPEAUEventMsg@@@Z	3947	0x140007454
?_EndOptimizedLayoutQ@Element@DirectUI@@QEAAXXZ	3948	0x140038de8
?_EnterOnCurrentThread@DUIXmlParser@DirectUI@@IEAAJXZ	3949	0x14001a5e4
?_Fill@Element@DirectUI@@IEAAXPEAUHDC__@@KHHHH_N@Z	3950	0x14003c2a8
?_FireWindowDpiChangeEvent@HWNDElement@DirectUI@@IEAAXXZ	3951	0x140037fac
?_FlushDS@Element@DirectUI@@AEAAXPEAVDeferCycle@2@@Z	3952	0x140003fe4
?_FlushLayout@Element@DirectUI@@KAXPEAV12@PEAVDeferCycle@2@@Z	3953	0x14002b0f0
?_GetBitmapSize@Macro@DirectUI@@KA_NPEAUHBITMAP__@@PEAUtagSIZE@@@Z	3954	0x14000a320
?_GetBuriedSheetDependencies@Element@DirectUI@@AEAAXPEBUPropertyInfo@2@PEAV12@PEAUDepRecs@2@PEAVDeferCycle@2@PEAJ@Z	3955	0x140018810
?_GetChangesUpdatePass@Element@DirectUI@@QEAAHXZ	3956	0x1400132f4
?_GetClassForElement@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAPEAUIClassInfo@2@@Z	3957	0x140030ed0
?_GetClassForElementByName@DUIXmlParser@DirectUI@@IEAAJPEBGPEAPEAUIClassInfo@2@@Z	3958	0x14000d3c0
?_GetComputedValue@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@PEAUUpdateCache@2@@Z	3959	0x14000d210
?_GetContent@Viewer@DirectUI@@AEAAPEAVElement@2@XZ	3960	0x140026940
?_GetDependencies@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@HPEAUDepRecs@2@HPEAVValue@2@PEAVDeferCycle@2@@Z	3961	0x14000a390
?_GetLineInfo@DUIXmlParser@DirectUI@@IEAA?AULINEINFO@2@PEAUIXmlReader@@@Z	3962	0x14000daf0
?_GetLocalValue@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@@Z	3963	0x14002bb98
?_GetLocalValueFromVM@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@@Z	3964	0x140012174
?_GetNeedsLayout@Element@DirectUI@@QEAAIXZ	3965	0x14001fb74
?_GetPerMonitorScaleFactorForDesktopWindow@HWNDElement@DirectUI@@IEAAHPEAUHWND__@@@Z	3966	0x1400193a4
?_GetPropertyForAttribute@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUIClassInfo@2@PEAPEBUPropertyInfo@2@@Z	3967	0x140039810
?_GetSpecifiedValue@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@PEAUUpdateCache@2@@Z	3968	0x140026750
?_GetSpecifiedValueIgnoreCache@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@@Z	3969	0x14000c728
?_GetValueForStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEAUIClassInfo@2@PEBG1PEAPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	3970	0x140006150
?_HandleImmersiveColorSchemeChange@HWNDElement@DirectUI@@IEAAXXZ	3971	0x140029cec
?_InheritProperties@Element@DirectUI@@AEAAXXZ	3972	0x1400268a8
?_InitializeTables@DUIXmlParser@DirectUI@@QEAAJXZ	3973	0x140021078
?_InternalEnsureVisible@Viewer@DirectUI@@AEAA_NHHHH@Z	3974	0x14003afd0
?_InvalidateCachedDSConstraints@Element@DirectUI@@KAXPEAV12@@Z	3975	0x140012aa0
?_IsSemanticZoomControl@ElementProxy@DirectUI@@AEAA_NH@Z	3976	0x140022e10
?_IsWindowHostUsingDoNotStealFocusFlag@ElementProxy@DirectUI@@AEAA_NXZ	3977	0x1400249d4
?_LeaveOnCurrentThread@DUIXmlParser@DirectUI@@IEAAXXZ	3978	0x14002ec4c
?_LoadImage32BitsPerPixel@Macro@DirectUI@@KAPEAVValue@2@PEBG@Z	3979	0x140018a04
?_MarkElementForDS@Element@DirectUI@@SAHPEAV12@@Z	3980	0x14003bf6c
?_MarkElementForLayout@Element@DirectUI@@SAHPEAV12@I@Z	3981	0x1400297f8
?_OnFontPropChanged@Element@DirectUI@@IEAAXPEAVValue@2@@Z	3982	0x14002af3c
?_OnGetInfoTip@CCTreeView@DirectUI@@MEAAJPEBUtagNMTVGETINFOTIPW@@@Z	3983	0x14002fdc4
?_OnItemChanged@CCTreeView@DirectUI@@MEAAJPEBUtagTVITEMCHANGE@@@Z	3984	0x140036868
?_OnUIStateChanged@HWNDElement@DirectUI@@MEAAXGG@Z	3985	0x14001d984
?_OnUIStateChanged@TouchHWNDElement@DirectUI@@MEAAXGG@Z	3986	0x140008038
?_ParseBehavior@DUIXmlParser@DirectUI@@IEAAJPEAVElement@2@PEBG@Z	3987	0x14002177c
?_ParseLayout@DUIXmlParser@DirectUI@@IEAAJPEBGPEAPEAVValue@2@@Z	3988	0x140028350
?_ParseValue@DUIXmlParser@DirectUI@@IEAAJPEBUPropertyInfo@2@PEBGPEAPEAVValue@2@@Z	3989	0x1400168bc
?_PostEvent@Element@DirectUI@@AEAAXPEAUEvent@2@H@Z	3990	0x1400297f0
?_PostSourceChange@Element@DirectUI@@AEAAJXZ	3991	0x140005c10
?_PreSourceChange@Element@DirectUI@@AEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@1@Z	3992	0x14002fc7c
?_PreSourceChange@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@HPEAVValue@2@1@Z	3993	0x140014f7c
?_RecordElementBehaviors@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBG@Z	3994	0x14000f1d0
?_RecordElementLayout@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBG@Z	3995	0x14002c120
?_RecordElementStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEBG_N@Z	3996	0x14001b18c
?_RecordElementTrees@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	3997	0x140030e90
?_RecordElementWithChildren@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@_NPEAPEAG@Z	3998	0x140024e98
?_RecordInstantiateElement@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAPEAG@Z	3999	0x140008e44
?_RecordSetElementProperties@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	4000	0x14001274c
?_RecordSetValue@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBG1@Z	4001	0x140012970
?_RemoveLocalValue@Element@DirectUI@@IEAAJP6APEBUPropertyInfo@2@XZ_N@Z	4002	0x140041044
?_RemoveLocalValue@Element@DirectUI@@IEAAJPEBUPropertyInfo@2@_N@Z	4003	0x14000957c
?_RepeatButtonActionCallback@RepeatButton@DirectUI@@CAXPEAUGMA_ACTIONINFO@@@Z	4004	0x14000def4
?_Reset@ShellBorderLayout@DirectUI@@AEAAXXZ	4005	0x140005244
?_ResolveStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEBGPEAPEAVValue@2@PEAI@Z	4006	0x140033704
?_ScalePointsToPixels@DUIXmlParser@DirectUI@@AEBAHH@Z	4007	0x14000a2d8
?_ScalePointsToPixels@DUIXmlParser@DirectUI@@AEBAMM@Z	4008	0x140027634
?_ScaleRelativePixels@DUIXmlParser@DirectUI@@AEBAHH@Z	4009	0x14001c3d4
?_ScaleRelativePixels@DUIXmlParser@DirectUI@@AEBAMM@Z	4010	0x14003518c
?_SelfLayoutDoLayout@Clipper@DirectUI@@UEAAXHH@Z	4011	0x1400140cc
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z	4012	0x14003e4bc
?_SelfLayoutDoLayout@ScrollBar@DirectUI@@UEAAXHH@Z	4013	0x140007b60
?_SelfLayoutDoLayout@TouchScrollBar@DirectUI@@UEAAXHH@Z	4014	0x14004162c
?_SelfLayoutDoLayout@Viewer@DirectUI@@UEAAXHH@Z	4015	0x140040e14
?_SelfLayoutUpdateDesiredSize@Clipper@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4016	0x14001bc1c
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4017	0x14000a0ac
?_SelfLayoutUpdateDesiredSize@ScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4018	0x14000e870
?_SelfLayoutUpdateDesiredSize@TouchScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4019	0x140020e68
?_SelfLayoutUpdateDesiredSize@Viewer@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4020	0x14000c3a0
?_SetBinaryXml@DUIXmlParser@DirectUI@@IEAAJPEBE_KPEAUHINSTANCE__@@@Z	4021	0x14000f8d0
?_SetGroupChanges@Element@DirectUI@@SA_NPEAV12@HPEAVDeferCycle@2@@Z	4022	0x140021a28
?_SetNeedsLayout@Element@DirectUI@@QEAAHI@Z	4023	0x140034638
?_SetProperties@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUIClassInfo@2@PEAVElement@2@@Z	4024	0x14001deb4
?_SetRelPixRect@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@HHHH@Z	4025	0x1400339d0
?_SetRelPixValue@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@H@Z	4026	0x140030d84
?_SetValue@Element@DirectUI@@IEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@_N@Z	4027	0x14003b730
?_SetValue@Element@DirectUI@@IEAAJPEBUPropertyInfo@2@HPEAVValue@2@_N@Z	4028	0x140035908
?_SetXMLFromResource@DUIXmlParser@DirectUI@@IEAAJPEBG0PEAUHINSTANCE__@@11@Z	4029	0x140006e10
?_SetupParserState@DUIXmlParser@DirectUI@@IEAAJPEAUHINSTANCE__@@0@Z	4030	0x14003da1c
?_SinkWndProc@HWNDHost@DirectUI@@CAHPEAXPEAUHWND__@@I_K_JPEA_J@Z	4031	0x14002d830
?_StartOptimizedLayoutQ@Element@DirectUI@@QEAAXXZ	4032	0x140013d04
?_SyncBackground@Element@DirectUI@@AEAAXXZ	4033	0x1400125dc
?_SyncRedrawStyle@Element@DirectUI@@AEAAXXZ	4034	0x140003c44
?_SyncVisible@Element@DirectUI@@AEAAXXZ	4035	0x14001a1e0
?_TransferGroupFlags@Element@DirectUI@@SAXPEAV12@H@Z	4036	0x14000e86c
?_UpdateDesiredSize@Element@DirectUI@@QEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4037	0x140040260
?_UpdateDesktopScaleFactor@HWNDElement@DirectUI@@AEAAHXZ	4038	0x1400022a0
?_UpdateLayoutPosition@Element@DirectUI@@QEAAXHH@Z	4039	0x140009b88
?_UpdateLayoutSize@Element@DirectUI@@QEAAXHH@Z	4040	0x14001ed18
?_UpdatePropertyInCache@Element@DirectUI@@AEAAXPEBUPropertyInfo@2@@Z	4041	0x14001aafc
?_UpdateTileList@NineGridLayout@DirectUI@@AEAAXHPEAVElement@2@@Z	4042	0x14001841c
?_UsesUIAProxies@ElementProxy@DirectUI@@IEAAHXZ	4043	0x1400076dc
?_VoidPCNotifyTree@Element@DirectUI@@CAXHPEAVDeferCycle@2@@Z	4044	0x140028ea4
?_WndProc@InvokeHelper@DirectUI@@CAHPEAXPEAUHWND__@@I_K_JPEA_J@Z	4045	0x14001ac58
?_ZeroRelease@Value@DirectUI@@AEAAXXZ	4046	0x140021370
?_atmArrow@Expando@DirectUI@@0GA	4047	0x140031de0
?_atmClipper@Expando@DirectUI@@0GA	4048	0x14000ead4
?_roleMapping@Schema@DirectUI@@0QBURoleMap@12@B	4049	0x1400076a4
?accDoDefaultAction@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@@Z	4050	0x140009c8c
?accDoDefaultAction@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@@Z	4051	0x1400353f4
?accHitTest@DuiAccessible@DirectUI@@UEAAJJJPEAUtagVARIANT@@@Z	4052	0x140013774
?accHitTest@HWNDHostAccessible@DirectUI@@UEAAJJJPEAUtagVARIANT@@@Z	4053	0x140023da8
?accLocation@DuiAccessible@DirectUI@@UEAAJPEAJ000UtagVARIANT@@@Z	4054	0x140006cc8
?accLocation@HWNDHostAccessible@DirectUI@@UEAAJPEAJ000UtagVARIANT@@@Z	4055	0x14003587c
?accNavigate@DuiAccessible@DirectUI@@UEAAJJUtagVARIANT@@PEAU3@@Z	4056	0x14001dc40
?accNavigate@HWNDHostAccessible@DirectUI@@UEAAJJUtagVARIANT@@PEAU3@@Z	4057	0x140040770
?accNavigate@HWNDHostClientAccessible@DirectUI@@UEAAJJUtagVARIANT@@PEAU3@@Z	4058	0x14003549c
?accSelect@DuiAccessible@DirectUI@@UEAAJJUtagVARIANT@@@Z	4059	0x140034818
?accSelect@HWNDHostAccessible@DirectUI@@UEAAJJUtagVARIANT@@@Z	4060	0x14001a5ac
?advanceFrameActionStart@Movie@DirectUI@@AEAAXXZ	4061	0x140035700
?advanceFrameActionStop@Movie@DirectUI@@AEAAXXZ	4062	0x14000219c
?cChangeBulk@EventManager@DirectUI@@0HB	4063	0x14003f65c
?c_RefCountBitOffset@Value@DirectUI@@0HB	4064	0x140017014
?c_RefCountMask@Value@DirectUI@@0JB	4065	0x140005080
?c_SingleRefCount@Value@DirectUI@@0JB	4066	0x14003a33c
?c_rgar@AccessibleButton@DirectUI@@0QBUACCESSIBLEROLE@12@B	4067	0x140040550
?doAction@Movie@DirectUI@@QEAAXPEAUGMA_ACTIONINFO@@@Z	4068	0x14000d0cc
?g_cRefCount@ResourceModuleHandles@DirectUI@@0JC	4069	0x14000ab3c
?g_controlInfoTable@Schema@DirectUI@@0QBUControlInfo@12@B	4070	0x140005580
?g_cs@ElementProviderManager@DirectUI@@2U_RTL_CRITICAL_SECTION@@A	4071	0x14001fa98
?g_cs@EventManager@DirectUI@@0U_RTL_CRITICAL_SECTION@@A	4072	0x14003e168
?g_cs@InvokeManager@DirectUI@@0U_RTL_CRITICAL_SECTION@@A	4073	0x140039040
?g_dwElSlot@DirectUI@@3KA	4074	0x14003ebcc
?g_eventInfoTable@Schema@DirectUI@@0QBUEventInfo@12@B	4075	0x1400241f8
?g_eventMapping@Schema@DirectUI@@0QBUEventMap@12@B	4076	0x14001c418
?g_eventRegisteredMap@EventManager@DirectUI@@0PAIA	4077	0x140007d8c
?g_fInited@Schema@DirectUI@@0_NA	4078	0x140014eb0
?g_fWantAnyEvent@EventManager@DirectUI@@0_NA	4079	0x140029e1c
?g_pArrayInvokeHelper@InvokeManager@DirectUI@@0PEAV?$UiaArray@PEAVInvokeHelper@DirectUI@@@2@EA	4080	0x140025c14
?g_pArrayPprv@ElementProviderManager@DirectUI@@0PEAV?$UiaArray@PEAVElementProvider@DirectUI@@@2@EA	4081	0x14001c6f0
?g_pArrayPropertyEvent@EventManager@DirectUI@@0PEAV?$UiaArray@H@2@EA	4082	0x140027b08
?g_patternInfoTable@Schema@DirectUI@@0QBUPatternInfo@12@B	4083	0x14002eb94
?g_patternMapping@Schema@DirectUI@@0QBUPatternMap@12@B	4084	0x1400093f0
?g_propertyInfoTable@Schema@DirectUI@@0QBUPropertyInfo@12@B	4085	0x140036990
?g_rgMouseMap@HWNDHost@DirectUI@@0QAY02$$CBIA	4086	0x1400217a4
?get_BoundingRectangle@ElementProvider@DirectUI@@UEAAJPEAUUiaRect@@@Z	4087	0x14003bbc4
?get_CanSelectMultiple@SelectionProvider@DirectUI@@UEAAJPEAH@Z	4088	0x1400322bc
?get_Column@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4089	0x14002529c
?get_ColumnCount@GridProvider@DirectUI@@UEAAJPEAH@Z	4090	0x140023e9c
?get_ColumnSpan@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4091	0x140004ed4
?get_ContainingGrid@GridItemProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z	4092	0x1400271a4
?get_ExpandCollapseState@ExpandCollapseProvider@DirectUI@@UEAAJPEAW4ExpandCollapseState@@@Z	4093	0x140036b68
?get_FragmentRoot@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderFragmentRoot@@@Z	4094	0x140012278
?get_HorizontalScrollPercent@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4095	0x14002fb90
?get_HorizontalViewSize@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4096	0x14000a4c0
?get_HorizontallyScrollable@ScrollProvider@DirectUI@@UEAAJPEAH@Z	4097	0x140015cb4
?get_HostRawElementProvider@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z	4098	0x1400411dc
?get_IsReadOnly@RangeValueProvider@DirectUI@@UEAAJPEAH@Z	4099	0x14001a208
?get_IsReadOnly@ValueProvider@DirectUI@@UEAAJPEAH@Z	4100	0x14002fee0
?get_IsSelected@SelectionItemProvider@DirectUI@@UEAAJPEAH@Z	4101	0x14001ac00
?get_IsSelectionRequired@SelectionProvider@DirectUI@@UEAAJPEAH@Z	4102	0x1400370a8
?get_LargeChange@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4103	0x14001862c
?get_Maximum@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4104	0x14000eb74
?get_Minimum@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4105	0x140026edc
?get_ProviderOptions@ElementProvider@DirectUI@@UEAAJPEAW4ProviderOptions@@@Z	4106	0x14000ee60
?get_Row@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4107	0x14003c91c
?get_RowCount@GridProvider@DirectUI@@UEAAJPEAH@Z	4108	0x140039e88
?get_RowOrColumnMajor@TableProvider@DirectUI@@UEAAJPEAW4RowOrColumnMajor@@@Z	4109	0x14000fe18
?get_RowSpan@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4110	0x1400276d8
?get_SelectionContainer@SelectionItemProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z	4111	0x14000ed68
?get_SmallChange@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4112	0x140031220
?get_ToggleState@ToggleProvider@DirectUI@@UEAAJPEAW4ToggleState@@@Z	4113	0x14003bb3c
?get_Value@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4114	0x140039564
?get_Value@ValueProvider@DirectUI@@UEAAJPEAPEAG@Z	4115	0x1400036f0
?get_VerticalScrollPercent@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4116	0x140041124
?get_VerticalViewSize@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4117	0x140017ecc
?get_VerticallyScrollable@ScrollProvider@DirectUI@@UEAAJPEAH@Z	4118	0x14000ff30
?get_accChild@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAUIDispatch@@@Z	4119	0x140025070
?get_accChild@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAUIDispatch@@@Z	4120	0x1400127dc
?get_accChildCount@DuiAccessible@DirectUI@@UEAAJPEAJ@Z	4121	0x14002a5bc
?get_accChildCount@HWNDHostAccessible@DirectUI@@UEAAJPEAJ@Z	4122	0x14003b6f0
?get_accDefaultAction@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4123	0x1400328a8
?get_accDefaultAction@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4124	0x140016bb8
?get_accDescription@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4125	0x14003b764
?get_accDescription@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4126	0x140036a1c
?get_accFocus@DuiAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4127	0x140036060
?get_accFocus@HWNDHostAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4128	0x14002e9e4
?get_accHelp@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4129	0x14002eae8
?get_accHelp@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4130	0x1400406f4
?get_accHelpTopic@DuiAccessible@DirectUI@@UEAAJPEAPEAGUtagVARIANT@@PEAJ@Z	4131	0x14001f6e8
?get_accHelpTopic@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAGUtagVARIANT@@PEAJ@Z	4132	0x140019b74
?get_accKeyboardShortcut@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4133	0x140034b90
?get_accKeyboardShortcut@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4134	0x14003aeb0
?get_accName@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4135	0x14002f2f0
?get_accName@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4136	0x14003ac98
?get_accParent@DuiAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4137	0x140015314
?get_accParent@HWNDElementAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4138	0x14003e340
?get_accParent@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4139	0x140014700
?get_accParent@HWNDHostClientAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4140	0x140028aa8
?get_accRole@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4141	0x14002c740
?get_accRole@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4142	0x140005c94
?get_accRole@HWNDHostClientAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4143	0x1400088c8
?get_accSelection@DuiAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4144	0x140006d68
?get_accSelection@HWNDHostAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4145	0x140032130
?get_accState@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4146	0x14003365c
?get_accState@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4147	0x140026fd4
?get_accValue@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4148	0x14003c780
?get_accValue@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4149	0x140033500
?put_accName@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4150	0x1400064f0
?put_accName@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4151	0x140021c08
?put_accValue@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4152	0x14001c944
?put_accValue@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4153	0x14003c000
?s_HandleDUIEventMessage@Element@DirectUI@@CA_NPEAV12@PEAUEventMsg@@@Z	4154	0x1400104cc
?s_ImageHlpFuncList@CallstackTracker@DirectUI@@0PAUIMGHLPFN_LOAD@12@A	4155	0x140033bfc
?s_SyncCallback@CSafeElementProxy@@SAJPEAUHGADGET__@@PEAXPEAUEventMsg@@@Z	4156	0x14000597c
?s_XMLParseError@DUIFactory@DirectUI@@CAXPEBG0HPEAX@Z	4157	0x140024ae0
?s_fdClr@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@K@12@B	4158	0x140035834
?s_fdFill@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@PEAVValue@DirectUI@@@12@B	4159	0x14002b208
?s_fdGraphic@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@PEAVValue@DirectUI@@@12@B	4160	0x14003763c
?s_fdInt@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@H@12@B	4161	0x140034eac
?s_fdRect@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@UScaledRECT@DirectUI@@@12@B	4162	0x140037000
?s_fdSize@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@UScaledSIZE@DirectUI@@@12@B	4163	0x14003acd4
?s_fdString@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@PEAVValue@DirectUI@@@12@B	4164	0x1400182ec
?s_hProcess@CallstackTracker@DirectUI@@0PEAXEA	4165	0x140012950
?s_hinstImageHlp@CallstackTracker@DirectUI@@0PEAUHINSTANCE__@@EA	4166	0x14003c410
?s_hinstNtDll@CallstackTracker@DirectUI@@0PEAUHINSTANCE__@@EA	4167	0x140016754
?s_initonceInit@CallstackTracker@DirectUI@@0T_RTL_RUN_ONCE@@A	4168	0x14002ba24
?s_pClassInfo@AccessibleButton@DirectUI@@0PEAUIClassInfo@2@EA	4169	0x140012934
?s_pClassInfo@AnimationStrip@DirectUI@@0PEAUIClassInfo@2@EA	4170	0x140023964
?s_pClassInfo@AutoButton@DirectUI@@0PEAUIClassInfo@2@EA	4171	0x140016c28
?s_pClassInfo@BaseScrollViewer@DirectUI@@0PEAUIClassInfo@2@EA	4172	0x140033e50
?s_pClassInfo@Bind@DirectUI@@0PEAUIClassInfo@2@EA	4173	0x140028b7c
?s_pClassInfo@Browser@DirectUI@@0PEAUIClassInfo@2@EA	4174	0x14000a048
?s_pClassInfo@Button@DirectUI@@0PEAUIClassInfo@2@EA	4175	0x14000181c
?s_pClassInfo@CCAVI@DirectUI@@0PEAUIClassInfo@2@EA	4176	0x14002a878
?s_pClassInfo@CCBase@DirectUI@@0PEAUIClassInfo@2@EA	4177	0x14003e8f8
?s_pClassInfo@CCBaseCheckRadioButton@DirectUI@@0PEAUIClassInfo@2@EA	4178	0x14003612c
?s_pClassInfo@CCBaseScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4179	0x140025b24
?s_pClassInfo@CCCheckBox@DirectUI@@0PEAUIClassInfo@2@EA	4180	0x14001ceac
?s_pClassInfo@CCCommandLink@DirectUI@@0PEAUIClassInfo@2@EA	4181	0x14003293c
?s_pClassInfo@CCHScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4182	0x14000cc64
?s_pClassInfo@CCListBox@DirectUI@@0PEAUIClassInfo@2@EA	4183	0x14003e834
?s_pClassInfo@CCListView@DirectUI@@0PEAUIClassInfo@2@EA	4184	0x1400194cc
?s_pClassInfo@CCProgressBar@DirectUI@@0PEAUIClassInfo@2@EA	4185	0x14002cb00
?s_pClassInfo@CCPushButton@DirectUI@@0PEAUIClassInfo@2@EA	4186	0x140006e3c
?s_pClassInfo@CCRadioButton@DirectUI@@0PEAUIClassInfo@2@EA	4187	0x14000f760
?s_pClassInfo@CCSysLink@DirectUI@@0PEAUIClassInfo@2@EA	4188	0x140032f48
?s_pClassInfo@CCTrackBar@DirectUI@@0PEAUIClassInfo@2@EA	4189	0x140030fe0
?s_pClassInfo@CCTreeView@DirectUI@@0PEAUIClassInfo@2@EA	4190	0x140015924
?s_pClassInfo@CCVScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4191	0x1400042d4
?s_pClassInfo@CheckBoxGlyph@DirectUI@@0PEAUIClassInfo@2@EA	4192	0x140011e28
?s_pClassInfo@Clipper@DirectUI@@0PEAUIClassInfo@2@EA	4193	0x14001d07c
?s_pClassInfo@Combobox@DirectUI@@0PEAUIClassInfo@2@EA	4194	0x140028288
?s_pClassInfo@DialogElement@DirectUI@@0PEAUIClassInfo@2@EA	4195	0x14002051c
?s_pClassInfo@Edit@DirectUI@@0PEAUIClassInfo@2@EA	4196	0x14001a4ac
?s_pClassInfo@Element@DirectUI@@0PEAUIClassInfo@2@EA	4197	0x14000d704
?s_pClassInfo@ElementWithHWND@DirectUI@@0PEAUIClassInfo@2@EA	4198	0x1400206b8
?s_pClassInfo@Expandable@DirectUI@@0PEAUIClassInfo@2@EA	4199	0x140003ca0
?s_pClassInfo@Expando@DirectUI@@0PEAUIClassInfo@2@EA	4200	0x140001e88
?s_pClassInfo@ExpandoButtonGlyph@DirectUI@@0PEAUIClassInfo@2@EA	4201	0x140008e98
?s_pClassInfo@HWNDElement@DirectUI@@0PEAUIClassInfo@2@EA	4202	0x140024dac
?s_pClassInfo@HWNDHost@DirectUI@@0PEAUIClassInfo@2@EA	4203	0x140020e40
?s_pClassInfo@Macro@DirectUI@@0PEAUIClassInfo@2@EA	4204	0x1400129c8
?s_pClassInfo@Movie@DirectUI@@0PEAUIClassInfo@2@EA	4205	0x14003b028
?s_pClassInfo@Navigator@DirectUI@@0PEAUIClassInfo@2@EA	4206	0x14003bab4
?s_pClassInfo@PText@DirectUI@@0PEAUIClassInfo@2@EA	4207	0x14003b0cc
?s_pClassInfo@Page@DirectUI@@0PEAUIClassInfo@2@EA	4208	0x140013ee0
?s_pClassInfo@Pages@DirectUI@@0PEAUIClassInfo@2@EA	4209	0x1400357a0
?s_pClassInfo@Progress@DirectUI@@0PEAUIClassInfo@2@EA	4210	0x140022f24
?s_pClassInfo@PushButton@DirectUI@@0PEAUIClassInfo@2@EA	4211	0x14002600c
?s_pClassInfo@RadioButtonGlyph@DirectUI@@0PEAUIClassInfo@2@EA	4212	0x140035f9c
?s_pClassInfo@RefPointElement@DirectUI@@0PEAUIClassInfo@2@EA	4213	0x14001cf40
?s_pClassInfo@RepeatButton@DirectUI@@0PEAUIClassInfo@2@EA	4214	0x1400203f0
?s_pClassInfo@Repeater@DirectUI@@0PEAUIClassInfo@2@EA	4215	0x14001fc18
?s_pClassInfo@ScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4216	0x140025748
?s_pClassInfo@ScrollViewer@DirectUI@@0PEAUIClassInfo@2@EA	4217	0x140030ed4
?s_pClassInfo@Selector@DirectUI@@0PEAUIClassInfo@2@EA	4218	0x140041260
?s_pClassInfo@SelectorNoDefault@DirectUI@@0PEAUIClassInfo@2@EA	4219	0x140040e74
?s_pClassInfo@StyledScrollViewer@DirectUI@@0PEAUIClassInfo@2@EA	4220	0x1400333b4
?s_pClassInfo@TextGraphic@DirectUI@@0PEAUIClassInfo@2@EA	4221	0x140035d14
?s_pClassInfo@Thumb@DirectUI@@0PEAUIClassInfo@2@EA	4222	0x14001a6ac
?s_pClassInfo@UnknownElement@DirectUI@@0PEAUIClassInfo@2@EA	4223	0x140020e4c
?s_pClassInfo@Viewer@DirectUI@@0PEAUIClassInfo@2@EA	4224	0x14000a79c
?s_pClassInfo@XBaby@DirectUI@@0PEAUIClassInfo@2@EA	4225	0x1400290d0
?s_pClassInfo@XElement@DirectUI@@0PEAUIClassInfo@2@EA	4226	0x140013ce4
?s_pfnImagehlpApiVersionEx@CallstackTracker@DirectUI@@0P6APEAUAPI_VERSION@@PEAU3@@ZEA	4227	0x14002fc24
?s_pfnRtlCaptureStackBackTrace@CallstackTracker@DirectUI@@0P6AGKKPEAPEAXPEAK@ZEA	4228	0x14002535c
?s_pfnSymFromAddr@CallstackTracker@DirectUI@@0P6AHPEAX_KPEA_KPEAU_SYMBOL_INFO@@@ZEA	4229	0x140024690
?s_pfnSymGetModuleInfo64@CallstackTracker@DirectUI@@0P6AHPEAX_KPEAU_IMAGEHLP_MODULE64@@@ZEA	4230	0x140017238
?s_pfnSymInitialize@CallstackTracker@DirectUI@@0P6AHPEAXPEBDH@ZEA	4231	0x140031734
?s_pfnSymLoadModule64@CallstackTracker@DirectUI@@0P6A_KPEAX0PEBD1_KK@ZEA	4232	0x1400144dc
?s_pfnSymSetOptions@CallstackTracker@DirectUI@@0P6AKK@ZEA	4233	0x1400375ac
?s_uButtonFocusChangeMsg@XElement@DirectUI@@2IB	4234	0x14000dd0c
?s_uInvokeHelperMsg@InvokeHelper@DirectUI@@0IB	4235	0x14000ccd8
?s_uNavigateOutMsg@XElement@DirectUI@@2IB	4236	0x140038510
?s_uUnhandledSyscharMsg@XElement@DirectUI@@2IB	4237	0x1400018b4
ARGBColorFromEnumI	4238	0x14000a338
AllowAllScalingPlateaus	4239	0x140008074
BlurBitmap	4240	0x140038d88
BrushFromEnumI	4241	0x14003c66c
ColorFromEnumI	4242	0x140010794
CreateDUIWrapper	4243	0x14003abd0
CreateDUIWrapperEx	4244	0x14002f194
CreateDUIWrapperFromResource	4245	0x140037bc0
CreateDUIWrapperTouchEx	1274	0x14000c82c
CreateTouchTooltip	4246	0x140003c08
DUI70_DUIXmlParserCreate	4247	0x14001d27c
DUI70_DUIXmlParserCreateElement	4248	0x140021380
DUI70_DUIXmlParserDestroy	4249	0x14000ee74
DUI70_DUIXmlParserSetXMLFromResource	4250	0x140001bc8
DUI70_ElementAddListener	4251	0x140015c5c
DUI70_ElementDestroy	4252	0x140039d00
DUI70_ElementEndDefer	4253	0x14000e104
DUI70_ElementFindDescendent	4254	0x14001d4bc
DUI70_ElementGetChildren	4255	0x14000dac4
DUI70_ElementGetRoot	4256	0x140012f88
DUI70_ElementRemoveListener	4257	0x140006528
DUI70_ElementSetAccRole	4258	0x14003ee7c
DUI70_ElementSetAccessible	4259	0x1400317a4
DUI70_ElementSetContentAlign	4260	0x140013258
DUI70_ElementSetContentString	4261	0x140011300
DUI70_ElementSetFont	4262	0x140013454
DUI70_ElementSetID	4263	0x14003c1c8
DUI70_ElementSetLayoutPos	4264	0x140010508
DUI70_ElementSetVisible	4265	0x140018640
DUI70_ElementStartDefer	4266	0x140001c68
DUI70_IsTouchButtonClickEqual	4267	0x1400210b0
DUI70_RichTextCreate	4268	0x140018734
DUI70_RichTextSetConstrainLayout	4269	0x14003461c
DUI70_ValueRelease	4270	0x14002356c
DUIDrawShadowText	4271	0x1400234d0
DUIStopPVLAnimation	4272	0x140007b0c
DisableAnimations	4273	0x14000ead4
DisableInitCallstackTracking	4274	0x1400068bc
DrawShadowTextEx	4275	0x140014624
DuiCreateObject	1442	0x140033040
ElementFromGadget	4276	0x140038ebc
EnableAnimations	4277	0x140007784
FlushThemeHandles	4278	0x14000af98
ForceDebugBreak	4279	0x14000c8e8
GetDesktopDPI	4280	0x140026418
GetElementDataEntry	4281	0x1400235b8
GetElementMacro	4282	0x14003fab4
GetFontCache	4283	0x14002a9a4
GetScaleFactor	4284	0x14003c2e4
GetThemeHandle	4285	0x140025124
HStrDup	4286	0x1400177ac
HrSysAllocString	4287	0x14000b72c
InitPreprocessor	4288	0x140036248
InitProcessPriv	4289	0x14001ca80
InitThread	4290	0x140037bd8
IsAnimationsEnabled	4291	0x1400344e8
IsPalette	4292	0x14003c9a4
IsUIAutomationProviderEnabled	4293	0x14001342c
MultiByteToUnicode	4294	0x140008cf4
NotifyAccessibilityEvent	4295	0x14002231c
PreprocessBuffer	4296	0x14001f708
ProcessAlphaBitmapI	4297	0x14001d700
PurgeThemeHandles	4298	0x1400022a8
RegisterAllControls	4299	0x140034788
RegisterBaseControls	4300	0x140028188
RegisterBrowserControls	4301	0x14001b2cc
RegisterCommonControls	4302	0x140006f60
RegisterExtendedControls	4303	0x14003d5d4
RegisterMacroControls	4304	0x1400057d0
RegisterMiscControls	4305	0x14001cadc
RegisterPVLBehaviorFactory	4306	0x140009ce0
RegisterStandardControls	4307	0x1400013f0
RegisterXControls	4308	0x14003e1e8
SetDefAction	4309	0x140038bb8
SetDesktopDPIOverride	4310	0x140014e9c
SkipDLLUnloadInitChecks	4311	0x140028d44
StartMessagePump	4312	0x14002cd1c
StopMessagePump	4313	0x1400322a4
StrToID	4314	0x14003c86c
UiaHideOnGetObject	4315	0x140022b4c
UiaOnDestroySink	4316	0x14002ecc4
UiaOnGetObject	4317	0x140022400
UiaOnToolTip	4318	0x14003777c
UnInitProcessPriv	4319	0x140005200
UnInitThread	4320	0x14000eafc
UnicodeToMultiByte	4321	0x1400272ec

Version Infos

Description	Data
LegalCopyright	Microsoft Corporation. All rights reserv
InternalName	bitsp
FileVersion	7.5.7600.16385 (win7_rtm.090713-
CompanyName	Microsoft Corporati
ProductName	Microsoft Windows Operating S
ProductVersion	6.1.7600
FileDescription	Background Intellig
OriginalFilename	kbdy
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2021 03:55:32.824851990 CEST	62060	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:55:32.846780062 CEST	53	62060	8.8.8.8	192.168.2.5
Sep 29, 2021 03:55:44.047333002 CEST	61805	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:55:44.078934908 CEST	53	61805	8.8.8.8	192.168.2.5
Sep 29, 2021 03:56:03.675709009 CEST	54795	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:56:03.703730106 CEST	53	54795	8.8.8.8	192.168.2.5
Sep 29, 2021 03:56:34.775495052 CEST	49557	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:56:34.800957918 CEST	53	49557	8.8.8.8	192.168.2.5
Sep 29, 2021 03:56:41.187963963 CEST	61733	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:56:41.209106922 CEST	53	61733	8.8.8.8	192.168.2.5
Sep 29, 2021 03:57:16.786659956 CEST	65447	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:57:16.822380066 CEST	53	65447	8.8.8.8	192.168.2.5
Sep 29, 2021 03:57:19.102566004 CEST	52441	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:57:19.128288984 CEST	53	52441	8.8.8.8	192.168.2.5
Sep 29, 2021 03:58:00.429949999 CEST	62176	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:58:00.493772984 CEST	53	62176	8.8.8.8	192.168.2.5
Sep 29, 2021 03:58:00.925738096 CEST	59596	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:58:00.945153952 CEST	53	59596	8.8.8.8	192.168.2.5
Sep 29, 2021 03:58:01.490353107 CEST	65296	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:58:01.509752989 CEST	53	65296	8.8.8.8	192.168.2.5
Sep 29, 2021 03:58:02.278800964 CEST	63183	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:58:02.298979998 CEST	53	63183	8.8.8.8	192.168.2.5
Sep 29, 2021 03:58:02.678308010 CEST	60151	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:58:02.698097944 CEST	53	60151	8.8.8.8	192.168.2.5
Sep 29, 2021 03:58:03.136235952 CEST	56969	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:58:03.155426025 CEST	53	56969	8.8.8.8	192.168.2.5
Sep 29, 2021 03:58:03.616520882 CEST	55161	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:58:03.650180101 CEST	53	55161	8.8.8.8	192.168.2.5
Sep 29, 2021 03:58:07.848325968 CEST	54757	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:58:07.868166924 CEST	53	54757	8.8.8.8	192.168.2.5
Sep 29, 2021 03:58:08.846414089 CEST	49992	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:58:08.865818977 CEST	53	49992	8.8.8.8	192.168.2.5
Sep 29, 2021 03:58:10.176279068 CEST	60075	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:58:10.197550058 CEST	53	60075	8.8.8.8	192.168.2.5
Sep 29, 2021 03:58:10.518765926 CEST	55016	53	192.168.2.5	8.8.8.8
Sep 29, 2021 03:58:10.553874969 CEST	53	55016	8.8.8.8	192.168.2.5

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll64.exe PID: 4956 Parent PID: 804

General

Start time:	03:55:35
Start date:	29/09/2021
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe 'C:\Users\user\Desktop\CiEceGPoOR.dll'
Imagebase:	0x7ff7859f0000
File size:	1136128 bytes
MD5 hash:	E0CC9D126C39A9D2FA1CAD5027EBBD18
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 4916 Parent PID: 4956

General

Start time:	03:55:36
Start date:	29/09/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\CiEceGPoOR.dll',#1
Imagebase:	0x7ff7eef80000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 4756 Parent PID: 4916

General

Start time:	03:55:36
Start date:	29/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe 'C:\Users\user\Desktop\CiEceGPoOR.dll',#1
Imagebase:	0x7ff786160000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000002.00000002.339185192.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 3228 Parent PID: 4956

General

Start time:	03:55:36
Start date:	29/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\CiEceGPoOR.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ
Imagebase:	0x7ff786160000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000003.00000002.253536981.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 3472 Parent PID: 4756

General

Start time:	03:55:38
Start date:	29/09/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff693d90000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2964 Parent PID: 4956

General

Start time:	03:55:40
Start date:	29/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\CiEceGPoOR.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ
Imagebase:	0x7ff786160000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000007.00000002.260833878.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5228 Parent PID: 4956

General

Start time:	03:55:43
Start date:	29/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\CiEceGPoOR.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ
Imagebase:	0x7ff786160000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000000A.00000002.268716589.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: BdeUISrv.exe PID: 7060 Parent PID: 3472

General

Start time:	03:56:20
Start date:	29/09/2021
Path:	C:\Windows\System32\BdeUISrv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\BdeUISrv.exe
Imagebase:	0x7ff7312e0000
File size:	52736 bytes
MD5 hash:	25D86BC656025F38D6E626B606F1D39D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: BdeUISrv.exe PID: 7076 Parent PID: 3472

General

Start time:	03:56:21
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\f49B\BdeUISrv.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\f49B\BdeUISrv.exe
Imagebase:	0x7ff7caa60000
File size:	52736 bytes
MD5 hash:	25D86BC656025F38D6E626B606F1D39D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000016.00000002.369765886.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: WMPDMC.exe PID: 496 Parent PID: 3472

General

Start time:	03:56:33
Start date:	29/09/2021
Path:	C:\Windows\System32\WMPDMC.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WMPDMC.exe
Imagebase:	0x7ff6c7670000
File size:	1517568 bytes
MD5 hash:	4085FDA375E50214142BD740559F5835
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WMPDMC.exe PID: 476 Parent PID: 3472

General

Start time:	03:56:34
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\WMp\WMPDMC.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\WMp\WMPDMC.exe
Imagebase:	0x7ff71e310000
File size:	1517568 bytes
MD5 hash:	4085FDA375E50214142BD740559F5835
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000018.00000002.396379510.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: LockScreenContentServer.exe PID: 3620 Parent PID: 3472

General

Start time:	03:56:45
Start date:	29/09/2021
Path:	C:\Windows\System32\LockScreenContentServer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\LockScreenContentServer.exe
Imagebase:	0x7ff605300000
File size:	47600 bytes
MD5 hash:	45E51238434FAF543D66E17EF3783413
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: LockScreenContentServer.exe PID: 5012 Parent PID: 3472

General

Start time:	03:56:46
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\ukxAYmxLA\LockScreenContentServer.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\ukxAYmxLA\LockScreenContentServer.exe
Imagebase:	0x7ff755d00000
File size:	47600 bytes
MD5 hash:	45E51238434FAF543D66E17EF3783413
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000001C.00000002.424243110.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: mspaint.exe PID: 6932 Parent PID: 3472

General

Start time:	03:56:59
Start date:	29/09/2021
Path:	C:\Windows\System32\mspaint.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\mspaint.exe
Imagebase:	0x7ff7308c0000
File size:	6780928 bytes
MD5 hash:	99F86A0D360FD9A3FCAD6B1E7D92A90C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: mspaint.exe PID: 6940 Parent PID: 3472

General

Start time:	03:57:00
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\vbVu\mspaint.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\vbVu\mspaint.exe
Imagebase:	0x7ff67b100000
File size:	6780928 bytes
MD5 hash:	99F86A0D360FD9A3FCAD6B1E7D92A90C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000020.00000002.455241434.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: SystemPropertiesRemote.exe PID: 5680 Parent PID: 3472

General

Start time:	03:57:13
Start date:	29/09/2021
Path:	C:\Windows\System32\SystemPropertiesRemote.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SystemPropertiesRemote.exe
Imagebase:	0x7ff74b730000
File size:	83968 bytes
MD5 hash:	70E55B55A17F1D1C4047CC678EB936F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: SystemPropertiesRemote.exe PID: 5868 Parent PID: 3472

General

Start time:	03:57:14
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\pjo7Mc7lI\SystemPropertiesRemote.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\pjo7Mc7lI\SystemPropertiesRemote.exe
Imagebase:	0x7ff7376b0000
File size:	83968 bytes
MD5 hash:	70E55B55A17F1D1C4047CC678EB936F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000023.00000002.481917685.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: AgentService.exe PID: 6040 Parent PID: 3472

General

Start time:	03:57:26
Start date:	29/09/2021
Path:	C:\Windows\System32\AgentService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\AgentService.exe
Imagebase:	0x7ff73ca90000
File size:	1189376 bytes
MD5 hash:	F7E36C20DB953DFF4FDDB817904C0E48
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: AgentService.exe PID: 6064 Parent PID: 3472

General

Start time:	03:57:28
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Z7wAQ0\AgentService.exe
Imagebase:	0x7ff7a3460000
File size:	1189376 bytes
MD5 hash:	F7E36C20DB953DFF4FDDB817904C0E48
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000025.00000002.514511264.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: wusa.exe PID: 4368 Parent PID: 3472

General

Start time:	03:57:41
Start date:	29/09/2021
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wusa.exe
Imagebase:	0x7ff6293e0000
File size:	308736 bytes
MD5 hash:	04CE745559916B99248F266BBF5F9ED9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: wusa.exe PID: 4720 Parent PID: 3472

General

Start time:	03:57:42
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\igQ\wusa.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\igQ\wusa.exe
Imagebase:	0x7ff778ca0000
File size:	308736 bytes
MD5 hash:	04CE745559916B99248F266BBF5F9ED9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000027.00000002.541829732.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll64.exe PID: 4956 Parent PID: 804 loaddll64.exeCOMMON

Executed Functions

Function 00000001400495B0, Relevance: 8.7, APIs: 2, Strings: 2, Instructions: 1727COMMON

Download Yara Rule

Strings

}*, xrefs: 0000000140049BDD
}*, xrefs: 0000000140049620

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: b2d8981d994e193b974dd97b3248349f041180fa9e1ee75c24f96b4e32672199
Instruction ID: dfe71950bb4b00d773a2c1e4d7d9ca62016f185058a51a46645e99606ce0912a
Opcode Fuzzy Hash: b2d8981d994e193b974dd97b3248349f041180fa9e1ee75c24f96b4e32672199
Instruction Fuzzy Hash: CDF2E476601B8481EB269F17D5503EE77A1F78EBC8F9A4025EB0A077B5DB38C945C348

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140036F30, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE ref: 000000014003704B
EntryPoint.CIECEGPOOR ref: 00000001400370EE

Strings

)8GV, xrefs: 0000000140037008
d, xrefs: 0000000140037032

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ConsoleEntryFreePoint
String ID: )8GV$d
API String ID: 3550414006-3589632123
Opcode ID: d05d8187567b24d43b5378db4c26f8457bb6311b4b9be5c519ef70a53fb6d972
Instruction ID: d510f836e5bc92855b025e221ee4853bd72dbb3d22a76ed0b2795177c136f2ac
Opcode Fuzzy Hash: d05d8187567b24d43b5378db4c26f8457bb6311b4b9be5c519ef70a53fb6d972
Instruction Fuzzy Hash: 2C91983230064096EB26EB66D0513EE23A5AB9C7D4F914526BB1E47BFBEE34CA05C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005C340, Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 886COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE ref: 000000014005D101

Strings

sy;, xrefs: 000000014005C9ED
sy;, xrefs: 000000014005C420

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InfoSystem
String ID: sy;$sy;
API String ID: 31276548-3660992706
Opcode ID: 4ba7a1a776c1b2a8194e3aee1005776fcb25fed3b21deabde970c8a1fedf5655
Instruction ID: 6e6b9d6b41ba510f9365bd6ae70f9dc3139515c8db1fe8c3f4a6c85962f57752
Opcode Fuzzy Hash: 4ba7a1a776c1b2a8194e3aee1005776fcb25fed3b21deabde970c8a1fedf5655
Instruction Fuzzy Hash: 2A82DB72215B848AEB26CF27D4507E977E1F789BC4F498426EB4A077B6DB39C941C380

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004BD40, Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 789COMMON

Download Yara Rule

Strings

}*, xrefs: 000000014004C37C
}*, xrefs: 000000014004BDB0

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: 7295418c03dacbe62c915b6dd4b980e4d41f822c5e8600d002afc3f8743a909a
Instruction ID: 589d9863290c94d963c78ae1aba4b537ce1e649f887b860e334c2c2edf70769e
Opcode Fuzzy Hash: 7295418c03dacbe62c915b6dd4b980e4d41f822c5e8600d002afc3f8743a909a
Instruction Fuzzy Hash: B872E172211B8081EBA68F23D4547ED77A1F78DBC4F8A5125EB4A477B6EB38C944C348

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D290, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 000000014005D2ED

Strings

., xrefs: 000000014005D36A

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindFirst
String ID: .
API String ID: 1974802433-248832578
Opcode ID: 676bd74008c321f1f054d2561c231ee4757c1d63a5241c01311e4a1111e2dca9
Instruction ID: 4bac0f1caae8588fed560e2f4dd75fe3b4005a9d196e6938d52e54566134f4c2
Opcode Fuzzy Hash: 676bd74008c321f1f054d2561c231ee4757c1d63a5241c01311e4a1111e2dca9
Instruction Fuzzy Hash: C841A43260564085FB76DB26E1003AD73A1A748BF8F184713EF69177E9DB7AC982C742

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140026CC0, Relevance: 2.9, Strings: 2, Instructions: 362COMMON

Download Yara Rule

Strings

)8GV, xrefs: 0000000140027120
)8GV, xrefs: 000000014002703B

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: )8GV$)8GV
API String ID: 0-993736920
Opcode ID: 82dd2e99d2c048cfa35103269aa97b75327bcafd82d5a19aeb73a74b67276a1b
Instruction ID: e7db99c2ed76c24e9271fdfca30502f9120cd4f12b6678b2f47d4e41cadbe873
Opcode Fuzzy Hash: 82dd2e99d2c048cfa35103269aa97b75327bcafd82d5a19aeb73a74b67276a1b
Instruction Fuzzy Hash: 3BF18F7272064095EB52EB72D8913EE6365FB993C8F900426BB0E47AFADF34CA45C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006A4B0, Relevance: 1.7, APIs: 1, Instructions: 237nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 000000014006A550

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 562df9e73cba7abacc68b3a3548fb6f2425e8bd91fdebdcc79cd3323aaab2324
Instruction ID: ba306794fc56961ae9be9e8108b60f4a03202e28571258f9feaa1cffdeadac3d
Opcode Fuzzy Hash: 562df9e73cba7abacc68b3a3548fb6f2425e8bd91fdebdcc79cd3323aaab2324
Instruction Fuzzy Hash: 25B16E36601B409AE712EF26D9403EE33A6F7497C8F645825EB4E47BA6DF38D524CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140048AC0, Relevance: 1.7, APIs: 1, Instructions: 185libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL ref: 0000000140048CDE

Part of subcall function 000000014005D1F0: FindNextFileW.KERNELBASE(?,?,CD3BEB56,0000000140048BFE), ref: 000000014005D21B

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindLoadNext
String ID:
API String ID: 50669962-0
Opcode ID: aa0438968589772fc8f2a9ec3ebe64abc64651e75ec2b3921e4afd98a3b5e278
Instruction ID: 5bbbb247b64301f03cc62f5655f26b2922a91791dd430743fbd3ba68f8766a4f
Opcode Fuzzy Hash: aa0438968589772fc8f2a9ec3ebe64abc64651e75ec2b3921e4afd98a3b5e278
Instruction Fuzzy Hash: 07819D3261568092FB22EB26E4513EE6365FBD83D4F814521FB4A57AEBEF38C605C704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140035270, Relevance: 1.7, APIs: 1, Instructions: 181COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140046C90: NtClose.NTDLL ref: 0000000140046CBE

ExitProcess.KERNEL32 ref: 00000001400354E1

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseExitProcess
String ID:
API String ID: 3487036407-0
Opcode ID: 5c30d9f3bf3ad5247cfe131953472b6de56d2531a4e84ebcbfa6a909151eb5a4
Instruction ID: 3d479053040576d7404e3dfab4813d6254088c9544e20b556efee73ce8d776a8
Opcode Fuzzy Hash: 5c30d9f3bf3ad5247cfe131953472b6de56d2531a4e84ebcbfa6a909151eb5a4
Instruction Fuzzy Hash: 5771BF32710A5096FB16EB72D4513EE2365AB883D9F844522BF5E53AFADF35C906C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046C90, Relevance: 1.5, APIs: 1, Instructions: 19nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL ref: 0000000140046CBE

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: daec19cacdd098f1244212ea8e14a5d3e1bd9439d57025bc9e494c2d8b520846
Instruction ID: acc9ee73913d888b71121e4cedfe861758cf19cabea33dd7822bbf7d3cf7603a
Opcode Fuzzy Hash: daec19cacdd098f1244212ea8e14a5d3e1bd9439d57025bc9e494c2d8b520846
Instruction Fuzzy Hash: 42E08CA1741A0041EF265276D0803A812809B4D7B4E194B209A7D0B3E0EA3888898716

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400524B0, Relevance: .8, Instructions: 815COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1fe821b06c1a4823bb9271ec043e796f757224c870123343ecb03a76390b80a
Instruction ID: bccbce3911ab829ef3288d496869760cb1404da12fac801df191153d1e38d36e
Opcode Fuzzy Hash: b1fe821b06c1a4823bb9271ec043e796f757224c870123343ecb03a76390b80a
Instruction Fuzzy Hash: 9172CD72601B9485FB26CF17D4503E967A1FB8EFC4F998426EB0A077A5EB39C945C380

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140065B80, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef59d8dad7016460516c65c54e0757d465c5ab080b3c9532efa0d5a42b826e15
Instruction ID: 84a8ec628d281786b49b5e6f6f6dec0d0376b1c45e732984354cafa0c8984479
Opcode Fuzzy Hash: ef59d8dad7016460516c65c54e0757d465c5ab080b3c9532efa0d5a42b826e15
Instruction Fuzzy Hash: D761947121164102FE76B72399047EE5292AFAD3E4F650B21BF6E47BF9EE38C9018740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140034870, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9551ae3eb8102b5ebebf946a3998feeee295eeedab946ed72fd7e67ef554d99f
Instruction ID: 713527809b35fed6260ebd230ad48717dd4fa7a304d79e310e96a8de0daf9cee
Opcode Fuzzy Hash: 9551ae3eb8102b5ebebf946a3998feeee295eeedab946ed72fd7e67ef554d99f
Instruction Fuzzy Hash: 5A717D32B04B4095FB12EBB2E4913DF67A5FBC8388F954025BB4957AAADF38D445CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140061360, Relevance: 6.3, APIs: 4, Instructions: 290registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 0000000140061459
RegEnumKeyW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 00000001400614B4
RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 0000000140061539
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002,?), ref: 0000000140061664

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close$EnumOpen
String ID:
API String ID: 138425441-0
Opcode ID: 672031fc434e6626b90ea1da62f3c38a687c8b9296ffac50e7f6928d6a85a361
Instruction ID: 4377045c35190c944746a6ea10b9b47c13ce871b5e3b3a15cce40fdff127085f
Opcode Fuzzy Hash: 672031fc434e6626b90ea1da62f3c38a687c8b9296ffac50e7f6928d6a85a361
Instruction Fuzzy Hash: 5BC1A43120568082FE629B16E8503EEA791E7C97E0F6C4A21FB6E47BE5DE78C941C740

Uniqueness

Uniqueness Score: -1.00%

Function 000002963F712252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000002963F7123B0
VirtualProtect.KERNELBASE ref: 000002963F712471
RtlAvlRemoveNode.NTDLL ref: 000002963F7125B4
VirtualProtect.KERNELBASE ref: 000002963F712677

Memory Dump Source

Source File: 00000000.00000002.274748221.000002963F710000.00000040.00000001.sdmp, Offset: 000002963F710000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 61c5cf338342106c95e5f562b92925a6961febcaf91f324c3210aa7e059b5ffd
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 13B15376618BC48AE770CB1AF45479EB7A1F7C9B80F108026EE8957B58DB79C845CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005F9F0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 000000014005FA4B

Strings

4aX, xrefs: 000000014005FA09

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DescriptorSecurity$ConvertString
String ID: 4aX
API String ID: 3907675253-4042356595
Opcode ID: a1249fc2010d9d5d05952f0359ba200457e66aefbced3d07103a2c3463c61beb
Instruction ID: 5c7b4eddd96f597e19123db416744eb931adcf52cf9da5c093af566d74744993
Opcode Fuzzy Hash: a1249fc2010d9d5d05952f0359ba200457e66aefbced3d07103a2c3463c61beb
Instruction Fuzzy Hash: EC216D72214B4582EA12EF66E1403DEB3A0FB8C7C4F844525EB8D07B6AEF39D625C745

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DAE0, Relevance: 3.1, APIs: 2, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44297aa2126b14dcd4d9c9accf23e52108ed4399094c5e3af94dd8103b7f7b57
Instruction ID: c5574eec75406f68cf122a08b4571db932f63f1e1c7d3e43579234279b4bb767
Opcode Fuzzy Hash: 44297aa2126b14dcd4d9c9accf23e52108ed4399094c5e3af94dd8103b7f7b57
Instruction Fuzzy Hash: A151D03130464182FA72EA63A4507EA77A2BB8CBD4F154527BF5A077E2EF7AC801C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DD30, Relevance: 3.1, APIs: 2, Instructions: 122fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 000000014005DDD8
ReadFile.KERNELBASE ref: 000000014005DE49

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 00f6d0f3771a8cfa98223a140d65de6735ec101d3a44d5ddd75e2d9def7749f0
Instruction ID: 869152f87e2051f324d9e8f0f01270def7d2743b76a8e6c9a5e95a296a3a7e26
Opcode Fuzzy Hash: 00f6d0f3771a8cfa98223a140d65de6735ec101d3a44d5ddd75e2d9def7749f0
Instruction Fuzzy Hash: A541583161464087EA62DB3AA4447AAB3A1FBD87E0F144712BB6D4B7F5DF39C802DB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBB9, Relevance: 3.1, APIs: 2, Instructions: 79filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: 8a0a731fb1e22280383dc4c244850d697ffee92b9dbadae0b2290ba2595e9be9
Instruction ID: 944ab0cbe82d54181631abf043b2a82f72de4fdca767e43f24bb2c72b9c0c91f
Opcode Fuzzy Hash: 8a0a731fb1e22280383dc4c244850d697ffee92b9dbadae0b2290ba2595e9be9
Instruction Fuzzy Hash: 8D21B431214A4581EA72DB66A0407EA3795F78CBE4F184617EFAE077E5DF7AC806C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBD2, Relevance: 3.1, APIs: 2, Instructions: 77filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: d6d835041d1b41abb3b5fe648f8f275da576c4891ed88a603463ed8b7f508fb5
Instruction ID: bee1728ae0ee1a0caa625709e376bb4aadd3217f15d1bcce0d190476addee932
Opcode Fuzzy Hash: d6d835041d1b41abb3b5fe648f8f275da576c4891ed88a603463ed8b7f508fb5
Instruction Fuzzy Hash: BE21D332311A4581EA72DA66A0407EA3795B78CBE4F184527AF9D077E5DE7AC806C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBE8, Relevance: 3.1, APIs: 2, Instructions: 76filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: 6bbc7cb38f56b555cae5d46dc9eb85d7f0e424b0d62445df59964c24eed4e9f3
Instruction ID: a00dbcca095f64b26cda9c271166364bdf2e86a9b80154192fb139b54d898421
Opcode Fuzzy Hash: 6bbc7cb38f56b555cae5d46dc9eb85d7f0e424b0d62445df59964c24eed4e9f3
Instruction Fuzzy Hash: 5521E532315A4581EA72DB62A0407EE3791F78CBE4F184517AFAD077E5DE7AC806C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140060D10, Relevance: 3.1, APIs: 2, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,000000014004890D), ref: 0000000140060D85
RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,000000014004890D), ref: 0000000140060DE8

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0af55b123fcd85ad11f65efe4d0ac2719b06ecdcd8a99680970ae4064010c44f
Instruction ID: 09cc4365fb23fa9fe14c599ab373ea3e5ec1bde103bfdbf39ccb6e9a9538c2db
Opcode Fuzzy Hash: 0af55b123fcd85ad11f65efe4d0ac2719b06ecdcd8a99680970ae4064010c44f
Instruction Fuzzy Hash: F521A37671569046EF52CB56E8003AFA391EB897F4F184621BF9C07BE8EA38D582C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBF8, Relevance: 3.1, APIs: 2, Instructions: 73filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: eb6f16229e65501cd5258548e2b4ff06530ad065b40e2a3bf9e2a9b945b11f61
Instruction ID: 68fcab11a3bde380270331896f94efb0ab36e54eb9d04e7f46ecdc112822b6b1
Opcode Fuzzy Hash: eb6f16229e65501cd5258548e2b4ff06530ad065b40e2a3bf9e2a9b945b11f61
Instruction Fuzzy Hash: 6821C132315A4541EA72DB62A0407EA3795F78CBE4F184627EFAD077E5DE7AC806C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046F60, Relevance: 1.7, APIs: 1, Instructions: 216COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0000000140046FDE

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 505a76da9390751f76a813a8bc9fce4b727984ade222f3073bfceff6bf9580dc
Instruction ID: 560481d37deeb2f3cc02cd101c0a384bc9ca8e36dca6fa428839860d024f360c
Opcode Fuzzy Hash: 505a76da9390751f76a813a8bc9fce4b727984ade222f3073bfceff6bf9580dc
Instruction Fuzzy Hash: EDA15D3271064099EB12EFB6C4913EE2365A7987C8F915126BF0D67AFAEF34C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005FDA0, Relevance: 1.6, APIs: 1, Instructions: 144synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNELBASE ref: 000000014005FEFE

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 6be956e981540fc735b56164f72d0aea79e48331418f8fd9eaab398243b5d8cf
Instruction ID: 2cd33cf12082532a652157af79f02d7873b375395221c82c38bac87e111ef697
Opcode Fuzzy Hash: 6be956e981540fc735b56164f72d0aea79e48331418f8fd9eaab398243b5d8cf
Instruction Fuzzy Hash: 6E51B2326117408AEB66EB22A0013EE6291EB9DBC4F580535FF4E477E6DF39C802D790

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D1F0, Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,?,CD3BEB56,0000000140048BFE), ref: 000000014005D21B

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: ff4ac6c2ef48f38791092f6d6c449714fc18167456ec2ef2bc1084d7df7feef3
Instruction ID: fe48dd106ee2d63de4642147a978de6f9e341aec22c75ad1205c2678dbe1ece1
Opcode Fuzzy Hash: ff4ac6c2ef48f38791092f6d6c449714fc18167456ec2ef2bc1084d7df7feef3
Instruction Fuzzy Hash: 80115B7561034082FF76DA6691047E933E1EB697C8F051013EF59472E9EB36C8D2C751

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140060BA0, Relevance: 1.5, APIs: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32 ref: 0000000140060C16

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: a3c12b60ccc1d223e9782810bc36042d204e1f874336debb41352ff4bff3a234
Instruction ID: 650aff04d41c3b1619de3e88208a4500c6b85af191ab70c767efd2679610bbe3
Opcode Fuzzy Hash: a3c12b60ccc1d223e9782810bc36042d204e1f874336debb41352ff4bff3a234
Instruction Fuzzy Hash: 1C112E72204B8486D7219F12E84039EB7A5F788B90FA89529EB8D43B58DF39D991CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046690, Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

RtlCreateHeap.NTDLL ref: 00000001400466DD

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 21b05e3ef22cad88cebd019d8e45e363c17e6ba0707ecabdd33f955b9f4b15ed
Instruction ID: 54976bf3431427af6da968cf6b263ec8d4a99ac7c2bea2f2fd5649cd882baac1
Opcode Fuzzy Hash: 21b05e3ef22cad88cebd019d8e45e363c17e6ba0707ecabdd33f955b9f4b15ed
Instruction Fuzzy Hash: B901D635706A8082EB528712FA4039A73A0F78C3C4F198524EF884B7A5EF38C8518B44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046730, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

RtlDeleteBoundaryDescriptor.NTDLL ref: 000000014004678C

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: BoundaryDeleteDescriptor
String ID:
API String ID: 3203483114-0
Opcode ID: 7b0e43f28c4f526d6edd5220e1ccf75e5ddb2081b4342278c18d43c75b4d1ee9
Instruction ID: 7e2fcedd46cf55f04110c2a11ced308778be976df41b62f125aabd7639a18320
Opcode Fuzzy Hash: 7b0e43f28c4f526d6edd5220e1ccf75e5ddb2081b4342278c18d43c75b4d1ee9
Instruction Fuzzy Hash: 70F0F878A4730141FE6A63B354543A511821FCC7C4F0E8834AF095B7A6EE38CD518699

Uniqueness

Uniqueness Score: -1.00%

Function 000002963F712057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000002963F7129A8), ref: 000002963F7120A7

Memory Dump Source

Source File: 00000000.00000002.274748221.000002963F710000.00000040.00000001.sdmp, Offset: 000002963F710000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 4d98cb87041551f9ec71842f94f743fbe42f7b235206fbe69680df53fc962456
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: D0313672615B8086D780DF1AE45875A7BB4F389BC4F208026EF8D87B28DF3AC446CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000000014002B6E0, Relevance: 8.2, Strings: 6, Instructions: 741COMMON

Download Yara Rule

Strings

4040, xrefs: 000000014002BB6A
3050, xrefs: 000000014002B992
0020, xrefs: 000000014002B98B
3050, xrefs: 000000014002BB42
0020, xrefs: 000000014002BB49
GNOP, xrefs: 000000014002B9CB

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: 0020$0020$3050$3050$4040$GNOP
API String ID: 0-829999343
Opcode ID: 537da1a0c1bbc7e636232495bc2fdab7c2537f76630bc9218dea00809d8f4601
Instruction ID: 282167bc52f218920562f67345f8403ae15435ff558287d674a5e0b6e797f698
Opcode Fuzzy Hash: 537da1a0c1bbc7e636232495bc2fdab7c2537f76630bc9218dea00809d8f4601
Instruction Fuzzy Hash: 4172507261068195EB22EF26D8913EE6365FB983C8F804016FB4E475FAEF34CA45C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140071DC0, Relevance: 5.7, Strings: 4, Instructions: 682COMMON

Download Yara Rule

Strings

VUUU, xrefs: 000000014007213B
VUUU, xrefs: 0000000140072194
ERCP, xrefs: 0000000140071EED
VUUU, xrefs: 000000014007211B

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU
API String ID: 0-2165971703
Opcode ID: 203c99bb3d64071a34d91be2023c6ff0f734778017a54347eb9ef20583df3fc0
Instruction ID: a95f611128f1d5d13a9bca75b656ea52fec65ffdb08565925219bb8e60db198b
Opcode Fuzzy Hash: 203c99bb3d64071a34d91be2023c6ff0f734778017a54347eb9ef20583df3fc0
Instruction Fuzzy Hash: 2252BE727046848AEB6A8F6AD5503ED7BA1F3087D8F144116FF569BAE8D73CC981C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400667D0, Relevance: 5.4, Strings: 4, Instructions: 448COMMON

Download Yara Rule

Strings

SW, xrefs: 0000000140066A1A
SW, xrefs: 0000000140066A69
SW, xrefs: 0000000140066CA6
SW, xrefs: 0000000140066C49

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: SW$SW$SW$SW
API String ID: 0-1120820918
Opcode ID: 4269d42bb04da8d2d584da9acdb52bde17cfea0105d642131f8bc10ec3972926
Instruction ID: 5271b3b9b35d550c8de01999338ba1aa790ab169e66fccb1d44a6718ff6f2241
Opcode Fuzzy Hash: 4269d42bb04da8d2d584da9acdb52bde17cfea0105d642131f8bc10ec3972926
Instruction Fuzzy Hash: 4C026D3170160146EB62EB73D8603EE2396AB9C3C8F554925BB4D87BEAEF35DA01C310

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140031DF0, Relevance: 5.3, Strings: 4, Instructions: 270COMMON

Download Yara Rule

Strings

GC,, xrefs: 0000000140032008
GC,, xrefs: 000000014003216C
GC,, xrefs: 00000001400321D7
GC,, xrefs: 0000000140031FC2

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: GC,$GC,$GC,$GC,
API String ID: 0-2774350030
Opcode ID: 98649618faad92dfac345ced2ac743c97f2c410892ae2dd8dadb9da2da6be478
Instruction ID: dd0ba4053c6bdb050c0e262549aa376da4335980b2dde8bb0cc8774c9fa84b1c
Opcode Fuzzy Hash: 98649618faad92dfac345ced2ac743c97f2c410892ae2dd8dadb9da2da6be478
Instruction Fuzzy Hash: 39B14A3232168096EA16EB22D4513EFA765FBDC7C4F854425FB4E57ABAEE38C605C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140057950, Relevance: 4.5, Strings: 2, Instructions: 1977COMMON

Download Yara Rule

Strings

}*, xrefs: 00000001400579C0
}*, xrefs: 0000000140057F89

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: a0a69438047e54f28e9ccb842af0afe3b69bef60083965763f3b059d71ba89a0
Instruction ID: 7c281f25cbc51a2c663274e483e0a5d4adc9f9b548fde4e06667abda5a9e2262
Opcode Fuzzy Hash: a0a69438047e54f28e9ccb842af0afe3b69bef60083965763f3b059d71ba89a0
Instruction Fuzzy Hash: 6E03CB72201B8482EB26CF23D4543ED67A1F78DBC4F994416EF4A177A6EB3AC945C380

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400263C0, Relevance: 4.3, Strings: 3, Instructions: 519COMMON

Download Yara Rule

Strings

)8GV, xrefs: 0000000140026A4D
)8GV, xrefs: 00000001400267B0
@, xrefs: 0000000140026B3F

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: )8GV$)8GV$@
API String ID: 0-2802744955
Opcode ID: eae204a58eb5bea4c4560801caf5a319cba3aa2e04bbdd6ea10fdaad1cd83927
Instruction ID: d4403fa2ef2757ed15b0d897a8d3d48ae9d82dee7601a7ae60b507309942f45e
Opcode Fuzzy Hash: eae204a58eb5bea4c4560801caf5a319cba3aa2e04bbdd6ea10fdaad1cd83927
Instruction Fuzzy Hash: 8F326E72610A8095FB22EB72D8513EE6365FB997C8F940026BB4E476FADF34CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400067B0, Relevance: 4.2, Strings: 3, Instructions: 406COMMON

Download Yara Rule

Strings

*/*, xrefs: 0000000140006D02
POST, xrefs: 0000000140006CF6
GET, xrefs: 000000014000688D, 000000014000689B

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: */*$GET$POST
API String ID: 0-3233530491
Opcode ID: 32d11deb30a1a87af2e00d0bceae541fc6016cb2569d4fb9eca702019c111a5c
Instruction ID: 6cf15a5ed41f927c804a0d4041fd2741414eb33ceb6b5d93e391305a3a4948eb
Opcode Fuzzy Hash: 32d11deb30a1a87af2e00d0bceae541fc6016cb2569d4fb9eca702019c111a5c
Instruction Fuzzy Hash: 57125C72610A8196EB11EF72E8913DE6765F7883D8F904122FB4E57AAADF34C249C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140035520, Relevance: 3.9, Strings: 3, Instructions: 117COMMON

Download Yara Rule

Strings

{QN, xrefs: 00000001400355E1
GC,, xrefs: 0000000140035665
GC,, xrefs: 0000000140035622

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: GC,$GC,${QN
API String ID: 0-3150587038
Opcode ID: fd0f7604477b89c46016288274ae5da6e1d22dae5e6d5d6e9033f3dbe6d447d0
Instruction ID: 9244b60d004d0bd22f383007071d62e4da67c70af0efad37e4d475a9577969ab
Opcode Fuzzy Hash: fd0f7604477b89c46016288274ae5da6e1d22dae5e6d5d6e9033f3dbe6d447d0
Instruction Fuzzy Hash: D851B3726017408AEB26AF72A0517DF3392EB98398F559529FB4E0BBE9DF39C401C741

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140025DB0, Relevance: 2.9, Strings: 2, Instructions: 401COMMON

Download Yara Rule

Strings

GC,, xrefs: 0000000140025E65
0, xrefs: 0000000140025FF4

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: 0$GC,
API String ID: 0-3557465234
Opcode ID: 666bbe70a71d3c2c69398fa3d4293e156315b44e2ec60054ed199f516d69305b
Instruction ID: 8e8f5bced65d739128878f1be46f709eb140c798bd495bd8ba2efbba04664ca7
Opcode Fuzzy Hash: 666bbe70a71d3c2c69398fa3d4293e156315b44e2ec60054ed199f516d69305b
Instruction Fuzzy Hash: 90F1C132705B8086EB56DB26A5503EE77A5F788BC8F544029FF8A47BA9DF38C845C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002FB20, Relevance: 2.7, Strings: 2, Instructions: 200COMMON

Download Yara Rule

Strings

cLpS, xrefs: 000000014002FB46
cLpS, xrefs: 000000014002FB76

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: cLpS$cLpS
API String ID: 0-581437482
Opcode ID: 34fd53aa0ebdbc9f7987fe69826bd589cd4ce70c6830deca293095981677af5c
Instruction ID: d6b56411a1e340b191dd7f08d0c8a8920ca136b0ade9766ce73097337fe28e3c
Opcode Fuzzy Hash: 34fd53aa0ebdbc9f7987fe69826bd589cd4ce70c6830deca293095981677af5c
Instruction Fuzzy Hash: F5916E32700A41A6FB12EB72D5513ED2366AB983D8F900126BF1D97AFADF34D919D340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140039140, Relevance: 2.1, Strings: 1, Instructions: 866COMMON

Download Yara Rule

Strings

D, xrefs: 0000000140039B2B

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 0452af0be93170f0712028ec6d1a4f1ed763d309de66f3c97f53239ecee0938c
Instruction ID: a2166a60d7ca2b4a0d1872d5e3506bb785f107662951e93f9f6f62b20c08bf0e
Opcode Fuzzy Hash: 0452af0be93170f0712028ec6d1a4f1ed763d309de66f3c97f53239ecee0938c
Instruction Fuzzy Hash: 32827E3222468186EB13EB26D4907EF6365FBD8794F904612FB5A47AFADF38C605C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000C5C0, Relevance: 2.1, Strings: 1, Instructions: 865COMMON

Download Yara Rule

Strings

GET, xrefs: 000000014000C5D5

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: GET
API String ID: 0-1805413626
Opcode ID: 661f230471d60ecbb39933eb60000974eafe41df73c72fb050cdf984b1df2847
Instruction ID: e67aa13565bd515be4758c424d677281e7e48e69fdea67d752e56d6b70eb8f16
Opcode Fuzzy Hash: 661f230471d60ecbb39933eb60000974eafe41df73c72fb050cdf984b1df2847
Instruction Fuzzy Hash: 7182CFB262568082FB52EB26E491BEE6761F7C97C8F851022FB4A576E7CF38C505C701

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140015120, Relevance: 2.1, APIs: 1, Instructions: 555COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32 ref: 000000014001530B

Part of subcall function 0000000140046C90: NtClose.NTDLL ref: 0000000140046CBE

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseEnvironmentExpandStrings
String ID:
API String ID: 1839112984-0
Opcode ID: 0c8cab0b1b935b3a37cb31b96907ffd9b34d960d626d1d55b93d79ad55693549
Instruction ID: c0dbe0ee55e83fb6c0f3bef3624a57e5635b4c6ed11a4d6c977be8f15ec7e338
Opcode Fuzzy Hash: 0c8cab0b1b935b3a37cb31b96907ffd9b34d960d626d1d55b93d79ad55693549
Instruction Fuzzy Hash: CB427E32710A4096FB12EB72D4913EE6765EB983D8F814422BB4D4BAFAEF34C645C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140019D20, Relevance: 2.0, APIs: 1, Instructions: 546COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16542955b275fa46a45d28497ac8cbf71c314abb7bab926a74d78794e1731fb
Instruction ID: abc698a25be580435ac5d46bd6b01b3c7dd535f90f9c32282677b8a643a0cbd6
Opcode Fuzzy Hash: b16542955b275fa46a45d28497ac8cbf71c314abb7bab926a74d78794e1731fb
Instruction Fuzzy Hash: 3C427D3271068095FB22EB76D8513EE2361EB993C8F904121BB0E5BAFAEF79C545C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140019580, Relevance: 2.0, APIs: 1, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb557a398152c7bfecc6b7987fbe0bf24dee84548747db322091cb7207de5ee
Instruction ID: 0bcce83d19b55e388762cc41cc2fbdfa61478623d1bee2f25155124e52c32027
Opcode Fuzzy Hash: beb557a398152c7bfecc6b7987fbe0bf24dee84548747db322091cb7207de5ee
Instruction Fuzzy Hash: 8A128E3271468095FB22EB72D8913EE2355EB997C4F804026BB4E5BAFADF35C605C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006EB0, Relevance: 1.9, Strings: 1, Instructions: 651COMMON

Download Yara Rule

Strings

cLpS, xrefs: 00000001400072A3

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: cLpS
API String ID: 0-2886372077
Opcode ID: 39b3e9410c272ead3331ad6fef3a5a390c12b147565654b66b7ca87bf70ff1a0
Instruction ID: 96b4c198141fe6e7034ab14ad9d5ea3cda72442e6a1109ae0a48173783152c86
Opcode Fuzzy Hash: 39b3e9410c272ead3331ad6fef3a5a390c12b147565654b66b7ca87bf70ff1a0
Instruction Fuzzy Hash: CF528D7272464092FA12EB62E8517EE63A5FB9C7C4F814022BB4E57BBADF38C505C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400139D0, Relevance: 1.8, Strings: 1, Instructions: 571COMMON

Download Yara Rule

Strings

m, xrefs: 000000014001422E

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateMutex
String ID: m
API String ID: 1964310414-3775001192
Opcode ID: 4490c8e53dbcae5c84b52c6e5dc6ecb6640294804a2576759aae00f2988173a8
Instruction ID: 0a9d90af75a6ede7406656d6adb6787827cf479cbe6b14872f7c626c13ea0b6d
Opcode Fuzzy Hash: 4490c8e53dbcae5c84b52c6e5dc6ecb6640294804a2576759aae00f2988173a8
Instruction Fuzzy Hash: 6A529B32710A80A6F74EEB32C5913EE7369F788384F904026AB2947AE6DF34D576C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001D100, Relevance: 1.7, Strings: 1, Instructions: 497COMMON

Download Yara Rule

Strings

s( j, xrefs: 000000014001D128

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: s( j
API String ID: 0-1450404818
Opcode ID: 19985d2dc72a707ec5f83c91129fc97538500d80b5f4466283615156a38f1139
Instruction ID: 6f5b3d0b06e06ce3defbe5b62ba999e8dce43b7996f1ec96da6707378b1ebcba
Opcode Fuzzy Hash: 19985d2dc72a707ec5f83c91129fc97538500d80b5f4466283615156a38f1139
Instruction Fuzzy Hash: 14325632715B9085EB16EF66D8513ED73A5FB88B88F454026EB4E5BBAADF38C505C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140029780, Relevance: 1.7, Strings: 1, Instructions: 491COMMON

Download Yara Rule

Strings

kw9b, xrefs: 000000014002989A

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseEnumValue
String ID: kw9b
API String ID: 858281747-837114885
Opcode ID: d3588acbbd43e5a4adda092107fc75f4a21e4c593e0d0d24f28e2c590809a9b5
Instruction ID: a79da12e532d7eb86b4034213f2927d281404f76e1d3d8be4d202bd2a10f559e
Opcode Fuzzy Hash: d3588acbbd43e5a4adda092107fc75f4a21e4c593e0d0d24f28e2c590809a9b5
Instruction Fuzzy Hash: D622A03270064056FB22EB62E4513EE6361EB8C7D8F814625BB4E57AFADF38CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140033BB0, Relevance: 1.7, Strings: 1, Instructions: 454COMMON

Download Yara Rule

Strings

U, xrefs: 000000014003408F

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: f9036e474cfb7cec08d70a083884fd778a0a259ae3f3919b2f894a717b3f998a
Instruction ID: 04dcf981b535b3d5a04f4e0f983876b723d65533687fb2a3abc72c4897885b35
Opcode Fuzzy Hash: f9036e474cfb7cec08d70a083884fd778a0a259ae3f3919b2f894a717b3f998a
Instruction Fuzzy Hash: 7A22A032714A8095FB22EB76D4913EE2761EB993D4F900122BB4E5BAFADF38C545C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023530, Relevance: 1.7, Strings: 1, Instructions: 430COMMON

Download Yara Rule

Strings

Content-Type, xrefs: 000000014002385F

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: Content-Type
API String ID: 0-2058190213
Opcode ID: c551b405b9330c65fd33ed6a327a0f38696d61ae2897db4a9c4cf0ed604fa382
Instruction ID: 8ed0294b40edec3e111ebf6e63eddced9ff886ac8d86313f53d4d34ac86a637b
Opcode Fuzzy Hash: c551b405b9330c65fd33ed6a327a0f38696d61ae2897db4a9c4cf0ed604fa382
Instruction Fuzzy Hash: D0128B7271064096EB26EB72D0953EE63A5EB9D7C8F804029FB4E576B6DF34C909C341

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400389A0, Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

0, xrefs: 0000000140038A46

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID: 0
API String ID: 3535843008-4108050209
Opcode ID: 7016f170174e11ab425f8740a2873dc54fd790cf1ab3d78218ff6c8b86cc580b
Instruction ID: 021d52728ad99ff4b45c00a2ee63d530dbb35c35c3e7b67721d4418a9cae59c0
Opcode Fuzzy Hash: 7016f170174e11ab425f8740a2873dc54fd790cf1ab3d78218ff6c8b86cc580b
Instruction Fuzzy Hash: A4D1483271064185EB22EB66D8503EF6365FB987C8F944421FF4E57AAAEF34CA05C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400205A0, Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

, xrefs: 000000014002069B

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 13b354268872ef66367d09f0eaf7f41c1b6cce90139d1ccde9a6c23eddc411d2
Instruction ID: 091f4e73938a5afec608f70625f4eed5baac112ec883e15b973b01c59944fd94
Opcode Fuzzy Hash: 13b354268872ef66367d09f0eaf7f41c1b6cce90139d1ccde9a6c23eddc411d2
Instruction Fuzzy Hash: 8FB1903271164156FB26EB72C0513EE2365A78C7C8F554429BF0E67BEAEE34D906C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002EED0, Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

, xrefs: 000000014002F04E

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 266006fd5134fcae821d54f81f057cdba6f5be873c6199ef93d4c42334c526d2
Instruction ID: 79bcb73a3e0a748e54816e3c2b9a8955141e4b7d1d3c260807ef7fd3e9233e09
Opcode Fuzzy Hash: 266006fd5134fcae821d54f81f057cdba6f5be873c6199ef93d4c42334c526d2
Instruction Fuzzy Hash: 4681AF3171528042FA66AB63A5513EE6382BBDC7C0F954839BF0E57BEADE38C9019750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023140, Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

tI*k, xrefs: 0000000140023300

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: tI*k
API String ID: 0-257501792
Opcode ID: b15996fbae463eef0efc9f4e5c4cbf386dde064011b2806a6f0ecd12f6b98297
Instruction ID: 2b3e36108f388e75195695150bf3b7502d87346db4925aa772ee75e92517338c
Opcode Fuzzy Hash: b15996fbae463eef0efc9f4e5c4cbf386dde064011b2806a6f0ecd12f6b98297
Instruction Fuzzy Hash: C891B332710A41C6FB12EB73D4913ED2365AB987C8F815026BF0E67AABDE34C605C391

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140078570, Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

ERCP, xrefs: 00000001400785BF

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: ERCP
API String ID: 0-1384759551
Opcode ID: 9a8959bd3d8286152fe3b07e5e9b9c99826fd1463cb640f02497020a3b8cf481
Instruction ID: 36d71a898891e4cfc692b0c24b63e4f8a605753b41eb4ec31f3d0d909baacb04
Opcode Fuzzy Hash: 9a8959bd3d8286152fe3b07e5e9b9c99826fd1463cb640f02497020a3b8cf481
Instruction Fuzzy Hash: 8541C2677244554AE3189F2598213BE2391F7E8781B008838BBC7C3B99E97CCE41C754

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004F940, Relevance: .9, Instructions: 873COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb12e34294cccc152743157d68ecf537d73dadfb1b78744b1cf0542ab0e03321
Instruction ID: fc2f62d5942ef41123ea32f2955be4f6aadf7052ab01c2248917173129c7cd0f
Opcode Fuzzy Hash: cb12e34294cccc152743157d68ecf537d73dadfb1b78744b1cf0542ab0e03321
Instruction Fuzzy Hash: 8A82BD72301B8486EB269F23D4503EE67A5F78DFC4F964022EB4A577A6DB38C945C384

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140053F20, Relevance: .8, Instructions: 808COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7250f98c0d712e4fed8a9177b7990c03dbf5da58cb0dd37bc7f0a46ed34db0c
Instruction ID: b1defcb4bfd3908c290bb80924a7f4486985742b072abc47c5e9bd5be53152ef
Opcode Fuzzy Hash: d7250f98c0d712e4fed8a9177b7990c03dbf5da58cb0dd37bc7f0a46ed34db0c
Instruction Fuzzy Hash: FF72CE32601BA482EB26CF17E4503ED77A5FB99BC8F9A4016EB49477B6DB36C941C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140054BA0, Relevance: .8, Instructions: 797COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6290f3f4936625c1500c9bb5ab49f73b0f0e92f6783c0cfd327242af27f29f
Instruction ID: 8249503d4e55669e8e7119aec1729776b7b2f3ca46fae70a891a003f6664f3d4
Opcode Fuzzy Hash: 0b6290f3f4936625c1500c9bb5ab49f73b0f0e92f6783c0cfd327242af27f29f
Instruction Fuzzy Hash: 3472DF32201B9486EB26DB17E4603ED77A5FB9DBC5F894012EB4A477B6DB3AC941C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140016E80, Relevance: .7, Instructions: 739COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 570444da3395dbff037c1797def2714c1b19642f17c99ed10635228c9c88b714
Instruction ID: 4fdb0601fab6f7a848b28641239d596080eab1ec2c6ff824b21f12e2ef69b5a1
Opcode Fuzzy Hash: 570444da3395dbff037c1797def2714c1b19642f17c99ed10635228c9c88b714
Instruction Fuzzy Hash: 48722D32724A4095EB02EB76D4913EE6765EB983C4FC05012BB4E879BBEF38C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004EB60, Relevance: .7, Instructions: 687COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf02e0b346a645ce41284f4b25ae6de0e0561089bc0c4212f6de5587c4ccb21
Instruction ID: d53d10191d1a85c044aba7f3ec212ac92ce5176a248edb2932ce54add84afe44
Opcode Fuzzy Hash: bbf02e0b346a645ce41284f4b25ae6de0e0561089bc0c4212f6de5587c4ccb21
Instruction Fuzzy Hash: 9D52BE72601B8081EB269F23D4543EE77A1F78CBC4F8A5426EB4A577B6DB38D845C348

Uniqueness

Uniqueness Score: -1.00%

Function 000000014007BD50, Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1d6ac494662c45c571e96f77a6e8211c4f0b163f6c515dcb42af03e52a945a
Instruction ID: 9c06e88039ccf999e040ad7794a2e2d02b6699145a9792014979c24fd1337f6c
Opcode Fuzzy Hash: dd1d6ac494662c45c571e96f77a6e8211c4f0b163f6c515dcb42af03e52a945a
Instruction Fuzzy Hash: B4623CB76206548BD7668F26C080B6C37B1F35DFA8F25521ADF0A43799CB39D891CB90

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003B220, Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c541702096c1ae675d9f8552b841f1df762d73269a6d039e8a3e529e919bb3f5
Instruction ID: acd1ff4a64a9c803ec812a22a8ce79600e1464d52fdb42fb628072365476121f
Opcode Fuzzy Hash: c541702096c1ae675d9f8552b841f1df762d73269a6d039e8a3e529e919bb3f5
Instruction Fuzzy Hash: 64429E31301A8141FA23EB6698513EF6391EB8C7E8F544616BF5A5BBEAEE38C505C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140024440, Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc2a6e3d2e1231b3fe707f0d0f35a30ce2f56e53bfff03d4db06bbddff5caabd
Instruction ID: 78f3400fd7e206f6a511ea736ed45412fb3e7259efd4ed926287f6c9bd4c6aa7
Opcode Fuzzy Hash: fc2a6e3d2e1231b3fe707f0d0f35a30ce2f56e53bfff03d4db06bbddff5caabd
Instruction Fuzzy Hash: E6427C32204A8096EB66EB32D0513EE67A4E79D3C8F914026F79A876F7DF38C945C741

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018630, Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be641126d00510a138eaf0288e4a3cc7478d06c63d6e8b20f4ab8089a02f43c
Instruction ID: 8108868c1ca7c4f1afbe8bd34af9d7f1e96dfbbf12b1edd0cffad3fdf1fa0b6f
Opcode Fuzzy Hash: 7be641126d00510a138eaf0288e4a3cc7478d06c63d6e8b20f4ab8089a02f43c
Instruction Fuzzy Hash: 3F429E3231068095FB22EB72D8913EE6765EB983D8F844122BB0D97AFADF34C645C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023BF0, Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060d71c651ab3aed04444553114f4ea5a7531cc3ca58c37faf4133b09f387ec2
Instruction ID: 183f2e46b23aa86a2c091461a645f9a581571388db0d92becfc597eb429af356
Opcode Fuzzy Hash: 060d71c651ab3aed04444553114f4ea5a7531cc3ca58c37faf4133b09f387ec2
Instruction Fuzzy Hash: 0732AB3271064089EB16EB36D4513EE27A5EB8CBD8F555126FF0E877BADE38C4868340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400123C0, Relevance: .5, Instructions: 544COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdfece18ddf6bca480a9aef1e07074b0a3e55dc7f17be70bd55bceb11844ecf8
Instruction ID: 71edd40f2b1ab928f6f3b4ddf8d26af45cb7d1258c95c78617a62a1a74f3288a
Opcode Fuzzy Hash: fdfece18ddf6bca480a9aef1e07074b0a3e55dc7f17be70bd55bceb11844ecf8
Instruction Fuzzy Hash: BF32AC3261068195EB12EB26D4913EE2765FB983C8F814122FB4E57AFBEF38C645C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B120, Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8328b10af82aab1ef65ff433d7820bced4cba86e0066b221c3c838f9fd1e431
Instruction ID: 3ba19fba285517c5acd5c21b3c9b7592edaf423ca2de06bba8230fcf7af2400b
Opcode Fuzzy Hash: e8328b10af82aab1ef65ff433d7820bced4cba86e0066b221c3c838f9fd1e431
Instruction Fuzzy Hash: 3C429B72624A8095FB12EB62D4957EE2365FB983C8F814022FB0D57ABBDF34C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400381A0, Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ee38f4c6dee734349d5b0dcc202e437ae908f573234f4aff5f510a5883c84b0
Instruction ID: eb795f204498a8d956ef0de19ff8bd43d97085c04d8ed5933d3115b51340510f
Opcode Fuzzy Hash: 7ee38f4c6dee734349d5b0dcc202e437ae908f573234f4aff5f510a5883c84b0
Instruction Fuzzy Hash: 7022793270064186EA23EB2AD4957EF63A5EB88BD4F554626FF0A477F6EE34C506C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003A2E0, Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8d1907d2a62ce1ae108db488a351868ceb64fffc9dd42578434a0f34ae656a
Instruction ID: 697e8bd1027fccc09012cb901671f32632dfdae7722e2c733c5167ca59ce0a7a
Opcode Fuzzy Hash: 1e8d1907d2a62ce1ae108db488a351868ceb64fffc9dd42578434a0f34ae656a
Instruction Fuzzy Hash: AE227C3271064186EA23EB26D4513EF63A1FB89BD4F544625EB4A577F6EF38C50AC340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B390, Relevance: .5, Instructions: 458COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b3dc1032e7b852d429d3288fc6d56ff3ef19d98c02d1d103b4f123b92fc1f1
Instruction ID: 5c003effdee5129b35cf12aebe167f862a01b0c8d0d2f43ab9f1123e32a30f31
Opcode Fuzzy Hash: 71b3dc1032e7b852d429d3288fc6d56ff3ef19d98c02d1d103b4f123b92fc1f1
Instruction Fuzzy Hash: 8C0203B21082A489F7768B26C9413FA7BE2E759788F254906FB8A435F5D738C9C1D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000DDF0, Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e375be9be99e9838cc7803ed6e7672458d2ec84ccfc9a0c18b017f9565b827c
Instruction ID: c2c66f55aa66479377f68c186b881699d763759fa92e2ffabb716b860ed1a50b
Opcode Fuzzy Hash: 2e375be9be99e9838cc7803ed6e7672458d2ec84ccfc9a0c18b017f9565b827c
Instruction Fuzzy Hash: CD224D72710A8091EB12EB72D4913EE6765FB987C8F904116FB4E876BAEF38C245C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005C40, Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f513173c25ae17789a403cea68c9e18d94625c6d02a52581dcb230289bad16b3
Instruction ID: 217fabc6e38e1d640ccd999207fddb20e056db183073941d35cbdb4b11e649c3
Opcode Fuzzy Hash: f513173c25ae17789a403cea68c9e18d94625c6d02a52581dcb230289bad16b3
Instruction Fuzzy Hash: 10229B72620A8091EB12EB62E4957EE2365F79D7C4F814022FB4E576BBDF38C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140067A40, Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed167cb2d41bf65051b1e1e6ca4fc372791feb4efe79826a7b7afb1d034e643
Instruction ID: 3448a1cfdf5732c1482eebf940cb1862e5db89764351cf67f11e8459266109f6
Opcode Fuzzy Hash: 6ed167cb2d41bf65051b1e1e6ca4fc372791feb4efe79826a7b7afb1d034e643
Instruction Fuzzy Hash: CD026C727006418AEB12DF26D4907EE73A6F788BC4F614525EB0E977AADF34D90AC740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000BB40, Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8296aae514971c10519780c04e533f569930ad849b100b0340065f0f39cb86db
Instruction ID: a963730c34943060851cd64ea719675db259de8104656558a9074d2de6a51302
Opcode Fuzzy Hash: 8296aae514971c10519780c04e533f569930ad849b100b0340065f0f39cb86db
Instruction Fuzzy Hash: 41128F7222468096FB52EB22D4917EE6765FBD93C8F811022FB4E57AABDF38C505C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140069010, Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: 8ba737fd6eb3582064a4010a34389e21ef5286fc0c1092fb2edc112ab0bd8b14
Instruction ID: 5afa6d75f76fbbc9d7f53df6043056336d1db5d7591574d5123318d553f9c856
Opcode Fuzzy Hash: 8ba737fd6eb3582064a4010a34389e21ef5286fc0c1092fb2edc112ab0bd8b14
Instruction Fuzzy Hash: 19124E3272469096EB12EF72D8913DE6765FB987C8F815022BB0D57AABDF34C605C710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001E170, Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 9b801c6cfe21829965e01690717934929f301b57ebd9e24914ab7e4ccc7a8bd8
Instruction ID: ac8bef764291a5126b18a53dad73757551fec454a5992e6944e07fe4b855ac86
Opcode Fuzzy Hash: 9b801c6cfe21829965e01690717934929f301b57ebd9e24914ab7e4ccc7a8bd8
Instruction Fuzzy Hash: 2A023B32724A80A2FB52EB72D4913EE6764FB983C4F815022BB4D57AEADF35C545C710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002FEC0, Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4119716334bae8ce4a12a511c9ef3e68b40bfa4d08e13555b81686db08763198
Instruction ID: b67327a95b15ec145a913cc43aeca3e3a8a77925bd43874970612b3ea802a6ff
Opcode Fuzzy Hash: 4119716334bae8ce4a12a511c9ef3e68b40bfa4d08e13555b81686db08763198
Instruction Fuzzy Hash: A802707272064095EB02EB66D4913EE6765FB987C8F905022FB4D83ABBEF34C649C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002980, Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 8eff327b3244b5e4bcb204ecf2616417784072c62e8997917ef3bb952dc9c563
Instruction ID: 5d574d698b33f004de0812fa71b34c36bbdae31478704d480fb686f148b39898
Opcode Fuzzy Hash: 8eff327b3244b5e4bcb204ecf2616417784072c62e8997917ef3bb952dc9c563
Instruction Fuzzy Hash: EB024C72324A8096FB12EB62D4913EE6765EB983D4FC15022BB4E57AEBDF34C605C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018F80, Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d2e0809d67b8b1f811cdbec3316d968dea6f236994da189dd9a614ab6620f0
Instruction ID: d38a929efe70148cd0bcafb05e8c0916e90d43f0c382b2c9e415ecaf47ade149
Opcode Fuzzy Hash: e8d2e0809d67b8b1f811cdbec3316d968dea6f236994da189dd9a614ab6620f0
Instruction Fuzzy Hash: C8F16D32610A8095FB12EB76D8513EE6365EB983D8F940521BB0E57AFBEF35C605C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140010880, Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d8f91d721c478637f80766b80e37fef242b82150883bd374cc6845ff3be0a72
Instruction ID: f0fb79f68922493fed5bc905321703954c20a875d362dace52344ff7232635a8
Opcode Fuzzy Hash: 8d8f91d721c478637f80766b80e37fef242b82150883bd374cc6845ff3be0a72
Instruction Fuzzy Hash: D7029272320AA19AEB42DF36C8917EE2724F748789F805016FF4B57AAAEF35C545C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001D910, Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: 05ee41dc75372f3184bd1bd526553eb93c41a596f4ef0b14bf7d6c74ff3eb6f4
Instruction ID: 9c3e8f75c9e591130820bb2956cb3806339feb13e112d9af22726fcddd3bd126
Opcode Fuzzy Hash: 05ee41dc75372f3184bd1bd526553eb93c41a596f4ef0b14bf7d6c74ff3eb6f4
Instruction Fuzzy Hash: 12026C32314A8095FB52EB72D4917EE2765EB983C4F805022BB4E97AEBDF35C649C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140033540, Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76dd430cce1ce6768c64dce55b4180b759221ef9574e8c45ed07b1ebd879cb4c
Instruction ID: d0d419901b6e3c3183ee3913f1137c5e588d0fadc92f77f7791849e6aeb29d3b
Opcode Fuzzy Hash: 76dd430cce1ce6768c64dce55b4180b759221ef9574e8c45ed07b1ebd879cb4c
Instruction Fuzzy Hash: 8A029132614A8095EB22EF32D4913EE6765FB98388F904412FB4E57AFADF34C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140017B40, Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36998a6e05a284bb58ec5d35b6900db28f6390cbd705add739e9231e301b8078
Instruction ID: fccd9241a873054b7c24d42fb58abb6f012b2f7f19fe3a4c061a127f88627f2a
Opcode Fuzzy Hash: 36998a6e05a284bb58ec5d35b6900db28f6390cbd705add739e9231e301b8078
Instruction Fuzzy Hash: 41E18E3271068095FB12EB76D8917EE6765EB983C8F804021BB0D5BAEBEF35C645C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002CB80, Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b6f1b094effc9f245018c12fb0bd54aed54c11f9143a05f6df0da17f49fd19b
Instruction ID: 02ee9b89192d395c78975687d30e6fb06be8b995001c736011e159ca0d17724c
Opcode Fuzzy Hash: 9b6f1b094effc9f245018c12fb0bd54aed54c11f9143a05f6df0da17f49fd19b
Instruction Fuzzy Hash: E2E13D32714A4095EB02EB66D4913EE6765FB983D8F900012FB4D97AFAEF34CA49C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400018D0, Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b36c55cc0c64182b75bd054714d27820267f0f2f65f1b0bf4452dbf409dd159
Instruction ID: 95da75048f27146dafc5de9d612871b80806eb61125b8034b1f63b71f4cba504
Opcode Fuzzy Hash: 4b36c55cc0c64182b75bd054714d27820267f0f2f65f1b0bf4452dbf409dd159
Instruction Fuzzy Hash: 47F12C3262498096EB12EB62D8513ED6365FBD8388F814522BB4E479FBEF74CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003AAC0, Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7780c785dee08e0bb9155763342d8440fe36315939b45b58d1687e3de4f63a
Instruction ID: cf5fdc312f2229dc6ff813412d90ddbabd12b8e4de7574aebc9877f7d05b411a
Opcode Fuzzy Hash: 9e7780c785dee08e0bb9155763342d8440fe36315939b45b58d1687e3de4f63a
Instruction Fuzzy Hash: 28D19032711A4195EB12EB76D4903EE23A1EB993C4F844425BF4E57BEAEF38C605C350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140064080, Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16253b5d55ff71ace7e49d720cc951c571e11621ee8e21fa8c6a30ce5dfdcbdc
Instruction ID: bf23390ce128f79092fde7b2b9043ef6653a4f1b38eae35900255c6e9c132ad5
Opcode Fuzzy Hash: 16253b5d55ff71ace7e49d720cc951c571e11621ee8e21fa8c6a30ce5dfdcbdc
Instruction Fuzzy Hash: ABC1D4231282D04BD7569B3764503FAAE91E79A3C8F280655FFC997AEBD63CC2149B10

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002D0D0, Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f12721fbfba6283dc7958c84227ce6bb15a7590cb07e0c84499cdb4845d6b172
Instruction ID: d0d512be425b72175eef7d799d9923e381f6a995b1e0446f0295c878f1c0c086
Opcode Fuzzy Hash: f12721fbfba6283dc7958c84227ce6bb15a7590cb07e0c84499cdb4845d6b172
Instruction Fuzzy Hash: CED13972724A4091EB02EB76D4913EE6765F7983C8F904016BB4D97ABAEF38C605C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140030530, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da2952e0823b3d5a59f73c7ab384f762a6d9a624e53a469d815e2d2c0d7a72ca
Instruction ID: 96955b53f7f5b4430e01eb0035ad3df088e7672fa3a311151148bede835f9000
Opcode Fuzzy Hash: da2952e0823b3d5a59f73c7ab384f762a6d9a624e53a469d815e2d2c0d7a72ca
Instruction Fuzzy Hash: E7C16136B0564089FB22EB76D0613EF27A1AB9C388F554425BF4E976FADE34C506C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002A110, Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 8317b6107b79d8746eb836802ab66d92c4c2213a6f1849c4bee5ec7b69d23b54
Instruction ID: 08807915bc927436db1a901aa043915a979950c5e23cf508b5f0d65b77d78aa9
Opcode Fuzzy Hash: 8317b6107b79d8746eb836802ab66d92c4c2213a6f1849c4bee5ec7b69d23b54
Instruction Fuzzy Hash: 0CD17032614A8096EB02EB26D4513EE6364FBD97C4F815122FB4D57AEBDF38CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005F490, Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c98a7c03b056bf897b50c999e530441a062f43ea8ff7e63b9bd448889a0739
Instruction ID: f96005f1b71c62cd91ec633b0fa556b6f093996ab6e40a041e3cbd638a23d0d9
Opcode Fuzzy Hash: 29c98a7c03b056bf897b50c999e530441a062f43ea8ff7e63b9bd448889a0739
Instruction Fuzzy Hash: C1C1BD3270164096FB12EF76D4413ED23A4EB883A8F484622BF2D57AE6EF38D955D350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022D00, Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005ad93020e0817431c5e85dbe6d11178de2602f8c4bd9af456519582a9ff990
Instruction ID: 38de139323f3e079e5738bdd278af51575638bb101dd3218b17e6965c0953cb4
Opcode Fuzzy Hash: 005ad93020e0817431c5e85dbe6d11178de2602f8c4bd9af456519582a9ff990
Instruction Fuzzy Hash: 1DB16A3671062094FB46EBA2D8A17DE2365BB89BC8F825025FF0D67BA7DE38C505C354

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140031540, Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97dd306fff28f1ab02ecd5c90015a73acd09471cf75e7327e0331e3ccb750c21
Instruction ID: bfe4e87f351d28bd3d3693bc96d2151355ab9388d993d4a46e39ffd0a3f78ad6
Opcode Fuzzy Hash: 97dd306fff28f1ab02ecd5c90015a73acd09471cf75e7327e0331e3ccb750c21
Instruction Fuzzy Hash: E6C16332704A809AFB22EBB2D4513EE2365AB9C3D8F854521BF1E676EADF30C505C354

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140062B00, Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfd4a30f1a27aef1054c36b1d99c0610af0cc08103e55e4b01f0e7caa7c836f
Instruction ID: f23c3879964f3f83b961310f1bad7f7be1ef7afa2b68ec7d59790f469601a501
Opcode Fuzzy Hash: bcfd4a30f1a27aef1054c36b1d99c0610af0cc08103e55e4b01f0e7caa7c836f
Instruction Fuzzy Hash: A9A10231211E8145EBA79A2798543EF27A6AB8C3D4F645825FF0E5B6E9EF34C901C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B41B, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16274a22d167cb7459d5025cfc47ed7afc639167fa2c9c1057ca1fd72c03709f
Instruction ID: c0d98bc7e162404dc537a7c1af49e5fbe25e03b535df8b2493956c53732576b9
Opcode Fuzzy Hash: 16274a22d167cb7459d5025cfc47ed7afc639167fa2c9c1057ca1fd72c03709f
Instruction Fuzzy Hash: B2A114F31182A486FB778A2685413FA7FE2E719789F254402FB8A435F6C63CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140066020, Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a77b3ded0776d671925a3aad9e7cc492f01908de9f9e7db45f2ad695b1e2ca
Instruction ID: d17e179c4ad3c1814a715198efb3da372d22ab0628f3c9d9f6a3a053a6971865
Opcode Fuzzy Hash: 39a77b3ded0776d671925a3aad9e7cc492f01908de9f9e7db45f2ad695b1e2ca
Instruction Fuzzy Hash: 79A1903271164045EB22EB7298507EE67E6AB9C3C8F550925BF4D47BEAEF34CA068310

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007A60, Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb3ae0ca8b09634f6b3eb7f35d10a75bd1e51e3d218a5b4533eb8f41dc86bd2
Instruction ID: 7cb660c1bafc6db3c15f0a4866a94b05aa7759728bb06ab0739d07cd917ce7e2
Opcode Fuzzy Hash: 8bb3ae0ca8b09634f6b3eb7f35d10a75bd1e51e3d218a5b4533eb8f41dc86bd2
Instruction Fuzzy Hash: 33B18C7262464191EB12EB62E4913EE6365FB9C7C4F801022FB4E47ABBDF38C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B43D, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8327572ae460ec67bee7642bc1df1dfc8e00bf19c98c3d2f0bb37742338d2b
Instruction ID: ff1b56ecf022c2229069a5389c0477a62f006b84fd5f9f69eebb894724ab9066
Opcode Fuzzy Hash: dc8327572ae460ec67bee7642bc1df1dfc8e00bf19c98c3d2f0bb37742338d2b
Instruction Fuzzy Hash: 44A125F21182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B424, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92fc6e297697f72d3d55b197ac04fe50775a4f95a26f4c9e919e5e137ab98750
Instruction ID: f965aa676d2cc64f6a485257af634002c7fef1377d4791c8bed9b1b7e56d6411
Opcode Fuzzy Hash: 92fc6e297697f72d3d55b197ac04fe50775a4f95a26f4c9e919e5e137ab98750
Instruction Fuzzy Hash: 79A115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B42D, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e075c1df208aa39fb877a834bfc4403f559291216783e55fb63477ae2eadfdc
Instruction ID: 86c182e730ead1fa639f737d8458d4edb1cdee6041daaa12aedc2aef895c7c0c
Opcode Fuzzy Hash: 1e075c1df208aa39fb877a834bfc4403f559291216783e55fb63477ae2eadfdc
Instruction Fuzzy Hash: 83A115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B436, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68406ce4345875cbc0110dbe212228596ffa7fd34d07f9d141f7f6a9cf54bfa
Instruction ID: 7a8579acbe1e06e5dcc528155c10978c06d1d02f61772b3afab02cdca005db6d
Opcode Fuzzy Hash: b68406ce4345875cbc0110dbe212228596ffa7fd34d07f9d141f7f6a9cf54bfa
Instruction Fuzzy Hash: 3EA115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B446, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a2fa5d4e375044cfc16d96b5b502da69406d12098659286745a9d4aecf6a6c
Instruction ID: 9b5f4d2890da7bc9148b0c777fb781a5a0913674a9f0c1f21bc34f13756e8484
Opcode Fuzzy Hash: 20a2fa5d4e375044cfc16d96b5b502da69406d12098659286745a9d4aecf6a6c
Instruction Fuzzy Hash: 37A114F31182A489FB778A2685413FA7FE2E719789F254402FB8A475F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140069A50, Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847c53cd22c21084d67cb822d3c8f80ec4024bd4884789ed31c06eb0f484aec6
Instruction ID: 9e8436de532ad8a8b9d83a7ce7f67d33a1e65f1b543d517c902b78be038a8119
Opcode Fuzzy Hash: 847c53cd22c21084d67cb822d3c8f80ec4024bd4884789ed31c06eb0f484aec6
Instruction Fuzzy Hash: 6FA19F3271464095EB22EB72D4913EE63A5A78C7C8F914426FF0D57AFAEE38C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001010, Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b042d90c0f8c1feaf42d72467fc8ea1d5898c5b9afd74594c11dc23e78b13021
Instruction ID: 891caef274385c1d9a1a05b5f8e139ad0eea2bdcde326525a3acf11d5ee056db
Opcode Fuzzy Hash: b042d90c0f8c1feaf42d72467fc8ea1d5898c5b9afd74594c11dc23e78b13021
Instruction Fuzzy Hash: 79918D7270164095EB16EF66E4507EE23A5ABDC7C4F448425BF4E97BA6EE34C906C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002EA00, Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 021a3a3adc72e5499a3e99e641452b728adda475d812817d2397788abd9fb6a4
Instruction ID: 09ec91f3f7d35e473cfa3e72b303784d96220d522314983c3d838af10b8059fe
Opcode Fuzzy Hash: 021a3a3adc72e5499a3e99e641452b728adda475d812817d2397788abd9fb6a4
Instruction Fuzzy Hash: C4A16E32314A8095FB22EB72D8513EE2365EB987D4F940426BB4D57AFADF34CA05C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018300, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce67bfafa3a41e60d72f08d4a165a2184096e63d57257d43e1b540ba17e5e704
Instruction ID: 9282ef7f3f2e177ec3162a27807bc3d77d508fe5c2bed51c5ff564ba7b898efa
Opcode Fuzzy Hash: ce67bfafa3a41e60d72f08d4a165a2184096e63d57257d43e1b540ba17e5e704
Instruction Fuzzy Hash: 99912232B15A4099FB12EBB2D4913ED23659B9C7C8F814525BF0DA76EBEE34C609C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002E1B0, Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: e13badc4eecd54d72134e33fa3c908df50463b4c7afbc823f6efb99f8860a50f
Instruction ID: a01e236db0e61280ae7bc249da652572acbbc64743681568c883ee8cb5c556df
Opcode Fuzzy Hash: e13badc4eecd54d72134e33fa3c908df50463b4c7afbc823f6efb99f8860a50f
Instruction Fuzzy Hash: D7916C3272468092FB12EB62D4957DE6365FB9C7C4F811022BB4D43AABDF78C544CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003EFB0, Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bec047f33ee0572188590f4278c6d3b9bee721e36306d1774188d0e8c9170a8
Instruction ID: 2085d5fbde7ab3b46fd7c59f247d5158c6ccb74e37f4a5dfc0e2ff2c0c09d730
Opcode Fuzzy Hash: 9bec047f33ee0572188590f4278c6d3b9bee721e36306d1774188d0e8c9170a8
Instruction Fuzzy Hash: 87814F36204A85C6EB679B2BE9403AF6B61F38DBD0F594512EF9A477B5CE38C442D310

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400276C0, Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edcdc2154c5838ab1c8625022021c2da12bae5cdd39a93ebf1f5cb6a04e32108
Instruction ID: bfac23c94d9038130fb0cc9f6c7292f6f1aa2b418e68c536fc9a693e481bc66c
Opcode Fuzzy Hash: edcdc2154c5838ab1c8625022021c2da12bae5cdd39a93ebf1f5cb6a04e32108
Instruction Fuzzy Hash: 1E91B13270164096FB22EB22D4517EE23A0EB9C3C8F855426BB4E57AFADF34C944C351

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140064E80, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bede4ae264e8185b0f9f24becd31f8195eff363a0612df846459a6d3a9af60c0
Instruction ID: 348a5c641c523964159132b8cb670365254cd557f13034448bd6fc243d7f1d42
Opcode Fuzzy Hash: bede4ae264e8185b0f9f24becd31f8195eff363a0612df846459a6d3a9af60c0
Instruction Fuzzy Hash: AB81503271064095FB12EB76D8913EE63A5AB9D7C8F944621BF0D4BAEAEF34C605C350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140016100, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e54b42b1a183fcc3e26b712d0c98e0febe665e521d345cd27406ffce54824ba
Instruction ID: 4362bffb4ce140633d60009826b42a117c21897de7dbf4a94b418fc321f1d931
Opcode Fuzzy Hash: 0e54b42b1a183fcc3e26b712d0c98e0febe665e521d345cd27406ffce54824ba
Instruction Fuzzy Hash: 35812032714A809AFB12EB72D4513ED2365EB9C388F814425BB4E67AEBEF35C605C354

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140032650, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 1556071639309c0f3bf9c98b804d70b10111ac1c0d30ce30fda26827df1e6222
Instruction ID: a8b049447ef23dc7a2f3147d56ae0c312f8ac6a7955db6ed7517384e00930876
Opcode Fuzzy Hash: 1556071639309c0f3bf9c98b804d70b10111ac1c0d30ce30fda26827df1e6222
Instruction Fuzzy Hash: 0371893270264096FB66AB7294503EE6391EB9C7C8F054526BB1D47BEAEF39C905C360

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400663F0, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d7b3c9e63ec17fbb3decf34851c1318d937a82485f1e960baa699eab580419
Instruction ID: 4c1290556f20f3e20b66d81894b0d385f6ea8bc2319cc982c81cb2944955426d
Opcode Fuzzy Hash: 53d7b3c9e63ec17fbb3decf34851c1318d937a82485f1e960baa699eab580419
Instruction Fuzzy Hash: 6E61B031301A4041EA66E737A9517EF97929F9D7D0FA44621BF5E877FAEE38C9028700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D850, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ec1b3edf0780c5c25e1336ba948ef3e7aec6e0b63b2610df3acb1851feab05
Instruction ID: 50d9e92313d7fbe24902196c924c1612cff9653e99501bbf2772a847790ebefc
Opcode Fuzzy Hash: 17ec1b3edf0780c5c25e1336ba948ef3e7aec6e0b63b2610df3acb1851feab05
Instruction Fuzzy Hash: 7D618D3271464496FB22EB72C0913EE23A5ABDC7C8F854422BF4D57AEAEE35C501C791

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001620, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e611ef6babe13b88f779e8dc5a7611e7c7a64f37548e21c7e35d19833addd5d9
Instruction ID: f8f81a1e6eeb4aa67bd22a5a7a70358e1ddf5b3241a247c9d5674b6b5ab46101
Opcode Fuzzy Hash: e611ef6babe13b88f779e8dc5a7611e7c7a64f37548e21c7e35d19833addd5d9
Instruction Fuzzy Hash: 9061C43262465091FB21EB26E0517EE6360FBCD7C4F815122BB5D47AEAEF79C541CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400319F0, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: ac7f08871eadb0e88aebf12c8c96c3d08f64978839d47a5fff32e650f5283656
Instruction ID: f33abad4c1c8ba015261be05896130ca5dc3e7c07ce7e813c180037223ea8262
Opcode Fuzzy Hash: ac7f08871eadb0e88aebf12c8c96c3d08f64978839d47a5fff32e650f5283656
Instruction Fuzzy Hash: 08718E32714A809AEB12EF76D4913EE7761F798388F844026FB4D47AAADF74C548CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400688A0, Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: c6b0428fc7416c9690bb78137e55356240e86da8257680fa94455239788aca03
Instruction ID: 125c4d10a522e701d1fb6d0f1aef761f583aa31ccbb75f1db25899523a723602
Opcode Fuzzy Hash: c6b0428fc7416c9690bb78137e55356240e86da8257680fa94455239788aca03
Instruction Fuzzy Hash: 0151633271468052FB22EBB6E4513EE6761EBD83C4F951122BB4D47AEADE38C544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022730, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025899d978c00459a39b97666279dda4e96ed2cbcc4f77a24580eef4709ea6a8
Instruction ID: af2d80f9b144edbe9aa630ca6e788b257520dbedf888a3db325da96401233726
Opcode Fuzzy Hash: 025899d978c00459a39b97666279dda4e96ed2cbcc4f77a24580eef4709ea6a8
Instruction Fuzzy Hash: FA612832600B8085E755DF36A481BDD33A9F78DB88FA84138EF990B36ADF318055D768

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140031340, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f431bbfb257fb34b4f249f0b6c1a5781a1840d33aa954166e75b638a15f3be8f
Instruction ID: 50cb9f747c07e87171e39f534f7bbd71060f83f950b2ada1a46c15cbddfc577a
Opcode Fuzzy Hash: f431bbfb257fb34b4f249f0b6c1a5781a1840d33aa954166e75b638a15f3be8f
Instruction Fuzzy Hash: A0511B32700A4096FB12EB76D4917EE2365AB9C7C8F954421BF0DA7AEADF34C605C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002F840, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1a38846fc5b12dd28166e38272f044d4b391af603d2f1471411a8db1635f5ab
Instruction ID: 9602d307e9de31d357e639a9611a18ab9b6f2b9e1d5f0c6a8a00986c6f50d329
Opcode Fuzzy Hash: e1a38846fc5b12dd28166e38272f044d4b391af603d2f1471411a8db1635f5ab
Instruction Fuzzy Hash: 7F51AD32200A40A2EA22EB22D9957FE63A5F7DC7D0F854626FB0D836B6DF34C556D710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002DDE0, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 92949d39d4540ea38b5c00f16dffcfa1214f5dbdd9c806517ba7762cbc11b342
Instruction ID: aca98edda921e0e11dbb2b437e66833b6d9475281c93859f86ded24665675a69
Opcode Fuzzy Hash: 92949d39d4540ea38b5c00f16dffcfa1214f5dbdd9c806517ba7762cbc11b342
Instruction Fuzzy Hash: E5516E3271465095FB52EB76E4913EE6761EBD8388F850026BB4E479EADF38C948CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140060FE0, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1f30609a35c92b6828c9fb432082ebd1e5c5e84766b67bb61e5bcc9401a082
Instruction ID: 51a026cb75a50cc44213724d5bb8c382370875f63e51d6fdf42d7c4c4c07ed92
Opcode Fuzzy Hash: 1c1f30609a35c92b6828c9fb432082ebd1e5c5e84766b67bb61e5bcc9401a082
Instruction Fuzzy Hash: 5D415F32B1066095FB12E77798517EE23A2ABCD7C4FA94421BF0E57AEBDE34C5018354

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400611A0, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8619ee3f9ccd1f320a5fbfbf5c9367aa5b7df2049cee1b1ea35a7e4b7e812f95
Instruction ID: fec891e6c53086f7b9094a78f95b73510c7007b912bc3ef8a41aa8e11e9acb14
Opcode Fuzzy Hash: 8619ee3f9ccd1f320a5fbfbf5c9367aa5b7df2049cee1b1ea35a7e4b7e812f95
Instruction Fuzzy Hash: 01413D31B2066095FB12EB7798513EE13A6ABDC7C4F994421BF0E97AEADE38C5058314

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022A00, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a10d479a193238a188e8adb5c0a2baa624421bbad2986b298b06f84ca2b66ec
Instruction ID: 4d6ce7f696a26fe9a74b6bb9734e6d6bbac3d85ccec2ef1c97bdec5ab73240ea
Opcode Fuzzy Hash: 9a10d479a193238a188e8adb5c0a2baa624421bbad2986b298b06f84ca2b66ec
Instruction Fuzzy Hash: FC51D732610B9085E785DF36E4813DD33A9F748F88F58413AAB8D4B7AADF348152C764

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400286B0, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 0dd31b007056381f4657a5f1dbdce23ecbf955912ad383fd51e82bbfc18d9e36
Instruction ID: a9185cf0004c76bb3001b2cb896eaa84c5f9aff40342764b4326ba4d96cea24c
Opcode Fuzzy Hash: 0dd31b007056381f4657a5f1dbdce23ecbf955912ad383fd51e82bbfc18d9e36
Instruction Fuzzy Hash: 9F514632310B81A2E74EDB32E5813D9B369FB8C384F908415EB9813AA6DF35D676D704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022340, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0bc628afaa724f2a407568f7776cab89400c990b0d91b82c0bf42df1747497
Instruction ID: 1e1e8128ca37617077ad8d3bddb138d765a5f71e348f586f351b06e9a9582713
Opcode Fuzzy Hash: 8d0bc628afaa724f2a407568f7776cab89400c990b0d91b82c0bf42df1747497
Instruction Fuzzy Hash: 5C51C773611B9085E745DF36E8813DD37A8F748F88F58413AEB894B6AADF308156C760

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140063BD0, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a990b53e0665ad0886faa979631976ec8b00dc7985899795eb44eacb3e5b3434
Instruction ID: 5f416d68214368cc8d497caad67b5ad9eebcd67f96a0df70edf52f54e079c757
Opcode Fuzzy Hash: a990b53e0665ad0886faa979631976ec8b00dc7985899795eb44eacb3e5b3434
Instruction Fuzzy Hash: DE31F53221099842FBA6471B9C613F93292E79C3E4F649625FB8E537F4D67DC8038B80

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005370, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bce42950a1e8a62078921d64ca997753bf7c09f413ca20ce6f360246a445e94
Instruction ID: 604a730c127844f2816d2636316060c5dd02da03d6f4240a24423d76594c64fe
Opcode Fuzzy Hash: 5bce42950a1e8a62078921d64ca997753bf7c09f413ca20ce6f360246a445e94
Instruction Fuzzy Hash: 55313F32610B9091E749DB36D9813DD73A9F78CB84FA58526A39847AA6DF35C177C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007EA0, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274495775.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.274489579.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274590714.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.274614468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.274620536.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc6e0ee29a39c7d5a8b9bac5d98e7e3adc62a080d0eb157144b98198d9367420
Instruction ID: 1d8fa33d8030516f9812c7435f1c2f5fee2e6c5a40d503ba1f82db291cb841dc
Opcode Fuzzy Hash: cc6e0ee29a39c7d5a8b9bac5d98e7e3adc62a080d0eb157144b98198d9367420
Instruction Fuzzy Hash: 7131DC32600B4080E745DF3699813EDB3E9FBACB88FA9853697484A9B6DF35C157D310

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 4756 Parent PID: 4916 rundll32.exeCOMMON

Executed Functions

Function 0000019299E92252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0000019299E923B0
VirtualProtect.KERNELBASE ref: 0000019299E92471
RtlAvlRemoveNode.NTDLL ref: 0000019299E925B4
VirtualProtect.KERNELBASE ref: 0000019299E92677

Memory Dump Source

Source File: 00000002.00000002.340047986.0000019299E90000.00000040.00000001.sdmp, Offset: 0000019299E90000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 8855f531d94f72a380afdb30d884598f25f062692f8a089169fa3cdb7bf48733
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 29B14276618BD58ADB30CB1AF4407DEB7A1F789B94F108026EEC957B58CB79C8518F40

Uniqueness

Uniqueness Score: -1.00%

Function 0000019299E92057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000019299E929A8), ref: 0000019299E920A7

Memory Dump Source

Source File: 00000002.00000002.340047986.0000019299E90000.00000040.00000001.sdmp, Offset: 0000019299E90000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: ae712ec85870589afc35c9e566b725728da13499ea3a97abc62c18fede64a743
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: F6312A76715B9086D790DF1AE45479A7BA0F389BD4F205026EF8D87B18DF3AC486CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 3228 Parent PID: 4956 rundll32.exeCOMMON

Executed Functions

Function 000002622EAC2252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000002622EAC23B0
VirtualProtect.KERNELBASE ref: 000002622EAC2471
RtlAvlRemoveNode.NTDLL ref: 000002622EAC25B4
VirtualProtect.KERNELBASE ref: 000002622EAC2677

Memory Dump Source

Source File: 00000003.00000002.253676857.000002622EAC0000.00000040.00000001.sdmp, Offset: 000002622EAC0000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 489519959edb4fcf3d7c36773c1f03d1a2d919a10fe92a104baf96417cfa9412
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 17B14276618BC486D770CB1AE440B9AB7A1F7C9B80F108026EECD57B58DB7EC8468F40

Uniqueness

Uniqueness Score: -1.00%

Function 000002622EAC2057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000002622EAC29A8), ref: 000002622EAC20A7

Memory Dump Source

Source File: 00000003.00000002.253676857.000002622EAC0000.00000040.00000001.sdmp, Offset: 000002622EAC0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 631e68fee0eda0b1f833255ec7362ec4422c8e8d08f89a7e5d74197db0641b6e
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 57310572615B9086D790DB1AE49475A7BB0F389BD4F209026EF8D87B28DB3AC4468B40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 2964 Parent PID: 4956 rundll32.exeCOMMON

Executed Functions

Function 0000019275562252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00000192755623B0
VirtualProtect.KERNELBASE ref: 0000019275562471
RtlAvlRemoveNode.NTDLL ref: 00000192755625B4
VirtualProtect.KERNELBASE ref: 0000019275562677

Memory Dump Source

Source File: 00000007.00000002.261464026.0000019275560000.00000040.00000001.sdmp, Offset: 0000019275560000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 7f49c6f6c0722756aa88cbfd6470f724f7a8f7f421ab622b5a4663c068dda1d8
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 43B15476618BC486D730CB5AE450BDEB7A1F7D9B90F108026EEC967B58DB79C8418F40

Uniqueness

Uniqueness Score: -1.00%

Function 0000019275562057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,00000192755629A8), ref: 00000192755620A7

Memory Dump Source

Source File: 00000007.00000002.261464026.0000019275560000.00000040.00000001.sdmp, Offset: 0000019275560000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: c2f587a662f28c83943392d392126c2917f6f465a0c7246d7f3fe4b9f120f3f8
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 95315C72615B9086D780DF1AE45479A7BA0F389FD4F204026EF8D97B18DF3AC442CB40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 5228 Parent PID: 4956 rundll32.exeCOMMON

Executed Functions

Function 000001CDF1E72252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001CDF1E723B0
VirtualProtect.KERNELBASE ref: 000001CDF1E72471
RtlAvlRemoveNode.NTDLL ref: 000001CDF1E725B4
VirtualProtect.KERNELBASE ref: 000001CDF1E72677

Memory Dump Source

Source File: 0000000A.00000002.269237425.000001CDF1E70000.00000040.00000001.sdmp, Offset: 000001CDF1E70000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 90a237bd350551974e93b46a3341a522d4d435f37034bf476c72a3b153128ae0
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 8CB15676618BC586E770CB5AF440BDEB7A1F7C9B80F10812ADE8957B58DB79C8428F40

Uniqueness

Uniqueness Score: -1.00%

Function 000001CDF1E72057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001CDF1E729A8), ref: 000001CDF1E720A7

Memory Dump Source

Source File: 0000000A.00000002.269237425.000001CDF1E70000.00000040.00000001.sdmp, Offset: 000001CDF1E70000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: c7c14cbcafd9ee5d2b328aad62021638b50304a6b8547de91e96d54df135ffa1
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: F1314B72615B8086D790DF5AF45479A7BA0F389BC4F204126EF8E87B18DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: BdeUISrv.exe PID: 7076 Parent PID: 3472 BdeUISrv.exeCOMMON

Executed Functions

Function 0000021D21472252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0000021D214723B0
VirtualProtect.KERNELBASE ref: 0000021D21472471
RtlAvlRemoveNode.NTDLL ref: 0000021D214725B4
VirtualProtect.KERNELBASE ref: 0000021D21472677

Memory Dump Source

Source File: 00000016.00000002.370301335.0000021D21470000.00000040.00000001.sdmp, Offset: 0000021D21470000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 50f3e2f3a9d0bb3bc042484f9a59d0c9217f8ce26607108acb84ab05c87a0f11
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: B5B152B6618BC486D770CB1AE440BDEB7A1F7D9B80F108126EE8D57B59DB79C8428F40

Uniqueness

Uniqueness Score: -1.00%

Function 0000021D21472057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000021D214729A8), ref: 0000021D214720A7

Memory Dump Source

Source File: 00000016.00000002.370301335.0000021D21470000.00000040.00000001.sdmp, Offset: 0000021D21470000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: d985eceec23d6e9da86f80b3c32da066a6e3b42d9c45ab697c37b2ac0aa47410
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 63314BB2615B8086D790DF1AE45479A7BA0F389BC4F208126EF8D87B18DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7CAA64500, Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 309COMMON

Download Yara Rule

APIs

ConvertStringSidToSidW.ADVAPI32 ref: 00007FF7CAA64638
IsValidSid.ADVAPI32 ref: 00007FF7CAA64659
GetAclInformation.ADVAPI32 ref: 00007FF7CAA64681
GetLengthSid.ADVAPI32 ref: 00007FF7CAA6469D
malloc.MSVCRT ref: 00007FF7CAA646AE
InitializeAcl.ADVAPI32 ref: 00007FF7CAA646CB
GetAce.ADVAPI32 ref: 00007FF7CAA64716
AddAce.ADVAPI32 ref: 00007FF7CAA64739
GetAclInformation.ADVAPI32 ref: 00007FF7CAA646F3

Part of subcall function 00007FF7CAA61324: GetLastError.KERNEL32(?,?,?,?,00007FF7CAA63F52,?,?,?,00007FF7CAA63F97,?,?,?,?,?,00007FF7CAA645BE), ref: 00007FF7CAA61328

AddAccessAllowedAce.ADVAPI32 ref: 00007FF7CAA6475F
free.MSVCRT ref: 00007FF7CAA6476F
free.MSVCRT ref: 00007FF7CAA64785
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF7CAA647AF
LocalFree.KERNEL32 ref: 00007FF7CAA647CC
CoInitializeSecurity.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7CAA64813
GetLastError.KERNEL32 ref: 00007FF7CAA648CE
LocalFree.KERNEL32 ref: 00007FF7CAA6494E
free.MSVCRT ref: 00007FF7CAA6498D
free.MSVCRT ref: 00007FF7CAA64997
free.MSVCRT ref: 00007FF7CAA649A0
free.MSVCRT ref: 00007FF7CAA649AA

Part of subcall function 00007FF7CAA64320: TraceMessage.ADVAPI32 ref: 00007FF7CAA64333

Strings

S-1-5-80-2962817144-200689703-2266453665-3849882635-1986547430, xrefs: 00007FF7CAA645A4

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: free$ErrorFreeInformationInitializeLastLocalSecurity$AccessAllowedConvertDaclDescriptorLengthMessageStringTraceValidmalloc
String ID: S-1-5-80-2962817144-200689703-2266453665-3849882635-1986547430
API String ID: 3138885880-1389451066
Opcode ID: 0bc2c9490b22047a22ea888155154c352915ddd435308938fb2d8470ed0ba554
Instruction ID: fa8d714ce07b84ba4c623308456a58cf8e43f5d074e17d07e7c770f6ee90032a
Opcode Fuzzy Hash: 0bc2c9490b22047a22ea888155154c352915ddd435308938fb2d8470ed0ba554
Instruction Fuzzy Hash: 01E16222B08A428AF750EF51F560BBDA7A0BF447AAF904475CE0E47690DF3DE4478B60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA638D0, Relevance: 35.3, APIs: 17, Strings: 3, Instructions: 349registrycomCOMMON

Download Yara Rule

APIs

CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7CAA63971
StringFromGUID2.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7CAA63A07
wcscpy_s.MSVCRT ref: 00007FF7CAA63A1F
wcscat_s.MSVCRT ref: 00007FF7CAA63A5F
wcscat_s.MSVCRT ref: 00007FF7CAA63A9B
RegOpenKeyExW.ADVAPI32 ref: 00007FF7CAA63B03
RegQueryInfoKeyW.ADVAPI32 ref: 00007FF7CAA63B4A
RegCloseKey.ADVAPI32 ref: 00007FF7CAA63B5B
wcscpy_s.MSVCRT ref: 00007FF7CAA63B9D
wcscat_s.MSVCRT ref: 00007FF7CAA63BD9
wcscat_s.MSVCRT ref: 00007FF7CAA63C15
RegOpenKeyExW.ADVAPI32 ref: 00007FF7CAA63C62
RegCloseKey.ADVAPI32 ref: 00007FF7CAA63C7B
RegQueryInfoKeyW.ADVAPI32 ref: 00007FF7CAA63CC2
RegCloseKey.ADVAPI32 ref: 00007FF7CAA63CD3
RegCloseKey.ADVAPI32 ref: 00007FF7CAA63D0B
RegCloseKey.ADVAPI32 ref: 00007FF7CAA63D19

Strings

\Required Categories, xrefs: 00007FF7CAA63A8D
CLSID\, xrefs: 00007FF7CAA63A12, 00007FF7CAA63B90
\Implemented Categories, xrefs: 00007FF7CAA63C07

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$wcscat_s$InfoOpenQuerywcscpy_s$CreateFromInstanceString
String ID: CLSID\$\Implemented Categories$\Required Categories
API String ID: 1083922788-4092563799
Opcode ID: d66b819d257da680a5716e40e363e8b491b5932a86dbf3f0706f0d82204bec4f
Instruction ID: 851b6293d34da27f3e2528ccbb1e35e020b5cebb9a3e97cb6b6b2b66308456bf
Opcode Fuzzy Hash: d66b819d257da680a5716e40e363e8b491b5932a86dbf3f0706f0d82204bec4f
Instruction Fuzzy Hash: 81E1B921A0874282FB24AF65F8649BDA7A5BF40B65F940476DA4D47AA4CF3CD443CF30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA664A0, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 155servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 00007FF7CAA66523
GetLastError.KERNEL32 ref: 00007FF7CAA66531
OpenServiceW.ADVAPI32 ref: 00007FF7CAA6655A
GetLastError.KERNEL32 ref: 00007FF7CAA66568
QueryServiceStatus.ADVAPI32 ref: 00007FF7CAA66589
StartServiceW.ADVAPI32 ref: 00007FF7CAA665A2
GetLastError.KERNEL32 ref: 00007FF7CAA665AC
Sleep.KERNEL32 ref: 00007FF7CAA665C3
QueryServiceStatus.ADVAPI32 ref: 00007FF7CAA665D1
GetLastError.KERNEL32 ref: 00007FF7CAA665F9
CloseServiceHandle.ADVAPI32 ref: 00007FF7CAA66610
CloseServiceHandle.ADVAPI32 ref: 00007FF7CAA66620

Part of subcall function 00007FF7CAA64320: TraceMessage.ADVAPI32 ref: 00007FF7CAA64333

Strings

ServicesActive, xrefs: 00007FF7CAA664FD
BDESVC, xrefs: 00007FF7CAA66550

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: Service$ErrorLast$CloseHandleOpenQueryStatus$ManagerMessageSleepStartTrace
String ID: BDESVC$ServicesActive
API String ID: 3723167904-2844110401
Opcode ID: e44f93c6a07b2301bd2b38ba170ff66daf209adcca82da83cc1a6e2a5d08699f
Instruction ID: 8815af9fc18026aa621e435772018b5451d0eedac47b83787f1123163faf76f2
Opcode Fuzzy Hash: e44f93c6a07b2301bd2b38ba170ff66daf209adcca82da83cc1a6e2a5d08699f
Instruction Fuzzy Hash: E0519225A08A42C2F658BF15B564EBDE3D0BF84BA6F9401B5C90E476A0DE3CE4078F20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA64D78, Relevance: 24.2, APIs: 16, Instructions: 158windowsleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FF7CAA64E4C
CreateThread.KERNEL32 ref: 00007FF7CAA64E7F
CloseHandle.KERNEL32 ref: 00007FF7CAA64E94
CoResumeClassObjects.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7CAA64E9F
SetEvent.KERNEL32 ref: 00007FF7CAA64EB2
WaitForSingleObject.KERNEL32 ref: 00007FF7CAA64EC3
CloseHandle.KERNEL32 ref: 00007FF7CAA64ECC
CoRevokeClassObject.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7CAA64F05
GetMessageW.USER32 ref: 00007FF7CAA64F32
TranslateMessage.USER32 ref: 00007FF7CAA64F41
DispatchMessageW.USER32 ref: 00007FF7CAA64F4C
GetMessageW.USER32 ref: 00007FF7CAA64F5F
CoRevokeClassObject.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7CAA64F8B
Sleep.KERNEL32 ref: 00007FF7CAA64FAF

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$ClassObject$CloseCreateEventHandleRevoke$DispatchObjectsResumeSingleSleepThreadTranslateWait
String ID:
API String ID: 517845487-0
Opcode ID: a8c3b643619d333e97f51029910c704887a24c3f3bf25a1f2ad3a6000a6244fb
Instruction ID: d3cc190f73fea4778779e3e00f58a1f7630879fcbf90f6fde0afeb7f31c1a261
Opcode Fuzzy Hash: a8c3b643619d333e97f51029910c704887a24c3f3bf25a1f2ad3a6000a6244fb
Instruction Fuzzy Hash: 99710021B08B438BF750AF65F664E7DA3A1EF58B66F8400B5CA0D47664DF2CE4468F24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA63F74, Relevance: 24.2, APIs: 16, Instructions: 152threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CAA63ED0: free.MSVCRT(?,?,?,00007FF7CAA63F97,?,?,?,?,?,00007FF7CAA645BE), ref: 00007FF7CAA63EED
Part of subcall function 00007FF7CAA63ED0: free.MSVCRT(?,?,?,00007FF7CAA63F97,?,?,?,?,?,00007FF7CAA645BE), ref: 00007FF7CAA63EFC
Part of subcall function 00007FF7CAA63ED0: free.MSVCRT(?,?,?,00007FF7CAA63F97,?,?,?,?,?,00007FF7CAA645BE), ref: 00007FF7CAA63F0B
Part of subcall function 00007FF7CAA63ED0: free.MSVCRT(?,?,?,00007FF7CAA63F97,?,?,?,?,?,00007FF7CAA645BE), ref: 00007FF7CAA63F1A
Part of subcall function 00007FF7CAA63ED0: InitializeSecurityDescriptor.ADVAPI32(?,?,?,00007FF7CAA63F97,?,?,?,?,?,00007FF7CAA645BE), ref: 00007FF7CAA63F3F

GetCurrentThread.KERNEL32 ref: 00007FF7CAA63FB4
OpenThreadToken.ADVAPI32(?,?,?,?,?), ref: 00007FF7CAA63FCA
CloseHandle.KERNEL32(?,?,?,?,?), ref: 00007FF7CAA63FEB

Part of subcall function 00007FF7CAA61324: GetLastError.KERNEL32(?,?,?,?,00007FF7CAA63F52,?,?,?,00007FF7CAA63F97,?,?,?,?,?,00007FF7CAA645BE), ref: 00007FF7CAA61328

GetCurrentProcess.KERNEL32(?,?,?,?,?), ref: 00007FF7CAA6401C
OpenProcessToken.ADVAPI32(?,?,?,?,?), ref: 00007FF7CAA6402B
CloseHandle.KERNEL32(?,?,?,?,?), ref: 00007FF7CAA6404C
SetSecurityDescriptorOwner.ADVAPI32(?,?,?,?,?), ref: 00007FF7CAA64073
free.MSVCRT(?,?,?,?,?), ref: 00007FF7CAA64084
SetSecurityDescriptorOwner.ADVAPI32(?,?,?,?,?), ref: 00007FF7CAA640AD
free.MSVCRT(?,?,?,?,?), ref: 00007FF7CAA640C1
SetSecurityDescriptorGroup.ADVAPI32(?,?,?,?,?), ref: 00007FF7CAA640E0
free.MSVCRT(?,?,?,?,?), ref: 00007FF7CAA640F1
SetSecurityDescriptorGroup.ADVAPI32(?,?,?,?,?), ref: 00007FF7CAA6411E
free.MSVCRT(?,?,?,?,?), ref: 00007FF7CAA64132
free.MSVCRT(?,?,?,?,?), ref: 00007FF7CAA64148
free.MSVCRT(?,?,?,?,?), ref: 00007FF7CAA64151

Part of subcall function 00007FF7CAA64180: GetTokenInformation.ADVAPI32 ref: 00007FF7CAA641D1
Part of subcall function 00007FF7CAA64180: GetLastError.KERNEL32 ref: 00007FF7CAA641D7
Part of subcall function 00007FF7CAA64180: malloc.MSVCRT ref: 00007FF7CAA641E6
Part of subcall function 00007FF7CAA64180: GetTokenInformation.ADVAPI32 ref: 00007FF7CAA6420B
Part of subcall function 00007FF7CAA64180: free.MSVCRT ref: 00007FF7CAA6422C
Part of subcall function 00007FF7CAA64180: GetTokenInformation.ADVAPI32 ref: 00007FF7CAA6426E
Part of subcall function 00007FF7CAA64180: GetLastError.KERNEL32 ref: 00007FF7CAA64274
Part of subcall function 00007FF7CAA64180: malloc.MSVCRT ref: 00007FF7CAA64283
Part of subcall function 00007FF7CAA64180: GetTokenInformation.ADVAPI32 ref: 00007FF7CAA642A8
Part of subcall function 00007FF7CAA64180: free.MSVCRT ref: 00007FF7CAA642C9
Part of subcall function 00007FF7CAA64180: free.MSVCRT ref: 00007FF7CAA642ED
Part of subcall function 00007FF7CAA64180: free.MSVCRT ref: 00007FF7CAA642FF

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: free$Token$DescriptorSecurity$Information$ErrorLast$CloseCurrentGroupHandleOpenOwnerProcessThreadmalloc$Initialize
String ID:
API String ID: 1429459600-0
Opcode ID: 70805b6969b4fec7e5db476a99efb3cd1645d88b94660ac30998f42a1b054dd6
Instruction ID: 8ab10d52a4f0c0b32b670c29ce20de4c3419aac818ea16836e3e608df9e7d46b
Opcode Fuzzy Hash: 70805b6969b4fec7e5db476a99efb3cd1645d88b94660ac30998f42a1b054dd6
Instruction Fuzzy Hash: F6517222B08A1386F740AFA1F5A0BBDA7A0AF44BA5F805471DF0E57655DF3CD4568B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA672BC, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7CAA6730B
RpcStringBindingComposeW.RPCRT4 ref: 00007FF7CAA6732D
RpcBindingFromStringBindingW.RPCRT4 ref: 00007FF7CAA67352
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7CAA6738A
GetLastError.KERNEL32 ref: 00007FF7CAA67394
RpcBindingSetAuthInfoExW.RPCRT4 ref: 00007FF7CAA673D7
RpcStringFreeW.RPCRT4 ref: 00007FF7CAA673FA
FreeSid.ADVAPI32 ref: 00007FF7CAA6740D
RpcBindingFree.RPCRT4 ref: 00007FF7CAA67421

Strings

ncalrpc, xrefs: 00007FF7CAA6731C

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: Binding$FreeString$AllocateAuthComposeErrorFromInfoInitializeLastmemset
String ID: ncalrpc
API String ID: 580237516-2983622238
Opcode ID: dd1116d3b18b243828ebdca67ef3b532bb4d9c8a47a8d547dc3e61090e5b4b3b
Instruction ID: 64ef6710d640e3d580659ba4c5aaf131bbc65d0be3455fb36266bf56a1116a43
Opcode Fuzzy Hash: dd1116d3b18b243828ebdca67ef3b532bb4d9c8a47a8d547dc3e61090e5b4b3b
Instruction Fuzzy Hash: E1516A32614B91DAF720DF61E490AADB3A8FB48B59F804136EA4D47F08DF38D616CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA62134, Relevance: 13.8, APIs: 9, Instructions: 312registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CAA61F7C: CharNextW.USER32(00000000,00000000,?,00007FF7CAA61EF0), ref: 00007FF7CAA61FC2
Part of subcall function 00007FF7CAA61F7C: CharNextW.USER32(00000000,00000000,?,00007FF7CAA61EF0), ref: 00007FF7CAA61FF2
Part of subcall function 00007FF7CAA61F7C: CharNextW.USER32 ref: 00007FF7CAA6200D
Part of subcall function 00007FF7CAA61F7C: CharNextW.USER32 ref: 00007FF7CAA62025
Part of subcall function 00007FF7CAA61F7C: CharNextW.USER32 ref: 00007FF7CAA62034
Part of subcall function 00007FF7CAA61F7C: CharNextW.USER32 ref: 00007FF7CAA62095

lstrcmpiW.KERNEL32(?,?,?,00000000,?,?,00000000,?,00007FF7CAA62EBA,?,?,00000000,00000000,00007FF7CAA62A22,?,00000000), ref: 00007FF7CAA621A5
CharNextW.USER32(?,?,00000000,?,?,00000000,?,00007FF7CAA62EBA,?,?,00000000,00000000,00007FF7CAA62A22,?,00000000), ref: 00007FF7CAA621F1
CharNextW.USER32(?,?,00000000,?,?,00000000,?,00007FF7CAA62EBA,?,?,00000000,00000000,00007FF7CAA62A22,?,00000000), ref: 00007FF7CAA622B1
CharNextW.USER32(?,?,00000000,?,?,00000000,?,00007FF7CAA62EBA,?,?,00000000,00000000,00007FF7CAA62A22,?,00000000), ref: 00007FF7CAA622CD
RegSetValueExW.ADVAPI32(?,?,00000000,?,?,00000000,?,00007FF7CAA62EBA,?,?,00000000,00000000,00007FF7CAA62A22,?,00000000), ref: 00007FF7CAA62337

Part of subcall function 00007FF7CAA61F7C: CharNextW.USER32(00000000,00000000,?,00007FF7CAA61EF0), ref: 00007FF7CAA620B6

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext$Valuelstrcmpi
String ID:
API String ID: 4139903544-0
Opcode ID: c40e0ae5fa6a192c8c4f1fe79ea68d52ce4f7154d232f005b6302cff32b69d27
Instruction ID: abd5321fad74f73657142ad27940fdd5da0c58ec797c594a14e82d4079e8a11a
Opcode Fuzzy Hash: c40e0ae5fa6a192c8c4f1fe79ea68d52ce4f7154d232f005b6302cff32b69d27
Instruction Fuzzy Hash: 1CC1A462E0864282F720AF65F464ABDE391FB847B1F804175EA5D83BD8DF7CD44A8B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA61DA4, Relevance: 12.1, APIs: 8, Instructions: 133libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF7CAA61DEF
FindResourceExW.KERNEL32 ref: 00007FF7CAA61E15
FreeLibrary.KERNEL32 ref: 00007FF7CAA61EF5

Part of subcall function 00007FF7CAA61324: GetLastError.KERNEL32(?,?,?,?,00007FF7CAA63F52,?,?,?,00007FF7CAA63F97,?,?,?,?,?,00007FF7CAA645BE), ref: 00007FF7CAA61328

EnterCriticalSection.KERNEL32 ref: 00007FF7CAA61F54

Part of subcall function 00007FF7CAA61A90: free.MSVCRT ref: 00007FF7CAA61AE9
Part of subcall function 00007FF7CAA61A90: free.MSVCRT ref: 00007FF7CAA61AFC

LeaveCriticalSection.KERNEL32 ref: 00007FF7CAA61F68

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalLibrarySectionfree$EnterErrorFindFreeLastLeaveLoadResource
String ID:
API String ID: 1794745527-0
Opcode ID: 6f2100e8df0ebb5cd31ff989338b97a74c6a28cfca38d67347c84956fe89ab24
Instruction ID: 328dfb3d8267641e8487af6de008edbb8ade31d776b76c3aae613c027447505a
Opcode Fuzzy Hash: 6f2100e8df0ebb5cd31ff989338b97a74c6a28cfca38d67347c84956fe89ab24
Instruction Fuzzy Hash: 5141C721B08A4282FB14AF25B860A7DA7A1EF48BA5F844175DE4E47B95EF3CD4038B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA64A10, Relevance: 12.1, APIs: 8, Instructions: 128memoryregistryCOMMON

Download Yara Rule

APIs

RegisterTraceGuidsW.ADVAPI32 ref: 00007FF7CAA64AA4
HeapSetInformation.KERNEL32 ref: 00007FF7CAA64AF2
GetLastError.KERNEL32 ref: 00007FF7CAA64AFC
GetProcessHeap.KERNEL32 ref: 00007FF7CAA64B3B
HeapSetInformation.KERNEL32 ref: 00007FF7CAA64B51
GetLastError.KERNEL32 ref: 00007FF7CAA64B5B
GetCommandLineW.KERNEL32 ref: 00007FF7CAA64BA4

Part of subcall function 00007FF7CAA64340: TraceMessage.ADVAPI32 ref: 00007FF7CAA64369

UnregisterTraceGuids.ADVAPI32 ref: 00007FF7CAA64C06

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: HeapTrace$ErrorGuidsInformationLast$CommandLineMessageProcessRegisterUnregister
String ID:
API String ID: 3598131306-0
Opcode ID: 766ef4695d39ab5f60619410d23e85cf86b42c78c60d9a1b529c2c1e0fc136d3
Instruction ID: ef0e8aa82547781e295081d58e18cb713cf57bdf88bd8162f333af29bb7ced59
Opcode Fuzzy Hash: 766ef4695d39ab5f60619410d23e85cf86b42c78c60d9a1b529c2c1e0fc136d3
Instruction Fuzzy Hash: DC517335908B4286FB50AF11F560AADF764FB44BA6F9844B2DA4D03694DF3CE447CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA67F30, Relevance: 9.0, APIs: 6, Instructions: 50timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7CAA67F61
GetCurrentProcessId.KERNEL32 ref: 00007FF7CAA67F6F
GetCurrentThreadId.KERNEL32 ref: 00007FF7CAA67F7B
GetTickCount.KERNEL32 ref: 00007FF7CAA67F87
GetTickCount.KERNEL32 ref: 00007FF7CAA67F97
QueryPerformanceCounter.KERNEL32 ref: 00007FF7CAA67FB2

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: dfb87d4e78dbd0da07909342907541787d5170039ebb51ac63ff547b335aebac
Instruction ID: 307658eae7fb594f673356d0879651722f9beb980442b7e1c3e2d45236f80411
Opcode Fuzzy Hash: dfb87d4e78dbd0da07909342907541787d5170039ebb51ac63ff547b335aebac
Instruction Fuzzy Hash: 86118121604F418AEB40EF70F8654AC73A4FB08769B800A30EA5D43754EF3CD166C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA67450, Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CAA672BC: memset.MSVCRT ref: 00007FF7CAA6730B
Part of subcall function 00007FF7CAA672BC: RpcStringBindingComposeW.RPCRT4 ref: 00007FF7CAA6732D
Part of subcall function 00007FF7CAA672BC: RpcStringFreeW.RPCRT4 ref: 00007FF7CAA673FA
Part of subcall function 00007FF7CAA672BC: FreeSid.ADVAPI32 ref: 00007FF7CAA6740D
Part of subcall function 00007FF7CAA672BC: RpcBindingFree.RPCRT4 ref: 00007FF7CAA67421

NdrClientCall3.RPCRT4 ref: 00007FF7CAA674AA
RpcBindingFree.RPCRT4 ref: 00007FF7CAA674DF

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: Free$Binding$String$Call3ClientComposememset
String ID:
API String ID: 2038241420-0
Opcode ID: 0539ba83c4e14899592d633cef2efd2225a8f93ff3dac889d403ccea71e29b3b
Instruction ID: 3914e33265610b8cc0a6114a3dd1d6d7cc68433de41eb01f8b8a39cb8edb0165
Opcode Fuzzy Hash: 0539ba83c4e14899592d633cef2efd2225a8f93ff3dac889d403ccea71e29b3b
Instruction Fuzzy Hash: F9113632628B4186F310DF25E85475EBBA4FB88B90F940175EA8C83B68DF38D452CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA674BE, Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

RpcBindingFree.RPCRT4 ref: 00007FF7CAA674DF

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: BindingFree
String ID:
API String ID: 3284907940-0
Opcode ID: a7fc85ca10fbc2366c5b7e1c960586efc2ad6ba0e6e1158c9197fe2292fbd708
Instruction ID: 70ff1729c16a46b30ae4862683e837f25b704dc3c49fd9246af12b839fa98007
Opcode Fuzzy Hash: a7fc85ca10fbc2366c5b7e1c960586efc2ad6ba0e6e1158c9197fe2292fbd708
Instruction Fuzzy Hash: C3E09A3660874087E7549F29A55436AA6E0F788791F94007AEB8D93A68DE2CD885CE14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA67DA0, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7CAA67DAB

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a225cba22af6f95e1ec24afd43af5f3ffaa77c166ddc13f050053f26bc1ce44a
Instruction ID: a6f96f945a485de262b408be75f7048ec342bad0a25e3fb6c4f9f9d727b6dad7
Opcode Fuzzy Hash: a225cba22af6f95e1ec24afd43af5f3ffaa77c166ddc13f050053f26bc1ce44a
Instruction Fuzzy Hash: 44B09210E35402C1EA04BF61ACA18A853A06B58322FC008B1C00D82220DE1C919B8F10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA660A0, Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7CAA66124
SysStringByteLen.OLEAUT32 ref: 00007FF7CAA661EC
ExpandEnvironmentStringsForUserW.USERENV ref: 00007FF7CAA66278
GetLastError.KERNEL32 ref: 00007FF7CAA66282
wcsncat_s.MSVCRT ref: 00007FF7CAA662F5
wcsncat_s.MSVCRT ref: 00007FF7CAA6630C
memset.MSVCRT ref: 00007FF7CAA66337
ShellExecuteExW.SHELL32 ref: 00007FF7CAA6636B
GetLastError.KERNEL32 ref: 00007FF7CAA66375

Part of subcall function 00007FF7CAA65A4C: TraceMessage.ADVAPI32 ref: 00007FF7CAA65A7C

memset.MSVCRT ref: 00007FF7CAA66134

Part of subcall function 00007FF7CAA64320: TraceMessage.ADVAPI32 ref: 00007FF7CAA64333

Strings

"%SystemRoot%\System32\, xrefs: 00007FF7CAA6626F
Open, xrefs: 00007FF7CAA6633C

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$ErrorLastMessageTracewcsncat_s$ByteEnvironmentExecuteExpandShellStringStringsUser
String ID: "%SystemRoot%\System32\$Open
API String ID: 143345367-1401382488
Opcode ID: d95d3546a92dc0a1ecb2cb74f03aafc78224315e6e52236ee63631ded744153a
Instruction ID: a025fefadb8bdce51164ea6ba9ecb4a91088e4c1f60af7f4b910af4744919141
Opcode Fuzzy Hash: d95d3546a92dc0a1ecb2cb74f03aafc78224315e6e52236ee63631ded744153a
Instruction Fuzzy Hash: 54B19221A08A42C1F754AF21F564FFDA790BB84BAAF8804B1CE0D576A5DE3CD517CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA63268, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7CAA632CB

Part of subcall function 00007FF7CAA61304: InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,00007FF7CAA61050), ref: 00007FF7CAA61308

GetModuleFileNameW.KERNEL32 ref: 00007FF7CAA63340
GetModuleHandleW.KERNEL32 ref: 00007FF7CAA633E1
EnterCriticalSection.KERNEL32 ref: 00007FF7CAA633F1
memcpy_s.MSVCRT ref: 00007FF7CAA63438
EnterCriticalSection.KERNEL32 ref: 00007FF7CAA63488
LeaveCriticalSection.KERNEL32 ref: 00007FF7CAA634AD
EnterCriticalSection.KERNEL32 ref: 00007FF7CAA634CD
LeaveCriticalSection.KERNEL32 ref: 00007FF7CAA634EF

Strings

Module_Raw, xrefs: 00007FF7CAA634D7
REGISTRY, xrefs: 00007FF7CAA6350E
Module, xrefs: 00007FF7CAA63495

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Enter$LeaveModule$FileHandleInitializeNamememcpy_smemset
String ID: Module$Module_Raw$REGISTRY
API String ID: 3759000642-549000027
Opcode ID: 67bd1d2e79513928df5339c6dccbd8620d13ecfacbe30b71661e3bb0208a10d9
Instruction ID: 8f11fef96f9f73f6072feb873fcc0217af6df2cde38aa8b5c7705c3294c905a9
Opcode Fuzzy Hash: 67bd1d2e79513928df5339c6dccbd8620d13ecfacbe30b71661e3bb0208a10d9
Instruction Fuzzy Hash: 2271F222B18A4285FB20AF64F860AFDA3A0FF54766FC41176DA0E47694DF6CD507CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA62634, Relevance: 18.3, APIs: 12, Instructions: 289stringmemoryCOMMON

Download Yara Rule

APIs

CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,00000000,?,00000000,?,00000000,00000000,00007FF7CAA6292F,?,00000000,?,?,00000000,00000000), ref: 00007FF7CAA626B5
CoTaskMemAlloc.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,00000000,?,00000000,?,00000000,00000000,00007FF7CAA6292F,?,00000000,?,?,00000000,00000000), ref: 00007FF7CAA626E6
CharNextW.USER32(?,?,?,00000000,?,00000000,?,00000000,00000000,00007FF7CAA6292F,?,00000000,?,?,00000000,00000000), ref: 00007FF7CAA62710
CharNextW.USER32(?,?,?,00000000,?,00000000,?,00000000,00000000,00007FF7CAA6292F,?,00000000,?,?,00000000,00000000), ref: 00007FF7CAA62742
CharNextW.USER32(?,?,?,00000000,?,00000000,?,00000000,00000000,00007FF7CAA6292F,?,00000000,?,?,00000000,00000000), ref: 00007FF7CAA6276B
wcsncpy_s.MSVCRT ref: 00007FF7CAA627A4
EnterCriticalSection.KERNEL32(?,?,?,00000000,?,00000000,?,00000000,00000000,00007FF7CAA6292F,?,00000000,?,?,00000000,00000000), ref: 00007FF7CAA627DA
lstrcmpiW.KERNEL32(?,?,?,00000000,?,00000000,?,00000000,00000000,00007FF7CAA6292F,?,00000000,?,?,00000000,00000000), ref: 00007FF7CAA627F8
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000000,?,00000000,00000000,00007FF7CAA6292F,?,00000000,?,?,00000000,00000000), ref: 00007FF7CAA62840
CharNextW.USER32(?,?,?,00000000,?,00000000,?,00000000,00000000,00007FF7CAA6292F,?,00000000,?,?,00000000,00000000), ref: 00007FF7CAA62879
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,00000000,?,00007FF7CAA61EF0), ref: 00007FF7CAA62982
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,00000000,?,?,00000000,00000000,?,00007FF7CAA61EF0), ref: 00007FF7CAA62A69

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext$Task$CriticalFreeSectionlstrcmpi$AllocEnterLeavewcsncpy_s
String ID:
API String ID: 227366125-0
Opcode ID: bd448c9a26795ba3b200be2508c0250d89e2d1c04203c14b0e3ed80fd887faf1
Instruction ID: 872fa37549a9842292394f8198c30a8f01c62f9f7b646affd7d5a1561f699396
Opcode Fuzzy Hash: bd448c9a26795ba3b200be2508c0250d89e2d1c04203c14b0e3ed80fd887faf1
Instruction Fuzzy Hash: E8B1A462F08A4285FB20AF51B960ABCA3A0FB54BB2F844175DE5D437D5DE3CD44B8B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA64180, Relevance: 18.1, APIs: 12, Instructions: 120COMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 00007FF7CAA641D1
GetLastError.KERNEL32 ref: 00007FF7CAA641D7
malloc.MSVCRT ref: 00007FF7CAA641E6
GetTokenInformation.ADVAPI32 ref: 00007FF7CAA6420B
free.MSVCRT ref: 00007FF7CAA6422C
GetTokenInformation.ADVAPI32 ref: 00007FF7CAA6426E
GetLastError.KERNEL32 ref: 00007FF7CAA64274
malloc.MSVCRT ref: 00007FF7CAA64283
GetTokenInformation.ADVAPI32 ref: 00007FF7CAA642A8
free.MSVCRT ref: 00007FF7CAA642C9
free.MSVCRT ref: 00007FF7CAA642ED
free.MSVCRT ref: 00007FF7CAA642FF

Part of subcall function 00007FF7CAA61324: GetLastError.KERNEL32(?,?,?,?,00007FF7CAA63F52,?,?,?,00007FF7CAA63F97,?,?,?,?,?,00007FF7CAA645BE), ref: 00007FF7CAA61328

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationTokenfree$ErrorLast$malloc
String ID:
API String ID: 2644650267-0
Opcode ID: 1fe4cfbfda059c8e4fd4c684a2a8dbe4179514fc60f0540c227ef3ebe2226edd
Instruction ID: 805b2bc505dd15e84fa9faadf8e7f412c27810ae66492a735da0b71e17ccfb38
Opcode Fuzzy Hash: 1fe4cfbfda059c8e4fd4c684a2a8dbe4179514fc60f0540c227ef3ebe2226edd
Instruction Fuzzy Hash: 61418335B08A4287FB50BFA1F560A7DE790AF84BA2F904074DA4D47B55DE3CE446CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA64FCC, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

CharNextW.USER32 ref: 00007FF7CAA6503A
CharNextW.USER32 ref: 00007FF7CAA65048
CharNextW.USER32 ref: 00007FF7CAA6509F
CharNextW.USER32 ref: 00007FF7CAA650AD
CharNextW.USER32 ref: 00007FF7CAA650BE

Strings

UnregServer, xrefs: 00007FF7CAA65056
APPID, xrefs: 00007FF7CAA650F9, 00007FF7CAA651EC
{C4AB7CB7-E735-48FF-AADD-39D09668F444}, xrefs: 00007FF7CAA65108, 00007FF7CAA651FB
RegServer, xrefs: 00007FF7CAA6506D

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext
String ID: APPID$RegServer$UnregServer${C4AB7CB7-E735-48FF-AADD-39D09668F444}
API String ID: 3213498283-984291482
Opcode ID: 3e40f12f38400eedab81abb73093bd8f3142d617e1b4672ceeff31129942b7b6
Instruction ID: d2e1ac76aaf9f97f692a8a11c6136dcb4192590fdc9fad3d73a9d4701fc8b308
Opcode Fuzzy Hash: 3e40f12f38400eedab81abb73093bd8f3142d617e1b4672ceeff31129942b7b6
Instruction Fuzzy Hash: 03614225F09B0385FB50BF61F460ABDA3A0AF45BA6B8440B5CE0D07754EF3CE4428B61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA61698, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7CAA616BD
GetProcAddress.KERNEL32 ref: 00007FF7CAA616D2
LoadLibraryExW.KERNEL32 ref: 00007FF7CAA616EA
GetProcAddress.KERNEL32 ref: 00007FF7CAA616FF
GetLastError.KERNEL32 ref: 00007FF7CAA6173D

Strings

advapi32.dll, xrefs: 00007FF7CAA616E1
RegDeleteKeyExW, xrefs: 00007FF7CAA616C8
API-MS-Win-Core-LocalRegistry-L1-1-0.dll, xrefs: 00007FF7CAA616B6
RegDeleteKeyW, xrefs: 00007FF7CAA616F5

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorHandleLastLibraryLoadModule
String ID: API-MS-Win-Core-LocalRegistry-L1-1-0.dll$RegDeleteKeyExW$RegDeleteKeyW$advapi32.dll
API String ID: 856554993-2654589138
Opcode ID: 9410ef1f7cabded68824b6c4c6220b91db17ef5f6e15df1750117cd900bbbe6d
Instruction ID: d60faca26dae78d698ed81858e9b9faf82ae8ca674e71212d0ac810081199586
Opcode Fuzzy Hash: 9410ef1f7cabded68824b6c4c6220b91db17ef5f6e15df1750117cd900bbbe6d
Instruction Fuzzy Hash: AD111A65A09B0681FB14AF61F464B7CA360AF54BA6F984474C91D07794EF3CE446CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA615C8, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

CharUpperW.USER32 ref: 00007FF7CAA615E5
CharUpperW.USER32 ref: 00007FF7CAA615F1
CharNextW.USER32 ref: 00007FF7CAA6161E
CharNextW.USER32 ref: 00007FF7CAA6162A
CharUpperW.USER32 ref: 00007FF7CAA61636
CharUpperW.USER32 ref: 00007FF7CAA61642

Strings

, xrefs: 00007FF7CAA61651
, xrefs: 00007FF7CAA6160F

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$Upper$Next
String ID: $
API String ID: 3006421506-227171996
Opcode ID: 308300df52f915a8b7ce980a4677d6b431d611a829b1a94b5ac3ef2e88de8622
Instruction ID: 7eb67f752a7fd39c56af169f659fc7b284e05e64a2ab6318ebae011755b52486
Opcode Fuzzy Hash: 308300df52f915a8b7ce980a4677d6b431d611a829b1a94b5ac3ef2e88de8622
Instruction Fuzzy Hash: CF11A529A09A5285FB65BF62B52457CF6E0AB04BE7FCC00B1DB99437D4DE2CD0528B24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA65A88, Relevance: 10.9, APIs: 7, Instructions: 370memorycomCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF7CAA65AFD
VariantInit.OLEAUT32 ref: 00007FF7CAA65B08
CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7CAA65B2C
SysAllocString.OLEAUT32 ref: 00007FF7CAA65E23
SysAllocString.OLEAUT32 ref: 00007FF7CAA65E6B
SysFreeString.OLEAUT32 ref: 00007FF7CAA65F23

Part of subcall function 00007FF7CAA64340: TraceMessage.ADVAPI32 ref: 00007FF7CAA64369

VariantClear.OLEAUT32 ref: 00007FF7CAA65F2E

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: StringVariant$AllocInit$ClearCreateFreeInstanceMessageTrace
String ID:
API String ID: 974516195-0
Opcode ID: 9ae510328fd4b47b0a93b565f9ca56e2de5c18bd6403f7cea70e79b062791608
Instruction ID: 6c99a8a8ec4ec48a9b63ecc97bd5e60e0a2070a11727d42e6193b4cf9965b3a2
Opcode Fuzzy Hash: 9ae510328fd4b47b0a93b565f9ca56e2de5c18bd6403f7cea70e79b062791608
Instruction Fuzzy Hash: C3024B32608B4681FB10EF65F4A0AADA7A0FB84B99F940471DE4D47BA4DF7CD446CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA656F4, Relevance: 10.7, APIs: 7, Instructions: 171COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7CAA6574F
GetModuleFileNameW.KERNEL32 ref: 00007FF7CAA657D2
LoadTypeLib.OLEAUT32 ref: 00007FF7CAA657F2
LoadRegTypeLib.OLEAUT32 ref: 00007FF7CAA6580F
EnterCriticalSection.KERNEL32 ref: 00007FF7CAA658F3
LeaveCriticalSection.KERNEL32 ref: 00007FF7CAA65909
LeaveCriticalSection.KERNEL32 ref: 00007FF7CAA65993

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeaveLoadType$FileModuleName
String ID:
API String ID: 603384207-0
Opcode ID: 472e25355cbd6b812e86fc7b9acfb3b7f84d67d0786e6121fa3faa84f4a62da5
Instruction ID: 6613075c1248beecdb971b09d893ac9ac2dbcf364e1fceee5237cf0206568eb9
Opcode Fuzzy Hash: 472e25355cbd6b812e86fc7b9acfb3b7f84d67d0786e6121fa3faa84f4a62da5
Instruction Fuzzy Hash: E1915D36618A4781FB50EF55F8A0B6DA3A0FB84BA2F844072DA4E43764DF3DD446CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA676CC, Relevance: 10.6, APIs: 7, Instructions: 143sleepCOMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 00007FF7CAA676F4
Sleep.KERNEL32 ref: 00007FF7CAA6772B
_amsg_exit.MSVCRT ref: 00007FF7CAA67749
_initterm.MSVCRT ref: 00007FF7CAA677D4
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7CAA67801
exit.MSVCRT ref: 00007FF7CAA678A6
_cexit.MSVCRT ref: 00007FF7CAA678B5

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_cexit_inittermexit
String ID:
API String ID: 642454821-0
Opcode ID: f21dafce626eb9dd522afba22a4a10e97d3f198309999641f932a1a271f51dea
Instruction ID: a386aa7ec5a270a43e43513f3b40e76d5bf93b4df1656150bf12240ed31be288
Opcode Fuzzy Hash: f21dafce626eb9dd522afba22a4a10e97d3f198309999641f932a1a271f51dea
Instruction Fuzzy Hash: 13614925A1860286F760BF15F860A7DA3A1FB447A2FD840B5D94D97694DF3CE882CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA61F7C, Relevance: 10.6, APIs: 7, Instructions: 130COMMON

Download Yara Rule

APIs

CharNextW.USER32(00000000,00000000,?,00007FF7CAA61EF0), ref: 00007FF7CAA61FC2
CharNextW.USER32(00000000,00000000,?,00007FF7CAA61EF0), ref: 00007FF7CAA61FF2
CharNextW.USER32 ref: 00007FF7CAA6200D
CharNextW.USER32 ref: 00007FF7CAA62025
CharNextW.USER32 ref: 00007FF7CAA62034
CharNextW.USER32 ref: 00007FF7CAA62095
CharNextW.USER32(00000000,00000000,?,00007FF7CAA61EF0), ref: 00007FF7CAA620B6

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: acc0f02ea2568b42cba1f1724f80c043f1ff3caa2a334e3fdce97782821d8830
Instruction ID: a6a9161f069a6d99dfa356abd8a844d9612d4f46ad177a409d79f96db9348b72
Opcode Fuzzy Hash: acc0f02ea2568b42cba1f1724f80c043f1ff3caa2a334e3fdce97782821d8830
Instruction Fuzzy Hash: AA517032F09A5281FB50AF12E5245BCB3A1EB58F92B858471DA4D43798EF3CE857C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA636DC, Relevance: 9.1, APIs: 6, Instructions: 120registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CAA636DC: GetModuleFileNameW.KERNEL32 ref: 00007FF7CAA63587

SysStringLen.OLEAUT32 ref: 00007FF7CAA63778
wcsncpy_s.MSVCRT ref: 00007FF7CAA63790
CharNextW.USER32 ref: 00007FF7CAA637DB
RegisterTypeLib.OLEAUT32 ref: 00007FF7CAA63848
SysFreeString.OLEAUT32 ref: 00007FF7CAA63855
SysFreeString.OLEAUT32 ref: 00007FF7CAA63877

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free$CharFileModuleNameNextRegisterTypewcsncpy_s
String ID:
API String ID: 47525985-0
Opcode ID: b1ffa4d7cad2daee7063f4cd2ea26b0a237889bb60bdade006dd7da35f106ca7
Instruction ID: f69c52500d555953e9e1c0fefce2b4cef920b09b75076395341ac917e5c46907
Opcode Fuzzy Hash: b1ffa4d7cad2daee7063f4cd2ea26b0a237889bb60bdade006dd7da35f106ca7
Instruction Fuzzy Hash: CB51B536A08B8682F710AF65F464ABDA3A0FB84BA1F940075DA4D53B54CF3DE447CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA6522C, Relevance: 9.1, APIs: 6, Instructions: 53synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

malloc.MSVCRT(00000000,00000000,?,00007FF7CAA61EF0), ref: 00007FF7CAA65238
WaitForSingleObject.KERNEL32 ref: 00007FF7CAA65270
WaitForSingleObject.KERNEL32 ref: 00007FF7CAA65281
CoSuspendClassObjects.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7CAA65297
CloseHandle.KERNEL32 ref: 00007FF7CAA652A7
PostThreadMessageW.USER32 ref: 00007FF7CAA652BA

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectSingleWait$ClassCloseHandleMessageObjectsPostSuspendThreadmalloc
String ID:
API String ID: 3202292521-0
Opcode ID: 3248e8d8f2a01abd3027b6b9cd03447fbe5144dd1d26ab1612bb6ca7674ffb48
Instruction ID: 1909a00b765c8899b0f3710cd9b387fe8e39b6e952d879cbf46599bb2adde1a6
Opcode Fuzzy Hash: 3248e8d8f2a01abd3027b6b9cd03447fbe5144dd1d26ab1612bb6ca7674ffb48
Instruction Fuzzy Hash: 86117C32A0864687FB14AFB5F464B7C6392EF58B36F8840B4C90D47684CF2CA496CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA68014, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7CAA6803C
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7CAA68055
RtlVirtualUnwind.KERNEL32 ref: 00007FF7CAA68091
OutputDebugStringA.KERNEL32 ref: 00007FF7CAA680C0

Strings

Invalid parameter passed to C runtime function., xrefs: 00007FF7CAA680B9

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: CaptureContextDebugEntryFunctionLookupOutputStringUnwindVirtual
String ID: Invalid parameter passed to C runtime function.
API String ID: 711593133-455672764
Opcode ID: f73c77d02dd275505a808a3aeef37116e34e76fa31cb4e891a9213aeff14b7df
Instruction ID: e7bbda6d12c45a79b78e888b71c1639831b1b60ba6e84c872e762fb9d3fd8a64
Opcode Fuzzy Hash: f73c77d02dd275505a808a3aeef37116e34e76fa31cb4e891a9213aeff14b7df
Instruction Fuzzy Hash: 9711FC26618F8181EA609F51F4647AEB364FB88766F901535DA8E43B58DE3CD145CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA61750, Relevance: 7.6, APIs: 5, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF7CAA617AA
RegCloseKey.ADVAPI32 ref: 00007FF7CAA617C4
RegEnumKeyExW.ADVAPI32 ref: 00007FF7CAA61826
RegCloseKey.ADVAPI32 ref: 00007FF7CAA6183A
RegCloseKey.ADVAPI32 ref: 00007FF7CAA6185D

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$EnumOpen
String ID:
API String ID: 138425441-0
Opcode ID: 4192f1a58f5fbad9ed75e11ea953996d5469effd36cea2bc0e1a12d26c387b72
Instruction ID: 885a95c35ade89315d41d74f8300b792b70293f1d015c655ffe7c058ac1ff94c
Opcode Fuzzy Hash: 4192f1a58f5fbad9ed75e11ea953996d5469effd36cea2bc0e1a12d26c387b72
Instruction Fuzzy Hash: 8B316932608F8286FB50EF55F4A07AEA7A0EB88795F940135EB8D47A58DF3CD4468B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA63E2C, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a92df8f73e5a4b391164f1da9d7deefffabc992f17202cf75cd578308397988
Instruction ID: b70911b2d7fd299533bdb2c451976cfea368dffe6e399800b4e27440b1e16bd9
Opcode Fuzzy Hash: 9a92df8f73e5a4b391164f1da9d7deefffabc992f17202cf75cd578308397988
Instruction Fuzzy Hash: 8E119122A09A42C2FB51AF66B82073DE2D5AF44FA1F944075DA0E87754EF3CD8478B34

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA63ED0, Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

free.MSVCRT(?,?,?,00007FF7CAA63F97,?,?,?,?,?,00007FF7CAA645BE), ref: 00007FF7CAA63EED
free.MSVCRT(?,?,?,00007FF7CAA63F97,?,?,?,?,?,00007FF7CAA645BE), ref: 00007FF7CAA63EFC
free.MSVCRT(?,?,?,00007FF7CAA63F97,?,?,?,?,?,00007FF7CAA645BE), ref: 00007FF7CAA63F0B
free.MSVCRT(?,?,?,00007FF7CAA63F97,?,?,?,?,?,00007FF7CAA645BE), ref: 00007FF7CAA63F1A

Part of subcall function 00007FF7CAA67564: malloc.MSVCRT(?,?,?,00007FF7CAA63F2F,?,?,?,00007FF7CAA63F97,?,?,?,?,?,00007FF7CAA645BE), ref: 00007FF7CAA67582

InitializeSecurityDescriptor.ADVAPI32(?,?,?,00007FF7CAA63F97,?,?,?,?,?,00007FF7CAA645BE), ref: 00007FF7CAA63F3F

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: free$DescriptorInitializeSecuritymalloc
String ID:
API String ID: 2785421624-0
Opcode ID: 7c63d91e4246ae6615ddab2bfadb24f502507f02831997c1ea79c6a29e4fd7eb
Instruction ID: 972143d6ec2902cb40a505c901051a3f9af3e4507fe7971c5308fdd124a510b0
Opcode Fuzzy Hash: 7c63d91e4246ae6615ddab2bfadb24f502507f02831997c1ea79c6a29e4fd7eb
Instruction Fuzzy Hash: 94111922A18A42D2FB40AF66E16473C6260FB88B52F4081B5D71D4B681DF2CE0B68724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA61C74, Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7CAA61C92

Part of subcall function 00007FF7CAA61A90: free.MSVCRT ref: 00007FF7CAA61AE9
Part of subcall function 00007FF7CAA61A90: free.MSVCRT ref: 00007FF7CAA61AFC

LeaveCriticalSection.KERNEL32 ref: 00007FF7CAA61CA4
DeleteCriticalSection.KERNEL32 ref: 00007FF7CAA61CB7
free.MSVCRT ref: 00007FF7CAA61CCF
free.MSVCRT ref: 00007FF7CAA61CE3

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: free$CriticalSection$DeleteEnterLeave
String ID:
API String ID: 3880800478-0
Opcode ID: 98d5ddaebe727969683f167d3d9406a9e94c0bbf69200de39397182bb595ff16
Instruction ID: b8835c80a1efc9e192c39ec15548fc9bb198d8d8680f7330fec4c1e1de6bf53d
Opcode Fuzzy Hash: 98d5ddaebe727969683f167d3d9406a9e94c0bbf69200de39397182bb595ff16
Instruction Fuzzy Hash: 39019622A08A4281FB05AF61F56477CA760FF44BAAF844571C60E0B554CF3CD49BC764

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA61000, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CAA61304: InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,00007FF7CAA61050), ref: 00007FF7CAA61308

GetCurrentThreadId.KERNEL32 ref: 00007FF7CAA61076
CoInitializeEx.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7CAA610B0
GetModuleHandleW.KERNEL32 ref: 00007FF7CAA610C8

Strings

Mscoree.dll, xrefs: 00007FF7CAA610C1

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize$CriticalCurrentHandleModuleSectionThread
String ID: Mscoree.dll
API String ID: 3633091013-4150509846
Opcode ID: 93fdf1e6b40f2ba4f677a4482e28b91cfea210404fdac5e9c0a95e6e71fd2b38
Instruction ID: b163de9a80b37524c8142dff706fd76c0f58d4e5430e9ca9221cc0279c7c5821
Opcode Fuzzy Hash: 93fdf1e6b40f2ba4f677a4482e28b91cfea210404fdac5e9c0a95e6e71fd2b38
Instruction Fuzzy Hash: 85410E60D1CA4685FB41BF11F866BBCA7A0AF147A7FD405B9C40C471A1DF6CA186CF22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA67960, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7CAA679D3
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7CAA679F2
RtlVirtualUnwind.KERNEL32 ref: 00007FF7CAA67A3F
__raise_securityfailure.LIBCMT ref: 00007FF7CAA67B24

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: cce1a658de05964f2e8c3bbb2602029ae8d9e416483a44009c341cc528339eb1
Instruction ID: e9778c2ab91d961da37b4d38d723dd7cf561be9e61ffbf0586f6b51a4f1e81e3
Opcode Fuzzy Hash: cce1a658de05964f2e8c3bbb2602029ae8d9e416483a44009c341cc528339eb1
Instruction Fuzzy Hash: 1E410635A08F0185FA40AF19F861769F3A4FB847A5F904176DA8D437A4DF7CD446CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA67B34, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CAA638CD), ref: 00007FF7CAA67B3F
RtlLookupFunctionEntry.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CAA638CD), ref: 00007FF7CAA67B5E
RtlVirtualUnwind.KERNEL32 ref: 00007FF7CAA67BAB
__raise_securityfailure.LIBCMT ref: 00007FF7CAA67C21

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 2779b3b565b6ef99c6ef654286d509e29f39867984c49481a94b5069ac47a53e
Instruction ID: 25569900bed6ec53509871205fe83e88233036950d64ed48186118f54ad5a199
Opcode Fuzzy Hash: 2779b3b565b6ef99c6ef654286d509e29f39867984c49481a94b5069ac47a53e
Instruction Fuzzy Hash: B121F035908F0186F740AF05F8A1B69B3A4FB847A6F900176DA8D03764DF7CE046CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7CAA6839E, Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

UnregisterClassA.USER32 ref: 00007FF7CAA683AC
free.MSVCRT ref: 00007FF7CAA683CE
DeleteCriticalSection.KERNEL32 ref: 00007FF7CAA683F1
free.MSVCRT ref: 00007FF7CAA6840A

Memory Dump Source

Source File: 00000016.00000002.372133347.00007FF7CAA61000.00000020.00020000.sdmp, Offset: 00007FF7CAA60000, based on PE: true

Associated: 00000016.00000002.372114341.00007FF7CAA60000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372156313.00007FF7CAA69000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.372181320.00007FF7CAA6D000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.372197803.00007FF7CAA6E000.00000002.00020000.sdmp Download File

Similarity

API ID: free$ClassCriticalDeleteSectionUnregister
String ID:
API String ID: 46291987-0
Opcode ID: 9420a203f0b3461ad91740f31a9c8ea837c192637df083b9b016e8b86f57385b
Instruction ID: c4e5e873047c3e6931035d8b7f5b5351b8f46ca8634c620f382fe692ccb985dd
Opcode Fuzzy Hash: 9420a203f0b3461ad91740f31a9c8ea837c192637df083b9b016e8b86f57385b
Instruction Fuzzy Hash: 3D11DA61A19A0286FB05AF52F4ADB7CA3B0EF447B7F8801B5C50D071A4DF6CA047CA24

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: WMPDMC.exe PID: 476 Parent PID: 3472 WMPDMC.exeCOMMON

Executed Functions

Function 000002204AB42252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000002204AB423B0
VirtualProtect.KERNELBASE ref: 000002204AB42471
RtlAvlRemoveNode.NTDLL ref: 000002204AB425B4
VirtualProtect.KERNELBASE ref: 000002204AB42677

Memory Dump Source

Source File: 00000018.00000002.396766682.000002204AB40000.00000040.00000001.sdmp, Offset: 000002204AB40000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 02393890b58be90e5659d49cebbc8d0c6cad76fb2073813ebf54a622378af0a8
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 3AB14376618BC486D730CB5AE49079AB7A0F7C9B80F108026EF8997B5ACB7DC841DF40

Uniqueness

Uniqueness Score: -1.00%

Function 000002204AB42057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000002204AB429A8), ref: 000002204AB420A7

Memory Dump Source

Source File: 00000018.00000002.396766682.000002204AB40000.00000040.00000001.sdmp, Offset: 000002204AB40000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 1e3af3b96612feff1ca59cd7945604d49845a0c0e6358e0fbbf7a9f4e63c3116
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 0B313672615B9086D780DF1AE49475A7BB1F389BC4F208026EF8D87B29DF3AC442CB40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF71E36BFB8, Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 169COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF71E36BFFB
GetDeviceCaps.GDI32 ref: 00007FF71E36C00B
LoadImageW.USER32 ref: 00007FF71E36C047
ReleaseDC.USER32 ref: 00007FF71E36C221

Strings

, xrefs: 00007FF71E36C19A

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsDeviceImageLoadRelease
String ID:
API String ID: 1559952536-3916222277
Opcode ID: 7c551502e64565489adc2b2cd8aa205dbc4f09ef3e6917fbe5b89bb9ad3f7059
Instruction ID: edfe10feb2b1b4004778afdfca905e74c3acfc9c0843a5708c1dc039d066e0cd
Opcode Fuzzy Hash: 7c551502e64565489adc2b2cd8aa205dbc4f09ef3e6917fbe5b89bb9ad3f7059
Instruction Fuzzy Hash: FD519535B19A4286EB24EB26B95477AA291FF89FE1F814438ED4E07B54DF3CF0498710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E3D6020, Relevance: 19.9, APIs: 13, Instructions: 403memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF71E3D61FF
HeapFree.KERNEL32 ref: 00007FF71E3D620D
GetProcessHeap.KERNEL32 ref: 00007FF71E3D6228
HeapFree.KERNEL32 ref: 00007FF71E3D6236
GetProcessHeap.KERNEL32 ref: 00007FF71E3D6259
HeapAlloc.KERNEL32 ref: 00007FF71E3D626B

Part of subcall function 00007FF71E35C1A0: GetProcessHeap.KERNEL32 ref: 00007FF71E35C1E1
Part of subcall function 00007FF71E35C1A0: HeapReAlloc.KERNEL32 ref: 00007FF71E35C1F5

GetProcessHeap.KERNEL32 ref: 00007FF71E3D632E
HeapFree.KERNEL32 ref: 00007FF71E3D633C
qsort.MSVCRT ref: 00007FF71E3D63D4
GetProcessHeap.KERNEL32 ref: 00007FF71E3D6578
HeapFree.KERNEL32 ref: 00007FF71E3D6586
GetProcessHeap.KERNEL32 ref: 00007FF71E3D659E
HeapFree.KERNEL32 ref: 00007FF71E3D65AC

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$Free$Alloc$qsort
String ID:
API String ID: 3998280610-0
Opcode ID: 579d87bbdda31229e9b4302375355b993e02d54a587fa8cb33cd3ff62984092e
Instruction ID: 0d0124ae11c5d8e4c0b8fb7dbcb09870a9473e85154a1fd808a8798ef6d3fb0c
Opcode Fuzzy Hash: 579d87bbdda31229e9b4302375355b993e02d54a587fa8cb33cd3ff62984092e
Instruction Fuzzy Hash: 0CF1AB72A08A5682EB25EB56D440739A360FF44BA4FC4823DDE2E47795DF3CF459A320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E3A003C, Relevance: 18.0, APIs: 14, Instructions: 488memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF71E3A00ED
HeapFree.KERNEL32 ref: 00007FF71E3A00FB
GetProcessHeap.KERNEL32 ref: 00007FF71E3A010D
HeapFree.KERNEL32 ref: 00007FF71E3A011B
GetProcessHeap.KERNEL32 ref: 00007FF71E3A0128
HeapAlloc.KERNEL32 ref: 00007FF71E3A013A

Part of subcall function 00007FF71E352FF0: RegGetValueW.KERNEL32 ref: 00007FF71E353065

GetProcessHeap.KERNEL32 ref: 00007FF71E3A01A5
HeapReAlloc.KERNEL32 ref: 00007FF71E3A01B9
GetProcessHeap.KERNEL32 ref: 00007FF71E3A0437
HeapAlloc.KERNEL32 ref: 00007FF71E3A0449
GetProcessHeap.KERNEL32 ref: 00007FF71E3A0496
HeapReAlloc.KERNEL32 ref: 00007FF71E3A04AA
GetProcessHeap.KERNEL32 ref: 00007FF71E3A0613
HeapFree.KERNEL32 ref: 00007FF71E3A0621

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$Alloc$Free$Value
String ID:
API String ID: 736243434-0
Opcode ID: a8c098b246612ab15a406ca774da92dc4e7524406e8547c4def53001880cfce8
Instruction ID: c959774d4c0de31e66457800b4dc9358ce46dcb3493e22dac87b72976370be19
Opcode Fuzzy Hash: a8c098b246612ab15a406ca774da92dc4e7524406e8547c4def53001880cfce8
Instruction Fuzzy Hash: DA12A536B09A028BE714EF6AD4405ACB7B5FB88BA8B454038DE0D97754DF38F859CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E336008, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32(?,?,imageres.dll,00007FF71E339ECB), ref: 00007FF71E336028
ActivateActCtx.KERNEL32(?,?,imageres.dll,00007FF71E339ECB), ref: 00007FF71E336053
GetLastError.KERNEL32(?,?,imageres.dll,00007FF71E339ECB), ref: 00007FF71E33605D

Strings

IsolationAware function called after IsolationAwareCleanup, xrefs: 00007FF71E336021
imageres.dll, xrefs: 00007FF71E33600D

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivateDebugErrorLastOutputString
String ID: IsolationAware function called after IsolationAwareCleanup$imageres.dll
API String ID: 2396347390-3770086974
Opcode ID: 9a535dedd03d6f5c630cf13ebf4f37e01f40891e123fefcbf2c533e0cae74d60
Instruction ID: 5efffd37baa648746d2b16909532550e57cc589da28cc92d1225862626b9322a
Opcode Fuzzy Hash: 9a535dedd03d6f5c630cf13ebf4f37e01f40891e123fefcbf2c533e0cae74d60
Instruction Fuzzy Hash: 16016D30E0CD03C9F650FB16A885A78A2A0BF443B5FD40039EE1D82690DE6DF89C8631

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E37A060, Relevance: 37.1, APIs: 20, Strings: 1, Instructions: 355windowCOMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF71E37A08F
DestroyWindow.USER32 ref: 00007FF71E37A0B4
SendMessageW.USER32 ref: 00007FF71E37A13D
PostMessageW.USER32 ref: 00007FF71E37A176
GetGadgetFocus.WMPDUI ref: 00007FF71E37A1EC
FindAtomW.KERNEL32 ref: 00007FF71E37A22E
SetFocus.USER32 ref: 00007FF71E37A320
GetWindowLongPtrW.USER32 ref: 00007FF71E37A332
GetFocus.USER32 ref: 00007FF71E37A3E2
SetFocus.USER32 ref: 00007FF71E37A3FE

Part of subcall function 00007FF71E379C80: RegisterWindowMessageW.USER32 ref: 00007FF71E379CC7

GetWindowLongPtrW.USER32 ref: 00007FF71E37A415
TlsGetValue.KERNEL32 ref: 00007FF71E37A45E
SetWindowResizeFlag.WMPDUI ref: 00007FF71E37A47E
SetWindowResizeFlag.WMPDUI ref: 00007FF71E37A4BE
TlsGetValue.KERNEL32 ref: 00007FF71E37A4CA
PostQuitMessage.USER32 ref: 00007FF71E37A50E
SetWindowLongPtrW.USER32 ref: 00007FF71E37A520
GadgetTransCompositionChanged.WMPDUI ref: 00007FF71E37A590
SendMessageW.USER32 ref: 00007FF71E37A5C0
DefWindowProcW.USER32 ref: 00007FF71E37A5D7

Strings

, xrefs: 00007FF71E37A3D3

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Message$FocusLong$FlagGadgetPostResizeSendValue$AtomChangedCompositionDestroyFindProcQuitRegisterTrans
String ID:
API String ID: 763708480-3916222277
Opcode ID: 14f3114fa8f05da8a2efe5eb87ec5c167665a36009a52f2a64894bfc3b800bea
Instruction ID: dd89357af1a2e7b6587c5a03e8a3c404ba0ff33c3fcc37cd4e544f15b371b3c4
Opcode Fuzzy Hash: 14f3114fa8f05da8a2efe5eb87ec5c167665a36009a52f2a64894bfc3b800bea
Instruction Fuzzy Hash: F8E17121E09E4782FA64AF65A4442B9B3A0EF46B74FC84539DD0E07794DF3CF85A9360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E339F40, Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF71E339F65
GetProcAddress.KERNEL32 ref: 00007FF71E339F7A
GetProcAddress.KERNEL32 ref: 00007FF71E339FA4
GetLastError.KERNEL32 ref: 00007FF71E339FE2

Strings

RegDeleteKeyExW, xrefs: 00007FF71E339F70
API-MS-Win-Core-LocalRegistry-L1-1-0.dll, xrefs: 00007FF71E339F5E
advapi32.dll, xrefs: 00007FF71E339F89
RegDeleteKeyW, xrefs: 00007FF71E339F9A

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorHandleLastModule
String ID: API-MS-Win-Core-LocalRegistry-L1-1-0.dll$RegDeleteKeyExW$RegDeleteKeyW$advapi32.dll
API String ID: 3392887714-2654589138
Opcode ID: f6de70b26ea80224fd18c1b2c19f18cb344e8a928d536abcd9f189823bee891e
Instruction ID: 1ef87c476f6e5e86c9c1b7c2bb82619f65d5a1718000479ca6a3244db6612624
Opcode Fuzzy Hash: f6de70b26ea80224fd18c1b2c19f18cb344e8a928d536abcd9f189823bee891e
Instruction Fuzzy Hash: 2111ED39A09E0381EF54AB11E454BB8A360AF44BA5F984439DE0D066A8DF3CF459C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E34BF40, Relevance: 14.0, APIs: 9, Instructions: 452memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF71E34C0B6
SafeArrayGetElement.OLEAUT32 ref: 00007FF71E34C0CB
SysStringByteLen.OLEAUT32 ref: 00007FF71E34C0E4
SysAllocStringByteLen.OLEAUT32 ref: 00007FF71E34C0F0
memset.MSVCRT ref: 00007FF71E34C13C
VariantClear.OLEAUT32 ref: 00007FF71E34C355
SysFreeString.OLEAUT32 ref: 00007FF71E34C35E

Part of subcall function 00007FF71E316680: TraceMessage.ADVAPI32 ref: 00007FF71E3166B9

EnterCriticalSection.KERNEL32 ref: 00007FF71E34C4A7
LeaveCriticalSection.KERNEL32 ref: 00007FF71E34C51C

Part of subcall function 00007FF71E315E04: TraceMessage.ADVAPI32 ref: 00007FF71E315E2D

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: String$ByteCriticalMessageSectionTraceVariant$AllocArrayClearElementEnterFreeInitLeaveSafememset
String ID:
API String ID: 2811422721-0
Opcode ID: 8c351f2aa6b1d2208b78169f05594e27882289f2cecba79cb0386a928a750e0d
Instruction ID: b8d03e5befd3313e3935595b09413558f799ebf50ad9afd862815e568393a10c
Opcode Fuzzy Hash: 8c351f2aa6b1d2208b78169f05594e27882289f2cecba79cb0386a928a750e0d
Instruction Fuzzy Hash: F8129072A08E4381FB18EB15D8441B8A7A1FB44BA8F950539DE0D477A1CF3DF89AC764

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E33A004, Relevance: 10.6, APIs: 7, Instructions: 130COMMON

Download Yara Rule

APIs

CharNextW.USER32 ref: 00007FF71E33A04A
CharNextW.USER32 ref: 00007FF71E33A07A
CharNextW.USER32 ref: 00007FF71E33A095
CharNextW.USER32 ref: 00007FF71E33A0AD
CharNextW.USER32 ref: 00007FF71E33A0BC
CharNextW.USER32 ref: 00007FF71E33A11D
CharNextW.USER32 ref: 00007FF71E33A13E

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 51da1e0cb20d4b363ace0d07f42a29c073f5a3546111d8d0e483909376e44619
Instruction ID: 66c431c9d717354c078d12635e90f408ca55c7a7102c9b20d44d9662d29f18a6
Opcode Fuzzy Hash: 51da1e0cb20d4b363ace0d07f42a29c073f5a3546111d8d0e483909376e44619
Instruction Fuzzy Hash: 8F516432F09E5284EB20AF11D54453DB3A1EB58FA0B888439DA4E47395EF3CF86AC350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E3A4040, Relevance: 10.6, APIs: 7, Instructions: 88memorywindowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF71E3A4095
GetProcessHeap.KERNEL32 ref: 00007FF71E3A40A9
HeapAlloc.KERNEL32 ref: 00007FF71E3A40B7
GetWindowTextW.USER32 ref: 00007FF71E3A40CE
GetProcessHeap.KERNEL32 ref: 00007FF71E3A40DF
HeapFree.KERNEL32 ref: 00007FF71E3A40ED
SendMessageW.USER32 ref: 00007FF71E3A4150

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$ProcessTextWindow$AllocFreeLengthMessageSend
String ID:
API String ID: 1865560444-0
Opcode ID: cd72ecaa30fe556db53ff6a0d5854c1960541a038c9c312792d8482e455ed78a
Instruction ID: 8527c025629c0d9b3d4d9034c52a12a3ed28ef1dbc1515eefd58c4b017ed6b0d
Opcode Fuzzy Hash: cd72ecaa30fe556db53ff6a0d5854c1960541a038c9c312792d8482e455ed78a
Instruction Fuzzy Hash: 73316231B09F4346EE54BB16A8502B9E2A1AFD5FA0FC88038ED4E47755DE2CF4498760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E326040, Relevance: 9.2, APIs: 6, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FF71E3261D3
RaiseException.KERNEL32 ref: 00007FF71E3261F7
SysAllocString.OLEAUT32 ref: 00007FF71E326209
RaiseException.KERNEL32 ref: 00007FF71E32622A
SysFreeString.OLEAUT32 ref: 00007FF71E326276
SysFreeString.OLEAUT32 ref: 00007FF71E326289

Part of subcall function 00007FF71E3157E8: TraceMessage.ADVAPI32 ref: 00007FF71E3157FB

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: String$AllocExceptionFreeRaise$MessageTrace
String ID:
API String ID: 978939744-0
Opcode ID: 633bbe474deab4568d67bad25835098850bccae00afd102297851b9961645549
Instruction ID: 79223129225fa342f0e12d8b78b9e3b15472ffe5f8f499c9edecf5a2d2de2314
Opcode Fuzzy Hash: 633bbe474deab4568d67bad25835098850bccae00afd102297851b9961645549
Instruction Fuzzy Hash: 1A91AC32A08F4386EB10AB65D8443A8A7A1AF44B68F944139DE5D177A0CF3DF89DD364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E3DDFE0, Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

SetGadgetOrder.WMPDUI ref: 00007FF71E3DE014
memset.MSVCRT ref: 00007FF71E3DE02B
SetTransitionVisualProperties.WMPDUI ref: 00007FF71E3DE05C
SetGadgetFlags.WMPDUI ref: 00007FF71E3DE075
SetGadgetFlags.WMPDUI ref: 00007FF71E3DE08E
AddLayeredRef.WMPDUI ref: 00007FF71E3DE09F

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: Gadget$Flags$LayeredOrderPropertiesTransitionVisualmemset
String ID:
API String ID: 784560575-0
Opcode ID: 74310073b0ef9f15bed7a0cab022bc54408ae57acc3d6ec2dcfda81989257901
Instruction ID: 7543769dc3dc2b44e96f9271f8ccef81e6602e3555bdf78fd57b2bbbda637881
Opcode Fuzzy Hash: 74310073b0ef9f15bed7a0cab022bc54408ae57acc3d6ec2dcfda81989257901
Instruction Fuzzy Hash: 91211F32B08A8681EB20EB26E4553AAB7A0FBC8F58F844035DE4D47755CF3DE55AC760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E373F30, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71E373074: _wcsicmp.MSVCRT ref: 00007FF71E373139

GetThemePartSize.UXTHEME ref: 00007FF71E373FDC
floorf.MSVCRT ref: 00007FF71E37402D
floorf.MSVCRT ref: 00007FF71E37404E

Strings

t##, xrefs: 00007FF71E373F6B
cannot have scalable value, xrefs: 00007FF71E373F97

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: floorf$PartSizeTheme_wcsicmp
String ID: cannot have scalable value$t##
API String ID: 1322144462-1704623611
Opcode ID: b7f2eaece1ac28a7d7efa43be3c8ebf5d12f6c523007956e998b85fb36434b78
Instruction ID: 63aa0c200003dcb944b587c2b2e7cf664ffaa809f09be393bc05ef3f6a066154
Opcode Fuzzy Hash: b7f2eaece1ac28a7d7efa43be3c8ebf5d12f6c523007956e998b85fb36434b78
Instruction Fuzzy Hash: FD41B172E15A528EE711DF75E84049CB7B4FB09368B458239EE0DA7714EB38F4A9CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E33C00C, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00007FF71E33C099
GetLastError.KERNEL32 ref: 00007FF71E33C0C6
DeactivateActCtx.KERNEL32 ref: 00007FF71E33C0DD
SetLastError.KERNEL32 ref: 00007FF71E33C0E9

Part of subcall function 00007FF71E336008: OutputDebugStringA.KERNEL32(?,?,imageres.dll,00007FF71E339ECB), ref: 00007FF71E336028
Part of subcall function 00007FF71E336008: ActivateActCtx.KERNEL32(?,?,imageres.dll,00007FF71E339ECB), ref: 00007FF71E336053
Part of subcall function 00007FF71E336008: GetLastError.KERNEL32(?,?,imageres.dll,00007FF71E339ECB), ref: 00007FF71E33605D

Strings

WMPDMC Spinner Message Window, xrefs: 00007FF71E33C090

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$ActivateCreateDeactivateDebugOutputStringWindow
String ID: WMPDMC Spinner Message Window
API String ID: 2940716307-2267841357
Opcode ID: 265683f0f489fad9ea2fe874f4f38248172fe56151e2737fc7e39db76b9f3105
Instruction ID: 356784e4bcfa8496d8df46e2bcad9a037f6e864421b68dd962eed70ee9f5382f
Opcode Fuzzy Hash: 265683f0f489fad9ea2fe874f4f38248172fe56151e2737fc7e39db76b9f3105
Instruction Fuzzy Hash: 18313231608F8386E764AF11E444529B6A4FB44BB0F950279DE5D63BA4CF3CF469CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E37FFF4, Relevance: 8.8, APIs: 7, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FF71E38000E
GetProcessHeap.KERNEL32 ref: 00007FF71E38003F
HeapFree.KERNEL32 ref: 00007FF71E38004D
GetProcessHeap.KERNEL32 ref: 00007FF71E380062
HeapFree.KERNEL32 ref: 00007FF71E380070
GetProcessHeap.KERNEL32 ref: 00007FF71E380076
HeapFree.KERNEL32 ref: 00007FF71E380084

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess$Value
String ID:
API String ID: 3709577838-0
Opcode ID: 1b13e903a5918a0eb0f4e96fc29f2d1415e564797d1bb011f4979379f5c8d4e9
Instruction ID: f470f60cc23063bd6ab9757fa89e0934b88995d963e4dc9ac4ec3bcc4acdf55e
Opcode Fuzzy Hash: 1b13e903a5918a0eb0f4e96fc29f2d1415e564797d1bb011f4979379f5c8d4e9
Instruction Fuzzy Hash: 2A115E71A08E4286EA05BF56F9445A9E365FF48FB0B898138EE5D03715DF3CF4698720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E36DFE8, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF71E36E016
PathCchAppend.API-MS-WIN-CORE-PATH-L1-1-0 ref: 00007FF71E36E036
LoadLibraryExW.KERNEL32 ref: 00007FF71E36E04D
GetLastError.KERNEL32 ref: 00007FF71E36E05F

Strings

xmllite.dll, xrefs: 00007FF71E36E025

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: AppendDirectoryErrorLastLibraryLoadPathSystem
String ID: xmllite.dll
API String ID: 393105263-1801209387
Opcode ID: 509baa9b52c99d4ec04e8d741e62ca25b128c6c372a34dcbe6db93e90ed3d4a7
Instruction ID: 3de3f57a2780b65d9f98250e5d9445d25f68408fb428d306139ca2351725f12f
Opcode Fuzzy Hash: 509baa9b52c99d4ec04e8d741e62ca25b128c6c372a34dcbe6db93e90ed3d4a7
Instruction Fuzzy Hash: A8115831708E4382EF14A722E4543B9A2A0FB88764F954039EA5E86664DF3CF65DC660

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E3CDFD4, Relevance: 7.7, APIs: 5, Instructions: 210COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71E398370: EnterCriticalSection.KERNEL32(?,?,?,00007FF71E3CE019), ref: 00007FF71E398384
Part of subcall function 00007FF71E398370: GetProcessHeap.KERNEL32(?,?,?,00007FF71E3CE019), ref: 00007FF71E39839B
Part of subcall function 00007FF71E398370: HeapAlloc.KERNEL32(?,?,?,00007FF71E3CE019), ref: 00007FF71E3983AB
Part of subcall function 00007FF71E398370: LeaveCriticalSection.KERNEL32(?,?,?,00007FF71E3CE019), ref: 00007FF71E39841F

EqualRect.USER32 ref: 00007FF71E3CE05A
VariantInit.OLEAUT32 ref: 00007FF71E3CE075
VariantInit.OLEAUT32 ref: 00007FF71E3CE07F
VariantClear.OLEAUT32 ref: 00007FF71E3CE0F2
VariantClear.OLEAUT32 ref: 00007FF71E3CE0FC

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$ClearCriticalHeapInitSection$AllocEnterEqualLeaveProcessRect
String ID:
API String ID: 1885845234-0
Opcode ID: b17eb5a49fc61385e027a8e316bd18a0cd6b5529447f8e736cc70985b93ee2d3
Instruction ID: 70ea6efc90568071f786f076fc287236a5ca176dfc067a8ff6ce0bcf6cb201bb
Opcode Fuzzy Hash: b17eb5a49fc61385e027a8e316bd18a0cd6b5529447f8e736cc70985b93ee2d3
Instruction Fuzzy Hash: 75A16C26B18E468AF701DFB5C4402ED63B1EB49768B404236EE0D67A59EF38F59EC350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E3A9F8C, Relevance: 7.6, APIs: 5, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71E34FF30: floorf.MSVCRT ref: 00007FF71E34FFC8

Part of subcall function 00007FF71E352FF0: RegGetValueW.KERNEL32 ref: 00007FF71E353065

floorf.MSVCRT ref: 00007FF71E3AA091
ceilf.MSVCRT ref: 00007FF71E3AA114

Part of subcall function 00007FF71E357078: TlsGetValue.KERNEL32 ref: 00007FF71E35709A
Part of subcall function 00007FF71E357078: DestroyIcon.USER32(?,?,-00000080,00007FF71E352C03,?,00000000,?,00007FF71E352F25,?,?,00000001,00007FF71E353147), ref: 00007FF71E357138
Part of subcall function 00007FF71E357078: DestroyIcon.USER32(?,?,-00000080,00007FF71E352C03,?,00000000,?,00007FF71E352F25,?,?,00000001,00007FF71E353147), ref: 00007FF71E35714B
Part of subcall function 00007FF71E357078: GetProcessHeap.KERNEL32(?,?,-00000080,00007FF71E352C03,?,00000000,?,00007FF71E352F25,?,?,00000001,00007FF71E353147), ref: 00007FF71E357166
Part of subcall function 00007FF71E357078: HeapFree.KERNEL32(?,?,-00000080,00007FF71E352C03,?,00000000,?,00007FF71E352F25,?,?,00000001,00007FF71E353147), ref: 00007FF71E357174
Part of subcall function 00007FF71E357078: GetProcessHeap.KERNEL32(?,?,-00000080,00007FF71E352C03,?,00000000,?,00007FF71E352F25,?,?,00000001,00007FF71E353147), ref: 00007FF71E3571F8
Part of subcall function 00007FF71E357078: HeapFree.KERNEL32(?,?,-00000080,00007FF71E352C03,?,00000000,?,00007FF71E352F25,?,?,00000001,00007FF71E353147), ref: 00007FF71E357206

floorf.MSVCRT ref: 00007FF71E3AA11B
ceilf.MSVCRT ref: 00007FF71E3AA147
floorf.MSVCRT ref: 00007FF71E3AA154

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: Heapfloorf$DestroyFreeIconProcessValueceilf
String ID:
API String ID: 2268732324-0
Opcode ID: 708ab57c7292ed14d2ab1398dc63f958bdcc413308621e6393b05a26de8f11f7
Instruction ID: f97d91f6fdd22e7717ee5232701d2ce19ff7a0d28738e4094c203f7ccdab8173
Opcode Fuzzy Hash: 708ab57c7292ed14d2ab1398dc63f958bdcc413308621e6393b05a26de8f11f7
Instruction Fuzzy Hash: DE51DA33A08A4246E765EB39C84127DB3A1EF85B74F844639E91D973D5DE2CF889C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E369F70, Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF71E369FC4
memset.MSVCRT ref: 00007FF71E369FE8
SendMessageW.USER32 ref: 00007FF71E36A01D

Part of subcall function 00007FF71E352FF0: RegGetValueW.KERNEL32 ref: 00007FF71E353065

SendMessageW.USER32 ref: 00007FF71E36A062

Part of subcall function 00007FF71E34FF30: floorf.MSVCRT ref: 00007FF71E34FFC8

SendMessageW.USER32 ref: 00007FF71E36A089

Part of subcall function 00007FF71E357078: TlsGetValue.KERNEL32 ref: 00007FF71E35709A
Part of subcall function 00007FF71E357078: DestroyIcon.USER32(?,?,-00000080,00007FF71E352C03,?,00000000,?,00007FF71E352F25,?,?,00000001,00007FF71E353147), ref: 00007FF71E357138
Part of subcall function 00007FF71E357078: DestroyIcon.USER32(?,?,-00000080,00007FF71E352C03,?,00000000,?,00007FF71E352F25,?,?,00000001,00007FF71E353147), ref: 00007FF71E35714B
Part of subcall function 00007FF71E357078: GetProcessHeap.KERNEL32(?,?,-00000080,00007FF71E352C03,?,00000000,?,00007FF71E352F25,?,?,00000001,00007FF71E353147), ref: 00007FF71E357166
Part of subcall function 00007FF71E357078: HeapFree.KERNEL32(?,?,-00000080,00007FF71E352C03,?,00000000,?,00007FF71E352F25,?,?,00000001,00007FF71E353147), ref: 00007FF71E357174
Part of subcall function 00007FF71E357078: GetProcessHeap.KERNEL32(?,?,-00000080,00007FF71E352C03,?,00000000,?,00007FF71E352F25,?,?,00000001,00007FF71E353147), ref: 00007FF71E3571F8
Part of subcall function 00007FF71E357078: HeapFree.KERNEL32(?,?,-00000080,00007FF71E352C03,?,00000000,?,00007FF71E352F25,?,?,00000001,00007FF71E353147), ref: 00007FF71E357206

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: HeapMessageSend$DestroyFreeIconProcessValue$floorfmemset
String ID:
API String ID: 1473827307-0
Opcode ID: e1c0cf51ee57c372ea6a51294e87904b4ad7e07971143c4f5929ea6ce101ad2c
Instruction ID: 0c88b94eaaa13df4cab4b0ddeed99169cfca194d320a2bc8c8bf01844dc70574
Opcode Fuzzy Hash: e1c0cf51ee57c372ea6a51294e87904b4ad7e07971143c4f5929ea6ce101ad2c
Instruction Fuzzy Hash: 1331B532609E4242EB60DF25E55476973A0FB88BA4F858139EE4D47B54CF3CE54ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E37E00C, Relevance: 7.6, APIs: 6, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,00007FF71E37DC7A,?,?,?,?,?,?,00000000,00007FF71E37DBC2,?,?,00000000,00007FF71E35E77E), ref: 00007FF71E37E065
HeapFree.KERNEL32(?,?,?,00007FF71E37DC7A,?,?,?,?,?,?,00000000,00007FF71E37DBC2,?,?,00000000,00007FF71E35E77E), ref: 00007FF71E37E073
GetProcessHeap.KERNEL32(?,?,?,00007FF71E37DC7A,?,?,?,?,?,?,00000000,00007FF71E37DBC2,?,?,00000000,00007FF71E35E77E), ref: 00007FF71E37E079
HeapFree.KERNEL32(?,?,?,00007FF71E37DC7A,?,?,?,?,?,?,00000000,00007FF71E37DBC2,?,?,00000000,00007FF71E35E77E), ref: 00007FF71E37E087
GetProcessHeap.KERNEL32(?,?,?,00007FF71E37DC7A,?,?,?,?,?,?,00000000,00007FF71E37DBC2,?,?,00000000,00007FF71E35E77E), ref: 00007FF71E37E095
HeapFree.KERNEL32(?,?,?,00007FF71E37DC7A,?,?,?,?,?,?,00000000,00007FF71E37DBC2,?,?,00000000,00007FF71E35E77E), ref: 00007FF71E37E0A3

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: fa3779ac079047000922d66c9ad616f2e62ce29c30e5a3e187c5c2907a2ef33d
Instruction ID: e5897f8407882d7359ae19d4099d5cfb095cf2083a49261f1ecdd2173312fe6a
Opcode Fuzzy Hash: fa3779ac079047000922d66c9ad616f2e62ce29c30e5a3e187c5c2907a2ef33d
Instruction Fuzzy Hash: 0A111F36A04E4682DB14AF53E444369B361FB48FA0F498038EF5D07724DE3CE499C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E37602C, Relevance: 6.4, APIs: 5, Instructions: 124memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,00000000,00000000,00007FF71E36D175,?,?,?,00007FF71E36D4FA,?,?,?,?,?,?,?,00007FF71E36D276), ref: 00007FF71E3760E3
HeapReAlloc.KERNEL32(?,?,?,00007FF71E36D4FA,?,?,?,?,?,?,?,00007FF71E36D276,?,?,?,?), ref: 00007FF71E3760F9
HeapAlloc.KERNEL32(?,?,?,00007FF71E36D4FA,?,?,?,?,?,?,?,00007FF71E36D276,?,?,?,?), ref: 00007FF71E37611F

Part of subcall function 00007FF71E3764C0: GetProcessHeap.KERNEL32(?,?,?,00007FF71E376086,?,00000000,00000000,00007FF71E36D175,?,?,?,00007FF71E36D4FA), ref: 00007FF71E376505
Part of subcall function 00007FF71E3764C0: HeapAlloc.KERNEL32(?,?,?,00007FF71E376086,?,00000000,00000000,00007FF71E36D175,?,?,?,00007FF71E36D4FA), ref: 00007FF71E376513
Part of subcall function 00007FF71E3764C0: memcpy.MSVCRT ref: 00007FF71E376545

memcpy.MSVCRT ref: 00007FF71E37616A
memset.MSVCRT ref: 00007FF71E37618A

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Alloc$Processmemcpy$memset
String ID:
API String ID: 1469596844-0
Opcode ID: cb0e9aa5dc636532c28f1550d938f18e43d38a2d4e46f885f0318329216e3f16
Instruction ID: f31fe3b12779733c5b3ae6593e029c858efa10667342907505d40dcc91bac1b4
Opcode Fuzzy Hash: cb0e9aa5dc636532c28f1550d938f18e43d38a2d4e46f885f0318329216e3f16
Instruction Fuzzy Hash: 4D41D432F08F8683EB24AF56A45402AF2A1BB45BE0B44853CCAAD17755DE7DF44D9710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E319FC0, Relevance: 6.2, APIs: 4, Instructions: 174COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32 ref: 00007FF71E31A36B
InitializeCriticalSection.KERNEL32 ref: 00007FF71E31A378
InitializeCriticalSection.KERNEL32 ref: 00007FF71E31A385
InitializeCriticalSection.KERNEL32 ref: 00007FF71E31A392

Part of subcall function 00007FF71E3157E8: TraceMessage.ADVAPI32 ref: 00007FF71E3157FB

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalInitializeSection$EmptyMessageRectTrace
String ID:
API String ID: 1132029270-0
Opcode ID: 0f5d65c36f735e6159175f5d8135f1b24a246394ebf84a10569c68f7780aabc4
Instruction ID: 8b772c0399e398150d5ab790e472a884c271b81cc69af6df7b5917cae21492ca
Opcode Fuzzy Hash: 0f5d65c36f735e6159175f5d8135f1b24a246394ebf84a10569c68f7780aabc4
Instruction Fuzzy Hash: A9B19B32515B9685E7419F25E8843DC77ACF744F98F58023AEE890B7A8CF789166C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E381F4C, Relevance: 6.1, APIs: 4, Instructions: 143COMMON

Download Yara Rule

APIs

GetGadgetRect.WMPDUI(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71E3812A9), ref: 00007FF71E381F8E
EqualRect.USER32 ref: 00007FF71E381FB2
SetWindowPos.USER32 ref: 00007FF71E3820E3
SetWindowPos.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71E3812A9), ref: 00007FF71E382101

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: RectWindow$EqualGadget
String ID:
API String ID: 4264314932-0
Opcode ID: ba16ec53b6459e96824838c505e32687c9609d119f28e3139fe1274b20d18ace
Instruction ID: 1baf4581e9bb71b64e5a3711453f5923a33ec79bc9b02a1cdf8dc4ba44d4759e
Opcode Fuzzy Hash: ba16ec53b6459e96824838c505e32687c9609d119f28e3139fe1274b20d18ace
Instruction Fuzzy Hash: 27519B72B14A5289EB50DF26D841AADB7B0FB48FA8F944239DE4D57758CF38E409C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E357FE8, Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF71E358032
memset.MSVCRT ref: 00007FF71E35804E
CreateDIBSection.GDI32 ref: 00007FF71E358089
ReleaseDC.USER32 ref: 00007FF71E3580EC

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateReleaseSectionmemset
String ID:
API String ID: 873749150-0
Opcode ID: a9a23bb0cfe20de83baac27982b2d57373fbea72a057dfcb22cedf64b372f003
Instruction ID: 3fc57466e38d6086ce3d0f35540674b081dc795f0b6bda753b0c72c45b5dc6b2
Opcode Fuzzy Hash: a9a23bb0cfe20de83baac27982b2d57373fbea72a057dfcb22cedf64b372f003
Instruction Fuzzy Hash: DB31E073B05B229AE711DF69E4405ADBBB0FB08798B904039EE0D53B45DF38E95AC710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E384020, Relevance: 6.0, APIs: 4, Instructions: 45timeCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FF71E38403A
KillTimer.USER32 ref: 00007FF71E384051
DeleteObject.GDI32 ref: 00007FF71E384071
memset.MSVCRT ref: 00007FF71E38408D

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteKillObjectTimerValuememset
String ID:
API String ID: 610862434-0
Opcode ID: 10a56ac597d94fc7161571bb02f9fc19c51f371fa7480a56f76713d8e7f47cdc
Instruction ID: 1ad44ae983ffbbcaa791aaa720fe7c4a8eee1ceb3104fcc98cf640709a21b2ab
Opcode Fuzzy Hash: 10a56ac597d94fc7161571bb02f9fc19c51f371fa7480a56f76713d8e7f47cdc
Instruction Fuzzy Hash: 3E11C432A09A8281EB51EB21E44167AB760EF44B64F884139DA4E47745CF3CF999C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E3EC006, Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00007FF71E3EC017
GetLastError.KERNEL32 ref: 00007FF71E3EC047
DeactivateActCtx.KERNEL32 ref: 00007FF71E3EC059
SetLastError.KERNEL32 ref: 00007FF71E3EC065

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$DeactivateExceptionThrow
String ID:
API String ID: 771589386-0
Opcode ID: fadcd1ba36344a391d95b91c02a576a1f3c7a234b4869318b68baf598d97664b
Instruction ID: 5e4ef4cf4d0a4f4204d609292e53b74f7039bab065c3badb06a44c3143d9202a
Opcode Fuzzy Hash: fadcd1ba36344a391d95b91c02a576a1f3c7a234b4869318b68baf598d97664b
Instruction Fuzzy Hash: FFF08622A05A47CAFB2C7F72A84417DA251AF547A5F89403CED0A05580CF3CF89D8660

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF71E3D8020, Relevance: 5.1, APIs: 4, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF71E3D808F
HeapAlloc.KERNEL32 ref: 00007FF71E3D80A1
GetProcessHeap.KERNEL32 ref: 00007FF71E3D8186
HeapFree.KERNEL32 ref: 00007FF71E3D8194

Memory Dump Source

Source File: 00000018.00000002.397733886.00007FF71E311000.00000020.00020000.sdmp, Offset: 00007FF71E310000, based on PE: true

Associated: 00000018.00000002.397718366.00007FF71E310000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397887339.00007FF71E3ED000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.397915109.00007FF71E424000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.397928877.00007FF71E428000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 457c95e9ee3287db81c4d04cdb071cba20c0b6ebbeb82647a77a9aa432058123
Instruction ID: 79765a6423751c798d2d569ed349adcce4b4737d7c98eb8e532232e42c32cf0e
Opcode Fuzzy Hash: 457c95e9ee3287db81c4d04cdb071cba20c0b6ebbeb82647a77a9aa432058123
Instruction Fuzzy Hash: 12516A32A14B81AAEB05EF25D5803A8A7A0FB48B98F844239DF0C47B51DF78F529C350

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report CiEceGPoOR

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre