Play interactive tour

Edit tour

Windows Analysis Report yPeVDkBY3n

Overview

General Information

Sample Name:	yPeVDkBY3n (renamed file extension from none to dll)
Analysis ID:	492878
MD5:	2cd9944b4c51630053a486adf9ba7928
SHA1:	fbbe87d4587c694c6b44870bb99e30e1d48d1c06
SHA256:	a92176c5e1216a097c14b387a64e96684497919d0777250897db8896331613ca
Tags:	Dridexexe
Infos:
Most interesting Screenshot:

Detection

Dridex

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Dridex unpacked file

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Changes memory attributes in foreign processes to executable or writable

Queues an APC in another process (thread injection)

Uses Atom Bombing / ProGate to inject into other processes

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Queries the installation date of Windows

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Uses the system / local time for branch decision (may execute only at specific dates)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Drops files with a non-matching file extension (content does not match file extension)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

PE file contains strange resources

Drops PE files

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Binary contains a suspicious time stamp

PE file contains more sections than normal

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 6392 cmdline: loaddll64.exe 'C:\Users\user\Desktop\yPeVDkBY3n.dll' MD5: E0CC9D126C39A9D2FA1CAD5027EBBD18)

cmd.exe (PID: 6432 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\yPeVDkBY3n.dll',#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 6480 cmdline: rundll32.exe 'C:\Users\user\Desktop\yPeVDkBY3n.dll',#1 MD5: 73C519F050C20580F8A62C849D49215A)

explorer.exe (PID: 3292 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

Netplwiz.exe (PID: 2848 cmdline: C:\Windows\system32\Netplwiz.exe MD5: A513A767CC9CC3E694D8C9D53B90B73E)

Netplwiz.exe (PID: 3584 cmdline: C:\Users\user\AppData\Local\SbH2\Netplwiz.exe MD5: A513A767CC9CC3E694D8C9D53B90B73E)

recdisc.exe (PID: 6784 cmdline: C:\Windows\system32\recdisc.exe MD5: D2AEFB37C329E455DC2C17D3AA049666)

recdisc.exe (PID: 6696 cmdline: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe MD5: D2AEFB37C329E455DC2C17D3AA049666)

phoneactivate.exe (PID: 6768 cmdline: C:\Windows\system32\phoneactivate.exe MD5: 09D1974A03068D4311F1CE94B765E817)

phoneactivate.exe (PID: 4116 cmdline: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe MD5: 09D1974A03068D4311F1CE94B765E817)

wermgr.exe (PID: 5968 cmdline: C:\Windows\system32\wermgr.exe MD5: FF214585BF10206E21EA8EBA202FACFD)

wermgr.exe (PID: 6056 cmdline: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe MD5: FF214585BF10206E21EA8EBA202FACFD)

wermgr.exe (PID: 4068 cmdline: C:\Windows\system32\wermgr.exe MD5: FF214585BF10206E21EA8EBA202FACFD)

wermgr.exe (PID: 7096 cmdline: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe MD5: FF214585BF10206E21EA8EBA202FACFD)

rdpinput.exe (PID: 4312 cmdline: C:\Windows\system32\rdpinput.exe MD5: 4403785D297C55D5DF26176B4F1A52C8)

rdpinput.exe (PID: 5240 cmdline: C:\Users\user\AppData\Local\iBq\rdpinput.exe MD5: 4403785D297C55D5DF26176B4F1A52C8)

rundll32.exe (PID: 6488 cmdline: rundll32.exe C:\Users\user\Desktop\yPeVDkBY3n.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6552 cmdline: rundll32.exe C:\Users\user\Desktop\yPeVDkBY3n.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6728 cmdline: rundll32.exe C:\Users\user\Desktop\yPeVDkBY3n.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ MD5: 73C519F050C20580F8A62C849D49215A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000016.00000002.362816566.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000004.00000002.334340057.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000024.00000002.458324438.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000001B.00000002.388799941.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000000A.00000002.267627821.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000027.00000002.485059141.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000001F.00000002.426654754.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000029.00000002.514047905.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000005.00000002.252235999.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000007.00000002.260064173.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
Click to see the 6 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: yPeVDkBY3n.dll	Virustotal: Detection: 64%	Perma Link
Source: yPeVDkBY3n.dll	Metadefender: Detection: 62%	Perma Link
Source: yPeVDkBY3n.dll	ReversingLabs: Detection: 75%

Antivirus / Scanner detection for submitted sample

Show sources

Source: yPeVDkBY3n.dll

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\iBq\WINSTA.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\xnA\dwmapi.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\SbH2\NETPLWIZ.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wer.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\NMBpLf1V\SYSDM.CPL	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\r4gbgdji\ReAgent.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wer.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\lW7exk8\DUI70.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wer.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452

Source: yPeVDkBY3n.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: rdpinput.pdbGCTL source: rdpinput.exe, 00000029.00000002.516210591.00007FF609423000.00000002.00020000.sdmp, rdpinput.exe.6.dr
Source:	Binary string: netplwiz.pdb source: Netplwiz.exe, 00000016.00000000.340021243.00007FF7D7314000.00000002.00020000.sdmp, Netplwiz.exe.6.dr
Source:	Binary string: netplwiz.pdbGCTL source: Netplwiz.exe, 00000016.00000000.340021243.00007FF7D7314000.00000002.00020000.sdmp, Netplwiz.exe.6.dr
Source:	Binary string: wbengine.pdbGCTL source: wbengine.exe.6.dr
Source:	Binary string: phoneactivate.pdb source: phoneactivate.exe, 0000001F.00000000.405014685.00007FF6DC4D0000.00000002.00020000.sdmp, phoneactivate.exe.6.dr
Source:	Binary string: wbengine.pdb source: wbengine.exe.6.dr
Source:	Binary string: WerMgr.pdb source: wermgr.exe, 00000024.00000002.461794461.00007FF7E2165000.00000002.00020000.sdmp, wermgr.exe, 00000027.00000000.463164776.00007FF75F9C5000.00000002.00020000.sdmp, wermgr.exe.6.dr
Source:	Binary string: SystemPropertiesProtection.pdb source: SystemPropertiesProtection.exe.6.dr
Source:	Binary string: SystemPropertiesProtection.pdbGCTL source: SystemPropertiesProtection.exe.6.dr
Source:	Binary string: WMPDMC.pdbGCTL source: WMPDMC.exe.6.dr
Source:	Binary string: phoneactivate.pdbGCTL source: phoneactivate.exe, 0000001F.00000000.405014685.00007FF6DC4D0000.00000002.00020000.sdmp, phoneactivate.exe.6.dr
Source:	Binary string: rdpinput.pdb source: rdpinput.exe, 00000029.00000002.516210591.00007FF609423000.00000002.00020000.sdmp, rdpinput.exe.6.dr
Source:	Binary string: recdisc.pdb source: recdisc.exe, 0000001B.00000000.366530322.00007FF6C2013000.00000002.00020000.sdmp, recdisc.exe.6.dr
Source:	Binary string: recdisc.pdbGCTL source: recdisc.exe, 0000001B.00000000.366530322.00007FF6C2013000.00000002.00020000.sdmp, recdisc.exe.6.dr
Source:	Binary string: WMPDMC.pdb source: WMPDMC.exe.6.dr
Source:	Binary string: WerMgr.pdbGCTL source: wermgr.exe, 00000024.00000002.461794461.00007FF7E2165000.00000002.00020000.sdmp, wermgr.exe, 00000027.00000000.463164776.00007FF75F9C5000.00000002.00020000.sdmp, wermgr.exe.6.dr

Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014005D290 FindFirstFileExW,	1_2_000000014005D290
Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe	Code function: 27_2_00007FF6C20062CC memset,memset,FindFirstFileW,FindFirstFileW,FindNextFileW,GetLastError,FindClose,FindClose,	27_2_00007FF6C20062CC
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E2161BA0 FindFirstFileExW,_wcsicmp,_wcsicmp,FindNextFileW,GetLastError,GetLastError,FindClose,	36_2_00007FF7E2161BA0
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E215BE54 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,CompareStringW,FindNextFileW,FindClose,FindClose,	36_2_00007FF7E215BE54
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9BBE54 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,CompareStringW,FindNextFileW,FindClose,FindClose,	39_2_00007FF75F9BBE54
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9C1BA0 FindFirstFileExW,_wcsicmp,_wcsicmp,FindNextFileW,GetLastError,GetLastError,FindClose,	39_2_00007FF75F9C1BA0

Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe

Code function: 27_2_00007FF6C200A050 memset,CoCreateGuid,GetLogicalDriveStringsW,GetDriveTypeW,GetDiskFreeSpaceExW,CloseHandle,CreateFileW,CloseHandle,CloseHandle,

27_2_00007FF6C200A050

Source: phoneactivate.exe	String found in binary or memory: http://schemas.mic
Source: explorer.exe, 00000006.00000000.273503366.0000000006870000.00000004.00000001.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J

E-Banking Fraud:

Yara detected Dridex unpacked file

Show sources

Source: Yara match	File source: 00000016.00000002.362816566.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.334340057.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.458324438.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.388799941.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.267627821.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.485059141.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.426654754.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.514047905.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.252235999.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.260064173.0000000140001000.00000020.00020000.sdmp, type: MEMORY

Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140034870	1_2_0000000140034870
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140035270	1_2_0000000140035270
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140048AC0	1_2_0000000140048AC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014005C340	1_2_000000014005C340
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140065B80	1_2_0000000140065B80
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006A4B0	1_2_000000014006A4B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400524B0	1_2_00000001400524B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140026CC0	1_2_0000000140026CC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014004BD40	1_2_000000014004BD40
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400495B0	1_2_00000001400495B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140036F30	1_2_0000000140036F30
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140069010	1_2_0000000140069010
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140001010	1_2_0000000140001010
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140066020	1_2_0000000140066020
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002F840	1_2_000000014002F840
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014005D850	1_2_000000014005D850
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140064080	1_2_0000000140064080
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140010880	1_2_0000000140010880
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400688A0	1_2_00000001400688A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002D0D0	1_2_000000014002D0D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400018D0	1_2_00000001400018D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140016100	1_2_0000000140016100
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014001D100	1_2_000000014001D100
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002A110	1_2_000000014002A110
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014001D910	1_2_000000014001D910
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140015120	1_2_0000000140015120
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014000B120	1_2_000000014000B120
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014004F940	1_2_000000014004F940
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140039140	1_2_0000000140039140
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140023140	1_2_0000000140023140
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140057950	1_2_0000000140057950
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014001E170	1_2_000000014001E170
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140002980	1_2_0000000140002980
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400611A0	1_2_00000001400611A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400389A0	1_2_00000001400389A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400381A0	1_2_00000001400381A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002E1B0	1_2_000000014002E1B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400139D0	1_2_00000001400139D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400319F0	1_2_00000001400319F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002EA00	1_2_000000014002EA00
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140022A00	1_2_0000000140022A00
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014003B220	1_2_000000014003B220
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140067A40	1_2_0000000140067A40
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140069A50	1_2_0000000140069A50
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140007A60	1_2_0000000140007A60
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014003AAC0	1_2_000000014003AAC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014003A2E0	1_2_000000014003A2E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140062B00	1_2_0000000140062B00
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140018300	1_2_0000000140018300
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002FB20	1_2_000000014002FB20
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140031340	1_2_0000000140031340
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140022340	1_2_0000000140022340
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140017B40	1_2_0000000140017B40
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014000BB40	1_2_000000014000BB40
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014004EB60	1_2_000000014004EB60
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140005370	1_2_0000000140005370
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002CB80	1_2_000000014002CB80
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B390	1_2_000000014006B390
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140054BA0	1_2_0000000140054BA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140033BB0	1_2_0000000140033BB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400263C0	1_2_00000001400263C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400123C0	1_2_00000001400123C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140063BD0	1_2_0000000140063BD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400663F0	1_2_00000001400663F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140023BF0	1_2_0000000140023BF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B41B	1_2_000000014006B41B
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B424	1_2_000000014006B424
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B42D	1_2_000000014006B42D
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B436	1_2_000000014006B436
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B43D	1_2_000000014006B43D
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140024440	1_2_0000000140024440
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140005C40	1_2_0000000140005C40
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B446	1_2_000000014006B446
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014005F490	1_2_000000014005F490
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140022D00	1_2_0000000140022D00
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140035520	1_2_0000000140035520
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140019D20	1_2_0000000140019D20
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140030530	1_2_0000000140030530
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140023530	1_2_0000000140023530
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140031540	1_2_0000000140031540
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140033540	1_2_0000000140033540
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014007BD50	1_2_000000014007BD50
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140078570	1_2_0000000140078570
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140019580	1_2_0000000140019580
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400205A0	1_2_00000001400205A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140025DB0	1_2_0000000140025DB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140071DC0	1_2_0000000140071DC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014000C5C0	1_2_000000014000C5C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002DDE0	1_2_000000014002DDE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140031DF0	1_2_0000000140031DF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014000DDF0	1_2_000000014000DDF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140001620	1_2_0000000140001620
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140018630	1_2_0000000140018630
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140032650	1_2_0000000140032650
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140064E80	1_2_0000000140064E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140016E80	1_2_0000000140016E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140007EA0	1_2_0000000140007EA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400286B0	1_2_00000001400286B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140006EB0	1_2_0000000140006EB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400276C0	1_2_00000001400276C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002FEC0	1_2_000000014002FEC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002EED0	1_2_000000014002EED0
Source: C:\Users\user\AppData\Local\SbH2\Netplwiz.exe	Code function: 22_2_00007FF7D7312B04	22_2_00007FF7D7312B04
Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe	Code function: 27_2_00007FF6C200D96C	27_2_00007FF6C200D96C
Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe	Code function: 27_2_00007FF6C20092C4	27_2_00007FF6C20092C4
Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe	Code function: 27_2_00007FF6C200231C	27_2_00007FF6C200231C
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4CB9B4	31_2_00007FF6DC4CB9B4
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4C5998	31_2_00007FF6DC4C5998
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4CD570	31_2_00007FF6DC4CD570
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4C5364	31_2_00007FF6DC4C5364
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4CCE28	31_2_00007FF6DC4CCE28
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4CD220	31_2_00007FF6DC4CD220
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4C97D4	31_2_00007FF6DC4C97D4
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4C83BC	31_2_00007FF6DC4C83BC
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4C91DC	31_2_00007FF6DC4C91DC
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4CA094	31_2_00007FF6DC4CA094
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4C8058	31_2_00007FF6DC4C8058
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4C730C	31_2_00007FF6DC4C730C
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4C12F8	31_2_00007FF6DC4C12F8
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4C6920	31_2_00007FF6DC4C6920
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4C5EE0	31_2_00007FF6DC4C5EE0
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4C84DC	31_2_00007FF6DC4C84DC
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E2152F54	36_2_00007FF7E2152F54
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E215E368	36_2_00007FF7E215E368
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E215CFF0	36_2_00007FF7E215CFF0
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E2162438	36_2_00007FF7E2162438
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E2156848	36_2_00007FF7E2156848
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E2160A58	36_2_00007FF7E2160A58
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E2157EFC	36_2_00007FF7E2157EFC
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9B7EFC	39_2_00007FF75F9B7EFC
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9C2438	39_2_00007FF75F9C2438
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9B6848	39_2_00007FF75F9B6848
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9C0A58	39_2_00007FF75F9C0A58
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9BCFF0	39_2_00007FF75F9BCFF0
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9B2F54	39_2_00007FF75F9B2F54
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9BE368	39_2_00007FF75F9BE368
Source: C:\Users\user\AppData\Local\iBq\rdpinput.exe	Code function: 41_2_00007FF609402578	41_2_00007FF609402578
Source: C:\Users\user\AppData\Local\iBq\rdpinput.exe	Code function: 41_2_00007FF60940FD48	41_2_00007FF60940FD48
Source: C:\Users\user\AppData\Local\iBq\rdpinput.exe	Code function: 41_2_00007FF609403BE0	41_2_00007FF609403BE0

Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe

Code function: String function: 00007FF6C2005D7C appears 58 times

Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140046C90 NtClose,	1_2_0000000140046C90
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006A4B0 NtQuerySystemInformation,	1_2_000000014006A4B0
Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe	Code function: 27_2_00007FF6C2009F88 NtQuerySystemInformation,	27_2_00007FF6C2009F88
Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe	Code function: 27_2_00007FF6C20115EC memset,CreateFileW,memset,NtQueryInformationFile,NtSetInformationFile,CloseHandle,	27_2_00007FF6C20115EC
Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe	Code function: 27_2_00007FF6C2011460 CreateFileW,NtQueryInformationFile,CloseHandle,	27_2_00007FF6C2011460
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E2161F54 NtQueryLicenseValue,	36_2_00007FF7E2161F54
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E215E368 ZwQueryWnfStateNameInformation,ZwUpdateWnfStateData,EtwEventWriteNoRegistration,NtQuerySystemInformation,NtOpenEvent,NtWaitForSingleObject,NtClose,RtlAllocateAndInitializeSid,RtlInitUnicodeString,memset,NtAlpcConnectPort,memset,NtAlpcSendWaitReceivePort,RtlFreeSid,NtClose,	36_2_00007FF7E215E368
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E2158404 DbgPrintEx,NtQueryInformationProcess,DbgPrintEx,DbgPrintEx,ReadProcessMemory,DbgPrintEx,GetLastError,	36_2_00007FF7E2158404
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E2162438 LoadLibraryExW,GetProcAddress,NtQueryLicenseValue,FreeLibrary,NtQueryLicenseValue,	36_2_00007FF7E2162438
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E21582EC DbgPrintEx,NtQueryInformationProcess,DbgPrintEx,DbgPrintEx,ReadProcessMemory,DbgPrintEx,GetLastError,	36_2_00007FF7E21582EC
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9B82EC DbgPrintEx,NtQueryInformationProcess,DbgPrintEx,DbgPrintEx,ReadProcessMemory,DbgPrintEx,GetLastError,	39_2_00007FF75F9B82EC
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9C2438 LoadLibraryExW,GetProcAddress,NtQueryLicenseValue,FreeLibrary,NtQueryLicenseValue,	39_2_00007FF75F9C2438
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9B8404 DbgPrintEx,NtQueryInformationProcess,DbgPrintEx,DbgPrintEx,ReadProcessMemory,DbgPrintEx,GetLastError,	39_2_00007FF75F9B8404
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9C1F54 NtQueryLicenseValue,	39_2_00007FF75F9C1F54
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9BE368 ZwQueryWnfStateNameInformation,ZwUpdateWnfStateData,EtwEventWriteNoRegistration,NtQuerySystemInformation,NtOpenEvent,NtWaitForSingleObject,NtClose,RtlAllocateAndInitializeSid,RtlInitUnicodeString,memset,NtAlpcConnectPort,memset,NtAlpcSendWaitReceivePort,RtlFreeSid,NtClose,	39_2_00007FF75F9BE368

Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe

Code function: 27_2_00007FF6C20065A0: CreateFileW,DeviceIoControl,CloseHandle,

27_2_00007FF6C20065A0

Source: yPeVDkBY3n.dll

Binary or memory string: OriginalFilenamekbdyj% vs yPeVDkBY3n.dll

Source: Netplwiz.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Netplwiz.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Netplwiz.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: recdisc.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: recdisc.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: recdisc.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wermgr.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wermgr.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wermgr.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wermgr.exe0.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wermgr.exe0.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wermgr.exe0.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesProtection.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesProtection.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesProtection.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WMPDMC.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WMPDMC.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WMPDMC.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WMPDMC.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WMPDMC.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WMPDMC.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WMPDMC.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WMPDMC.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WMPDMC.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: DUI70.dll.6.dr	Static PE information: Number of sections : 32 > 10
Source: yPeVDkBY3n.dll	Static PE information: Number of sections : 31 > 10
Source: wer.dll.6.dr	Static PE information: Number of sections : 32 > 10
Source: WINSTA.dll.6.dr	Static PE information: Number of sections : 32 > 10
Source: SYSDM.CPL.6.dr	Static PE information: Number of sections : 32 > 10
Source: ReAgent.dll.6.dr	Static PE information: Number of sections : 32 > 10
Source: NETPLWIZ.dll.6.dr	Static PE information: Number of sections : 32 > 10
Source: wer.dll0.6.dr	Static PE information: Number of sections : 32 > 10
Source: dwmapi.dll.6.dr	Static PE information: Number of sections : 32 > 10
Source: wer.dll1.6.dr	Static PE information: Number of sections : 32 > 10

Source: yPeVDkBY3n.dll	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: NETPLWIZ.dll.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: ReAgent.dll.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DUI70.dll.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: wer.dll.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: wer.dll0.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WINSTA.dll.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SYSDM.CPL.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dwmapi.dll.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: wer.dll1.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: yPeVDkBY3n.dll	Virustotal: Detection: 64%
Source: yPeVDkBY3n.dll	Metadefender: Detection: 62%
Source: yPeVDkBY3n.dll	ReversingLabs: Detection: 75%

Source: yPeVDkBY3n.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe 'C:\Users\user\Desktop\yPeVDkBY3n.dll'
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\yPeVDkBY3n.dll',#1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\yPeVDkBY3n.dll',#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\yPeVDkBY3n.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\yPeVDkBY3n.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\yPeVDkBY3n.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\Netplwiz.exe C:\Windows\system32\Netplwiz.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\SbH2\Netplwiz.exe C:\Users\user\AppData\Local\SbH2\Netplwiz.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\recdisc.exe C:\Windows\system32\recdisc.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\phoneactivate.exe C:\Windows\system32\phoneactivate.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\rdpinput.exe C:\Windows\system32\rdpinput.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\iBq\rdpinput.exe C:\Users\user\AppData\Local\iBq\rdpinput.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\yPeVDkBY3n.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\yPeVDkBY3n.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\yPeVDkBY3n.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\yPeVDkBY3n.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\yPeVDkBY3n.dll',#1	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\Netplwiz.exe C:\Windows\system32\Netplwiz.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\SbH2\Netplwiz.exe C:\Users\user\AppData\Local\SbH2\Netplwiz.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\recdisc.exe C:\Windows\system32\recdisc.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\phoneactivate.exe C:\Windows\system32\phoneactivate.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\rdpinput.exe C:\Windows\system32\rdpinput.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\iBq\rdpinput.exe C:\Users\user\AppData\Local\iBq\rdpinput.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\eb42b1a5c308fc11edf1ddbdd25c8486_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Jump to behavior

Source: wbengine.exe.6.dr	Binary string: 3Z((HANDLE)(LONG_PTR)-1) != hFilebase\stor\blb\dsm\dsmutils\dll\fsutilswrapper.cppExtractVolumePath(ssPath, ssVolumePath)SplitDirPath( ssDirPath, ssParentDir, ssDirName )GetParentPaths(ssPath, arrstrPaths)ssDirPath.Length() != 0base\stor\blb\dsm\dsmutils\dll\fsutils.cpppstrPath != 0pstrName != 0CLOCK$COMLPTCONPRNAUXNUL\\?\GLOBALROOT\Device\base\stor\blb\dsm\dsmutils\dll\fsutils.cppInvalid path:%lsssPath.Length() > 0GetVolumePrefixLength failed for %lsFailed to parse path:%lsExtractVolumePath(ssWorkingPath, ssVolumePath)ssWorkingPath[ssWorkingPath.Length() - 1] == L'\\'(((HRESULT)(hrReason)) < 0)pstrPath && pstrPath[0]pfIsReparsedppstrReparsePtPath && (ppstrReparsePtPath == 0)GetFileAttributes() failed on:%lsIsPathMountPoint(ssPath.PeekStr(), &fMountPoint)pszVolumePath != 0phVolume != 0ssVolumePath[ssVolumePath.Length() - 1] == L'\\'Failed to open volume:%ls((HANDLE)(LONG_PTR)-1) == hVolumeppstrPath && ppstrPath == 0dwPathLength > 0 && pstrFilePath[dwPathLength-1] == L'\\'0 != pdwFileAttributesGetFileInformationByHandle(hFile, &fileInfo)0 != lpstrFilePathCreateFile unsuccessful for %wsFSWrapperGetFileAttributes(hFile, pdwFileAttributes)0 != pFileAttributesGetFileInformationByHandleEx(hFile, FileBasicInfo, &fileInfo, sizeof(FILE_BASIC_INFO))GetFileSize failed for %ws((DWORD)-1) != dwFileAttributesGetFileInformationByHandleEx failedSetFileInformationByHandle failedFSWrapperSetFileAttributes(hFile, dwFileAttributes)SplitDirPath(strPath, strParent, strChild)Path %S is invalid as it contains a '.' or '..', hr=0x%08xHRESULT_FROM_WIN32(GetLastError())wszPath && wszPath[0]pfIsPathMountPoint
Source: wbengine.exe.6.dr	Binary string: abase\stor\blb\engine\blbengutils\blbvolumeutils.cpppbFloppypguidVolumeId != NULLpbIsCritical != NULLpguidVolumeIdwszMountedDeviceNamewszVolumeGuidpwszReparsePointName\\?\GLOBALROOT\DEVICE\HARDDISKVOLUME%dWsbMountedVolumeFile%lu_%spVolumeCatrgVolumeLocalwszVolumeGuidPathpwszVolumeGlobalRootPathVolume%ws\\?\GLOBALROOT%wspdwlJournalIdplastUsnwszVolumeName && *wszVolumeNamepbPerformResizepdwlUsnSizevssSnapshotId != GUID_NULLdwlJournalId != BLB_INVALID_USN_JOURNAL_IDusnBeforeSnapShot != BLB_INVALID_USN_IDwszBackupSetDirectorypwszVhdPathwszVolumeName != NULLpbIsVolumeOnSharedDisk != NULLpbIsCSVpdwVolumeNumber?UV9
Source: wbengine.exe.6.dr	Binary string: base\stor\blb\catalog\compare.cpprowid1 != rowid2pKey->m_type == pCol->m_typepRow1 > pRow2_hImpersonationToken != INVALID_HANDLE_VALUEbase\stor\blb\blbimg\blbimg.cxxReadHandle != INVALID_HANDLE_VALUEWriteHandle != INVALID_HANDLE_VALUEpdwFlagsFveGetStatusWwszDeviceName%ws\%wsuCurrentBit < HintSpaceBitmapSizeExtentLength > 0pCurrentListEntry->Length > 0pbRecomputeNeededpBadClusExtentsBeforeRecovery\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy{\System Volume Information\*{3808876B-C176-4e48-B7AE-04046E6CC752}\System Volume Information\{{3808876B-C176-4e48-B7AE-04046E6CC752}ReplicationContext->FirstBlock != NULLIoState[CurrentBuffer] == BLBIMGI_IO_STATE_WRITINGBackupFileName != NULLReplicationHandleReplicationContext != NULLoffset[i] < volumeSizet.QuadPart < restoreContext->VolumeSizereadBuffer != NULL\pagefile.sys\hiberfil.sys!IsListEmpty(&diffsInSource){IQ
Source: wbengine.exe.6.dr	Binary string: e\\?\Globalroot\Device\Harddisk%lu\Partition1\\?\Globalroot\Device\Harddisk%lu\Partition2\\?\Globalroot\Device\HarddiskVolume%luChild_{47b7fa87-ce42-48ff-8b18-2f1088121503}WindowsBackupLinksbase\stor\blb\engine\blbengutils\blbvhdhelper.cppwszVhdFile && wszVhdFilepwszVolumeDevicePathwszDiskPath && wszDiskPathpwszVolumePathwszMountedDeviceName && wszMountedDeviceNamepCBlbVhdwszMountedVolumePathNoSlash && wszMountedVolumePathNoSlashpVhdContextpVhdContextForRemovalwszVolumeDevicePath && wszVolumeDevicePathppVhdContextpVhdContext->m_pCBlbVhdsdiVersion == STORAGE_DEPENDENCY_INFO_VERSION_1 \|\| sdiVersion == STORAGE_DEPENDENCY_INFO_VERSION_2ppDependencyInfopbIsVolVirtualppStorageDepInfowszTargetVolName && wszTargetVolNamewszVirtualSrcVolName && wszVirtualSrcVolNamepbIsVirtualSrcVolDependantpVolumeVHDInfo != NULLpstDepInfo != NULLpstDepInfoType2MaxAncestor != NULLpwszDiffVhdFilePath && pwszVhdTempPath%ws_%ws_%wspProgressReportCallbackContextwszVHDVolumeDevicePathpbCompactionRequiredwszVhdFilepGuidSnapshotIdwszVHDVolumeDevicePath && wszVHDVolumeDevicePathpdwVHDDeviceDiskNumberpVhdHandle

Source: classification engine

Classification label: mal92.troj.evad.winDLL@41/19@0/0

Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe

Code function: 27_2_00007FF6C200D96C CoCreateGuid,CoCreateInstance,CoCreateInstance,SysAllocString,SysAllocString,SHCreateStreamOnFileEx,CoTaskMemAlloc,CoTaskMemFree,SysFreeString,SysFreeString,

27_2_00007FF6C200D96C

Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: RtlInitUnicodeString,RtlCreateBoundaryDescriptor,RtlInitUnicodeString,RtlCreateServiceSid,GetProcessHeap,HeapAlloc,RtlCreateServiceSid,RtlAddSIDToBoundaryDescriptor,OpenPrivateNamespaceW,GetLastError,GetProcessHeap,HeapFree,RtlDeleteBoundaryDescriptor,		36_2_00007FF7E215DE98
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: RtlInitUnicodeString,RtlCreateBoundaryDescriptor,RtlInitUnicodeString,RtlCreateServiceSid,GetProcessHeap,HeapAlloc,RtlCreateServiceSid,RtlAddSIDToBoundaryDescriptor,OpenPrivateNamespaceW,GetLastError,GetProcessHeap,HeapFree,RtlDeleteBoundaryDescriptor,		39_2_00007FF75F9BDE98

Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe

Code function: 27_2_00007FF6C200A050 memset,CoCreateGuid,GetLogicalDriveStringsW,GetDriveTypeW,GetDiskFreeSpaceExW,CloseHandle,CreateFileW,CloseHandle,CloseHandle,

27_2_00007FF6C200A050

Source: C:\Users\user\AppData\Local\iBq\rdpinput.exe

Code function: 41_2_00007FF609404B74 OpenSCManagerW,OpenServiceW,StartServiceW,GetLastError,CloseServiceHandle,CloseServiceHandle,Sleep,

41_2_00007FF609404B74

Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe

Code function: 36_2_00007FF7E2151A70 CreateToolhelp32Snapshot,GetLastError,Process32FirstW,GetLastError,_wcsicmp,Process32NextW,CloseHandle,

36_2_00007FF7E2151A70

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\yPeVDkBY3n.dll',#1

Source: C:\Users\user\AppData\Local\iBq\rdpinput.exe	Mutant created: \Sessions\1\BaseNamedObjects\{deb7f765-e69b-728c-3180-fd487bbd6ce1}
Source: C:\Users\user\AppData\Local\iBq\rdpinput.exe	Mutant created: \Sessions\1\BaseNamedObjects\{274fd39f-8d8a-b1de-df00-37bf686eafd0}

Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe

Code function: 31_2_00007FF6DC4C4794 FindResourceExW,GetLastError,LoadResource,LockResource,

31_2_00007FF6DC4C4794

Source: yPeVDkBY3n.dll

Static PE information: More than 4319 > 100 exports found

Source: yPeVDkBY3n.dll

Static PE information: Image base 0x140000000 > 0x60000000

Source: yPeVDkBY3n.dll

Static file information: File size 2330624 > 1048576

Source: yPeVDkBY3n.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: rdpinput.pdbGCTL source: rdpinput.exe, 00000029.00000002.516210591.00007FF609423000.00000002.00020000.sdmp, rdpinput.exe.6.dr
Source:	Binary string: netplwiz.pdb source: Netplwiz.exe, 00000016.00000000.340021243.00007FF7D7314000.00000002.00020000.sdmp, Netplwiz.exe.6.dr
Source:	Binary string: netplwiz.pdbGCTL source: Netplwiz.exe, 00000016.00000000.340021243.00007FF7D7314000.00000002.00020000.sdmp, Netplwiz.exe.6.dr
Source:	Binary string: wbengine.pdbGCTL source: wbengine.exe.6.dr
Source:	Binary string: phoneactivate.pdb source: phoneactivate.exe, 0000001F.00000000.405014685.00007FF6DC4D0000.00000002.00020000.sdmp, phoneactivate.exe.6.dr
Source:	Binary string: wbengine.pdb source: wbengine.exe.6.dr
Source:	Binary string: WerMgr.pdb source: wermgr.exe, 00000024.00000002.461794461.00007FF7E2165000.00000002.00020000.sdmp, wermgr.exe, 00000027.00000000.463164776.00007FF75F9C5000.00000002.00020000.sdmp, wermgr.exe.6.dr
Source:	Binary string: SystemPropertiesProtection.pdb source: SystemPropertiesProtection.exe.6.dr
Source:	Binary string: SystemPropertiesProtection.pdbGCTL source: SystemPropertiesProtection.exe.6.dr
Source:	Binary string: WMPDMC.pdbGCTL source: WMPDMC.exe.6.dr
Source:	Binary string: phoneactivate.pdbGCTL source: phoneactivate.exe, 0000001F.00000000.405014685.00007FF6DC4D0000.00000002.00020000.sdmp, phoneactivate.exe.6.dr
Source:	Binary string: rdpinput.pdb source: rdpinput.exe, 00000029.00000002.516210591.00007FF609423000.00000002.00020000.sdmp, rdpinput.exe.6.dr
Source:	Binary string: recdisc.pdb source: recdisc.exe, 0000001B.00000000.366530322.00007FF6C2013000.00000002.00020000.sdmp, recdisc.exe.6.dr
Source:	Binary string: recdisc.pdbGCTL source: recdisc.exe, 0000001B.00000000.366530322.00007FF6C2013000.00000002.00020000.sdmp, recdisc.exe.6.dr
Source:	Binary string: WMPDMC.pdb source: WMPDMC.exe.6.dr
Source:	Binary string: WerMgr.pdbGCTL source: wermgr.exe, 00000024.00000002.461794461.00007FF7E2165000.00000002.00020000.sdmp, wermgr.exe, 00000027.00000000.463164776.00007FF75F9C5000.00000002.00020000.sdmp, wermgr.exe.6.dr

Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140056A4D push rdi; ret		1_2_0000000140056A4E
Source: C:\Users\user\AppData\Local\iBq\rdpinput.exe	Code function: 41_2_00007FF609405E92 push rcx; ret		41_2_00007FF609405E93

Source: yPeVDkBY3n.dll	Static PE information: section name: .qkm
Source: yPeVDkBY3n.dll	Static PE information: section name: .cvjb
Source: yPeVDkBY3n.dll	Static PE information: section name: .tlmkv
Source: yPeVDkBY3n.dll	Static PE information: section name: .wucsxe
Source: yPeVDkBY3n.dll	Static PE information: section name: .fltwtj
Source: yPeVDkBY3n.dll	Static PE information: section name: .tblq
Source: yPeVDkBY3n.dll	Static PE information: section name: .hcmjm
Source: yPeVDkBY3n.dll	Static PE information: section name: .nagyk
Source: yPeVDkBY3n.dll	Static PE information: section name: .jrucz
Source: yPeVDkBY3n.dll	Static PE information: section name: .rnr
Source: yPeVDkBY3n.dll	Static PE information: section name: .ths
Source: yPeVDkBY3n.dll	Static PE information: section name: .uuy
Source: yPeVDkBY3n.dll	Static PE information: section name: .llcgmp
Source: yPeVDkBY3n.dll	Static PE information: section name: .zibji
Source: yPeVDkBY3n.dll	Static PE information: section name: .nnbdme
Source: yPeVDkBY3n.dll	Static PE information: section name: .oxoht
Source: yPeVDkBY3n.dll	Static PE information: section name: .poofxn
Source: yPeVDkBY3n.dll	Static PE information: section name: .yoxffm
Source: yPeVDkBY3n.dll	Static PE information: section name: .lbp
Source: yPeVDkBY3n.dll	Static PE information: section name: .cmyjh
Source: yPeVDkBY3n.dll	Static PE information: section name: .khlpd
Source: yPeVDkBY3n.dll	Static PE information: section name: .ksydf
Source: yPeVDkBY3n.dll	Static PE information: section name: .jtgc
Source: yPeVDkBY3n.dll	Static PE information: section name: .ivi
Source: yPeVDkBY3n.dll	Static PE information: section name: .sqcys
Source: phoneactivate.exe.6.dr	Static PE information: section name: .imrsiv
Source: wermgr.exe.6.dr	Static PE information: section name: .imrsiv
Source: wermgr.exe.6.dr	Static PE information: section name: .didat
Source: wermgr.exe0.6.dr	Static PE information: section name: .imrsiv
Source: wermgr.exe0.6.dr	Static PE information: section name: .didat
Source: WMPDMC.exe.6.dr	Static PE information: section name: .didat
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .qkm
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .cvjb
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .tlmkv
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .wucsxe
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .fltwtj
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .tblq
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .hcmjm
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .nagyk
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .jrucz
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .rnr
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .ths
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .uuy
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .llcgmp
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .zibji
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .nnbdme
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .oxoht
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .poofxn
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .yoxffm
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .lbp
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .cmyjh
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .khlpd
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .ksydf
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .jtgc
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .ivi
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .sqcys
Source: NETPLWIZ.dll.6.dr	Static PE information: section name: .pyswvk
Source: ReAgent.dll.6.dr	Static PE information: section name: .qkm
Source: ReAgent.dll.6.dr	Static PE information: section name: .cvjb
Source: ReAgent.dll.6.dr	Static PE information: section name: .tlmkv
Source: ReAgent.dll.6.dr	Static PE information: section name: .wucsxe
Source: ReAgent.dll.6.dr	Static PE information: section name: .fltwtj
Source: ReAgent.dll.6.dr	Static PE information: section name: .tblq
Source: ReAgent.dll.6.dr	Static PE information: section name: .hcmjm
Source: ReAgent.dll.6.dr	Static PE information: section name: .nagyk
Source: ReAgent.dll.6.dr	Static PE information: section name: .jrucz
Source: ReAgent.dll.6.dr	Static PE information: section name: .rnr
Source: ReAgent.dll.6.dr	Static PE information: section name: .ths
Source: ReAgent.dll.6.dr	Static PE information: section name: .uuy
Source: ReAgent.dll.6.dr	Static PE information: section name: .llcgmp
Source: ReAgent.dll.6.dr	Static PE information: section name: .zibji
Source: ReAgent.dll.6.dr	Static PE information: section name: .nnbdme
Source: ReAgent.dll.6.dr	Static PE information: section name: .oxoht
Source: ReAgent.dll.6.dr	Static PE information: section name: .poofxn
Source: ReAgent.dll.6.dr	Static PE information: section name: .yoxffm
Source: ReAgent.dll.6.dr	Static PE information: section name: .lbp
Source: ReAgent.dll.6.dr	Static PE information: section name: .cmyjh
Source: ReAgent.dll.6.dr	Static PE information: section name: .khlpd
Source: ReAgent.dll.6.dr	Static PE information: section name: .ksydf
Source: ReAgent.dll.6.dr	Static PE information: section name: .jtgc
Source: ReAgent.dll.6.dr	Static PE information: section name: .ivi
Source: ReAgent.dll.6.dr	Static PE information: section name: .sqcys
Source: ReAgent.dll.6.dr	Static PE information: section name: .xfh
Source: DUI70.dll.6.dr	Static PE information: section name: .qkm
Source: DUI70.dll.6.dr	Static PE information: section name: .cvjb
Source: DUI70.dll.6.dr	Static PE information: section name: .tlmkv
Source: DUI70.dll.6.dr	Static PE information: section name: .wucsxe
Source: DUI70.dll.6.dr	Static PE information: section name: .fltwtj
Source: DUI70.dll.6.dr	Static PE information: section name: .tblq
Source: DUI70.dll.6.dr	Static PE information: section name: .hcmjm
Source: DUI70.dll.6.dr	Static PE information: section name: .nagyk
Source: DUI70.dll.6.dr	Static PE information: section name: .jrucz
Source: DUI70.dll.6.dr	Static PE information: section name: .rnr
Source: DUI70.dll.6.dr	Static PE information: section name: .ths
Source: DUI70.dll.6.dr	Static PE information: section name: .uuy
Source: DUI70.dll.6.dr	Static PE information: section name: .llcgmp
Source: DUI70.dll.6.dr	Static PE information: section name: .zibji
Source: DUI70.dll.6.dr	Static PE information: section name: .nnbdme
Source: DUI70.dll.6.dr	Static PE information: section name: .oxoht
Source: DUI70.dll.6.dr	Static PE information: section name: .poofxn
Source: DUI70.dll.6.dr	Static PE information: section name: .yoxffm
Source: DUI70.dll.6.dr	Static PE information: section name: .lbp
Source: DUI70.dll.6.dr	Static PE information: section name: .cmyjh
Source: DUI70.dll.6.dr	Static PE information: section name: .khlpd
Source: DUI70.dll.6.dr	Static PE information: section name: .ksydf
Source: DUI70.dll.6.dr	Static PE information: section name: .jtgc
Source: DUI70.dll.6.dr	Static PE information: section name: .ivi
Source: DUI70.dll.6.dr	Static PE information: section name: .sqcys
Source: DUI70.dll.6.dr	Static PE information: section name: .grwy
Source: wer.dll.6.dr	Static PE information: section name: .qkm
Source: wer.dll.6.dr	Static PE information: section name: .cvjb
Source: wer.dll.6.dr	Static PE information: section name: .tlmkv
Source: wer.dll.6.dr	Static PE information: section name: .wucsxe
Source: wer.dll.6.dr	Static PE information: section name: .fltwtj
Source: wer.dll.6.dr	Static PE information: section name: .tblq
Source: wer.dll.6.dr	Static PE information: section name: .hcmjm
Source: wer.dll.6.dr	Static PE information: section name: .nagyk
Source: wer.dll.6.dr	Static PE information: section name: .jrucz
Source: wer.dll.6.dr	Static PE information: section name: .rnr
Source: wer.dll.6.dr	Static PE information: section name: .ths
Source: wer.dll.6.dr	Static PE information: section name: .uuy
Source: wer.dll.6.dr	Static PE information: section name: .llcgmp
Source: wer.dll.6.dr	Static PE information: section name: .zibji
Source: wer.dll.6.dr	Static PE information: section name: .nnbdme
Source: wer.dll.6.dr	Static PE information: section name: .oxoht
Source: wer.dll.6.dr	Static PE information: section name: .poofxn
Source: wer.dll.6.dr	Static PE information: section name: .yoxffm
Source: wer.dll.6.dr	Static PE information: section name: .lbp
Source: wer.dll.6.dr	Static PE information: section name: .cmyjh
Source: wer.dll.6.dr	Static PE information: section name: .khlpd
Source: wer.dll.6.dr	Static PE information: section name: .ksydf
Source: wer.dll.6.dr	Static PE information: section name: .jtgc
Source: wer.dll.6.dr	Static PE information: section name: .ivi
Source: wer.dll.6.dr	Static PE information: section name: .sqcys
Source: wer.dll.6.dr	Static PE information: section name: .qbg
Source: wer.dll0.6.dr	Static PE information: section name: .qkm
Source: wer.dll0.6.dr	Static PE information: section name: .cvjb
Source: wer.dll0.6.dr	Static PE information: section name: .tlmkv
Source: wer.dll0.6.dr	Static PE information: section name: .wucsxe
Source: wer.dll0.6.dr	Static PE information: section name: .fltwtj
Source: wer.dll0.6.dr	Static PE information: section name: .tblq
Source: wer.dll0.6.dr	Static PE information: section name: .hcmjm
Source: wer.dll0.6.dr	Static PE information: section name: .nagyk
Source: wer.dll0.6.dr	Static PE information: section name: .jrucz
Source: wer.dll0.6.dr	Static PE information: section name: .rnr
Source: wer.dll0.6.dr	Static PE information: section name: .ths
Source: wer.dll0.6.dr	Static PE information: section name: .uuy
Source: wer.dll0.6.dr	Static PE information: section name: .llcgmp
Source: wer.dll0.6.dr	Static PE information: section name: .zibji
Source: wer.dll0.6.dr	Static PE information: section name: .nnbdme
Source: wer.dll0.6.dr	Static PE information: section name: .oxoht
Source: wer.dll0.6.dr	Static PE information: section name: .poofxn
Source: wer.dll0.6.dr	Static PE information: section name: .yoxffm
Source: wer.dll0.6.dr	Static PE information: section name: .lbp
Source: wer.dll0.6.dr	Static PE information: section name: .cmyjh
Source: wer.dll0.6.dr	Static PE information: section name: .khlpd
Source: wer.dll0.6.dr	Static PE information: section name: .ksydf
Source: wer.dll0.6.dr	Static PE information: section name: .jtgc
Source: wer.dll0.6.dr	Static PE information: section name: .ivi
Source: wer.dll0.6.dr	Static PE information: section name: .sqcys
Source: wer.dll0.6.dr	Static PE information: section name: .kjh
Source: WINSTA.dll.6.dr	Static PE information: section name: .qkm
Source: WINSTA.dll.6.dr	Static PE information: section name: .cvjb
Source: WINSTA.dll.6.dr	Static PE information: section name: .tlmkv
Source: WINSTA.dll.6.dr	Static PE information: section name: .wucsxe
Source: WINSTA.dll.6.dr	Static PE information: section name: .fltwtj
Source: WINSTA.dll.6.dr	Static PE information: section name: .tblq
Source: WINSTA.dll.6.dr	Static PE information: section name: .hcmjm
Source: WINSTA.dll.6.dr	Static PE information: section name: .nagyk
Source: WINSTA.dll.6.dr	Static PE information: section name: .jrucz
Source: WINSTA.dll.6.dr	Static PE information: section name: .rnr
Source: WINSTA.dll.6.dr	Static PE information: section name: .ths
Source: WINSTA.dll.6.dr	Static PE information: section name: .uuy
Source: WINSTA.dll.6.dr	Static PE information: section name: .llcgmp
Source: WINSTA.dll.6.dr	Static PE information: section name: .zibji
Source: WINSTA.dll.6.dr	Static PE information: section name: .nnbdme
Source: WINSTA.dll.6.dr	Static PE information: section name: .oxoht
Source: WINSTA.dll.6.dr	Static PE information: section name: .poofxn
Source: WINSTA.dll.6.dr	Static PE information: section name: .yoxffm
Source: WINSTA.dll.6.dr	Static PE information: section name: .lbp
Source: WINSTA.dll.6.dr	Static PE information: section name: .cmyjh
Source: WINSTA.dll.6.dr	Static PE information: section name: .khlpd
Source: WINSTA.dll.6.dr	Static PE information: section name: .ksydf
Source: WINSTA.dll.6.dr	Static PE information: section name: .jtgc
Source: WINSTA.dll.6.dr	Static PE information: section name: .ivi
Source: WINSTA.dll.6.dr	Static PE information: section name: .sqcys
Source: WINSTA.dll.6.dr	Static PE information: section name: .iwang
Source: SYSDM.CPL.6.dr	Static PE information: section name: .qkm
Source: SYSDM.CPL.6.dr	Static PE information: section name: .cvjb
Source: SYSDM.CPL.6.dr	Static PE information: section name: .tlmkv
Source: SYSDM.CPL.6.dr	Static PE information: section name: .wucsxe
Source: SYSDM.CPL.6.dr	Static PE information: section name: .fltwtj
Source: SYSDM.CPL.6.dr	Static PE information: section name: .tblq
Source: SYSDM.CPL.6.dr	Static PE information: section name: .hcmjm
Source: SYSDM.CPL.6.dr	Static PE information: section name: .nagyk
Source: SYSDM.CPL.6.dr	Static PE information: section name: .jrucz
Source: SYSDM.CPL.6.dr	Static PE information: section name: .rnr
Source: SYSDM.CPL.6.dr	Static PE information: section name: .ths
Source: SYSDM.CPL.6.dr	Static PE information: section name: .uuy
Source: SYSDM.CPL.6.dr	Static PE information: section name: .llcgmp
Source: SYSDM.CPL.6.dr	Static PE information: section name: .zibji
Source: SYSDM.CPL.6.dr	Static PE information: section name: .nnbdme
Source: SYSDM.CPL.6.dr	Static PE information: section name: .oxoht
Source: SYSDM.CPL.6.dr	Static PE information: section name: .poofxn
Source: SYSDM.CPL.6.dr	Static PE information: section name: .yoxffm
Source: SYSDM.CPL.6.dr	Static PE information: section name: .lbp
Source: SYSDM.CPL.6.dr	Static PE information: section name: .cmyjh
Source: SYSDM.CPL.6.dr	Static PE information: section name: .khlpd
Source: SYSDM.CPL.6.dr	Static PE information: section name: .ksydf
Source: SYSDM.CPL.6.dr	Static PE information: section name: .jtgc
Source: SYSDM.CPL.6.dr	Static PE information: section name: .ivi
Source: SYSDM.CPL.6.dr	Static PE information: section name: .sqcys
Source: SYSDM.CPL.6.dr	Static PE information: section name: .gkwrn
Source: dwmapi.dll.6.dr	Static PE information: section name: .qkm
Source: dwmapi.dll.6.dr	Static PE information: section name: .cvjb
Source: dwmapi.dll.6.dr	Static PE information: section name: .tlmkv
Source: dwmapi.dll.6.dr	Static PE information: section name: .wucsxe
Source: dwmapi.dll.6.dr	Static PE information: section name: .fltwtj
Source: dwmapi.dll.6.dr	Static PE information: section name: .tblq
Source: dwmapi.dll.6.dr	Static PE information: section name: .hcmjm
Source: dwmapi.dll.6.dr	Static PE information: section name: .nagyk
Source: dwmapi.dll.6.dr	Static PE information: section name: .jrucz
Source: dwmapi.dll.6.dr	Static PE information: section name: .rnr
Source: dwmapi.dll.6.dr	Static PE information: section name: .ths
Source: dwmapi.dll.6.dr	Static PE information: section name: .uuy
Source: dwmapi.dll.6.dr	Static PE information: section name: .llcgmp
Source: dwmapi.dll.6.dr	Static PE information: section name: .zibji
Source: dwmapi.dll.6.dr	Static PE information: section name: .nnbdme
Source: dwmapi.dll.6.dr	Static PE information: section name: .oxoht
Source: dwmapi.dll.6.dr	Static PE information: section name: .poofxn
Source: dwmapi.dll.6.dr	Static PE information: section name: .yoxffm
Source: dwmapi.dll.6.dr	Static PE information: section name: .lbp
Source: dwmapi.dll.6.dr	Static PE information: section name: .cmyjh
Source: dwmapi.dll.6.dr	Static PE information: section name: .khlpd
Source: dwmapi.dll.6.dr	Static PE information: section name: .ksydf
Source: dwmapi.dll.6.dr	Static PE information: section name: .jtgc
Source: dwmapi.dll.6.dr	Static PE information: section name: .ivi
Source: dwmapi.dll.6.dr	Static PE information: section name: .sqcys
Source: dwmapi.dll.6.dr	Static PE information: section name: .hmami
Source: wer.dll1.6.dr	Static PE information: section name: .qkm
Source: wer.dll1.6.dr	Static PE information: section name: .cvjb
Source: wer.dll1.6.dr	Static PE information: section name: .tlmkv
Source: wer.dll1.6.dr	Static PE information: section name: .wucsxe
Source: wer.dll1.6.dr	Static PE information: section name: .fltwtj
Source: wer.dll1.6.dr	Static PE information: section name: .tblq
Source: wer.dll1.6.dr	Static PE information: section name: .hcmjm
Source: wer.dll1.6.dr	Static PE information: section name: .nagyk
Source: wer.dll1.6.dr	Static PE information: section name: .jrucz
Source: wer.dll1.6.dr	Static PE information: section name: .rnr
Source: wer.dll1.6.dr	Static PE information: section name: .ths
Source: wer.dll1.6.dr	Static PE information: section name: .uuy
Source: wer.dll1.6.dr	Static PE information: section name: .llcgmp
Source: wer.dll1.6.dr	Static PE information: section name: .zibji
Source: wer.dll1.6.dr	Static PE information: section name: .nnbdme
Source: wer.dll1.6.dr	Static PE information: section name: .oxoht
Source: wer.dll1.6.dr	Static PE information: section name: .poofxn
Source: wer.dll1.6.dr	Static PE information: section name: .yoxffm
Source: wer.dll1.6.dr	Static PE information: section name: .lbp
Source: wer.dll1.6.dr	Static PE information: section name: .cmyjh
Source: wer.dll1.6.dr	Static PE information: section name: .khlpd
Source: wer.dll1.6.dr	Static PE information: section name: .ksydf
Source: wer.dll1.6.dr	Static PE information: section name: .jtgc
Source: wer.dll1.6.dr	Static PE information: section name: .ivi
Source: wer.dll1.6.dr	Static PE information: section name: .sqcys
Source: wer.dll1.6.dr	Static PE information: section name: .uxnmn

Source: DUI70.dll.6.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x289607
Source: yPeVDkBY3n.dll	Static PE information: real checksum: 0x7d786c40 should be: 0x2428c2
Source: wer.dll.6.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x23b447
Source: WINSTA.dll.6.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x243435
Source: SYSDM.CPL.6.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x2420d8
Source: ReAgent.dll.6.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x23e2c0
Source: NETPLWIZ.dll.6.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x249738
Source: wer.dll0.6.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x23b64a
Source: dwmapi.dll.6.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x243847
Source: wer.dll1.6.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x249d95

Source: Netplwiz.exe.6.dr

Static PE information: 0xD5E5CD76 [Sun Sep 19 19:22:30 2083 UTC]

Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\NMBpLf1V\SYSDM.CPL

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\iBq\WINSTA.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\xnA\WMPDMC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\r4gbgdji\ReAgent.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\02vERQ6Eo\wer.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\lW7exk8\DUI70.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\JaJWNKcB\wer.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\NMBpLf1V\SYSDM.CPL	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\NMBpLf1V\SystemPropertiesProtection.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\SbH2\NETPLWIZ.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\iBq\rdpinput.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\xnA\dwmapi.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\4S1sd\wbengine.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\SbH2\Netplwiz.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\4S1sd\wer.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\iBq\rdpinput.exe

Code function: 41_2_00007FF609404B74 OpenSCManagerW,OpenServiceW,StartServiceW,GetLastError,CloseServiceHandle,CloseServiceHandle,Sleep,

41_2_00007FF609404B74

Source: C:\Users\user\AppData\Local\iBq\rdpinput.exe

Code function: 41_2_00007FF609413F94 LoadLibraryExW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

41_2_00007FF609413F94

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\explorer.exe TID: 4140

Thread sleep count: 36 > 30

Jump to behavior

Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe

Last function: Thread delayed

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\xnA\WMPDMC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\NMBpLf1V\SYSDM.CPL	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\NMBpLf1V\SystemPropertiesProtection.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\xnA\dwmapi.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\4S1sd\wbengine.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E2157BC4 GetSystemTimeAsFileTime followed by cmp: cmp ebx, 01h and CTI: jne 00007FF7E2157CE0h		36_2_00007FF7E2157BC4
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9B7BC4 GetSystemTimeAsFileTime followed by cmp: cmp ebx, 01h and CTI: jne 00007FF75F9B7CE0h		39_2_00007FF75F9B7BC4

Source: C:\Windows\System32\loaddll64.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 1_2_000000014005C340 GetSystemInfo,

1_2_000000014005C340

Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014005D290 FindFirstFileExW,	1_2_000000014005D290
Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe	Code function: 27_2_00007FF6C20062CC memset,memset,FindFirstFileW,FindFirstFileW,FindNextFileW,GetLastError,FindClose,FindClose,	27_2_00007FF6C20062CC
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E2161BA0 FindFirstFileExW,_wcsicmp,_wcsicmp,FindNextFileW,GetLastError,GetLastError,FindClose,	36_2_00007FF7E2161BA0
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E215BE54 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,CompareStringW,FindNextFileW,FindClose,FindClose,	36_2_00007FF7E215BE54
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9BBE54 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,CompareStringW,FindNextFileW,FindClose,FindClose,	39_2_00007FF75F9BBE54
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9C1BA0 FindFirstFileExW,_wcsicmp,_wcsicmp,FindNextFileW,GetLastError,GetLastError,FindClose,	39_2_00007FF75F9C1BA0

Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe

Code function: 27_2_00007FF6C200A050 memset,CoCreateGuid,GetLogicalDriveStringsW,GetDriveTypeW,GetDiskFreeSpaceExW,CloseHandle,CreateFileW,CloseHandle,CloseHandle,

27_2_00007FF6C200A050

Source: explorer.exe, 00000006.00000000.260976521.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000006.00000000.260976521.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000006.00000000.284855178.000000000E9F0000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.280460232.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.284855178.000000000E9F0000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}osoft S##
Source: explorer.exe, 00000006.00000000.280460232.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: explorer.exe, 00000006.00000000.272262073.00000000048E0000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.280460232.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}C
Source: explorer.exe, 00000006.00000000.279397370.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Datc
Source: explorer.exe, 00000006.00000000.279397370.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000006.00000000.294097957.00000000069DA000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD002

Source: C:\Users\user\AppData\Local\SbH2\Netplwiz.exe

Code function: 22_2_00007FF7D7311728 GetCurrentThreadId,memset,IsDebuggerPresent,OutputDebugStringW,

22_2_00007FF7D7311728

Source: C:\Users\user\AppData\Local\SbH2\Netplwiz.exe

Code function: 22_2_00007FF7D7313D70 GetProcessHeap,HeapFree,

22_2_00007FF7D7313D70

Source: C:\Windows\System32\loaddll64.exe

Code function: 1_2_0000000140048AC0 LdrLoadDll,FindClose,

1_2_0000000140048AC0

Source: C:\Users\user\AppData\Local\SbH2\Netplwiz.exe	Code function: 22_2_00007FF7D7313690 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_00007FF7D7313690
Source: C:\Users\user\AppData\Local\SbH2\Netplwiz.exe	Code function: 22_2_00007FF7D7313930 SetUnhandledExceptionFilter,	22_2_00007FF7D7313930
Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe	Code function: 27_2_00007FF6C2011FB4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	27_2_00007FF6C2011FB4
Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe	Code function: 27_2_00007FF6C2011D30 SetUnhandledExceptionFilter,	27_2_00007FF6C2011D30
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4CDD68 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_00007FF6DC4CDD68
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Code function: 31_2_00007FF6DC4CE060 SetUnhandledExceptionFilter,	31_2_00007FF6DC4CE060
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E2163140 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	36_2_00007FF7E2163140
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Code function: 36_2_00007FF7E2162B00 SetUnhandledExceptionFilter,	36_2_00007FF7E2162B00
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9C2B00 SetUnhandledExceptionFilter,	39_2_00007FF75F9C2B00
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Code function: 39_2_00007FF75F9C3140 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	39_2_00007FF75F9C3140
Source: C:\Users\user\AppData\Local\iBq\rdpinput.exe	Code function: 41_2_00007FF609422610 SetUnhandledExceptionFilter,	41_2_00007FF609422610
Source: C:\Users\user\AppData\Local\iBq\rdpinput.exe	Code function: 41_2_00007FF60942292C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	41_2_00007FF60942292C

HIPS / PFW / Operating System Protection Evasion:

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: NETPLWIZ.dll.6.dr

Jump to dropped file

Changes memory attributes in foreign processes to executable or writable

Show sources

Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFFAE1CEFE0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFFAE1CE000 protect: page execute read	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFFAC2B2A20 protect: page execute and read and write	Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Windows\System32\rundll32.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Uses Atom Bombing / ProGate to inject into other processes

Show sources

Source: C:\Windows\System32\rundll32.exe

Atom created: 405553565741544156488D6C24D14881EC98 0x00000000 inc eax 0x00000001 push ebp 0x00000002 push ebx 0x00000003 push esi 0x00000004 push edi 0x00000005 inc ecx 0x00000006 push esp 0x00000007 inc ecx 0x00000008 push esi 0x00000009 dec eax 0x0000000a lea ebp, dword ptr [esp-2Fh] 0x0000000e dec eax 0x0000000f sub esp, 00000098h

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\yPeVDkBY3n.dll',#1

Jump to behavior

Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe

Code function: 36_2_00007FF7E215AE50 GetFileSecurityW,GetLastError,GetFileSecurityW,GetLastError,GetSecurityDescriptorDacl,GetLastError,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetLastError,GetTokenInformation,GetLastError,SetEntriesInAclW,InitializeSecurityDescriptor,GetLastError,SetSecurityDescriptorDacl,GetLastError,SetFileSecurityW,GetLastError,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,LocalFree,CloseHandle,

36_2_00007FF7E215AE50

Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe

Code function: 36_2_00007FF7E2161750 AllocateAndInitializeSid,CheckTokenMembership,RegOpenKeyExW,RegCloseKey,FreeSid,

36_2_00007FF7E2161750

Source: explorer.exe, 00000006.00000000.290073698.0000000001400000.00000002.00020000.sdmp	Binary or memory string: uProgram Manager
Source: explorer.exe, 00000006.00000000.290073698.0000000001400000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.290073698.0000000001400000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.290073698.0000000001400000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000006.00000000.269794712.0000000000EB8000.00000004.00000020.sdmp	Binary or memory string: ProgmanX
Source: explorer.exe, 00000006.00000000.279397370.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndAj

Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SbH2\Netplwiz.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SbH2\Netplwiz.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\iBq\rdpinput.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\iBq\rdpinput.exe	Queries volume information: unknown VolumeInformation

Source: C:\Users\user\AppData\Local\SbH2\Netplwiz.exe

Code function: HeapSetInformation,memset,LoadCursorW,GetStockObject,RegisterClassW,GetUserDefaultUILanguage,GetLocaleInfoW,CreateWindowExW,GetLastError,CreateWindowExW,UsersRunDllW,DestroyWindow,

22_2_00007FF7D731286C

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\SbH2\Netplwiz.exe

Code function: 22_2_00007FF7D7313AD0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

22_2_00007FF7D7313AD0

Source: C:\Users\user\AppData\Local\iBq\rdpinput.exe

Code function: 41_2_00007FF60941D63C GetVersionExW,

41_2_00007FF60941D63C

Source: C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe

Code function: 31_2_00007FF6DC4C1E00 StrToID,?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z,?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z,

31_2_00007FF6DC4C1E00

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Service Execution2	Windows Service2	Windows Service2	Masquerading11	OS Credential Dumping	System Time Discovery11	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution1	Application Shimming1	Process Injection312	Virtualization/Sandbox Evasion1	LSASS Memory	Security Software Discovery21	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Application Shimming1	Process Injection312	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Process Discovery3	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information3	LSA Secrets	File and Directory Discovery2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Rundll321	Cached Domain Credentials	System Information Discovery36	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing2	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Timestomp1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
yPeVDkBY3n.dll	64%	Virustotal		Browse
yPeVDkBY3n.dll	63%	Metadefender		Browse
yPeVDkBY3n.dll	76%	ReversingLabs	Win64.Infostealer.Dridex
yPeVDkBY3n.dll	100%	Avira	HEUR/AGEN.1114452

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\iBq\WINSTA.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\xnA\dwmapi.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\SbH2\NETPLWIZ.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\02vERQ6Eo\wer.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\NMBpLf1V\SYSDM.CPL	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\r4gbgdji\ReAgent.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\02vERQ6Eo\wer.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\lW7exk8\DUI70.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\02vERQ6Eo\wer.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	0%	Virustotal		Browse
C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
7.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
41.2.rdpinput.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.2.wermgr.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
5.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.2.phoneactivate.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
36.2.wermgr.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.2.recdisc.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.loaddll64.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.Netplwiz.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://schemas.mic	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000006.00000000.273503366.0000000006870000.00000004.00000001.sdmp	false		high
http://schemas.mic	phoneactivate.exe	false	URL Reputation: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	492878
Start date:	29.09.2021
Start time:	04:14:54
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	yPeVDkBY3n (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal92.troj.evad.winDLL@41/19@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 58.6% (good quality ratio 38.1%) Quality average: 46.8% Quality standard deviation: 41.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 20.82.210.154, 67.26.139.254, 67.26.81.254, 67.27.157.254, 8.248.139.254, 8.248.119.254, 20.54.110.249, 40.112.88.60, 80.67.82.211, 80.67.82.235, 204.79.197.200, 13.107.21.200 Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, www.bing.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, dual-a-0001.a-msedge.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe	td1i2JJWLZ.dll	Get hash	malicious	Browse
	TDhTkVMvVd.dll	Get hash	malicious	Browse
	ShmrlNrhab.dll	Get hash	malicious	Browse
	knYgnOrOXk.dll	Get hash	malicious	Browse
	Dk62bv8zDb.dll	Get hash	malicious	Browse
	UVkobIdWdL.dll	Get hash	malicious	Browse
	EeshGc2wcs.dll	Get hash	malicious	Browse
	3XSR1oCsva.dll	Get hash	malicious	Browse
	9kiaVokmF5.dll	Get hash	malicious	Browse
	90eZiqkJTL.dll	Get hash	malicious	Browse
	e75OHzYF9S.dll	Get hash	malicious	Browse
	BddeqTej4A.dll	Get hash	malicious	Browse
	DC2zX44MQr.dll	Get hash	malicious	Browse
	AUThpzgw53.dll	Get hash	malicious	Browse
	Yz2OIFLI6N.dll	Get hash	malicious	Browse
	RpwMYPzTGV.dll	Get hash	malicious	Browse
	62sLZtD8d8.dll	Get hash	malicious	Browse
	X5C9EzCB7A.dll	Get hash	malicious	Browse
	aaPdM4E7Kv.dll	Get hash	malicious	Browse
	bHcIZ7Xm3U.dll	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\02vERQ6Eo\wer.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2338816
Entropy (8bit):	3.29446783991526
Encrypted:	false
SSDEEP:	12288:FVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:cfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	1473BA39831B2BB5DA9797CF8A760752
SHA1:	ABCA22697FCAAD2585A730FB64A90222A08E751B
SHA-256:	13B0EC43B346CE31DB4034996B76E6605A3DBE8BDEB5171F148AF838532F3427
SHA-512:	0DE8E20350A369622B204B5427F58219DF6F0D98107A8CBCEE8362FB5DF7049DCC791D85B82B66D29C63275D462EE46C0F44B5E5D74FECBC66193C245881429D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d. ..DN^.........." ................p..........@..............................#.....@lx}..b...........................................#.W....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	209312
Entropy (8bit):	6.796289498157116
Encrypted:	false
SSDEEP:	6144:swTMBboFMSuc/9NPXWPJROo/wVJyB60OHyLC7vs:swTMB02SD/mXO64c2Hyw
MD5:	FF214585BF10206E21EA8EBA202FACFD
SHA1:	1ED4AE92D235497F62610078D51105C4634AFADE
SHA-256:	C48C430EB07ACC2FF8BDDD6057F5C9F72C2E83F67478F1E4A1792AF866711538
SHA-512:	24073F60B886C58F227769B2DD7D1439DF841784E43E753265DA761801FDA58FBEEDAC4A642E0A6ABDA40A6263153FAA1A9540DF6D35E38BF0EE5327EA55B4FE
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: td1i2JJWLZ.dll, Detection: malicious, Browse Filename: TDhTkVMvVd.dll, Detection: malicious, Browse Filename: ShmrlNrhab.dll, Detection: malicious, Browse Filename: knYgnOrOXk.dll, Detection: malicious, Browse Filename: Dk62bv8zDb.dll, Detection: malicious, Browse Filename: UVkobIdWdL.dll, Detection: malicious, Browse Filename: EeshGc2wcs.dll, Detection: malicious, Browse Filename: 3XSR1oCsva.dll, Detection: malicious, Browse Filename: 9kiaVokmF5.dll, Detection: malicious, Browse Filename: 90eZiqkJTL.dll, Detection: malicious, Browse Filename: e75OHzYF9S.dll, Detection: malicious, Browse Filename: BddeqTej4A.dll, Detection: malicious, Browse Filename: DC2zX44MQr.dll, Detection: malicious, Browse Filename: AUThpzgw53.dll, Detection: malicious, Browse Filename: Yz2OIFLI6N.dll, Detection: malicious, Browse Filename: RpwMYPzTGV.dll, Detection: malicious, Browse Filename: 62sLZtD8d8.dll, Detection: malicious, Browse Filename: X5C9EzCB7A.dll, Detection: malicious, Browse Filename: aaPdM4E7Kv.dll, Detection: malicious, Browse Filename: bHcIZ7Xm3U.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(j.jI..jI..jI..c1...I...-..iI...-..qI..jI...H...-..mI...-..`I...-..KI...-..kI...-..kI..RichjI..................PE..d...p............"......,..........`(.........@.............................p.......................`......................................... .... ..0:...............!...`..\...@...T...........................`Q..............`R.. ...t........................text...++.......,.................. ..`.imrsiv......@...........................rdata.......P.......0..............@..@.data...X...........................@....pdata..............................@..@.didat..@...........................@....rsrc...0:... ...<..................@..@.reloc..\....`......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\4S1sd\wbengine.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1535488
Entropy (8bit):	6.5079506357027785
Encrypted:	false
SSDEEP:	24576:UgSNpxTPrVDqUtzohGP5ilEI1T4N9sS4aC+369riDQMbbKoLtHWwtPJhVx8OIC9h:UtNpxTPrVuUtMhGRuEAc3sfaYhiDXmod
MD5:	6E235F75DF84C387388D23D697D6540B
SHA1:	A97DE324726F3ECBA383863CB643E4AD5DADB4DC
SHA-256:	7113DD02243E9368EF3265CF5A7F991F9B4D69CAB70B1A446062F8DD714AFC8E
SHA-512:	F294A7F7AD6FAD1E2F2E82123AFB78B76E56C603EF3FA37CDD73992DE91640EB55E2F002072DD57B850B1D7E9162F49B4DE973CFE71DF35DAD958B439E1F287A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|r..\|r..\|r..q..\|r..v..\|r..w..\|r..s..\|r..\|s..}r..{.M\|r..r..\|r.....\|r..p..\|r.Rich.\|r.........................PE..d...!............"..........z......p..........@.....................................v....`.......... .........................................\|............ ...u..................@...T....................=..(....<..............(=...............................text............................... ..`.rdata..b.... ......................@..@.data....&..........................@....pdata...u... ...v..................@..@.rsrc................Z..............@..@.reloc...............f..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\4S1sd\wer.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2338816
Entropy (8bit):	3.2944858495711675
Encrypted:	false
SSDEEP:	12288:WVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:LfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	3543EC05CA756B1F06EB2B0AACC9D942
SHA1:	4A9BDFA30309113CE909403BA861FE7DA61DBEA6
SHA-256:	5AFFA69FE77443A45448F840449A83A99ED5DC7305B9EDAD1B18E83920D6651A
SHA-512:	D5811F403386C4CF2A0BC9FCD2840E60C6E9D3728759D8F17DE29098F59E40B8479EBBB0A13ADF9F1996007E413A0ADF017BE869DE419B6DA34A0B7946F97A9C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d. ..DN^.........." ................p..........@..............................#.....@lx}..b...........................................#.W....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\JaJWNKcB\wer.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2338816
Entropy (8bit):	3.29446537113494
Encrypted:	false
SSDEEP:	12288:EVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ17:hfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	747B98D135003541875FAF52AC306E8C
SHA1:	48B2F6D5E0DD975C2317B57001CF76FA7E216FDB
SHA-256:	0E0A32F47BC17DCE5065B354B9D2D80F197171AAA21851C662ED5FAF4E06E2F9
SHA-512:	2EFFDF7DA31856CAC3D244EAB4D3D1B5A9BD75986F742EDD4F7C20C3F4090157D57D8EF623CFB38A89A4110068FA730F2B814D10AF456640E6C464C67E1F7E34
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d. ..DN^.........." ................p..........@..............................#.....@lx}..b...........................................#.W....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	209312
Entropy (8bit):	6.796289498157116
Encrypted:	false
SSDEEP:	6144:swTMBboFMSuc/9NPXWPJROo/wVJyB60OHyLC7vs:swTMB02SD/mXO64c2Hyw
MD5:	FF214585BF10206E21EA8EBA202FACFD
SHA1:	1ED4AE92D235497F62610078D51105C4634AFADE
SHA-256:	C48C430EB07ACC2FF8BDDD6057F5C9F72C2E83F67478F1E4A1792AF866711538
SHA-512:	24073F60B886C58F227769B2DD7D1439DF841784E43E753265DA761801FDA58FBEEDAC4A642E0A6ABDA40A6263153FAA1A9540DF6D35E38BF0EE5327EA55B4FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(j.jI..jI..jI..c1...I...-..iI...-..qI..jI...H...-..mI...-..`I...-..KI...-..kI...-..kI..RichjI..................PE..d...p............"......,..........`(.........@.............................p.......................`......................................... .... ..0:...............!...`..\...@...T...........................`Q..............`R.. ...t........................text...++.......,.................. ..`.imrsiv......@...........................rdata.......P.......0..............@..@.data...X...........................@....pdata..............................@..@.didat..@...........................@....rsrc...0:... ...<..................@..@.reloc..\....`......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\NMBpLf1V\SYSDM.CPL Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2334720
Entropy (8bit):	3.2847498805521744
Encrypted:	false
SSDEEP:	12288:tVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:0fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	CC8967264AC0051358BBFA68E6427F00
SHA1:	D8730FCDE9EA727896962968C916B2CC7F2BEA4F
SHA-256:	CBFCA948E3B05DE0FD6379BCFBBA681BD92AAE312475273B676B79273480D566
SHA-512:	BF886CF6E5D769915D5DEF3EA7EEC60C52E2E892B2141003DFEFE443BC6E99B7E43C1E86517357CCB5F4763321D440EE17B26EDEA7FACC3198259637CCF76512
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d. ..DN^.........." ................p..........@..............................#.....@lx}..b...........................................#......c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\NMBpLf1V\SystemPropertiesProtection.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.065737112404973
Encrypted:	false
SSDEEP:	1536:YKuZAtREC/rMcgEPJV+G57ThjEC0kzJP+V5J8:+AzECTMpuDhjRVJGq
MD5:	B6C7834B60F72194E32822CD7F39D7A9
SHA1:	26AC4990B1203DD53A299857477EB2DE5CDC0DB1
SHA-256:	02F96A1E1233655997498DF6B11A48270DF05BDA561F004EDC83A165216A04C9
SHA-512:	96E8E380902866247A2873348C88DB244E87E1F925FF78AF06CE5541C5A1AA535BDA6DEB8941D646A1E7E91801BE934D715C990C96B5764511438BBE597D5F8A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a..[a..[a..[h..[o..[..Z`..[..Zc..[..Zp..[a..[C..[..Zd..[..Z`..[..q[`..[..Z`..[Richa..[........................PE..d...k............."..........>.................@....................................{4....`.......... .......................................&.......P..@'...@.................. ...."..T............................ ...............!..8............................text............................... ..`.rdata..N.... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...@'...P...(..................@..@.reloc.. ............F..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SbH2\NETPLWIZ.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2334720
Entropy (8bit):	3.28413644771884
Encrypted:	false
SSDEEP:	12288:nVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:OfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	5D08B0BB75667703159CEB7006226811
SHA1:	9A80743073CD75512FE4A9CD568B3F3AC71F519B
SHA-256:	BDF603FE8005AEF48DD0FE2A3A5924E23D14BAF77C908BE436511E595EFBD564
SHA-512:	357CA06848E9093FAE5C33498DDCA73829B19FF1AE8647D36CF0F647573372E791CDFBE196E2F7D67B4F14394AEFF603E64DE8687D6B207DC94B54EC9CDD3DF5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d. ..DN^.........." ................p..........@..............................#.....@lx}..b...........................................#......c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\SbH2\Netplwiz.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	5.640119387300135
Encrypted:	false
SSDEEP:	768:Sm6uxIL0DPeyQvEsNN6hU2hGGalaQkQcryUJU3fUrh6WeENiJDBPrxZt4W:p6MMD6hlBBjrywUKeWSDBPrxZaW
MD5:	A513A767CC9CC3E694D8C9D53B90B73E
SHA1:	F10B719117D26DAFCC9DBE54E9F9D78A0F80EE2A
SHA-256:	C9F7AC4322504D7EC8305973951A66FBE34E55E34A59409B5B574D627A474369
SHA-512:	03BBBC076D3497E35952143085B9DCC83EDE855A00A190F05712FC91F0C0C4301995D0123EBDCA75A59B93C51358EAD5C4030F8EE9C33F9D1BF1A0EDBC52FD64
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;.K.U.K.U.K.U.B..G.U.$.P.J.U.$.V.H.U.$.Q.Y.U.$.T.F.U.K.T...U.$.\.J.U.$...J.U.$.W.J.U.RichK.U.........................PE..d...v............."..........n......@6.........@..........................................`.......... .......................................L...........F...p..................4....F..T............................@...............A...............................text....-.......................... ..`.rdata..t....@.......2..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc....F.......H...P..............@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\iBq\WINSTA.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2338816
Entropy (8bit):	3.3011416970535334
Encrypted:	false
SSDEEP:	12288:8VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:JfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	94B821B5B1E458C1CB0B4A09B906F7B0
SHA1:	2A7FCEA73E2D92E83B845D89D8595BAE0FC676FB
SHA-256:	C264C3CF59F7D34D629B367B30BF57A0D9449C2448C9305FEAABB8CC7CAB1C23
SHA-512:	39FF14ED7990A54A1E535EF71B19BB77F36D4968A4279D1FF9CD67D63F649A7F194C62902BE8AA5479A1B2D18DFFE1079907E62AF9ADC95BE2DCDDAA423CB3DB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d. ..DN^.........." ................p..........@..............................#.....@lx}..b...........................................#.m....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\iBq\rdpinput.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	178688
Entropy (8bit):	6.278002754824444
Encrypted:	false
SSDEEP:	3072:8i0hLL+KEukKO40+enSqroxn2JIQLtBDYiBJD3cR4DJSpzrA:10d/O40+8Sqk4ZLnBt2tp/
MD5:	4403785D297C55D5DF26176B4F1A52C8
SHA1:	4889F6E0B3CF649C3A8778779D7CEA534B9174B2
SHA-256:	7B8ED6EB50068D4C1B8E51F6F2E3604E6C3B6BB42C6D81ADD4C3B023B6386FF6
SHA-512:	3BAFC7BAE2586F05F05125BF34299D556D46F519D718DAEF8007A0B45D40B0D3CD794A4C55B93CBC1BA2DF111346E6012DEEAD0539AEA91BE71E8ABC877E511F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........i..s:..s:..s:..:..s:..p;..s:..w;..s:..v;..s:..r;..s:..r:..s:..z;..s:...:..s:..q;..s:Rich..s:........PE..d....9`..........."................. #.........@....................................&m....`.......... ..................................................p.......d.......................T............................A...............B...............................text...s........................... ..`.rdata..2n...0...p..."..............@..@.data...............................@....pdata..d...........................@..@.rsrc...p...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\lW7exk8\DUI70.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2617344
Entropy (8bit):	3.8188438649651406
Encrypted:	false
SSDEEP:	12288:ZVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1huj:YfP7fWsK5z9A+WGAW+V5SB6Ct4bnbhu
MD5:	62BE542D5399EB4FFA77F34146C89A06
SHA1:	C9C196CBF6C3E3ED6F4F75F4866FF368DBA3E733
SHA-256:	51A3092EC5597F8A2D20CFD605262809A24F5871C5D7DE3AC83C80D6EAF8FEEB
SHA-512:	675674438CA776ABAA99D4F3B89F255D7EA07D9202358661EB18B825661B260F0227982C0DA447EF941A73777266AD68D9484E80F8C4DCD3C469E9E9F8AC85C3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d. ..DN^.........." ..........#.....p..........@..............................'.....@lx}..b...........................................#.dQ...c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	107504
Entropy (8bit):	6.536585324272613
Encrypted:	false
SSDEEP:	1536:UhKYFAVrKO6PcIgpCaYov3ZKCZwaG70Ur/61cVtat/gLaoU0Sj09P0e:dmlPcNphvo0mtV1La8Lse
MD5:	09D1974A03068D4311F1CE94B765E817
SHA1:	7DD683571E4DCCAF181A5271BBCF15B3BC9D0155
SHA-256:	5D4F713CFC98E7148B67D063193D93BFE29F8329705A03690590633FADE32EE5
SHA-512:	07FD0700C8368485BEC91847C4B9721B059FEDB678C603A57FBD5DABCF110C80B0BD1D114384D4334F0412F3F4FD93C839A1B17F3A9F02C25CD59216692A8AC9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i.......................................O.....................Rich............................PE..d.....^...........".................`..........@....................................;;............... .......................................0.......p.. J...`.......~...%..........`"..T.......................(....................................................text............................... ..`.imrsiv..................................rdata...I.......J..................@..@.data...8....P.......$..............@....pdata.......`.......&..............@..@.rsrc... J...p...L...0..............@..@.reloc...............\|..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\r4gbgdji\ReAgent.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2334720
Entropy (8bit):	3.2894017306191445
Encrypted:	false
SSDEEP:	12288:fVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:WfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	BD93CFC880CD85449C09D257F59E7EB0
SHA1:	36145EE889672CEA943B718D0C7A56874AC47E2D
SHA-256:	443324951C2842D25EB7A9F8CDB562FCBF6A98AA744354C911E1467248F14AF9
SHA-512:	71DBD742B7D0C2A63F0C45663105E82224994FA8969D41A9C4732E631A2899F7E6358148DB7C00978FC6BB756951CB3B31339C49E17E6DB2D15F46342ECB5D8E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d. ..DN^.........." ................p..........@..............................#.....@lx}..b...........................................#......c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	192512
Entropy (8bit):	6.154101271794163
Encrypted:	false
SSDEEP:	3072:H4SpDkUbgEHxW3BIovAuegPO8evTq2VC:H4/3BdFegEv+2V
MD5:	D2AEFB37C329E455DC2C17D3AA049666
SHA1:	69C5182FDC8A86009113EE721C8F1632F7B3D2DB
SHA-256:	A65F86E8EC62BEB3019E368E506DAB21FF872097EBF3FAEB4A3B23F2A08DFCE9
SHA-512:	DD5D63D79FD9E43560291687E0B41B71D6ECA55F033FE94BAA4FAF4CB967F6480CAC4F5481B3102F0589A65AFA473F5637B1C31C522329A275461F3D8C4353A3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e_...1...1...1..\|....1..`5...1..`2...1..`4...1..`0...1...0...1..`8...1..`...1..`3...1.Rich..1.................PE..d...+38..........."............................@.............................@............`.......... .......................................\|....... ..0....................0......0m..T....................9..(....8...............9...............................text............................... ..`.rdata...f...0...h..................@..@.data...`a.......Z..................@....pdata..............................@..@.rsrc...0.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\xnA\WMPDMC.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1517568
Entropy (8bit):	6.62150533612437
Encrypted:	false
SSDEEP:	24576:esSffc55l2PlDph6LYq3BRf6Te8+n3wAJF1/Mk+F6uwY6V0qRr8kmHVJZh/u:cct2PpphUlxRn3wAblMk+F6+6S2r8/Hu
MD5:	4085FDA375E50214142BD740559F5835
SHA1:	22D548F1E0F4832AAEE3D983A156FDABD3021DA4
SHA-256:	93F61516B7FD3CE8F1E97F25B760BDF62AE58CC7714B559FEFC2C75AD1130804
SHA-512:	7712F8E551D475A9D2FF3BED9992A2B3D53AB01F61DCB7313320181F9EB6B5B84558CCA45AE95150267128C8B228F806F869157B7F4961755076DD83F02E3BDF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@..................-......*......+....../...../.A.....'.X...........,....Rich...................PE..d...D..9.........."................. ..........@..........................................`.......... ............................................... ..x.......l............0...S..`Y..T....................G..(....F..............8G...............................text.............................. ..`.rdata..Pg.......h..................@..@.data...p=...@.......,..............@....pdata..l............D..............@..@.didat..............................@....rsrc...x.... ......................@..@.reloc...S...0...T..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\xnA\dwmapi.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2334720
Entropy (8bit):	3.2895072698111227
Encrypted:	false
SSDEEP:	12288:sVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ZfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	6D84A6C94112D7804EB1CC758C55B2CF
SHA1:	E6FFCE4E0BFDFA2C06617AE9580DB414C9E70920
SHA-256:	3832A03C486433934C446ADFD15C9FE87161C77716797CAE2DAB09B7A14A2EFA
SHA-512:	8700430F0F586309DAD71DF76E928887138D8D06E357E214929D979B416A23F20F71200DAF0347713649A54C41B6F012602229346FA8BEDD9C4C6976ACDEF709
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d. ..DN^.........." ................p..........@..............................#.....@lx}..b...........................................#.&....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\eb42b1a5c308fc11edf1ddbdd25c8486_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	4462
Entropy (8bit):	5.481944559569596
Encrypted:	false
SSDEEP:	48:e+afUydu/etyBs1mM/p2h7Rl071riXrf8I+afUGdrZ4+GGx8u56DgCBnC5gCkHyf:edA/etNWcaj8IdhZ46Z6Xchkm3
MD5:	5BCBC228F6BDC12E0C1A9506C16268C0
SHA1:	E9A3B2AACA5DE93288F2715EEC42C0279833F97D
SHA-256:	D964D2C003C0D595492B8726ABEAA5F4C71DE847E4F263DAD1872FAD6FAF6DE6
SHA-512:	8254B7B248110E0A1F7EB69E3979BBA8B4CFA2AE07A79CB26DFF3D970693F4657281018EEBF45DED66A1BE8FA376F572E2E6C750BF03D38DD4E66721A396618F
Malicious:	false
Reputation:	unknown
Preview:	........................................user.........................................user.....................RSA1.................4........%d..S.\|..Zl...69.3.L....o.....dh..f.Y.N.....A_....t..fS.p.:F.........3l)...a0...,F.Z3....Kk,X....S...M....q........................z..O......a. ..NO..IP........,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ......\|...T.....Q....<.G.v.................. ......\|.sl.\..c..g8.,....FW..S ..T.....u.;......p&.:..h .)W.,. ..K..g.0....8.n..\|.G.sg<MI....x).........{?....U...u.\|Z^....k..3T.F...r..N...1..@.&....%cH.\B.},.4.d.....@.h...xC.....F..2Z.[}....j.'...+..T...[.+.%.A.5....X.Z...q.....vD@....aJ...4.........G......r../\|%....Bb..I-@..Y\|<.."..(.............$C.x.J...S..^70J.$^$.&.8..!.b.!......#.9..8D.qF...D.....4....8.JE.+K#U.\|r..)..}..!..U%.fA.\|.a..&...../.c.k..{..wK...L.U5..G..o...T%7.+.]Q.A._c...=W.......&..!U.....b.X!.nsG..V..Q..eM.O4.g.T.] R.[.Q.....t\|.../....w..N%1W..i.%!O..O.6q....[..z\|.

Static File Info

General
File type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Entropy (8bit):	4.199261302559909
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	yPeVDkBY3n.dll
File size:	2330624
MD5:	2cd9944b4c51630053a486adf9ba7928
SHA1:	fbbe87d4587c694c6b44870bb99e30e1d48d1c06
SHA256:	a92176c5e1216a097c14b387a64e96684497919d0777250897db8896331613ca
SHA512:	3e532df504fe04dd632b9a719827a19e2353d2167860130d0feb7b5f848cab6da07d565b7ee93e346f4c34c62a6ad7504a8c9f82d12303e2a205c297ff1e9bba
SSDEEP:	12288:i5VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1MVedA:i4fP7fWsK5z9A+WGAW+V5SB6Ct4bnbg
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|.

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x140041070
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x5E4E44CC [Thu Feb 20 08:35:24 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6668be91e2c948b183827f040944057f

Entrypoint Preview

Instruction
dec eax
xor eax, eax
dec eax
add eax, 5Ah
dec eax
mov dword ptr [00073D82h], ecx
dec eax
lea ecx, dword ptr [FFFFECABh]
dec eax
mov dword ptr [00073D7Ch], edx
dec eax
add eax, ecx
dec esp
mov dword ptr [00073D92h], ecx
dec esp
mov dword ptr [00073DA3h], ebp
dec esp
mov dword ptr [00073D7Ch], eax
dec esp
mov dword ptr [00073D85h], edi
dec esp
mov dword ptr [00073D86h], esi
dec esp
mov dword ptr [00073D8Fh], esp
dec eax
mov ecx, eax
dec eax
sub ecx, 5Ah
dec eax
mov dword ptr [00073D89h], esi
dec eax
test eax, eax
je 00007FC4B4A62B5Fh
dec eax
mov dword ptr [00073D45h], esp
dec eax
mov dword ptr [00073D36h], ebp
dec eax
mov dword ptr [00073D7Fh], ebx
dec eax
mov dword ptr [00073D70h], edi
dec eax
test eax, eax
je 00007FC4B4A62B3Eh
jmp ecx
dec eax
add edi, ecx
dec eax
mov dword ptr [FFFFEC37h], ecx
dec eax
xor ecx, eax
jmp ecx
retn 0008h
ud2
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebx
dec eax
sub esp, 00000080h
mov eax, F957B016h
mov byte ptr [esp+7Fh], 00000037h
mov edx, dword ptr [esp+78h]
inc ecx
mov eax, edx
inc ecx
or eax, 5D262B0Ch
inc esp
mov dword ptr [esp+78h], eax
dec eax
mov dword ptr [eax+eax+00h], 00000000h

Rich Headers

Programming Language:

[LNK] VS2012 UPD4 build 61030
[ASM] VS2013 UPD2 build 30501
[ C ] VS2012 UPD2 build 60315
[C++] VS2013 UPD4 build 31101
[RES] VS2012 UPD3 build 60610
[LNK] VS2017 v15.5.4 build 25834
[ C ] VS2017 v15.5.4 build 25834
[ASM] VS2010 build 30319
[EXP] VS2015 UPD1 build 23506
[IMP] VS2008 SP1 build 30729
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD2 build 60315
[C++] VS2015 UPD1 build 23506
[ C ] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1f3010	0x45164	.sqcys
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa6390	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc0000	0x468	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc1000	0x2324	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x42000	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x40796	0x41000	False	0.776085486779	data	7.73364605679	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x42000	0x64f2c	0x65000	False	0.702390160891	data	7.86574512659	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa7000	0x178b8	0x18000	False	0.0694580078125	data	3.31515306295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0xbf000	0x12c	0x1000	False	0.06005859375	PEX Binary Archive	0.581723022719	IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc0000	0x880	0x1000	False	0.139892578125	data	1.23838501563	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc1000	0x2324	0x3000	False	0.0498046875	data	4.65321444248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.qkm	0xc4000	0x74a	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.cvjb	0xc5000	0x1e66	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tlmkv	0xc7000	0xbde	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.wucsxe	0xc8000	0x45174	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.fltwtj	0x10e000	0x1267	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tblq	0x110000	0x5a7	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.hcmjm	0x111000	0x45174	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.nagyk	0x157000	0xbde	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.jrucz	0x158000	0x13e	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rnr	0x159000	0x3fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ths	0x15a000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.uuy	0x15b000	0x451c2	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.llcgmp	0x1a1000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.zibji	0x1a2000	0xebe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.nnbdme	0x1a3000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.oxoht	0x1a4000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.poofxn	0x1a5000	0x706	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.yoxffm	0x1a6000	0x2da	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.lbp	0x1a7000	0x1f7	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.cmyjh	0x1a8000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.khlpd	0x1a9000	0x45174	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ksydf	0x1ef000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.jtgc	0x1f0000	0x128f	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ivi	0x1f2000	0x736	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.sqcys	0x1f3000	0x45174	0x46000	False	0.218484933036	data	5.76112633091	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xc00a0	0x370	data	English	United States
RT_MANIFEST	0xc0410	0x56	ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
USER32.dll	LookupIconIdFromDirectoryEx, WaitForInputIdle, GetParent, GetFocus
SETUPAPI.dll	CM_Get_Resource_Conflict_DetailsW
KERNEL32.dll	DeleteCriticalSection, DeleteTimerQueue, TerminateJobObject, GetFileInformationByHandle, GetThreadLocale, GetNamedPipeServerProcessId, GetConsoleFontSize
GDI32.dll	CreateBitmapIndirect, GetPolyFillMode
CRYPT32.dll	CertGetCTLContextProperty
ADVAPI32.dll	AddAccessDeniedObjectAce
SHLWAPI.dll	ChrCmpIW

Exports

Name	Ordinal	Address
??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ	1	0x14002dcb4
??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ	2	0x140012c88
??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ	3	0x140017248
??0?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@QEAA@XZ	4	0x14003a248
??0?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@QEAA@XZ	5	0x1400294d0
??0?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@QEAA@XZ	6	0x1400095c0
??0?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@QEAA@XZ	7	0x14001b664
??0?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@QEAA@XZ	8	0x14001cc94
??0?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@QEAA@XZ	9	0x140013628
??0?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@QEAA@XZ	10	0x14000ce10
??0?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@QEAA@XZ	11	0x14002b3c8
??0?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@QEAA@XZ	12	0x140040d28
??0?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@QEAA@XZ	13	0x1400309f8
??0?$SafeArrayAccessor@H@DirectUI@@QEAA@XZ	14	0x140030420
??0AccessibleButton@DirectUI@@QEAA@$$QEAV01@@Z	15	0x14000a7b4
??0AccessibleButton@DirectUI@@QEAA@AEBV01@@Z	16	0x140003ac0
??0AccessibleButton@DirectUI@@QEAA@XZ	17	0x140014894
??0AnimationStrip@DirectUI@@QEAA@AEBV01@@Z	18	0x14001c928
??0AnimationStrip@DirectUI@@QEAA@XZ	19	0x140006ce4
??0AutoButton@DirectUI@@QEAA@$$QEAV01@@Z	20	0x140018a9c
??0AutoButton@DirectUI@@QEAA@AEBV01@@Z	21	0x140029d30
??0AutoButton@DirectUI@@QEAA@XZ	22	0x14001528c
??0AutoLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z	23	0x14000fbe8
??0AutoThread@DirectUI@@QEAA@XZ	24	0x1400269c8
??0AutoVariant@DirectUI@@QEAA@XZ	25	0x140039778
??0BaseScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	26	0x140024898
??0BaseScrollBar@DirectUI@@QEAA@AEBV01@@Z	27	0x140039480
??0BaseScrollBar@DirectUI@@QEAA@XZ	28	0x14000f028
??0BaseScrollViewer@DirectUI@@QEAA@AEBV01@@Z	29	0x140006de8
??0BaseScrollViewer@DirectUI@@QEAA@XZ	30	0x14001e230
??0Bind@DirectUI@@QEAA@$$QEAV01@@Z	31	0x14000aee4
??0Bind@DirectUI@@QEAA@AEBV01@@Z	32	0x14002b944
??0Bind@DirectUI@@QEAA@XZ	33	0x1400114e4
??0BorderLayout@DirectUI@@QEAA@AEBV01@@Z	34	0x14003cbf8
??0BorderLayout@DirectUI@@QEAA@XZ	35	0x140027034
??0Browser@DirectUI@@QEAA@$$QEAV01@@Z	36	0x14000b248
??0Browser@DirectUI@@QEAA@AEBV01@@Z	37	0x140008644
??0Browser@DirectUI@@QEAA@XZ	38	0x140007324
??0BrowserSelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z	39	0x14003ba6c
??0BrowserSelectionProxy@DirectUI@@QEAA@AEBV01@@Z	40	0x14001c648
??0BrowserSelectionProxy@DirectUI@@QEAA@XZ	41	0x140026ecc
??0Button@DirectUI@@QEAA@AEBV01@@Z	42	0x1400102e4
??0Button@DirectUI@@QEAA@XZ	43	0x14001ead0
??0CCAVI@DirectUI@@QEAA@$$QEAV01@@Z	44	0x140034be4
??0CCAVI@DirectUI@@QEAA@AEBV01@@Z	45	0x140011d10
??0CCAVI@DirectUI@@QEAA@XZ	46	0x1400411b4
??0CCBase@DirectUI@@QEAA@AEBV01@@Z	47	0x14000bdfc
??0CCBase@DirectUI@@QEAA@KPEBG@Z	48	0x1400061f4
??0CCBaseCheckRadioButton@DirectUI@@QEAA@$$QEAV01@@Z	49	0x1400220cc
??0CCBaseCheckRadioButton@DirectUI@@QEAA@AEBV01@@Z	50	0x14002f4b8
??0CCBaseCheckRadioButton@DirectUI@@QEAA@K@Z	51	0x1400308a0
??0CCBaseScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	52	0x1400238e8
??0CCBaseScrollBar@DirectUI@@QEAA@AEBV01@@Z	53	0x14002d118
??0CCBaseScrollBar@DirectUI@@QEAA@K@Z	54	0x140017674
??0CCCheckBox@DirectUI@@QEAA@$$QEAV01@@Z	55	0x140010ff8
??0CCCheckBox@DirectUI@@QEAA@AEBV01@@Z	56	0x14002c604
??0CCCheckBox@DirectUI@@QEAA@K@Z	57	0x14000fbdc
??0CCCommandLink@DirectUI@@QEAA@$$QEAV01@@Z	58	0x140037644
??0CCCommandLink@DirectUI@@QEAA@AEBV01@@Z	59	0x140019a98
??0CCCommandLink@DirectUI@@QEAA@K@Z	60	0x140014b74
??0CCHScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	61	0x140038c98
??0CCHScrollBar@DirectUI@@QEAA@AEBV01@@Z	62	0x14002836c
??0CCHScrollBar@DirectUI@@QEAA@XZ	63	0x140029d40
??0CCListBox@DirectUI@@QEAA@$$QEAV01@@Z	64	0x140010f8c
??0CCListBox@DirectUI@@QEAA@AEBV01@@Z	65	0x140004ed4
??0CCListBox@DirectUI@@QEAA@XZ	66	0x1400264e8
??0CCListView@DirectUI@@QEAA@$$QEAV01@@Z	67	0x14000d59c
??0CCListView@DirectUI@@QEAA@AEBV01@@Z	68	0x1400089b8
??0CCListView@DirectUI@@QEAA@XZ	69	0x14003f33c
??0CCProgressBar@DirectUI@@QEAA@$$QEAV01@@Z	70	0x14001034c
??0CCProgressBar@DirectUI@@QEAA@AEBV01@@Z	71	0x140005d94
??0CCProgressBar@DirectUI@@QEAA@XZ	72	0x140028df8
??0CCPushButton@DirectUI@@QEAA@$$QEAV01@@Z	73	0x14003a6a8
??0CCPushButton@DirectUI@@QEAA@AEBV01@@Z	74	0x14003e3c4
??0CCPushButton@DirectUI@@QEAA@K@Z	75	0x140016fb0
??0CCRadioButton@DirectUI@@QEAA@$$QEAV01@@Z	76	0x140025610
??0CCRadioButton@DirectUI@@QEAA@AEBV01@@Z	77	0x14003a7b8
??0CCRadioButton@DirectUI@@QEAA@XZ	78	0x14002e488
??0CCSysLink@DirectUI@@QEAA@$$QEAV01@@Z	79	0x140036434
??0CCSysLink@DirectUI@@QEAA@AEBV01@@Z	80	0x140036458
??0CCSysLink@DirectUI@@QEAA@XZ	81	0x14000943c
??0CCTrackBar@DirectUI@@QEAA@$$QEAV01@@Z	82	0x1400300cc
??0CCTrackBar@DirectUI@@QEAA@AEBV01@@Z	83	0x140016480
??0CCTrackBar@DirectUI@@QEAA@XZ	84	0x140031938
??0CCTreeView@DirectUI@@QEAA@$$QEAV01@@Z	85	0x14001eac8
??0CCTreeView@DirectUI@@QEAA@AEBV01@@Z	86	0x14002e130
??0CCTreeView@DirectUI@@QEAA@K@Z	87	0x14003b3a0
??0CCVScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	88	0x140033c34
??0CCVScrollBar@DirectUI@@QEAA@AEBV01@@Z	89	0x140028e78
??0CCVScrollBar@DirectUI@@QEAA@XZ	90	0x140028fec
??0CallstackTracker@DirectUI@@QEAA@XZ	91	0x140023f50
??0CheckBoxGlyph@DirectUI@@QEAA@AEBV01@@Z	92	0x140011c70
??0CheckBoxGlyph@DirectUI@@QEAA@XZ	93	0x140036b64
??0ClassInfoBase@DirectUI@@QEAA@AEBV01@@Z	94	0x14003cea4
??0ClassInfoBase@DirectUI@@QEAA@XZ	95	0x140017ddc
??0Clipper@DirectUI@@QEAA@$$QEAV01@@Z	96	0x1400091c4
??0Clipper@DirectUI@@QEAA@AEBV01@@Z	97	0x140024228
??0Clipper@DirectUI@@QEAA@XZ	98	0x14003a1f4
??0Combobox@DirectUI@@QEAA@AEBV01@@Z	99	0x1400215b0
??0Combobox@DirectUI@@QEAA@XZ	100	0x140011ca0
??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z	101	0x140037d7c
??0DCSurface@DirectUI@@QEAA@AEBV01@@Z	102	0x1400071c0
??0DCSurface@DirectUI@@QEAA@PEAUHDC__@@@Z	103	0x1400325dc
??0DUIFactory@DirectUI@@QEAA@PEAUHWND__@@@Z	104	0x14001de40
??0DUIXmlParser@DirectUI@@QEAA@AEBV01@@Z	105	0x14000d488
??0DUIXmlParser@DirectUI@@QEAA@XZ	106	0x140003470
??0DialogElement@DirectUI@@QEAA@$$QEAV01@@Z	107	0x14002dc38
??0DialogElement@DirectUI@@QEAA@AEBV01@@Z	108	0x140011b0c
??0DialogElement@DirectUI@@QEAA@XZ	109	0x14003c378
??0DuiAccessible@DirectUI@@QEAA@XZ	110	0x14000e1e4
??0Edit@DirectUI@@QEAA@AEBV01@@Z	111	0x140001a00
??0Edit@DirectUI@@QEAA@XZ	112	0x14001b0e4
??0Element@DirectUI@@QEAA@AEBV01@@Z	113	0x14003df40
??0Element@DirectUI@@QEAA@XZ	114	0x14000ec00
??0ElementProvider@DirectUI@@QEAA@XZ	115	0x14002b710
??0ElementProxy@DirectUI@@IEAA@XZ	116	0x140032fac
??0ElementProxy@DirectUI@@QEAA@$$QEAV01@@Z	117	0x140039268
??0ElementProxy@DirectUI@@QEAA@AEBV01@@Z	118	0x1400125f4
??0ElementWithHWND@DirectUI@@QEAA@$$QEAV01@@Z	119	0x1400183c8
??0ElementWithHWND@DirectUI@@QEAA@AEBV01@@Z	120	0x14000a818
??0ElementWithHWND@DirectUI@@QEAA@XZ	121	0x14003de10
??0ExpandCollapseProvider@DirectUI@@QEAA@XZ	122	0x1400369ac
??0ExpandCollapseProxy@DirectUI@@QEAA@$$QEAV01@@Z	123	0x14003460c
??0ExpandCollapseProxy@DirectUI@@QEAA@AEBV01@@Z	124	0x140009b58
??0ExpandCollapseProxy@DirectUI@@QEAA@XZ	125	0x140001cfc
??0Expandable@DirectUI@@QEAA@$$QEAV01@@Z	126	0x1400097dc
??0Expandable@DirectUI@@QEAA@AEBV01@@Z	127	0x14002c1f0
??0Expandable@DirectUI@@QEAA@XZ	128	0x14002de24
??0Expando@DirectUI@@QEAA@$$QEAV01@@Z	129	0x14001def0
??0Expando@DirectUI@@QEAA@AEBV01@@Z	130	0x140003884
??0Expando@DirectUI@@QEAA@XZ	131	0x14002c800
??0ExpandoButtonGlyph@DirectUI@@QEAA@AEBV01@@Z	132	0x14002b2dc
??0ExpandoButtonGlyph@DirectUI@@QEAA@XZ	133	0x14001e73c
??0FillLayout@DirectUI@@QEAA@AEBV01@@Z	134	0x14000c75c
??0FillLayout@DirectUI@@QEAA@XZ	135	0x14001b6b8
??0FlowLayout@DirectUI@@QEAA@AEBV01@@Z	136	0x1400238d0
??0FlowLayout@DirectUI@@QEAA@XZ	137	0x140025f88
??0FontCache@DirectUI@@QEAA@$$QEAV01@@Z	138	0x14003a680
??0FontCache@DirectUI@@QEAA@AEBV01@@Z	139	0x140037824
??0FontCache@DirectUI@@QEAA@XZ	140	0x140022794
??0FontCheckOut@DirectUI@@QEAA@PEAVElement@1@PEAUHDC__@@@Z	141	0x1400406c0
??0GridItemProvider@DirectUI@@QEAA@XZ	142	0x14002d2f8
??0GridItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	143	0x140022ac8
??0GridItemProxy@DirectUI@@QEAA@AEBV01@@Z	144	0x14003db68
??0GridItemProxy@DirectUI@@QEAA@XZ	145	0x1400139f4
??0GridLayout@DirectUI@@QEAA@AEBV01@@Z	146	0x14001b520
??0GridLayout@DirectUI@@QEAA@XZ	147	0x14001333c
??0GridProvider@DirectUI@@QEAA@XZ	148	0x14001dc74
??0GridProxy@DirectUI@@QEAA@$$QEAV01@@Z	149	0x140028138
??0GridProxy@DirectUI@@QEAA@AEBV01@@Z	150	0x140041150
??0GridProxy@DirectUI@@QEAA@XZ	151	0x1400118c8
??0HWNDElement@DirectUI@@QEAA@AEBV01@@Z	152	0x1400276f8
??0HWNDElement@DirectUI@@QEAA@XZ	153	0x14002db44
??0HWNDElementAccessible@DirectUI@@QEAA@XZ	154	0x1400026cc
??0HWNDElementProvider@DirectUI@@QEAA@XZ	155	0x14000d6c0
??0HWNDElementProxy@DirectUI@@IEAA@XZ	156	0x14003bbf8
??0HWNDElementProxy@DirectUI@@QEAA@$$QEAV01@@Z	157	0x14001339c
??0HWNDElementProxy@DirectUI@@QEAA@AEBV01@@Z	158	0x14000af28
??0HWNDHost@DirectUI@@QEAA@AEBV01@@Z	159	0x14001347c
??0HWNDHost@DirectUI@@QEAA@XZ	160	0x14001a6c0
??0HWNDHostAccessible@DirectUI@@QEAA@XZ	161	0x140009794
??0HWNDHostClientAccessible@DirectUI@@QEAA@XZ	162	0x140003c88
??0IDataEngine@DirectUI@@QEAA@AEBU01@@Z	163	0x140003df8
??0IDataEngine@DirectUI@@QEAA@XZ	164	0x140035684
??0IDataEntry@DirectUI@@QEAA@AEBU01@@Z	165	0x140028320
??0IDataEntry@DirectUI@@QEAA@XZ	166	0x140032310
??0IProvider@DirectUI@@QEAA@$$QEAV01@@Z	167	0x14002a65c
??0IProvider@DirectUI@@QEAA@AEBV01@@Z	168	0x14001efe0
??0IProvider@DirectUI@@QEAA@XZ	169	0x1400289d4
??0ISBLeak@DirectUI@@QEAA@$$QEAU01@@Z	170	0x14001124c
??0ISBLeak@DirectUI@@QEAA@AEBU01@@Z	171	0x14000a364
??0ISBLeak@DirectUI@@QEAA@XZ	172	0x140040b90
??0IXElementCP@DirectUI@@QEAA@$$QEAV01@@Z	173	0x14000fea0
??0IXElementCP@DirectUI@@QEAA@AEBV01@@Z	174	0x140019e30
??0IXElementCP@DirectUI@@QEAA@XZ	175	0x140009604
??0IXProviderCP@DirectUI@@QEAA@$$QEAV01@@Z	176	0x140028158
??0IXProviderCP@DirectUI@@QEAA@AEBV01@@Z	177	0x140005dd8
??0IXProviderCP@DirectUI@@QEAA@XZ	178	0x1400219c0
??0InvokeHelper@DirectUI@@QEAA@XZ	179	0x1400399d0
??0InvokeProvider@DirectUI@@QEAA@XZ	180	0x1400131f0
??0InvokeProxy@DirectUI@@QEAA@$$QEAV01@@Z	181	0x14002c774
??0InvokeProxy@DirectUI@@QEAA@AEBV01@@Z	182	0x14003a8d8
??0InvokeProxy@DirectUI@@QEAA@XZ	183	0x14000d8e4
??0ItemList@DirectUI@@QEAA@XZ	184	0x140036a40
??0Layout@DirectUI@@QEAA@AEBV01@@Z	185	0x1400083b4
??0Layout@DirectUI@@QEAA@XZ	186	0x14001e198
??0LinkedList@DirectUI@@QEAA@XZ	187	0x1400188e0
??0Macro@DirectUI@@QEAA@$$QEAV01@@Z	188	0x1400149b4
??0Macro@DirectUI@@QEAA@AEBV01@@Z	189	0x14003b788
??0Macro@DirectUI@@QEAA@XZ	190	0x14002b650
??0ModernProgressBar@DirectUI@@QEAA@XZ	191	0x140033cbc
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	192	0x140036cc8
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	193	0x1400301ac
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@XZ	194	0x140036cf8
??0ModernProgressRing@DirectUI@@QEAA@XZ	195	0x140001fbc
??0Movie@DirectUI@@QEAA@AEBV01@@Z	196	0x14003508c
??0Movie@DirectUI@@QEAA@XZ	197	0x14001aec0
??0NativeHWNDHost@DirectUI@@QEAA@AEBV01@@Z	198	0x140034f88
??0NativeHWNDHost@DirectUI@@QEAA@XZ	199	0x14003c0fc
??0Navigator@DirectUI@@QEAA@$$QEAV01@@Z	200	0x140016a58
??0Navigator@DirectUI@@QEAA@AEBV01@@Z	201	0x140036bec
??0Navigator@DirectUI@@QEAA@XZ	202	0x14002f510
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	203	0x14002d948
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z	204	0x140030984
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@XZ	205	0x14000815c
??0NineGridLayout@DirectUI@@QEAA@AEBV01@@Z	206	0x140011e98
??0NineGridLayout@DirectUI@@QEAA@XZ	207	0x140005350
??0PText@DirectUI@@QEAA@AEBV01@@Z	208	0x140019070
??0PText@DirectUI@@QEAA@XZ	209	0x14001eed4
??0Page@DirectUI@@QEAA@$$QEAV01@@Z	210	0x1400382c0
??0Page@DirectUI@@QEAA@AEBV01@@Z	211	0x140033d4c
??0Page@DirectUI@@QEAA@XZ	212	0x14001de74
??0Pages@DirectUI@@QEAA@$$QEAV01@@Z	213	0x14003c97c
??0Pages@DirectUI@@QEAA@AEBV01@@Z	214	0x140038cec
??0Pages@DirectUI@@QEAA@XZ	215	0x1400207ec
??0Progress@DirectUI@@QEAA@AEBV01@@Z	216	0x140016d08
??0Progress@DirectUI@@QEAA@XZ	217	0x140024364
??0ProgressRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	218	0x14001553c
??0ProgressRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	219	0x14000e6b0
??0ProgressRangeValueProxy@DirectUI@@QEAA@XZ	220	0x140035bc8
??0ProviderProxy@DirectUI@@IEAA@XZ	221	0x140018f14
??0ProviderProxy@DirectUI@@QEAA@$$QEAV01@@Z	222	0x14000bcf8
??0ProviderProxy@DirectUI@@QEAA@AEBV01@@Z	223	0x140026010
??0Proxy@DirectUI@@QEAA@AEBV01@@Z	224	0x14002b33c
??0Proxy@DirectUI@@QEAA@XZ	225	0x14002de3c
??0PushButton@DirectUI@@QEAA@$$QEAV01@@Z	226	0x14002ed88
??0PushButton@DirectUI@@QEAA@AEBV01@@Z	227	0x14001494c
??0PushButton@DirectUI@@QEAA@XZ	228	0x14001d960
??0RadioButtonGlyph@DirectUI@@QEAA@AEBV01@@Z	229	0x14001d750
??0RadioButtonGlyph@DirectUI@@QEAA@XZ	230	0x14000490c
??0RangeValueProvider@DirectUI@@QEAA@XZ	231	0x140022888
??0RangeValueProxy@DirectUI@@IEAA@XZ	232	0x1400212f0
??0RangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	233	0x140010144
??0RangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	234	0x14003356c
??0RefPointElement@DirectUI@@QEAA@AEBV01@@Z	235	0x14003b944
??0RefPointElement@DirectUI@@QEAA@XZ	236	0x140030944
??0RefcountBase@DirectUI@@QEAA@XZ	237	0x14001f830
??0RepeatButton@DirectUI@@QEAA@AEBV01@@Z	238	0x140016c28
??0RepeatButton@DirectUI@@QEAA@XZ	239	0x14001332c
??0Repeater@DirectUI@@QEAA@$$QEAV01@@Z	240	0x140037540
??0Repeater@DirectUI@@QEAA@AEBV01@@Z	241	0x14000d5d4
??0Repeater@DirectUI@@QEAA@XZ	242	0x140030dd8
??0ResourceModuleHandles@DirectUI@@QEAA@XZ	243	0x14001df7c
??0RichText@DirectUI@@QEAA@XZ	244	0x1400038c4
??0RowLayout@DirectUI@@QEAA@AEBV01@@Z	245	0x14001f548
??0RowLayout@DirectUI@@QEAA@XZ	246	0x14001c57c
??0ScrollBar@DirectUI@@QEAA@AEBV01@@Z	247	0x14002f388
??0ScrollBar@DirectUI@@QEAA@XZ	248	0x14003bb28
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	249	0x14001b620
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	250	0x1400121ac
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@XZ	251	0x1400025e4
??0ScrollItemProvider@DirectUI@@QEAA@XZ	252	0x14002501c
??0ScrollItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	253	0x1400296ec
??0ScrollItemProxy@DirectUI@@QEAA@AEBV01@@Z	254	0x140028a18
??0ScrollItemProxy@DirectUI@@QEAA@XZ	255	0x14002b810
??0ScrollProvider@DirectUI@@QEAA@XZ	256	0x140039eec
??0ScrollProxy@DirectUI@@QEAA@$$QEAV01@@Z	257	0x14003af78
??0ScrollProxy@DirectUI@@QEAA@AEBV01@@Z	258	0x14000bdd0
??0ScrollProxy@DirectUI@@QEAA@XZ	259	0x140031570
??0ScrollViewer@DirectUI@@QEAA@AEBV01@@Z	260	0x1400349c0
??0ScrollViewer@DirectUI@@QEAA@XZ	261	0x140015bd4
??0SelectionItemProvider@DirectUI@@QEAA@XZ	262	0x14001a648
??0SelectionItemProxy@DirectUI@@IEAA@XZ	263	0x14000d50c
??0SelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	264	0x140028afc
??0SelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z	265	0x140015f80
??0SelectionProvider@DirectUI@@QEAA@XZ	266	0x14003d870
??0SelectionProxy@DirectUI@@IEAA@XZ	267	0x140039994
??0SelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z	268	0x1400398e0
??0SelectionProxy@DirectUI@@QEAA@AEBV01@@Z	269	0x140004078
??0Selector@DirectUI@@QEAA@AEBV01@@Z	270	0x14000ad68
??0Selector@DirectUI@@QEAA@XZ	271	0x14003ce14
??0SelectorNoDefault@DirectUI@@QEAA@$$QEAV01@@Z	272	0x140013494
??0SelectorNoDefault@DirectUI@@QEAA@AEBV01@@Z	273	0x140027944
??0SelectorNoDefault@DirectUI@@QEAA@XZ	274	0x14001bc00
??0SelectorSelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	275	0x140036080
??0SelectorSelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z	276	0x140038098
??0SelectorSelectionItemProxy@DirectUI@@QEAA@XZ	277	0x140022174
??0SelectorSelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z	278	0x14002d1cc
??0SelectorSelectionProxy@DirectUI@@QEAA@AEBV01@@Z	279	0x140011d6c
??0SelectorSelectionProxy@DirectUI@@QEAA@XZ	280	0x14003fd6c
??0ShellBorderLayout@DirectUI@@QEAA@AEBV01@@Z	281	0x14003dbf4
??0ShellBorderLayout@DirectUI@@QEAA@XZ	282	0x14003eebc
??0StyleSheet@DirectUI@@QEAA@$$QEAV01@@Z	283	0x140025e18
??0StyleSheet@DirectUI@@QEAA@AEBV01@@Z	284	0x14003aaf0
??0StyleSheet@DirectUI@@QEAA@XZ	285	0x140006734
??0StyledScrollViewer@DirectUI@@QEAA@AEBV01@@Z	286	0x14003d5d8
??0StyledScrollViewer@DirectUI@@QEAA@XZ	287	0x1400012c4
??0Surface@DirectUI@@QEAA@AEBV01@@Z	288	0x140035250
??0Surface@DirectUI@@QEAA@XZ	289	0x14003b9b0
??0TableItemProvider@DirectUI@@QEAA@XZ	290	0x14002cb84
??0TableItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	291	0x14003b37c
??0TableItemProxy@DirectUI@@QEAA@AEBV01@@Z	292	0x140029890
??0TableItemProxy@DirectUI@@QEAA@XZ	293	0x140013f84
??0TableLayout@DirectUI@@QEAA@AEBV01@@Z	294	0x14001b93c
??0TableLayout@DirectUI@@QEAA@XZ	295	0x140028ad4
??0TableProvider@DirectUI@@QEAA@XZ	296	0x14002aed4
??0TableProxy@DirectUI@@QEAA@$$QEAV01@@Z	297	0x14001ee94
??0TableProxy@DirectUI@@QEAA@AEBV01@@Z	298	0x14000cdb4
??0TableProxy@DirectUI@@QEAA@XZ	299	0x1400328d4
??0TaskPage@DirectUI@@QEAA@AEBV01@@Z	300	0x14002d4ec
??0TaskPage@DirectUI@@QEAA@XZ	301	0x140007888
??0TextGraphic@DirectUI@@QEAA@$$QEAV01@@Z	302	0x140033664
??0TextGraphic@DirectUI@@QEAA@AEBV01@@Z	303	0x14002cb70
??0TextGraphic@DirectUI@@QEAA@XZ	304	0x1400105f0
??0Thumb@DirectUI@@QEAA@AEBV01@@Z	305	0x140015364
??0Thumb@DirectUI@@QEAA@XZ	306	0x140039f18
??0ToggleProvider@DirectUI@@QEAA@XZ	307	0x140014010
??0ToggleProxy@DirectUI@@QEAA@$$QEAV01@@Z	308	0x1400149b0
??0ToggleProxy@DirectUI@@QEAA@AEBV01@@Z	309	0x1400392ec
??0ToggleProxy@DirectUI@@QEAA@XZ	310	0x140034bf0
??0TouchButton@DirectUI@@QEAA@XZ	311	0x14003eadc
??0TouchCheckBox@DirectUI@@QEAA@XZ	312	0x14002fcf0
??0TouchCheckBoxGlyph@DirectUI@@QEAA@XZ	313	0x140007a30
??0TouchCommandButton@DirectUI@@QEAA@XZ	314	0x14000abcc
??0TouchEdit2@DirectUI@@QEAA@XZ	315	0x14003787c
??0TouchHWNDElement@DirectUI@@QEAA@XZ	316	0x140004bb0
??0TouchHyperLink@DirectUI@@QEAA@XZ	317	0x14002cfe4
??0TouchRepeatButton@DirectUI@@QEAA@XZ	318	0x14001c7d0
??0TouchScrollBar@DirectUI@@QEAA@XZ	319	0x1400230c4
??0TouchSelect@DirectUI@@QEAA@XZ	320	0x14003d178
??0TouchSelectItem@DirectUI@@QEAA@XZ	321	0x140013e5c
??0UnknownElement@DirectUI@@QEAA@AEBV01@@Z	322	0x14003f620
??0UnknownElement@DirectUI@@QEAA@XZ	323	0x140027958
??0ValueProvider@DirectUI@@QEAA@XZ	324	0x14002c380
??0ValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	325	0x14002980c
??0ValueProxy@DirectUI@@QEAA@AEBV01@@Z	326	0x14001d630
??0ValueProxy@DirectUI@@QEAA@XZ	327	0x14000c4a8
??0VerticalFlowLayout@DirectUI@@QEAA@AEBV01@@Z	328	0x14002d574
??0VerticalFlowLayout@DirectUI@@QEAA@XZ	329	0x140011724
??0Viewer@DirectUI@@QEAA@AEBV01@@Z	330	0x14000d664
??0Viewer@DirectUI@@QEAA@XZ	331	0x14000fc88
??0XBaby@DirectUI@@QEAA@AEBV01@@Z	332	0x140010a68
??0XBaby@DirectUI@@QEAA@XZ	333	0x14000bd9c
??0XElement@DirectUI@@QEAA@AEBV01@@Z	334	0x140031d88
??0XElement@DirectUI@@QEAA@XZ	335	0x1400268b4
??0XHost@DirectUI@@QEAA@XZ	336	0x140015e00
??0XProvider@DirectUI@@QEAA@AEBV01@@Z	337	0x14000bafc
??0XProvider@DirectUI@@QEAA@XZ	338	0x14003f5f4
??0XResourceProvider@DirectUI@@QEAA@$$QEAV01@@Z	339	0x140006ef4
??0XResourceProvider@DirectUI@@QEAA@AEBV01@@Z	340	0x140025bb8
??0XResourceProvider@DirectUI@@QEAA@XZ	341	0x140040940
??1?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@UEAA@XZ	342	0x14000a40c
??1?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@UEAA@XZ	343	0x14002600c
??1?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@UEAA@XZ	344	0x140004c10
??1?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@UEAA@XZ	345	0x140003638
??1?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@UEAA@XZ	346	0x140040f70
??1?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@UEAA@XZ	347	0x1400196c8
??1?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@UEAA@XZ	348	0x1400335b0
??1?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@UEAA@XZ	349	0x140019000
??1?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@UEAA@XZ	350	0x14003800c
??1?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@UEAA@XZ	351	0x14001b618
??1?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@UEAA@XZ	352	0x140016fd0
??1?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@UEAA@XZ	353	0x140032b44
??1?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@UEAA@XZ	354	0x140016880
??1?$SafeArrayAccessor@H@DirectUI@@QEAA@XZ	355	0x14002ccc4
??1AccessibleButton@DirectUI@@UEAA@XZ	356	0x140037bd4
??1AnimationStrip@DirectUI@@UEAA@XZ	357	0x1400039f4
??1AutoButton@DirectUI@@UEAA@XZ	358	0x14001859c
??1AutoLock@DirectUI@@QEAA@XZ	359	0x14000d9b8
??1AutoThread@DirectUI@@QEAA@XZ	360	0x140023b28
??1AutoVariant@DirectUI@@QEAA@XZ	361	0x140023208
??1BaseScrollViewer@DirectUI@@UEAA@XZ	362	0x14000db58
??1Bind@DirectUI@@UEAA@XZ	363	0x14003d800
??1BorderLayout@DirectUI@@UEAA@XZ	364	0x140026a00
??1Browser@DirectUI@@UEAA@XZ	365	0x14001edf0
??1Button@DirectUI@@UEAA@XZ	366	0x14001b8d8
??1CCAVI@DirectUI@@UEAA@XZ	367	0x14000ca1c
??1CCBase@DirectUI@@UEAA@XZ	368	0x140013f60
??1CCBaseCheckRadioButton@DirectUI@@UEAA@XZ	369	0x14002a598
??1CCBaseScrollBar@DirectUI@@UEAA@XZ	370	0x140026e10
??1CCCheckBox@DirectUI@@UEAA@XZ	371	0x1400132e4
??1CCCommandLink@DirectUI@@UEAA@XZ	372	0x1400247cc
??1CCHScrollBar@DirectUI@@UEAA@XZ	373	0x140006a9c
??1CCListBox@DirectUI@@UEAA@XZ	374	0x140030834
??1CCListView@DirectUI@@UEAA@XZ	375	0x140026bdc
??1CCProgressBar@DirectUI@@UEAA@XZ	376	0x14001fbb0
??1CCPushButton@DirectUI@@UEAA@XZ	377	0x14000b2f0
??1CCRadioButton@DirectUI@@UEAA@XZ	378	0x14002158c
??1CCSysLink@DirectUI@@UEAA@XZ	379	0x14000f6f8
??1CCTrackBar@DirectUI@@UEAA@XZ	380	0x14001fb58
??1CCTreeView@DirectUI@@UEAA@XZ	381	0x1400099f4
??1CCVScrollBar@DirectUI@@UEAA@XZ	382	0x140015568
??1CallstackTracker@DirectUI@@QEAA@XZ	383	0x140013b34
??1CheckBoxGlyph@DirectUI@@UEAA@XZ	384	0x140022d68
??1ClassInfoBase@DirectUI@@UEAA@XZ	385	0x1400275d0
??1Clipper@DirectUI@@UEAA@XZ	386	0x14003e9e4
??1Combobox@DirectUI@@UEAA@XZ	387	0x1400042ac
??1CritSecLock@DirectUI@@QEAA@XZ	388	0x14002b920
??1DCSurface@DirectUI@@UEAA@XZ	389	0x140039d68
??1DUIFactory@DirectUI@@QEAA@XZ	390	0x14003874c
??1DUIXmlParser@DirectUI@@UEAA@XZ	391	0x14001b7b0
??1DialogElement@DirectUI@@UEAA@XZ	392	0x140034f84
??1DuiAccessible@DirectUI@@UEAA@XZ	393	0x14000cad0
??1Edit@DirectUI@@UEAA@XZ	394	0x140041784
??1Element@DirectUI@@UEAA@XZ	395	0x14001d5cc
??1ElementProvider@DirectUI@@UEAA@XZ	396	0x1400040a8
??1ElementWithHWND@DirectUI@@UEAA@XZ	397	0x140013424
??1ExpandCollapseProvider@DirectUI@@UEAA@XZ	398	0x1400234a8
??1Expandable@DirectUI@@UEAA@XZ	399	0x140028b6c
??1Expando@DirectUI@@UEAA@XZ	400	0x14002607c
??1ExpandoButtonGlyph@DirectUI@@UEAA@XZ	401	0x140027ed0
??1FillLayout@DirectUI@@UEAA@XZ	402	0x14003273c
??1FlowLayout@DirectUI@@UEAA@XZ	403	0x1400263cc
??1FontCheckOut@DirectUI@@QEAA@XZ	404	0x14003a888
??1GridItemProvider@DirectUI@@UEAA@XZ	405	0x140003c04
??1GridLayout@DirectUI@@UEAA@XZ	406	0x1400113f4
??1GridProvider@DirectUI@@UEAA@XZ	407	0x1400255e0
??1HWNDElement@DirectUI@@UEAA@XZ	408	0x14000fb68
??1HWNDElementAccessible@DirectUI@@UEAA@XZ	409	0x14000d8ac
??1HWNDElementProvider@DirectUI@@UEAA@XZ	410	0x14000768c
??1HWNDHost@DirectUI@@UEAA@XZ	411	0x140033ac4
??1HWNDHostAccessible@DirectUI@@UEAA@XZ	412	0x14001f0b4
??1HWNDHostClientAccessible@DirectUI@@UEAA@XZ	413	0x14002f13c
??1IDataEngine@DirectUI@@UEAA@XZ	414	0x140026488
??1IDataEntry@DirectUI@@UEAA@XZ	415	0x14000a0c4
??1InvokeHelper@DirectUI@@UEAA@XZ	416	0x1400174b8
??1InvokeProvider@DirectUI@@UEAA@XZ	417	0x14002f068
??1ItemList@DirectUI@@UEAA@XZ	418	0x140035320
??1Layout@DirectUI@@UEAA@XZ	419	0x14000b114
??1LinkedList@DirectUI@@QEAA@XZ	420	0x1400221c4
??1Macro@DirectUI@@UEAA@XZ	421	0x14003f950
??1ModernProgressBar@DirectUI@@UEAA@XZ	422	0x14001921c
??1ModernProgressRing@DirectUI@@UEAA@XZ	423	0x140032e90
??1Movie@DirectUI@@UEAA@XZ	424	0x14002d4b8
??1NativeHWNDHost@DirectUI@@UEAA@XZ	425	0x14002a840
??1Navigator@DirectUI@@UEAA@XZ	426	0x1400281c4
??1NineGridLayout@DirectUI@@UEAA@XZ	427	0x14001d37c
??1PText@DirectUI@@UEAA@XZ	428	0x140008884
??1Page@DirectUI@@UEAA@XZ	429	0x140041170
??1Pages@DirectUI@@UEAA@XZ	430	0x140040180
??1Progress@DirectUI@@UEAA@XZ	431	0x14003f68c
??1Proxy@DirectUI@@UEAA@XZ	432	0x140015548
??1PushButton@DirectUI@@UEAA@XZ	433	0x14000f58c
??1RadioButtonGlyph@DirectUI@@UEAA@XZ	434	0x140021e60
??1RangeValueProvider@DirectUI@@UEAA@XZ	435	0x1400087e0
??1RefPointElement@DirectUI@@UEAA@XZ	436	0x14003e9ec
??1RefcountBase@DirectUI@@UEAA@XZ	437	0x140021208
??1RepeatButton@DirectUI@@UEAA@XZ	438	0x14002ad14
??1Repeater@DirectUI@@UEAA@XZ	439	0x140017560
??1ResourceModuleHandles@DirectUI@@QEAA@XZ	440	0x14003a330
??1RichText@DirectUI@@UEAA@XZ	441	0x140022e0c
??1RowLayout@DirectUI@@UEAA@XZ	442	0x140039874
??1ScrollBar@DirectUI@@UEAA@XZ	443	0x140034a74
??1ScrollItemProvider@DirectUI@@UEAA@XZ	444	0x1400297dc
??1ScrollProvider@DirectUI@@UEAA@XZ	445	0x140008f60
??1ScrollViewer@DirectUI@@UEAA@XZ	446	0x14003bfe8
??1SelectionItemProvider@DirectUI@@UEAA@XZ	447	0x14003f85c
??1SelectionProvider@DirectUI@@UEAA@XZ	448	0x14000eb5c
??1Selector@DirectUI@@UEAA@XZ	449	0x14002a808
??1SelectorNoDefault@DirectUI@@UEAA@XZ	450	0x14003ff60
??1ShellBorderLayout@DirectUI@@UEAA@XZ	451	0x140038704
??1StyledScrollViewer@DirectUI@@UEAA@XZ	452	0x140002c44
??1Surface@DirectUI@@UEAA@XZ	453	0x140022090
??1TableItemProvider@DirectUI@@UEAA@XZ	454	0x140014274
??1TableLayout@DirectUI@@UEAA@XZ	455	0x14003f320
??1TableProvider@DirectUI@@UEAA@XZ	456	0x140034a88
??1TaskPage@DirectUI@@UEAA@XZ	457	0x14003eaf8
??1TextGraphic@DirectUI@@UEAA@XZ	458	0x14001e6d0
??1Thumb@DirectUI@@UEAA@XZ	459	0x140030654
??1ToggleProvider@DirectUI@@UEAA@XZ	460	0x140015c48
??1TouchButton@DirectUI@@UEAA@XZ	461	0x140005498
??1TouchCheckBox@DirectUI@@UEAA@XZ	462	0x14004021c
??1TouchCheckBoxGlyph@DirectUI@@UEAA@XZ	463	0x14002d3fc
??1TouchHWNDElement@DirectUI@@UEAA@XZ	464	0x14000da54
??1TouchHyperLink@DirectUI@@UEAA@XZ	465	0x140030e8c
??1TouchScrollBar@DirectUI@@UEAA@XZ	466	0x1400091f4
??1TouchSelect@DirectUI@@UEAA@XZ	467	0x14001e5c4
??1TouchSelectItem@DirectUI@@UEAA@XZ	468	0x14000ab9c
??1UnknownElement@DirectUI@@UEAA@XZ	469	0x140014ba8
??1ValueProvider@DirectUI@@UEAA@XZ	470	0x140007b3c
??1VerticalFlowLayout@DirectUI@@UEAA@XZ	471	0x1400229ec
??1Viewer@DirectUI@@UEAA@XZ	472	0x14003e170
??1XBaby@DirectUI@@UEAA@XZ	473	0x14003837c
??1XElement@DirectUI@@UEAA@XZ	474	0x140013fe4
??1XHost@DirectUI@@QEAA@XZ	475	0x14000ea98
??1XProvider@DirectUI@@UEAA@XZ	476	0x140041134
??4?$FunctionDefinition@H@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	477	0x140030d3c
??4?$FunctionDefinition@H@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	478	0x140023704
??4?$FunctionDefinition@K@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	479	0x140012890
??4?$FunctionDefinition@K@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	480	0x14002e5f4
??4?$FunctionDefinition@PEAVValue@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	481	0x14001d438
??4?$FunctionDefinition@PEAVValue@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	482	0x14001fd3c
??4?$FunctionDefinition@UScaledRECT@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	483	0x14001f754
??4?$FunctionDefinition@UScaledRECT@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	484	0x140023860
??4?$FunctionDefinition@UScaledSIZE@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	485	0x14001fc74
??4?$FunctionDefinition@UScaledSIZE@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	486	0x14002d340
??4ACCESSIBLEROLE@AccessibleButton@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	487	0x140030fd8
??4ACCESSIBLEROLE@AccessibleButton@DirectUI@@QEAAAEAU012@AEBU012@@Z	488	0x14003f848
??4AccessibleButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	489	0x14003b890
??4AccessibleButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	490	0x140001be4
??4AnimationStrip@DirectUI@@QEAAAEAV01@AEBV01@@Z	491	0x140003ac4
??4AutoButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	492	0x14000d268
??4AutoButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	493	0x1400043b0
??4AutoLock@DirectUI@@QEAAAEAV01@AEBV01@@Z	494	0x14003a34c
??4AutoThread@DirectUI@@QEAAAEAV01@AEBV01@@Z	495	0x140038418
??4AutoVariant@DirectUI@@QEAAAEAV01@AEBV01@@Z	496	0x140020c30
??4BaseScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	497	0x1400119a8
??4BaseScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	498	0x140025690
??4BaseScrollViewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	499	0x140023de8
??4Bind@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	500	0x14002bbf0
??4Bind@DirectUI@@QEAAAEAV01@AEBV01@@Z	501	0x1400103bc
??4BorderLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	502	0x140010884
??4Browser@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	503	0x140033294
??4Browser@DirectUI@@QEAAAEAV01@AEBV01@@Z	504	0x14001a328
??4BrowserSelectionProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	505	0x140005fe4
??4BrowserSelectionProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	506	0x14000d0f0
??4Button@DirectUI@@QEAAAEAV01@AEBV01@@Z	507	0x140007ec4
??4CCAVI@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	508	0x140017248
??4CCAVI@DirectUI@@QEAAAEAV01@AEBV01@@Z	509	0x14003bccc
??4CCBase@DirectUI@@QEAAAEAV01@AEBV01@@Z	510	0x140035b2c
??4CCBaseCheckRadioButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	511	0x1400304a0
??4CCBaseCheckRadioButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	512	0x140019c58
??4CCBaseScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	513	0x140040cf8
??4CCBaseScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	514	0x140030594
??4CCCheckBox@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	515	0x14004126c
??4CCCheckBox@DirectUI@@QEAAAEAV01@AEBV01@@Z	516	0x140040970
??4CCCommandLink@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	517	0x14001fb3c
??4CCCommandLink@DirectUI@@QEAAAEAV01@AEBV01@@Z	518	0x140005d14
??4CCHScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	519	0x14001a330
??4CCHScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	520	0x14001b038
??4CCListBox@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	521	0x14000d2f8
??4CCListBox@DirectUI@@QEAAAEAV01@AEBV01@@Z	522	0x140034458
??4CCListView@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	523	0x1400229d8
??4CCListView@DirectUI@@QEAAAEAV01@AEBV01@@Z	524	0x14001867c
??4CCProgressBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	525	0x14001e420
??4CCProgressBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	526	0x1400189bc
??4CCPushButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	527	0x140002320
??4CCPushButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	528	0x140032e4c
??4CCRadioButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	529	0x14002be74
??4CCRadioButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	530	0x1400190b4
??4CCSysLink@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	531	0x140013db4
??4CCSysLink@DirectUI@@QEAAAEAV01@AEBV01@@Z	532	0x14001ed24
??4CCTrackBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	533	0x14001f1f0
??4CCTrackBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	534	0x140036a54
??4CCTreeView@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	535	0x14000265c
??4CCTreeView@DirectUI@@QEAAAEAV01@AEBV01@@Z	536	0x14000a6a4
??4CCVScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	537	0x140017e84
??4CCVScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	538	0x140005cec
??4CallstackTracker@DirectUI@@QEAAAEAV01@AEBV01@@Z	539	0x140031c38
??4CheckBoxGlyph@DirectUI@@QEAAAEAV01@AEBV01@@Z	540	0x140005020
??4ClassInfoBase@DirectUI@@QEAAAEAV01@AEBV01@@Z	541	0x14000b0dc
??4Clipper@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	542	0x1400056e0
??4Clipper@DirectUI@@QEAAAEAV01@AEBV01@@Z	543	0x140032bec
??4Combobox@DirectUI@@QEAAAEAV01@AEBV01@@Z	544	0x1400175b0
??4CritSecLock@DirectUI@@QEAAAEAV01@AEBV01@@Z	545	0x1400395f4
??4DCSurface@DirectUI@@QEAAAEAV01@AEBV01@@Z	546	0x140037d34
??4DUIFactory@DirectUI@@QEAAAEAV01@AEBV01@@Z	547	0x14000bc48
??4DUIXmlParser@DirectUI@@QEAAAEAV01@AEBV01@@Z	548	0x14000ff64
??4DialogElement@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	549	0x140036540
??4DialogElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	550	0x1400023e4
??4DialogElementCore@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	551	0x14003a3e8
??4DialogElementCore@DirectUI@@QEAAAEAV01@AEBV01@@Z	552	0x140020334
??4DuiNavigate@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	553	0x14000a4bc
??4DuiNavigate@DirectUI@@QEAAAEAV01@AEBV01@@Z	554	0x140037b54
??4Edit@DirectUI@@QEAAAEAV01@AEBV01@@Z	555	0x14001c364
??4Element@DirectUI@@QEAAAEAV01@AEBV01@@Z	556	0x140003d8c
??4ElementProviderManager@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	557	0x140002f78
??4ElementProviderManager@DirectUI@@QEAAAEAV01@AEBV01@@Z	558	0x14002b1d8
??4ElementProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	559	0x1400126f4
??4ElementProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	560	0x14002c0ac
??4ElementWithHWND@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	561	0x140020918
??4ElementWithHWND@DirectUI@@QEAAAEAV01@AEBV01@@Z	562	0x140004660
??4EventManager@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	563	0x140031030
??4EventManager@DirectUI@@QEAAAEAV01@AEBV01@@Z	564	0x14002bd8c
??4ExpandCollapseProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	565	0x140004214
??4ExpandCollapseProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	566	0x140011f00
??4Expandable@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	567	0x14000ed28
??4Expandable@DirectUI@@QEAAAEAV01@AEBV01@@Z	568	0x140008f6c
??4Expando@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	569	0x14003e57c
??4Expando@DirectUI@@QEAAAEAV01@AEBV01@@Z	570	0x140009ad4
??4ExpandoButtonGlyph@DirectUI@@QEAAAEAV01@AEBV01@@Z	571	0x14001e574
??4Expression@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	572	0x14001fb50
??4Expression@DirectUI@@QEAAAEAV01@AEBV01@@Z	573	0x140040ae8
??4FillLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	574	0x14003c8b8
??4FlowLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	575	0x140018eb4
??4FontCache@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	576	0x14002edd8
??4FontCache@DirectUI@@QEAAAEAV01@AEBV01@@Z	577	0x140007a84
??4FontCheckOut@DirectUI@@QEAAAEAV01@AEBV01@@Z	578	0x140016dd0
??4GridItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	579	0x140040cf4
??4GridItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	580	0x140037a6c
??4GridLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	581	0x140037dbc
??4GridProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	582	0x1400158cc
??4GridProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	583	0x140038bf0
??4HWNDElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	584	0x14000aee0
??4HWNDElementProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	585	0x14002b9a0
??4HWNDElementProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	586	0x14000b62c
??4HWNDHost@DirectUI@@QEAAAEAV01@AEBV01@@Z	587	0x14000cc90
??4IDataEngine@DirectUI@@QEAAAEAU01@AEBU01@@Z	588	0x140010f24
??4IDataEntry@DirectUI@@QEAAAEAU01@AEBU01@@Z	589	0x14001f3c4
??4IProvider@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	590	0x14002d56c
??4IProvider@DirectUI@@QEAAAEAV01@AEBV01@@Z	591	0x140038c74
??4ISBLeak@DirectUI@@QEAAAEAU01@$$QEAU01@@Z	592	0x14001077c
??4ISBLeak@DirectUI@@QEAAAEAU01@AEBU01@@Z	593	0x14001c708
??4IXElementCP@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	594	0x14001e474
??4IXElementCP@DirectUI@@QEAAAEAV01@AEBV01@@Z	595	0x14003a114
??4IXProviderCP@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	596	0x14003f780
??4IXProviderCP@DirectUI@@QEAAAEAV01@AEBV01@@Z	597	0x140033a40
??4InvokeManager@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	598	0x1400041a0
??4InvokeManager@DirectUI@@QEAAAEAV01@AEBV01@@Z	599	0x14000b5d8
??4InvokeProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	600	0x14001ef8c
??4InvokeProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	601	0x140004b98
??4Layout@DirectUI@@QEAAAEAV01@AEBV01@@Z	602	0x140039678
??4LinkedList@DirectUI@@QEAAAEAV01@AEBV01@@Z	603	0x1400168a4
??4LinkedListNode@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	604	0x14003141c
??4LinkedListNode@DirectUI@@QEAAAEAV01@AEBV01@@Z	605	0x140037ec0
??4Macro@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	606	0x140007164
??4Macro@DirectUI@@QEAAAEAV01@AEBV01@@Z	607	0x14002313c
??4ModernProgressBarRangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	608	0x140017598
??4ModernProgressBarRangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	609	0x140021a5c
??4Movie@DirectUI@@QEAAAEAV01@AEBV01@@Z	610	0x1400272c0
??4NativeHWNDHost@DirectUI@@QEAAAEAV01@AEBV01@@Z	611	0x1400040c0
??4NavReference@DirectUI@@QEAAAEAU01@$$QEAU01@@Z	612	0x140040670
??4NavReference@DirectUI@@QEAAAEAU01@AEBU01@@Z	613	0x14001fbd0
??4NavScoring@DirectUI@@QEAAAEAU01@$$QEAU01@@Z	614	0x140023bb4
??4NavScoring@DirectUI@@QEAAAEAU01@AEBU01@@Z	615	0x14003f654
??4Navigator@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	616	0x140025460
??4Navigator@DirectUI@@QEAAAEAV01@AEBV01@@Z	617	0x1400097e8
??4NavigatorSelectionItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	618	0x140027a00
??4NavigatorSelectionItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	619	0x14000911c
??4NineGridLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	620	0x14000956c
??4PText@DirectUI@@QEAAAEAV01@AEBV01@@Z	621	0x14000a834
??4PVLAnimation@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	622	0x140016de0
??4PVLAnimation@DirectUI@@QEAAAEAV01@AEBV01@@Z	623	0x14000a3dc
??4Page@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	624	0x14003025c
??4Page@DirectUI@@QEAAAEAV01@AEBV01@@Z	625	0x14000d3c4
??4Pages@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	626	0x14000eaf8
??4Pages@DirectUI@@QEAAAEAV01@AEBV01@@Z	627	0x140022a6c
??4Progress@DirectUI@@QEAAAEAV01@AEBV01@@Z	628	0x140040690
??4ProgressRangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	629	0x14001ff10
??4ProgressRangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	630	0x140036d08
??4ProviderProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	631	0x14000783c
??4ProviderProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	632	0x14000d4f8
??4Proxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	633	0x14001ead8
??4PushButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	634	0x140015bf0
??4PushButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	635	0x140011c2c
??4RadioButtonGlyph@DirectUI@@QEAAAEAV01@AEBV01@@Z	636	0x14000576c
??4RangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	637	0x14001b134
??4RangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	638	0x14003a7f0
??4RefPointElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	639	0x1400206d0
??4RepeatButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	640	0x14003a738
??4Repeater@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	641	0x14001d7ac
??4Repeater@DirectUI@@QEAAAEAV01@AEBV01@@Z	642	0x140009ea8
??4ResourceModuleHandles@DirectUI@@QEAAAEAV01@AEBV01@@Z	643	0x1400386b0
??4RowLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	644	0x140020ddc
??4Schema@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	645	0x140004c4c
??4Schema@DirectUI@@QEAAAEAV01@AEBV01@@Z	646	0x1400141c8
??4ScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	647	0x1400099b0
??4ScrollBarRangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	648	0x14001dc84
??4ScrollBarRangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	649	0x14000a004
??4ScrollItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	650	0x140034fa8
??4ScrollItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	651	0x140010ed8
??4ScrollProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	652	0x14001ef88
??4ScrollProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	653	0x14001c4bc
??4ScrollViewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	654	0x14000cc84
??4SelectionItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	655	0x14000bfac
??4SelectionItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	656	0x14001097c
??4SelectionProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	657	0x1400092b0
??4SelectionProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	658	0x1400348a4
??4Selector@DirectUI@@QEAAAEAV01@AEBV01@@Z	659	0x140021230
??4SelectorNoDefault@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	660	0x140022c2c
??4SelectorNoDefault@DirectUI@@QEAAAEAV01@AEBV01@@Z	661	0x1400097a4
??4SelectorSelectionItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	662	0x14003d454
??4SelectorSelectionItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	663	0x1400046f0
??4SelectorSelectionProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	664	0x140025c48
??4SelectorSelectionProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	665	0x14004070c
??4ShellBorderLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	666	0x14003d8f4
??4StyleSheet@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	667	0x1400043e0
??4StyleSheet@DirectUI@@QEAAAEAV01@AEBV01@@Z	668	0x14002a580
??4StyledScrollViewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	669	0x140029ef4
??4Surface@DirectUI@@QEAAAEAV01@AEBV01@@Z	670	0x14003c9a0
??4TableItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	671	0x14001e038
??4TableItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	672	0x140012088
??4TableLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	673	0x140033eac
??4TableProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	674	0x1400271d0
??4TableProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	675	0x14002f588
??4TaskPage@DirectUI@@QEAAAEAV01@AEBV01@@Z	676	0x140015cdc
??4TextGraphic@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	677	0x140010ad4
??4TextGraphic@DirectUI@@QEAAAEAV01@AEBV01@@Z	678	0x140028604
??4Thumb@DirectUI@@QEAAAEAV01@AEBV01@@Z	679	0x140012280
??4ToggleProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	680	0x140034c24
??4ToggleProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	681	0x140004d10
??4UnknownElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	682	0x140020338
??4Value@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	683	0x140009588
??4Value@DirectUI@@QEAAAEAV01@AEBV01@@Z	684	0x140033304
??4ValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	685	0x140006308
??4ValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	686	0x1400398d8
??4VerticalFlowLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	687	0x140038e00
??4Viewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	688	0x14002c924
??4XBaby@DirectUI@@QEAAAEAV01@AEBV01@@Z	689	0x1400199f8
??4XElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	690	0x140039020
??4XHost@DirectUI@@QEAAAEAV01@AEBV01@@Z	691	0x14003902c
??4XProvider@DirectUI@@QEAAAEAV01@AEBV01@@Z	692	0x14001b3f0
??4XResourceProvider@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	693	0x14001402c
??4XResourceProvider@DirectUI@@QEAAAEAV01@AEBV01@@Z	694	0x140036978
??B?$SafeArrayAccessor@H@DirectUI@@QEAAPEAHXZ	695	0x14002db90
??BTaskPage@DirectUI@@QEAAPEAU_PSP@@XZ	696	0x140015b8c
??_7?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@6BIProvider@1@@	697	0x140008bec
??_7?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@6BRefcountBase@1@@	698	0x140014b80
??_7?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@6BIProvider@1@@	699	0x14001a764
??_7?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@6BRefcountBase@1@@	700	0x14000416c
??_7?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@6BIProvider@1@@	701	0x14002d554
??_7?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@6BRefcountBase@1@@	702	0x14001811c
??_7?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@6BIProvider@1@@	703	0x140006474
??_7?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@6BRefcountBase@1@@	704	0x14001299c
??_7?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@6BIProvider@1@@	705	0x140030248
??_7?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@6BRefcountBase@1@@	706	0x14002ca3c
??_7?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@6BIProvider@1@@	707	0x14000f1a4
??_7?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@6BRefcountBase@1@@	708	0x140032304
??_7?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@6BIProvider@1@@	709	0x140031888
??_7?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@6BRefcountBase@1@@	710	0x140004b9c
??_7?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@6BIProvider@1@@	711	0x140010780
??_7?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@6BRefcountBase@1@@	712	0x14003721c
??_7?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@6BIProvider@1@@	713	0x14003c2e4
??_7?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@6BRefcountBase@1@@	714	0x140003e60
??_7?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@6BIProvider@1@@	715	0x14002aa8c
??_7?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@6BRefcountBase@1@@	716	0x140004870
??_7?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@6BIProvider@1@@	717	0x140028ec8
??_7?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@6BRefcountBase@1@@	718	0x140028a1c
??_7?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@6BIProvider@1@@	719	0x14002c91c
??_7?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@6BRefcountBase@1@@	720	0x1400014c0
??_7?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@6BIProvider@1@@	721	0x14002869c
??_7?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@6BRefcountBase@1@@	722	0x14003a9f0
??_7AccessibleButton@DirectUI@@6B@	723	0x14001b518
??_7AnimationStrip@DirectUI@@6B@	724	0x140004bf0
??_7AutoButton@DirectUI@@6B@	725	0x14003c8a0
??_7BaseScrollBar@DirectUI@@6B@	726	0x14001e380
??_7BaseScrollViewer@DirectUI@@6BElement@1@@	727	0x140016f2c
??_7BaseScrollViewer@DirectUI@@6BIElementListener@1@@	728	0x14003c4ac
??_7Bind@DirectUI@@6B@	729	0x14002c8d0
??_7BorderLayout@DirectUI@@6B@	730	0x140021194
??_7Browser@DirectUI@@6B@	731	0x14000f1d0
??_7BrowserSelectionProxy@DirectUI@@6B@	732	0x1400293cc
??_7Button@DirectUI@@6B@	733	0x14003ffe8
??_7CCAVI@DirectUI@@6B@	734	0x1400041b0
??_7CCBase@DirectUI@@6B@	735	0x140013188
??_7CCBaseCheckRadioButton@DirectUI@@6B@	736	0x14002d1ec
??_7CCBaseScrollBar@DirectUI@@6BBaseScrollBar@1@@	737	0x140024ec0
??_7CCBaseScrollBar@DirectUI@@6BCCBase@1@@	738	0x14002f618
??_7CCCheckBox@DirectUI@@6B@	739	0x14000fd88
??_7CCCommandLink@DirectUI@@6B@	740	0x140015940
??_7CCHScrollBar@DirectUI@@6BBaseScrollBar@1@@	741	0x1400187c8
??_7CCHScrollBar@DirectUI@@6BCCBase@1@@	742	0x14002f07c
??_7CCListBox@DirectUI@@6B@	743	0x14002bfa8
??_7CCListView@DirectUI@@6B@	744	0x14002eb08
??_7CCProgressBar@DirectUI@@6B@	745	0x14001eafc
??_7CCPushButton@DirectUI@@6B@	746	0x140006b4c
??_7CCRadioButton@DirectUI@@6B@	747	0x140008d80
??_7CCSysLink@DirectUI@@6B@	748	0x1400097d4
??_7CCTrackBar@DirectUI@@6B@	749	0x14001b61c
??_7CCTreeView@DirectUI@@6B@	750	0x14002f014
??_7CCVScrollBar@DirectUI@@6BBaseScrollBar@1@@	751	0x140039384
??_7CCVScrollBar@DirectUI@@6BCCBase@1@@	752	0x14003a864
??_7CheckBoxGlyph@DirectUI@@6B@	753	0x1400067a4
??_7ClassInfoBase@DirectUI@@6B@	754	0x14003f0c8
??_7Clipper@DirectUI@@6B@	755	0x14000413c
??_7Combobox@DirectUI@@6B@	756	0x14000683c
??_7DCSurface@DirectUI@@6B@	757	0x140009c30
??_7DUIXmlParser@DirectUI@@6B@	758	0x14004156c
??_7DialogElement@DirectUI@@6BHWNDElement@1@@	759	0x140022c00
??_7DialogElement@DirectUI@@6BIDialogElement@1@@	760	0x14003ba78
??_7DialogElement@DirectUI@@6BIElementListener@1@@	761	0x140001050
??_7DuiAccessible@DirectUI@@6BIAccIdentity@@@	762	0x140036360
??_7DuiAccessible@DirectUI@@6BIAccessible@@@	763	0x14002431c
??_7DuiAccessible@DirectUI@@6BIEnumVARIANT@@@	764	0x1400070d8
??_7DuiAccessible@DirectUI@@6BIOleWindow@@@	765	0x14003e674
??_7DuiAccessible@DirectUI@@6BIServiceProvider@@@	766	0x140031e4c
??_7Edit@DirectUI@@6B@	767	0x14000fc0c
??_7Element@DirectUI@@6B@	768	0x14002d578
??_7ElementProvider@DirectUI@@6BIRawElementProviderAdviseEvents@@@	769	0x1400355a4
??_7ElementProvider@DirectUI@@6BIRawElementProviderFragment@@@	770	0x1400173c8
??_7ElementProvider@DirectUI@@6BIRawElementProviderSimple2@@@	771	0x140030d00
??_7ElementProvider@DirectUI@@6BRefcountBase@1@@	772	0x14000b474
??_7ElementWithHWND@DirectUI@@6B@	773	0x140020c40
??_7ExpandCollapseProvider@DirectUI@@6B@	774	0x14001b628
??_7ExpandCollapseProvider@DirectUI@@6BIProvider@1@@	775	0x14003f484
??_7ExpandCollapseProvider@DirectUI@@6BRefcountBase@1@@	776	0x14002be88
??_7ExpandCollapseProxy@DirectUI@@6B@	777	0x14003f6d0
??_7Expandable@DirectUI@@6B@	778	0x140027780
??_7Expando@DirectUI@@6B@	779	0x14003fda0
??_7ExpandoButtonGlyph@DirectUI@@6B@	780	0x140021350
??_7FillLayout@DirectUI@@6B@	781	0x140003c18
??_7FlowLayout@DirectUI@@6B@	782	0x14001e174
??_7FontCache@DirectUI@@6B@	783	0x140026eb4
??_7GridItemProvider@DirectUI@@6B@	784	0x140038620
??_7GridItemProvider@DirectUI@@6BIProvider@1@@	785	0x140006150
??_7GridItemProvider@DirectUI@@6BRefcountBase@1@@	786	0x14001d6d4
??_7GridItemProxy@DirectUI@@6B@	787	0x140023d24
??_7GridLayout@DirectUI@@6B@	788	0x14000edc0
??_7GridProvider@DirectUI@@6B@	789	0x14002d558
??_7GridProvider@DirectUI@@6BIProvider@1@@	790	0x14001c2a8
??_7GridProvider@DirectUI@@6BRefcountBase@1@@	791	0x140022bec
??_7GridProxy@DirectUI@@6B@	792	0x140032194
??_7HWNDElement@DirectUI@@6B@	793	0x1400330a0
??_7HWNDElementAccessible@DirectUI@@6BIAccIdentity@@@	794	0x140031354
??_7HWNDElementAccessible@DirectUI@@6BIAccessible@@@	795	0x14003fb70
??_7HWNDElementAccessible@DirectUI@@6BIEnumVARIANT@@@	796	0x14004173c
??_7HWNDElementAccessible@DirectUI@@6BIOleWindow@@@	797	0x14001cbe4
??_7HWNDElementAccessible@DirectUI@@6BIServiceProvider@@@	798	0x140033758
??_7HWNDElementProvider@DirectUI@@6B@	799	0x140021ce8
??_7HWNDElementProvider@DirectUI@@6BIRawElementProviderAdviseEvents@@@	800	0x140014fc8
??_7HWNDElementProvider@DirectUI@@6BIRawElementProviderFragment@@@	801	0x140013520
??_7HWNDElementProvider@DirectUI@@6BIRawElementProviderSimple2@@@	802	0x140015e4c
??_7HWNDElementProvider@DirectUI@@6BRefcountBase@1@@	803	0x14001723c
??_7HWNDHost@DirectUI@@6B@	804	0x1400260cc
??_7HWNDHostAccessible@DirectUI@@6BIAccIdentity@@@	805	0x140033404
??_7HWNDHostAccessible@DirectUI@@6BIAccessible@@@	806	0x140019500
??_7HWNDHostAccessible@DirectUI@@6BIEnumVARIANT@@@	807	0x14000ce7c
??_7HWNDHostAccessible@DirectUI@@6BIOleWindow@@@	808	0x14002b988
??_7HWNDHostAccessible@DirectUI@@6BIServiceProvider@@@	809	0x14001981c
??_7HWNDHostClientAccessible@DirectUI@@6BIAccIdentity@@@	810	0x1400403fc
??_7HWNDHostClientAccessible@DirectUI@@6BIAccessible@@@	811	0x14000dcfc
??_7HWNDHostClientAccessible@DirectUI@@6BIEnumVARIANT@@@	812	0x1400332f0
??_7HWNDHostClientAccessible@DirectUI@@6BIOleWindow@@@	813	0x14002196c
??_7HWNDHostClientAccessible@DirectUI@@6BIServiceProvider@@@	814	0x1400216a0
??_7IDataEngine@DirectUI@@6B@	815	0x140030340
??_7IDataEntry@DirectUI@@6B@	816	0x14000cb7c
??_7ISBLeak@DirectUI@@6B@	817	0x140030b18
??_7IXElementCP@DirectUI@@6B@	818	0x14003c0f0
??_7IXProviderCP@DirectUI@@6B@	819	0x14003fbfc
??_7InvokeHelper@DirectUI@@6B@	820	0x140015fc0
??_7InvokeProvider@DirectUI@@6B@	821	0x14001c28c
??_7InvokeProvider@DirectUI@@6BIProvider@1@@	822	0x14000d42c
??_7InvokeProvider@DirectUI@@6BRefcountBase@1@@	823	0x140002ac4
??_7InvokeProxy@DirectUI@@6B@	824	0x14001f84c
??_7Layout@DirectUI@@6B@	825	0x14003bd7c
??_7Macro@DirectUI@@6B@	826	0x14002a9b0
??_7ModernProgressBarRangeValueProxy@DirectUI@@6B@	827	0x140034dd4
??_7Movie@DirectUI@@6B@	828	0x140022064
??_7NativeHWNDHost@DirectUI@@6B@	829	0x14003145c
??_7Navigator@DirectUI@@6B@	830	0x14002fa88
??_7NavigatorSelectionItemProxy@DirectUI@@6B@	831	0x140005894
??_7NineGridLayout@DirectUI@@6B@	832	0x1400377f8
??_7PText@DirectUI@@6B@	833	0x14001e5fc
??_7Page@DirectUI@@6B@	834	0x14003319c
??_7Pages@DirectUI@@6B@	835	0x14000e62c
??_7Progress@DirectUI@@6B@	836	0x140029474
??_7ProgressRangeValueProxy@DirectUI@@6B@	837	0x14001c610
??_7Proxy@DirectUI@@6B@	838	0x140033760
??_7PushButton@DirectUI@@6B@	839	0x14000bb14
??_7RadioButtonGlyph@DirectUI@@6B@	840	0x140004eec
??_7RangeValueProvider@DirectUI@@6B@	841	0x14001eb5c
??_7RangeValueProvider@DirectUI@@6BIProvider@1@@	842	0x140020b64
??_7RangeValueProvider@DirectUI@@6BRefcountBase@1@@	843	0x140012b1c
??_7RangeValueProxy@DirectUI@@6B@	844	0x1400245c8
??_7RefPointElement@DirectUI@@6B@	845	0x14000b898
??_7RefcountBase@DirectUI@@6B@	846	0x1400228d4
??_7RepeatButton@DirectUI@@6B@	847	0x1400290ac
??_7Repeater@DirectUI@@6B@	848	0x140018d54
??_7RowLayout@DirectUI@@6B@	849	0x14003d85c
??_7ScrollBar@DirectUI@@6BBaseScrollBar@1@@	850	0x14002ce50
??_7ScrollBar@DirectUI@@6BElement@1@@	851	0x14003a000
??_7ScrollBarRangeValueProxy@DirectUI@@6B@	852	0x1400112d4
??_7ScrollItemProvider@DirectUI@@6B@	853	0x14000d1ec
??_7ScrollItemProvider@DirectUI@@6BIProvider@1@@	854	0x140038f68
??_7ScrollItemProvider@DirectUI@@6BRefcountBase@1@@	855	0x140028a30
??_7ScrollItemProxy@DirectUI@@6B@	856	0x14003c2e4
??_7ScrollProvider@DirectUI@@6B@	857	0x140025db8
??_7ScrollProvider@DirectUI@@6BIProvider@1@@	858	0x140040468
??_7ScrollProvider@DirectUI@@6BRefcountBase@1@@	859	0x14001aef4
??_7ScrollProxy@DirectUI@@6B@	860	0x14001c514
??_7ScrollViewer@DirectUI@@6BElement@1@@	861	0x1400382b8
??_7ScrollViewer@DirectUI@@6BIElementListener@1@@	862	0x140017184
??_7SelectionItemProvider@DirectUI@@6B@	863	0x140041514
??_7SelectionItemProvider@DirectUI@@6BIProvider@1@@	864	0x140034150
??_7SelectionItemProvider@DirectUI@@6BRefcountBase@1@@	865	0x140020b4c
??_7SelectionItemProxy@DirectUI@@6B@	866	0x14002f910
??_7SelectionProvider@DirectUI@@6B@	867	0x14000a214
??_7SelectionProvider@DirectUI@@6BIProvider@1@@	868	0x1400270c8
??_7SelectionProvider@DirectUI@@6BRefcountBase@1@@	869	0x14000a3e8
??_7SelectionProxy@DirectUI@@6B@	870	0x140030f04
??_7Selector@DirectUI@@6B@	871	0x14003a9b8
??_7SelectorNoDefault@DirectUI@@6B@	872	0x14003a81c
??_7SelectorSelectionItemProxy@DirectUI@@6B@	873	0x14002549c
??_7SelectorSelectionProxy@DirectUI@@6B@	874	0x14002f488
??_7ShellBorderLayout@DirectUI@@6B@	875	0x14001fb14
??_7StyleSheet@DirectUI@@6B@	876	0x14001eec0
??_7StyledScrollViewer@DirectUI@@6BElement@1@@	877	0x14000e75c
??_7StyledScrollViewer@DirectUI@@6BIElementListener@1@@	878	0x140040658
??_7Surface@DirectUI@@6B@	879	0x140001364
??_7TableItemProvider@DirectUI@@6B@	880	0x14003a2a8
??_7TableItemProvider@DirectUI@@6BIProvider@1@@	881	0x14001e468
??_7TableItemProvider@DirectUI@@6BRefcountBase@1@@	882	0x14002da8c
??_7TableItemProxy@DirectUI@@6B@	883	0x14001c7ac
??_7TableLayout@DirectUI@@6B@	884	0x14000b704
??_7TableProvider@DirectUI@@6B@	885	0x140013c90
??_7TableProvider@DirectUI@@6BIProvider@1@@	886	0x1400049f4
??_7TableProvider@DirectUI@@6BRefcountBase@1@@	887	0x140024d5c
??_7TableProxy@DirectUI@@6B@	888	0x140012130
??_7TaskPage@DirectUI@@6BIElementListener@1@@	889	0x140025054
??_7TaskPage@DirectUI@@6BIXProviderCP@1@@	890	0x14001c7f0
??_7TextGraphic@DirectUI@@6B@	891	0x140012400
??_7Thumb@DirectUI@@6B@	892	0x14001d418
??_7ToggleProvider@DirectUI@@6B@	893	0x1400319a8
??_7ToggleProvider@DirectUI@@6BIProvider@1@@	894	0x140040b40
??_7ToggleProvider@DirectUI@@6BRefcountBase@1@@	895	0x140001114
??_7ToggleProxy@DirectUI@@6B@	896	0x140040530
??_7UnknownElement@DirectUI@@6B@	897	0x140014ec8
??_7ValueProvider@DirectUI@@6B@	898	0x140020570
??_7ValueProvider@DirectUI@@6BIProvider@1@@	899	0x1400170d4
??_7ValueProvider@DirectUI@@6BRefcountBase@1@@	900	0x1400377b0
??_7ValueProxy@DirectUI@@6B@	901	0x140006bfc
??_7VerticalFlowLayout@DirectUI@@6B@	902	0x14000f944
??_7Viewer@DirectUI@@6B@	903	0x14001d750
??_7XBaby@DirectUI@@6B@	904	0x14003287c
??_7XBaby@DirectUI@@6BHWNDElement@1@@	905	0x140032948
??_7XBaby@DirectUI@@6BIDialogElement@1@@	906	0x140020a44
??_7XBaby@DirectUI@@6BIElementListener@1@@	907	0x140020150
??_7XElement@DirectUI@@6BHWNDHost@1@@	908	0x140009dc0
??_7XElement@DirectUI@@6BIXElementCP@1@@	909	0x14002b5c0
??_7XProvider@DirectUI@@6B@	910	0x14000dca0
??_7XResourceProvider@DirectUI@@6B@	911	0x14000d52c
??_FCCBase@DirectUI@@QEAAXXZ	912	0x1400240d8
??_FCCBaseScrollBar@DirectUI@@QEAAXXZ	913	0x14000dab0
??_FCCCheckBox@DirectUI@@QEAAXXZ	914	0x14001a128
??_FCCCommandLink@DirectUI@@QEAAXXZ	915	0x140020c68
??_FCCPushButton@DirectUI@@QEAAXXZ	916	0x14002ad94
??_FCCTreeView@DirectUI@@QEAAXXZ	917	0x14002c80c
?AbsorbsShortcutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	918	0x14001f9bc
?AccDefActionProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	919	0x140006834
?AccDescProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	920	0x1400128e4
?AccHelpProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	921	0x140025738
?AccItemStatusProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	922	0x14001dac4
?AccItemTypeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	923	0x140018890
?AccNameProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	924	0x140027114
?AccNavigate@DuiAccessible@DirectUI@@SAJPEAVElement@2@JPEAPEAV32@@Z	925	0x140020e64
?AccRoleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	926	0x140017b1c
?AccStateProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	927	0x1400154ec
?AccValueProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	928	0x140035cc4
?AcceleratorKeyProperty@Schema@DirectUI@@2HA	929	0x140017188
?Access@?$SafeArrayAccessor@H@DirectUI@@QEAAJPEAUtagSAFEARRAY@@G@Z	930	0x14000fdb8
?AccessKeyProperty@Schema@DirectUI@@2HA	931	0x14001c930
?AccessibleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	932	0x140027c34
?ActionInitiated@Navigator@DirectUI@@SA?AVUID@@XZ	933	0x140004444
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z	934	0x14003b2b4
?ActivateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z	935	0x14003679c
?ActivateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z	936	0x14003adf8
?ActiveProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	937	0x14000a518
?ActiveStateChanged@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	938	0x14002bb4c
?ActualReferencePointProp@RefPointElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	939	0x1400104b4
?Add@BaseScrollViewer@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	940	0x140002e14
?Add@Element@DirectUI@@QEAAJPEAV12@@Z	941	0x140004e10
?Add@Element@DirectUI@@QEAAJPEAV12@P6AHPEBX1@Z@Z	942	0x14003c6fc
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z	943	0x140039a64
?Add@ElementProviderManager@DirectUI@@SAJPEAVElementProvider@2@@Z	944	0x140005854
?Add@Expando@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	945	0x14002a430
?Add@LinkedList@DirectUI@@QEAAXPEAVLinkedListNode@2@@Z	946	0x140011138
?Add@Macro@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	947	0x1400229e4
?Add@Pages@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	948	0x140019ea8
?Add@TouchEdit2@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	949	0x14002b458
?Add@TouchSelect@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	950	0x140012d44
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z	951	0x1400386c8
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ	952	0x1400194b8
?AddChildren@ScrollViewer@DirectUI@@MEAAJXZ	953	0x1400071c4
?AddChildren@StyledScrollViewer@DirectUI@@MEAAJXZ	954	0x14002d1b0
?AddElement@TouchSelect@DirectUI@@QEAAJPEAVElement@2@PEBG@Z	955	0x14002d258
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z	956	0x14002d008
?AddRectangleChange@EventManager@DirectUI@@CAJPEAVElement@2@_N1@Z	957	0x140036778
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ	958	0x140039ecc
?AddRef@DuiAccessible@DirectUI@@UEAAKXZ	959	0x140040d1c
?AddRef@Element@DirectUI@@QEAAKXZ	960	0x140010a94
?AddRef@ElementProvider@DirectUI@@UEAAKXZ	961	0x14001aff4
?AddRef@ExpandCollapseProvider@DirectUI@@UEAAKXZ	962	0x14000dcd8
?AddRef@GridItemProvider@DirectUI@@UEAAKXZ	963	0x140010004
?AddRef@GridProvider@DirectUI@@UEAAKXZ	964	0x14000cb58
?AddRef@HWNDElementProvider@DirectUI@@UEAAKXZ	965	0x140016ba0
?AddRef@InvokeProvider@DirectUI@@UEAAKXZ	966	0x14003cf00
?AddRef@RangeValueProvider@DirectUI@@UEAAKXZ	967	0x140002abc
?AddRef@RefcountBase@DirectUI@@QEAAJXZ	968	0x1400384a4
?AddRef@ScrollItemProvider@DirectUI@@UEAAKXZ	969	0x1400231d4
?AddRef@ScrollProvider@DirectUI@@UEAAKXZ	970	0x14003f510
?AddRef@SelectionItemProvider@DirectUI@@UEAAKXZ	971	0x1400332ec
?AddRef@SelectionProvider@DirectUI@@UEAAKXZ	972	0x14002ed4c
?AddRef@TableItemProvider@DirectUI@@UEAAKXZ	973	0x140033268
?AddRef@TableProvider@DirectUI@@UEAAKXZ	974	0x140014b9c
?AddRef@ToggleProvider@DirectUI@@UEAAKXZ	975	0x14000ba90
?AddRef@Value@DirectUI@@QEAAXXZ	976	0x14002b0ac
?AddRef@ValueProvider@DirectUI@@UEAAKXZ	977	0x140006864
?AddRef@XProvider@DirectUI@@UEAAKXZ	978	0x14003e890
?AddRulesToStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAVStyleSheet@2@PEBGPEAV?$DynamicArray@UXMLParserCond@DirectUI@@$0A@@2@PEAV?$DynamicArray@PEAG$0A@@2@@Z	979	0x14000d5c4
?AddString@CCListBox@DirectUI@@QEAAHPEBG@Z	980	0x140008170
?AddString@Combobox@DirectUI@@QEAAHPEBG@Z	981	0x14003f5e8
?AddString@TouchSelect@DirectUI@@QEAAJPEBG@Z	982	0x140039940
?AddString@TouchSelect@DirectUI@@QEAAJPEBGPEAPEAVElement@2@@Z	983	0x140023cbc
?AddStringWithLabelOverride@TouchSelect@DirectUI@@QEAAJPEBG0PEAPEAVElement@2@@Z	984	0x14002ec10
?AddToSelection@NavigatorSelectionItemProxy@DirectUI@@AEAAJPEAVBrowser@2@@Z	985	0x140034464
?AddToSelection@SelectionItemProvider@DirectUI@@UEAAJXZ	986	0x14002e76c
?AddToSelection@SelectorSelectionItemProxy@DirectUI@@AEAAJXZ	987	0x14001eba8
?AdvanceFrame@AnimationStrip@DirectUI@@IEAAXXZ	988	0x14001647c
?AdvanceFrame@Movie@DirectUI@@SA?AVUID@@XZ	989	0x14001a27c
?AdviseEventAdded@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z	990	0x1400053ec
?AdviseEventAdded@EventManager@DirectUI@@SAJHPEAUtagSAFEARRAY@@@Z	991	0x1400061c0
?AdviseEventRemoved@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z	992	0x140005e34
?AdviseEventRemoved@EventManager@DirectUI@@SAJHPEAUtagSAFEARRAY@@@Z	993	0x14002757c
?AliasedRenderingProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	994	0x140004be0
?AlphaProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	995	0x14000dbec
?AnimatePopupOnDismissProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	996	0x140002c10
?AnimateScroll@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	997	0x140014e8c
?AnimationChange@Element@DirectUI@@SA?AVUID@@XZ	998	0x14000e18c
?AnimationProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	999	0x14003dec8
?AnimationStatusChange@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1000	0x140019dac
?ApplySinkRegion@HWNDHost@DirectUI@@AEAAXPEBUtagRECT@@_N@Z	1001	0x14002e26c
?Arrow@Expando@DirectUI@@KAGXZ	1002	0x140021dc4
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ	1003	0x1400033e8
?AsyncContentLoadedEvent@Schema@DirectUI@@2HA	1004	0x140008d40
?Attach@Layout@DirectUI@@UEAAXPEAVElement@2@@Z	1005	0x1400386f4
?AttachCtrlSubclassProc@HWNDHost@DirectUI@@KAXPEAUHWND__@@@Z	1006	0x140009974
?AutoGroupingProp@CCRadioButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1007	0x140007bf0
?AutoStartProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1008	0x14002a214
?AutoStopProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1009	0x1400106d0
?AutomationFocusChangedEvent@Schema@DirectUI@@2HA	1010	0x14002e0f8
?AutomationIdProperty@Schema@DirectUI@@2HA	1011	0x140021170
?AutomationPropertyChangedEvent@Schema@DirectUI@@2HA	1012	0x140003fe0
?BackgroundOwnerIDProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	1013	0x140029770
?BackgroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1014	0x14003e108
?BaselineProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1015	0x140002708
?BorderColorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1016	0x14003f7b0
?BorderStyleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1017	0x140011288
?BorderThicknessProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1018	0x140019828
?BoundingRectangleProperty@Schema@DirectUI@@2HA	1019	0x140014248
?BroadcastEvent@Element@DirectUI@@QEAAXPEAUEvent@2@@Z	1020	0x140033848
?BufferingProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	1021	0x14002a1d4
?BuildCacheInfo@FlowLayout@DirectUI@@IEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@_N@Z	1022	0x140030858
?BuildCacheInfo@VerticalFlowLayout@DirectUI@@IEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@_N@Z	1023	0x14002a3d4
?BuildElement@Macro@DirectUI@@MEAAJXZ	1024	0x14000bc8c
?BuildElement@Repeater@DirectUI@@MEAAJXZ	1025	0x140001158
?ButtonClassAcceptsEnterKeyProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	1026	0x140030504
?ButtonControlType@Schema@DirectUI@@2HA	1027	0x14000aedc
?CacheParser@XBaby@DirectUI@@UEAAXPEAVDUIXmlParser@2@@Z	1028	0x140031ba8
?CalendarControlType@Schema@DirectUI@@2HA	1029	0x14002282c
?CanPerformManualVisualSwap@TouchScrollViewer@DirectUI@@QEAA_NXZ	1030	0x14001f560
?CanSetFocus@HWNDElement@DirectUI@@UEAA_NXZ	1031	0x1400213e0
?CanSetFocus@XBaby@DirectUI@@UEAA_NXZ	1032	0x14003ba68
?CanSetFocus@XProvider@DirectUI@@UEAAJPEA_N@Z	1033	0x1400142d8
?CancelClick@TouchButton@DirectUI@@QEAA_NW4ClickDevice@12@@Z	1034	0x14002a7f0
?CancelCurrentDrag@TouchSlider@DirectUI@@QEAAXXZ	1035	0x140023874
?CaptureCallstackFrames@CallstackTracker@DirectUI@@QEAAHXZ	1036	0x140001ea8
?CapturedProp@Button@DirectUI@@SAPEBUPropertyInfo@2@XZ	1037	0x14002c078
?CapturedProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1038	0x14001174c
?CaretMoved@TouchEditBase@DirectUI@@SA?AVUID@@XZ	1039	0x140035178
?CheckBoxControlType@Schema@DirectUI@@2HA	1040	0x14000b08c
?CheckScroll@BaseScrollViewer@DirectUI@@AEAAXPEAVBaseScrollBar@2@HHH@Z	1041	0x1400226d4
?CheckedStateProp@TouchCheckBox@DirectUI@@SAPEBUPropertyInfo@2@XZ	1042	0x14003e3f4
?ChildrenProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1043	0x14000731c
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z	1044	0x140010848
?ClassNameProperty@Schema@DirectUI@@2HA	1045	0x14000bbe8
?ClassProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1046	0x14002164c
?ClearButtonClicked@TouchEdit2@DirectUI@@SA?AVUID@@XZ	1047	0x1400017e0
?ClearCacheDirty@Layout@DirectUI@@IEAAXXZ	1048	0x140034de8
?ClearParser@DUIFactory@DirectUI@@AEAAXXZ	1049	0x14000d8bc
?Click@Button@DirectUI@@SA?AVUID@@XZ	1050	0x14001bf7c
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ	1051	0x14001fa6c
?ClickDefaultButton@DialogElement@DirectUI@@UEAA_NXZ	1052	0x140034164
?ClickDefaultButton@DialogElementCore@DirectUI@@QEAA_NXZ	1053	0x140015c58
?ClickDefaultButton@XBaby@DirectUI@@UEAA_NXZ	1054	0x14001fe2c
?ClickDefaultButton@XProvider@DirectUI@@UEAAHXZ	1055	0x140029250
?ClickablePointProperty@Schema@DirectUI@@2HA	1056	0x140023b68
?Clipper@Expando@DirectUI@@KAGXZ	1057	0x140024990
?Clone@DuiAccessible@DirectUI@@UEAAJPEAPEAUIEnumVARIANT@@@Z	1058	0x140037c70
?Clone@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAUIEnumVARIANT@@@Z	1059	0x140014c78
?Close@ElementProviderManager@DirectUI@@SAXXZ	1060	0x140019044
?Close@EventManager@DirectUI@@SAXXZ	1061	0x140016d50
?Close@InvokeManager@DirectUI@@SAXXZ	1062	0x14004178c
?ClosePopup@TouchSelect@DirectUI@@QEAAXXZ	1063	0x140006754
?CloseThread@InvokeManager@DirectUI@@SAXXZ	1064	0x14001a3c8
?Collapse@ExpandCollapseProvider@DirectUI@@UEAAJXZ	1065	0x1400190cc
?ColorFontPaletteIndexProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1066	0x140029474
?ComboBoxControlType@Schema@DirectUI@@2HA	1067	0x14003a214
?CompositedTextProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1068	0x14000200c
?CompositingQualityProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1069	0x140009598
?CompositionChange@HWNDElement@DirectUI@@SA?AVUID@@XZ	1070	0x140007d10
?ConnectProp@Bind@DirectUI@@SAPEBUPropertyInfo@2@XZ	1071	0x1400118ac
?ConstrainLayoutProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1072	0x14001e72c
?ContentAlignProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1073	0x14003351c
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1074	0x140003fd8
?Context@Button@DirectUI@@SA?AVUID@@XZ	1075	0x14001960c
?ContextMenuHintShowing@ContextMenuBehavior@DirectUI@@SA?AVUID@@XZ	1076	0x14002d2ac
?ContextMenuRequested@ContextMenuBehavior@DirectUI@@SA?AVUID@@XZ	1077	0x1400369c0
?ContextMenuRequested@TouchEdit2@DirectUI@@SA?AVUID@@XZ	1078	0x14001c10c
?ContextSensitiveHelp@DuiAccessible@DirectUI@@UEAAJH@Z	1079	0x140033310
?ContextSensitiveHelp@HWNDHostAccessible@DirectUI@@UEAAJH@Z	1080	0x14002ea80
?ControlTypeProperty@Schema@DirectUI@@2HA	1081	0x1400284e0
?CopySheets@DUIXmlParser@DirectUI@@QEAAJPEAPEAV?$DynamicArray@PEAVValue@DirectUI@@$0A@@2@@Z	1082	0x14003c968
?Count@?$SafeArrayAccessor@H@DirectUI@@QEAAHXZ	1083	0x14002cf54
?Create@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1084	0x14000ddbc
?Create@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1085	0x14002f8b4
?Create@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1086	0x14003f348
?Create@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1087	0x140018d80
?Create@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1088	0x14002e52c
?Create@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1089	0x140008f1c
?Create@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1090	0x14000bbd4
?Create@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1091	0x140021534
?Create@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1092	0x140023bf4
?Create@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1093	0x140021148
?Create@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1094	0x14003d83c
?Create@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1095	0x1400381c4
?Create@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1096	0x14003bc34
?Create@AcceleratorBehavior@@SAJPEAPEAUIDuiBehavior@@@Z	1097	0x14003cd1c
?Create@AccessibleButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1098	0x1400297cc
?Create@AnimationStrip@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1099	0x140039c64
?Create@AutoButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1100	0x1400118a0
?Create@Bind@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1101	0x14000c5ac
?Create@BorderLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1102	0x140007234
?Create@BorderLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1103	0x1400119f0
?Create@Browser@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1104	0x140008ca4
?Create@Button@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1105	0x140006ba4
?Create@Button@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1106	0x140002edc
?Create@CCAVI@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1107	0x140030d58
?Create@CCAVI@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1108	0x140008d14
?Create@CCBase@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1109	0x14000a7ac
?Create@CCBase@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1110	0x140022370
?Create@CCCheckBox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1111	0x140036e10
?Create@CCCheckBox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1112	0x140034464
?Create@CCCommandLink@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1113	0x14000e290
?Create@CCCommandLink@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1114	0x14001bf3c
?Create@CCHScrollBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1115	0x14002de3c
?Create@CCHScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1116	0x140035e6c
?Create@CCListBox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1117	0x140029ba4
?Create@CCListBox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1118	0x14003c06c
?Create@CCListView@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1119	0x14003ab94
?Create@CCListView@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1120	0x14000ed58
?Create@CCProgressBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1121	0x14003b01c
?Create@CCProgressBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1122	0x14002eb78
?Create@CCPushButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1123	0x140031a80
?Create@CCPushButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1124	0x14002d52c
?Create@CCRadioButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1125	0x140008da8
?Create@CCRadioButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1126	0x14000dbc0
?Create@CCSysLink@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1127	0x14001b184
?Create@CCSysLink@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1128	0x14003b310
?Create@CCTrackBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1129	0x14000c690
?Create@CCTrackBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1130	0x1400360e0
?Create@CCTreeView@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1131	0x14003fa94
?Create@CCTreeView@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1132	0x140036b88
?Create@CCVScrollBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1133	0x1400103c8
?Create@CCVScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1134	0x14003f5b8
?Create@CheckBoxGlyph@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1135	0x140034238
?Create@CheckBoxGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1136	0x14001e3d4
?Create@Clipper@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1137	0x140035a88
?Create@Combobox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1138	0x14001cfd8
?Create@Combobox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1139	0x1400117e4
?Create@ContextMenuBehavior@DirectUI@@SAJPEAPEAUIDuiBehavior@@@Z	1140	0x140032cac
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z	1141	0x14000df28
?Create@DialogElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z	1142	0x140005518
?Create@DuiAccessible@DirectUI@@SAJPEAVElement@2@PEAPEAV12@@Z	1143	0x1400090f4
?Create@Edit@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1144	0x14001406c
?Create@Edit@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1145	0x14003bb88
?Create@Element@DirectUI@@SAJIPEAV12@PEAKPEAPEAV12@@Z	1146	0x140029ea8
?Create@ElementProvider@DirectUI@@SAJPEAVElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z	1147	0x140011a78
?Create@ElementProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1148	0x14002c49c
?Create@ElementWithHWND@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1149	0x14003fa04
?Create@ExpandCollapseProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1150	0x14001ea80
?Create@Expandable@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1151	0x140021770
?Create@Expando@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1152	0x140033870
?Create@ExpandoButtonGlyph@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1153	0x140002b80
?Create@ExpandoButtonGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1154	0x14003aef0
?Create@FillLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1155	0x14000214c
?Create@FillLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1156	0x140022ffc
?Create@FlowLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1157	0x140012ba4
?Create@FlowLayout@DirectUI@@SAJ_NIIIPEAPEAVLayout@2@@Z	1158	0x14003a330
?Create@GridItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1159	0x1400230e8
?Create@GridLayout@DirectUI@@SAJHHPEAPEAVLayout@2@@Z	1160	0x140038ab0
?Create@GridLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1161	0x1400199c0
?Create@GridProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1162	0x1400020c4
?Create@HWNDElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z	1163	0x14001b0d4
?Create@HWNDElementAccessible@DirectUI@@SAJPEAVHWNDElement@2@PEAPEAVDuiAccessible@2@@Z	1164	0x140019548
?Create@HWNDElementProvider@DirectUI@@SAJPEAVHWNDElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z	1165	0x140012bc4
?Create@HWNDElementProxy@DirectUI@@SAPEAV12@PEAVHWNDElement@2@@Z	1166	0x14003e4e8
?Create@HWNDHost@DirectUI@@SAJIIPEAVElement@2@PEAKPEAPEAV32@@Z	1167	0x14001d5c4
?Create@HWNDHost@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1168	0x14003eb78
?Create@HWNDHostAccessible@DirectUI@@SAJPEAVElement@2@PEAUIAccessible@@PEAPEAVDuiAccessible@2@@Z	1169	0x140015968
?Create@HWNDHostClientAccessible@DirectUI@@SAJPEAVElement@2@PEAUIAccessible@@PEAPEAVDuiAccessible@2@@Z	1170	0x140013d78
?Create@InvokeProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1171	0x14002e348
?Create@ItemList@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1172	0x14002ce7c
?Create@Layout@DirectUI@@SAJPEAPEAV12@@Z	1173	0x140024d8c
?Create@Macro@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1174	0x14003cf38
?Create@ModernProgressBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1175	0x140016c08
?Create@ModernProgressRing@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1176	0x140025480
?Create@Movie@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1177	0x140002bcc
?Create@Movie@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1178	0x1400104ac
?Create@NativeHWNDHost@DirectUI@@SAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@IPEAPEAV12@@Z	1179	0x14003bc00
?Create@NativeHWNDHost@DirectUI@@SAJPEBGPEAUHWND__@@PEAUHICON__@@HHHHHHIPEAPEAV12@@Z	1180	0x1400054e4
?Create@Navigator@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1181	0x14001a25c
?Create@NineGridLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1182	0x140012f88
?Create@NineGridLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1183	0x140004338
?Create@PText@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1184	0x14002aa08
?Create@Page@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1185	0x1400196fc
?Create@Pages@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1186	0x1400195d4
?Create@Progress@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1187	0x140014524
?Create@PushButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1188	0x14002e63c
?Create@RadioButtonGlyph@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1189	0x140038f4c
?Create@RadioButtonGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1190	0x140023008
?Create@RangeValueProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1191	0x14003bda8
?Create@RefPointElement@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1192	0x14000ac28
?Create@RefPointElement@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1193	0x1400303d0
?Create@RepeatButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1194	0x140034510
?Create@RepeatButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1195	0x1400364ec
?Create@Repeater@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1196	0x14002c8f0
?Create@RichText@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1197	0x140001b34
?Create@RowLayout@DirectUI@@SAJHIIPEAPEAVLayout@2@@Z	1198	0x14002a63c
?Create@RowLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1199	0x140016558
?Create@RowLayout@DirectUI@@SAJIIPEAPEAVLayout@2@@Z	1200	0x14001a534
?Create@ScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1201	0x140015574
?Create@ScrollBar@DirectUI@@SAJ_NPEAVElement@2@PEAKPEAPEAV32@@Z	1202	0x140017ab0
?Create@ScrollItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1203	0x140026814
?Create@ScrollProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1204	0x140012264
?Create@ScrollViewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1205	0x14003664c
?Create@ScrubBehavior@@SAJPEAPEAUIDuiBehavior@@@Z	1206	0x14002e0b8
?Create@SelectionItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1207	0x140010810
?Create@SelectionProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1208	0x140005220
?Create@Selector@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1209	0x140005a8c
?Create@SelectorNoDefault@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1210	0x14003046c
?Create@SemanticZoomToggle@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1211	0x140009790
?Create@ShellBorderLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1212	0x14001f3bc
?Create@ShellBorderLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1213	0x140032038
?Create@StyleSheet@DirectUI@@SAJPEAPEAV12@@Z	1214	0x140035330
?Create@StyledScrollViewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1215	0x140013cbc
?Create@TableItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1216	0x140023b60
?Create@TableLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1217	0x1400269ac
?Create@TableProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1218	0x14001bfb8
?Create@TextGraphic@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1219	0x140037850
?Create@Thumb@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1220	0x1400095dc
?Create@Thumb@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1221	0x14001a874
?Create@ToggleProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1222	0x1400093a4
?Create@TouchButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1223	0x14002d93c
?Create@TouchButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1224	0x1400247b4
?Create@TouchCheckBox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1225	0x14000c718
?Create@TouchCheckBox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1226	0x140030c84
?Create@TouchCheckBoxGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1227	0x14001ff10
?Create@TouchCommandButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1228	0x14003acb0
?Create@TouchCommandButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1229	0x14003c81c
?Create@TouchEdit2@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1230	0x140018bb8
?Create@TouchEditBase@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1231	0x1400257a4
?Create@TouchHWNDElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z	1232	0x1400231f4
?Create@TouchHyperLink@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1233	0x1400024e0
?Create@TouchHyperLink@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1234	0x140022804
?Create@TouchRepeatButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1235	0x14000dc20
?Create@TouchRepeatButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1236	0x140002b18
?Create@TouchScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1237	0x140031ccc
?Create@TouchScrollViewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1238	0x14001eeec
?Create@TouchSelect@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1239	0x140009fc4
?Create@TouchSelectItem@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1240	0x14001a744
?Create@TouchSlider@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1241	0x14002d2f8
?Create@TouchSwitch@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1242	0x140011e68
?Create@UnknownElement@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1243	0x1400367c0
?Create@UnknownElement@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1244	0x140012a50
?Create@ValueProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1245	0x140025d60
?Create@VerticalFlowLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1246	0x140019b18
?Create@VerticalFlowLayout@DirectUI@@SAJ_NIIIPEAPEAVLayout@2@@Z	1247	0x14000fb2c
?Create@Viewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1248	0x1400286f4
?Create@XBaby@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1249	0x14003f874
?Create@XBaby@DirectUI@@SAJPEAVIXElementCP@2@PEAVXProvider@2@PEAUHWND__@@PEAVElement@2@PEAKPEAPEAV62@@Z	1250	0x1400262dc
?Create@XElement@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1251	0x14002f114
?Create@XElement@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1252	0x14000da84
?Create@XHost@DirectUI@@SAJPEAVIXElementCP@2@PEAPEAV12@@Z	1253	0x1400235fc
?Create@XProvider@DirectUI@@SAJPEAVElement@2@PEAVIXProviderCP@2@PEAPEAV12@@Z	1254	0x1400413c0
?Create@XResourceProvider@DirectUI@@SAJPEAPEAV12@@Z	1255	0x140012e70
?Create@XResourceProvider@DirectUI@@SAJPEAUHINSTANCE__@@PEBG11PEAPEAV12@@Z	1256	0x140005c40
?CreateAccNameLabel@HWNDHost@DirectUI@@IEAAPEAUHWND__@@PEAU3@@Z	1257	0x1400222b4
?CreateAtom@Value@DirectUI@@SAPEAV12@G@Z	1258	0x140030b8c
?CreateAtom@Value@DirectUI@@SAPEAV12@PEBG@Z	1259	0x140038610
?CreateBool@Value@DirectUI@@SAPEAV12@_N@Z	1260	0x140030394
?CreateButtons@ScrollBar@DirectUI@@MEAAJXZ	1261	0x140032d90
?CreateButtons@TouchScrollBar@DirectUI@@UEAAJXZ	1262	0x1400250e0
?CreateCache@RichText@DirectUI@@SAJIPEAPEAUIDUIRichTextCache@@@Z	1263	0x140028860
?CreateColor@Value@DirectUI@@SAPEAV12@K@Z	1264	0x14002ff14
?CreateColor@Value@DirectUI@@SAPEAV12@KKE@Z	1265	0x1400368b4
?CreateColor@Value@DirectUI@@SAPEAV12@KKKE@Z	1266	0x140016f34
?CreateCursor@Value@DirectUI@@SAPEAV12@PEAUHICON__@@@Z	1267	0x140020b00
?CreateCursor@Value@DirectUI@@SAPEAV12@PEBG@Z	1268	0x14001c1b0
?CreateDFCFill@Value@DirectUI@@SAPEAV12@II@Z	1269	0x14001123c
?CreateDTBFill@Value@DirectUI@@SAPEAV12@PEBGHH@Z	1270	0x14000eb40
?CreateDUI@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAPEAUHWND__@@@Z	1271	0x1400186ec
?CreateDUICP@TaskPage@DirectUI@@EEAAJPEAVHWNDElement@2@PEAUHWND__@@1PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z	1272	0x14003f8a8
?CreateDUICP@XResourceProvider@DirectUI@@UEAAJPEAVHWNDElement@2@PEAUHWND__@@1PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z	1273	0x14002c93c
?CreateDoubleList@Value@DirectUI@@SAPEAV12@PEAV?$DynamicArray@N$0A@@2@@Z	1275	0x140015854
?CreateDoubleList@Value@DirectUI@@SAPEAV12@PEBNH@Z	1276	0x14002c3ac
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z	1277	0x140030274
?CreateElementList@Value@DirectUI@@SAPEAV12@PEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@@Z	1278	0x14000a650
?CreateElementRef@Value@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1279	0x1400100a0
?CreateElementScaledValue@Value@DirectUI@@SAPEAV12@PEAVElement@2@PEAV12@@Z	1280	0x140019d00
?CreateEncodedString@Value@DirectUI@@SAPEAV12@PEBG@Z	1281	0x14002bebc
?CreateExpression@Value@DirectUI@@SAPEAV12@PEAVExpression@2@@Z	1282	0x140024bf4
?CreateFill@Value@DirectUI@@SAPEAV12@AEBUFill@2@@Z	1283	0x14002db6c
?CreateFloat@Value@DirectUI@@SAPEAV12@MW4DynamicScaleValue@@@Z	1284	0x140017024
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHBITMAP__@@EI_N11@Z	1285	0x140007610
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHENHMETAFILE__@@0@Z	1286	0x14001bdf0
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHICON__@@_N11@Z	1287	0x14001fdf0
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUISharedBitmap@@EI@Z	1288	0x1400155dc
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEBGEIGGPEAUHINSTANCE__@@_N2@Z	1289	0x140006548
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEBGGGPEAUHINSTANCE__@@_N2@Z	1290	0x140029c48
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEBGUScaledSIZE@2@PEAUHINSTANCE__@@_N3@Z	1291	0x140036174
?CreateHWND@CCBase@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1292	0x140032a60
?CreateHWND@CCBaseScrollBar@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1293	0x14001cac0
?CreateHWND@Combobox@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1294	0x14003e9fc
?CreateHWND@Edit@DirectUI@@MEAAPEAUHWND__@@PEAU3@@Z	1295	0x14001bee0
?CreateHWND@Edit@DirectUI@@MEAAPEAUHWND__@@PEAU3@_N@Z	1296	0x14001d954
?CreateHWND@HWNDHost@DirectUI@@MEAAPEAUHWND__@@PEAU3@@Z	1297	0x1400102dc
?CreateHWND@XElement@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1298	0x140021c3c
?CreateHostWindow@NativeHWNDHost@DirectUI@@UEAAPEAUHWND__@@KPEBG0KHHHHPEAU3@PEAUHMENU__@@PEAUHINSTANCE__@@PEAX@Z	1299	0x140026178
?CreateIconGraphicHelper@Value@DirectUI@@CAPEAV12@PEAUHICON__@@_N11@Z	1300	0x14003636c
?CreateInstance@CSafeElementProxy@@SAJPEAVElement@DirectUI@@PEAPEAV1@@Z	1301	0x1400100d0
?CreateInt@Value@DirectUI@@SAPEAV12@HW4DynamicScaleValue@@@Z	1302	0x14002cc30
?CreateLayout@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@P6AJHPEAHPEAPEAVValue@2@@Z@Z	1303	0x14002c458
?CreateLayout@Value@DirectUI@@SAPEAV12@PEAVLayout@2@@Z	1304	0x14002119c
?CreateParser@DUIFactory@DirectUI@@QEAAJXZ	1305	0x14000fb68
?CreateParser@XProvider@DirectUI@@QEAAJPEAPEAVDUIXmlParser@2@@Z	1306	0x140002d08
?CreateParserCP@TaskPage@DirectUI@@EEAAJPEAPEAVDUIXmlParser@2@@Z	1307	0x14002d5a8
?CreateParserCP@XResourceProvider@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z	1308	0x14002f0fc
?CreatePatternProvider@Schema@DirectUI@@SAJW4Pattern@12@PEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1309	0x14001d41c
?CreatePoint@Value@DirectUI@@SAPEAV12@HHW4DynamicScaleValue@@@Z	1310	0x1400169b8
?CreateRect@Value@DirectUI@@SAPEAV12@HHHHW4DynamicScaleValue@@@Z	1311	0x14001eddc
?CreateScaledValue@Value@DirectUI@@SAPEAV12@MPEAV12@@Z	1312	0x140025348
?CreateScrollBars@ScrollViewer@DirectUI@@MEAAJXZ	1313	0x140004f1c
?CreateScrollBars@StyledScrollViewer@DirectUI@@MEAAJXZ	1314	0x14003cfec
?CreateSize@Value@DirectUI@@SAPEAV12@HHW4DynamicScaleValue@@@Z	1315	0x14002da94
?CreateString@Value@DirectUI@@SAPEAV12@PEBGPEAUHINSTANCE__@@@Z	1316	0x1400311dc
?CreateStringRP@Value@DirectUI@@SAPEAV12@PEBGPEAUHINSTANCE__@@@Z	1317	0x14002cd8c
?CreateStyleParser@HWNDElement@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z	1318	0x140037a54
?CreateStyleParser@XBaby@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z	1319	0x14002eea0
?CreateStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBGPEAPEAVStyleSheet@2@@Z	1320	0x140013294
?CreateStyleSheet@Value@DirectUI@@SAPEAV12@PEAVStyleSheet@2@@Z	1321	0x14003e1c0
?CreateValueList@Value@DirectUI@@SAPEAV12@PEAV12@@Z	1322	0x14000ff08
?CreateValueList@Value@DirectUI@@SAPEAV12@PEAV?$DynamicArray@PEAVValue@DirectUI@@$0A@@2@@Z	1323	0x14001a1e0
?CreateXBaby@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAUHWND__@@PEAVElement@2@PEAKPEAPEAUIXBaby@2@@Z	1324	0x1400092e4
?CreateXmlReader@DUIXmlParser@DirectUI@@IEAAJPEAPEAUIXmlReader@@@Z	1325	0x1400123b0
?CreateXmlReaderFromHGLOBAL@DUIXmlParser@DirectUI@@IEAAJPEAXPEAPEAUIXmlReader@@@Z	1326	0x140011ee8
?CreateXmlReaderInputWithEncodingName@DUIXmlParser@DirectUI@@IEAAJPEAUIStream@@PEBGPEAPEAUIUnknown@@@Z	1327	0x14002bda8
?CtrlSubclassProc@HWNDHost@DirectUI@@KA_JPEAUHWND__@@I_K_J@Z	1328	0x14001e110
?CultureProperty@Schema@DirectUI@@2HA	1329	0x14001e54c
?CursorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1330	0x140038354
?CustomControlType@Schema@DirectUI@@2HA	1331	0x140006edc
?CustomDragDropScalingHint@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1332	0x140022e60
?CustomProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1333	0x140018714
?CustomReflowHint@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1334	0x1400396a0
?CustomTapHint@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1335	0x1400331a8
?Cut@TouchEditBase@DirectUI@@SA?AVUID@@XZ	1336	0x140003c04
?DCompDeviceRebuilt@Element@DirectUI@@SA?AVUID@@XZ	1337	0x1400074b0
?DPIProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1338	0x140016118
?DUICreatePropertySheetPage@TaskPage@DirectUI@@QEAAJPEAUHINSTANCE__@@@Z	1339	0x1400322dc
?DataGridControlType@Schema@DirectUI@@2HA	1340	0x140008df8
?DataItemControlType@Schema@DirectUI@@2HA	1341	0x1400034c8
?DefaultAction@Button@DirectUI@@UEAAJXZ	1342	0x140024d78
?DefaultAction@CCBase@DirectUI@@UEAAJXZ	1343	0x14001a204
?DefaultAction@CCPushButton@DirectUI@@UEAAJXZ	1344	0x140031148
?DefaultAction@Element@DirectUI@@UEAAJXZ	1345	0x140035150
?DefaultAction@SemanticZoomToggle@DirectUI@@UEAAJXZ	1346	0x14002b728
?DefaultAction@TouchButton@DirectUI@@UEAAJXZ	1347	0x14003d484
?DefaultAction@TouchRepeatButton@DirectUI@@UEAAJXZ	1348	0x1400201cc
?DefaultButtonTrackingProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	1349	0x14001de88
?DelayActivateTooltip@HWNDElement@DirectUI@@QEAAXXZ	1350	0x140022770
?DeleteString@CCListBox@DirectUI@@QEAAHH@Z	1351	0x140036750
?DesiredSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1352	0x1400071b4
?Destroy@ClassInfoBase@DirectUI@@UEAAXXZ	1353	0x140040d2c
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ	1354	0x140016690
?Destroy@Element@DirectUI@@QEAAJ_N@Z	1355	0x140004abc
?Destroy@Expression@DirectUI@@QEAAXXZ	1356	0x140011154
?Destroy@Layout@DirectUI@@QEAAXXZ	1357	0x1400035f8
?Destroy@NativeHWNDHost@DirectUI@@QEAAXXZ	1358	0x140024170
?Destroy@XHost@DirectUI@@QEAAXXZ	1359	0x14000820c
?DestroyAll@Element@DirectUI@@QEAAJ_N@Z	1360	0x14001063c
?DestroyCP@TaskPage@DirectUI@@EEAAXXZ	1361	0x140012158
?DestroyCP@XResourceProvider@DirectUI@@UEAAXXZ	1362	0x14002e87c
?DestroyListener@EventManager@DirectUI@@SAXPEAVElement@2@@Z	1363	0x140016498
?DestroyMsg@NativeHWNDHost@DirectUI@@SAIXZ	1364	0x14003a430
?DestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ	1365	0x140004f5c
?DestroyWindow@XHost@DirectUI@@QEAAXXZ	1366	0x14002ffa0
?Detach@CSafeElementProxy@@QEAAXXZ	1367	0x140016580
?Detach@Element@DirectUI@@QEAAXPEAVDeferCycle@2@@Z	1368	0x14000afe4
?Detach@HWNDHost@DirectUI@@QEAAXXZ	1369	0x140021ce8
?Detach@Layout@DirectUI@@UEAAXPEAVElement@2@@Z	1370	0x140021b3c
?DetachParser@DUIFactory@DirectUI@@QEAAPEAVDUIXmlParser@2@XZ	1371	0x1400321a0
?DeterminateProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	1372	0x14000d1b4
?DirectionProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1373	0x140022de4
?DirtyProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	1374	0x14002d8e4
?DisableAccTextExtendProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1375	0x140008a44
?DisableMouseInRectCheckProp@TouchRepeatButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1376	0x140030c90
?DisableSelectionHandlesOnEmptyContent@TouchEdit2@DirectUI@@QEAAXXZ	1377	0x1400380fc
?Disconnect@DuiAccessible@DirectUI@@UEAAJXZ	1378	0x1400134e4
?Disconnect@HWNDElementAccessible@DirectUI@@UEAAJXZ	1379	0x14002e058
?Disconnect@HWNDHostAccessible@DirectUI@@UEAAJXZ	1380	0x140035ad4
?DismissIHMAsync@TouchHWNDElement@DirectUI@@QEAAJXZ	1381	0x14000d840
?DllsLoaded@CallstackTracker@DirectUI@@CAHXZ	1382	0x1400334b4
?DoInvoke@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@IEAAJHZZ	1383	0x140030168
?DoInvoke@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@IEAAJHZZ	1384	0x14002f31c
?DoInvoke@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@IEAAJHZZ	1385	0x14001ee84
?DoInvoke@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@IEAAJHZZ	1386	0x14002a84c
?DoInvoke@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@IEAAJHZZ	1387	0x140008edc
?DoInvoke@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@IEAAJHZZ	1388	0x14000d6cc
?DoInvoke@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@IEAAJHZZ	1389	0x14001eee0
?DoInvoke@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@IEAAJHZZ	1390	0x140031324
?DoInvoke@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@IEAAJHZZ	1391	0x14002a8a8
?DoInvoke@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@IEAAJHZZ	1392	0x140011294
?DoInvoke@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@IEAAJHZZ	1393	0x1400249bc
?DoInvoke@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@IEAAJHZZ	1394	0x14003901c
?DoInvoke@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@IEAAJHZZ	1395	0x140025814
?DoInvoke@ElementProvider@DirectUI@@IEAAJHZZ	1396	0x140026f2c
?DoInvoke@InvokeHelper@DirectUI@@QEAAJHPEAVElementProvider@2@P6APEAVProviderProxy@2@PEAVElement@2@@ZPEAD@Z	1397	0x1400193f8
?DoInvokeArgs@ElementProvider@DirectUI@@QEAAJHP6APEAVProviderProxy@2@PEAVElement@2@@ZPEAD@Z	1398	0x1400042a0
?DoLayout@BorderLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1399	0x140011734
?DoLayout@FillLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1400	0x14002e660
?DoLayout@FlowLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1401	0x1400387cc
?DoLayout@GridLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1402	0x140025e18
?DoLayout@Layout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1403	0x14001997c
?DoLayout@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1404	0x140032bf8
?DoLayout@RowLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1405	0x140039388
?DoLayout@TableLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1406	0x14003e3d4
?DoLayout@VerticalFlowLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1407	0x1400277c4
?DoMethod@BrowserSelectionProxy@DirectUI@@UEAAJHPEAD@Z	1408	0x140018c14
?DoMethod@ElementProxy@DirectUI@@UEAAJHPEAD@Z	1409	0x140037020
?DoMethod@ExpandCollapseProxy@DirectUI@@UEAAJHPEAD@Z	1410	0x140031c04
?DoMethod@GridItemProxy@DirectUI@@UEAAJHPEAD@Z	1411	0x140005184
?DoMethod@GridProxy@DirectUI@@UEAAJHPEAD@Z	1412	0x14001936c
?DoMethod@HWNDElementProxy@DirectUI@@UEAAJHPEAD@Z	1413	0x14000da58
?DoMethod@InvokeProxy@DirectUI@@UEAAJHPEAD@Z	1414	0x14000aaa4
?DoMethod@ModernProgressBarRangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1415	0x140024ca0
?DoMethod@NavigatorSelectionItemProxy@DirectUI@@UEAAJHPEAD@Z	1416	0x14000d430
?DoMethod@ProgressRangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1417	0x140006c98
?DoMethod@RangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1418	0x140024264
?DoMethod@ScrollBarRangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1419	0x14001e8e4
?DoMethod@ScrollItemProxy@DirectUI@@UEAAJHPEAD@Z	1420	0x140020fbc
?DoMethod@ScrollProxy@DirectUI@@UEAAJHPEAD@Z	1421	0x140035f34
?DoMethod@SelectionItemProxy@DirectUI@@UEAAJHPEAD@Z	1422	0x140020c30
?DoMethod@SelectionProxy@DirectUI@@UEAAJHPEAD@Z	1423	0x14003aa04
?DoMethod@SelectorSelectionItemProxy@DirectUI@@UEAAJHPEAD@Z	1424	0x140006d54
?DoMethod@SelectorSelectionProxy@DirectUI@@UEAAJHPEAD@Z	1425	0x14002d180
?DoMethod@TableItemProxy@DirectUI@@UEAAJHPEAD@Z	1426	0x1400126e8
?DoMethod@TableProxy@DirectUI@@UEAAJHPEAD@Z	1427	0x140014dd4
?DoMethod@ToggleProxy@DirectUI@@UEAAJHPEAD@Z	1428	0x14000f7b4
?DoMethod@ValueProxy@DirectUI@@UEAAJHPEAD@Z	1429	0x14002a150
?DockPattern@Schema@DirectUI@@2HA	1430	0x14002b940
?DocumentControlType@Schema@DirectUI@@2HA	1431	0x1400410c4
?DoubleBuffered@Element@DirectUI@@QEAAX_N@Z	1432	0x140015968
?Drag@Thumb@DirectUI@@SA?AVUID@@XZ	1433	0x140004c34
?DragDragCancelEvent@Schema@DirectUI@@2HA	1434	0x140036fd4
?DragDragCompleteEvent@Schema@DirectUI@@2HA	1435	0x1400234a8
?DragDragStartEvent@Schema@DirectUI@@2HA	1436	0x140025d7c
?DragPattern@Schema@DirectUI@@2HA	1437	0x1400329ac
?Drag_DropEffect_Property@Schema@DirectUI@@2HA	1438	0x140008cb4
?Drag_DropEffects_Property@Schema@DirectUI@@2HA	1439	0x14003ab8c
?Drag_IsGrabbed_Property@Schema@DirectUI@@2HA	1440	0x140028220
?DrawOutlinesProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1441	0x14003882c
?DumpDuiProperties@@YAXPEAVElement@DirectUI@@@Z	1443	0x14000bdf8
?DumpDuiTree@@YAXPEAVElement@DirectUI@@H@Z	1444	0x140013054
?EdgeHighlightColorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1445	0x140009888
?EdgeHighlightThicknessProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1446	0x140002674
?EditControlType@Schema@DirectUI@@2HA	1447	0x140006000
?ElementFromPoint@HWNDElement@DirectUI@@QEAAPEAVElement@2@PEAUtagPOINT@@@Z	1448	0x14000e32c
?ElementFromPoint@HWNDElementProxy@DirectUI@@IEAAJNNPEAPEAUIRawElementProviderFragment@@@Z	1449	0x140040f5c
?ElementMovesOnIHMNotifyProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	1450	0x14000fdf4
?ElementProviderFromPoint@HWNDElementProvider@DirectUI@@UEAAJNNPEAPEAUIRawElementProviderFragment@@@Z	1451	0x14003dd34
?EnableDesignMode@DUIXmlParser@DirectUI@@QEAAXXZ	1452	0x1400110cc
?EnableUiaEvents@Element@DirectUI@@QEAAX_N@Z	1453	0x14001d618
?EnabledProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1454	0x140013574
?End@BaseScrollBar@DirectUI@@UEAAXXZ	1455	0x14000d60c
?EndDefer@Element@DirectUI@@QEAAXK@Z	1456	0x14002fd20
?EndDefer@EventManager@DirectUI@@SAJPEAVElement@2@@Z	1457	0x14001654c
?EnforceSizeProp@PushButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1458	0x140020b88
?EnsureVisible@Element@DirectUI@@QEAA_NI@Z	1459	0x140027534
?EnsureVisible@Element@DirectUI@@QEAA_NXZ	1460	0x14003b030
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z	1461	0x140002994
?EnsureVisible@Viewer@DirectUI@@UEAA_NHHHH@Z	1462	0x140031dcc
?Enter@Edit@DirectUI@@SA?AVUID@@XZ	1463	0x14002bad8
?Enter@TouchEditBase@DirectUI@@SA?AVUID@@XZ	1464	0x14001ff90
?Entered@Browser@DirectUI@@SA?AVUID@@XZ	1465	0x140017df4
?EnumCallstackFrames@CallstackTracker@DirectUI@@QEAAHP6AXPEBD0KK@Z@Z	1466	0x140006ea4
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z	1467	0x140011d44
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z	1468	0x140031164
?EraseFeedback@TouchSlider@DirectUI@@QEAAXXZ	1469	0x14002a758
?EstimateContentSize@CCPushButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1470	0x1400389b0
?EventFromEventId@Schema@DirectUI@@SA?AW4Event@12@H@Z	1471	0x140030f88
?EventListener@EventManager@DirectUI@@SAJPEAVElement@2@PEAUEvent@2@@Z	1472	0x140032e00
?ExecuteManualSwapDeferredZoomToRect@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	1473	0x140038e24
?Expand@ExpandCollapseProvider@DirectUI@@UEAAJXZ	1474	0x14001f4b8
?ExpandCollapsePattern@Schema@DirectUI@@2HA	1475	0x14002acb8
?ExpandCollapse_ExpandCollapseState_Property@Schema@DirectUI@@2HA	1476	0x14002a494
?ExpandProp@Macro@DirectUI@@SAPEBUPropertyInfo@2@XZ	1477	0x140007774
?ExpandedProp@Expandable@DirectUI@@SAPEBUPropertyInfo@2@XZ	1478	0x140012aec
?ExtentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1479	0x140034570
?FWantAnyEvent@EventManager@DirectUI@@SA_NPEAVElement@2@@Z	1480	0x140037760
?FillSymbolInfo@CallstackTracker@DirectUI@@AEAAXPEAUSTACK_SYMBOL_INFO@12@_K@Z	1481	0x140030f30
?FilterOnPasteProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	1482	0x14001689c
?FinalizeCurrentIMEComposition@TouchEdit2@DirectUI@@UEAAJXZ	1483	0x140041244
?FinalizeCurrentIMEComposition@TouchEditBase@DirectUI@@UEAAJXZ	1484	0x140029484
?Find@ElementProviderManager@DirectUI@@SAPEAVElementProvider@2@PEAVElement@2@@Z	1485	0x140026f6c
?FindAccessibleRole@AccessibleButton@DirectUI@@CAPEBUACCESSIBLEROLE@12@H@Z	1486	0x14001249c
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z	1487	0x14002b534
?FindDescendentWorker@Element@DirectUI@@AEAAPEAV12@G@Z	1488	0x14002fa6c
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UEAAHGH@Z	1489	0x1400414dc
?FindInvokeHelper@InvokeManager@DirectUI@@CAPEAVInvokeHelper@2@PEAI@Z	1490	0x14000ce48
?FindProviderCallback@ElementProviderManager@DirectUI@@CA_NPEAVElementProvider@2@PEAX@Z	1491	0x1400263e4
?FindRefPoint@RefPointElement@DirectUI@@SAPEAVElement@2@PEAV32@PEAUtagPOINT@@@Z	1492	0x140019334
?FindShortcut@HWNDElement@DirectUI@@SA_NGPEAVElement@2@PEAPEAV32@PEAH2H@Z	1493	0x140039ee0
?FindShortcutRecursive@HWNDElement@DirectUI@@KA_NGPEAVElement@2@PEAPEAV32@PEAH2H@Z	1494	0x14003f350
?FireAnimationChangeEvent@BaseScrollViewer@DirectUI@@IEAAX_N@Z	1495	0x140002ac0
?FireClickEvent@TouchButton@DirectUI@@UEAAXIIW4ClickDevice@12@PEAUtagPOINT@@@Z	1496	0x140021130
?FireClickEvent@TouchRepeatButton@DirectUI@@UEAAXIIW4ClickDevice@TouchButton@2@PEAUtagPOINT@@@Z	1497	0x1400394c4
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z	1498	0x1400218b0
?FireEventOnMouseOrPointerRelease@TouchSlider@DirectUI@@QEAAXXZ	1499	0x140002fcc
?FireHostEvent@PushButton@DirectUI@@AEAAXPEAVElement@2@_N@Z	1500	0x140039804
?FireNavigate@Browser@DirectUI@@AEAAHG@Z	1501	0x1400345f8
?FireNavigationEvent@Navigator@DirectUI@@AEAAXXZ	1502	0x14003ad98
?FireRightClickEvent@TouchButton@DirectUI@@UEAAXIPEAUtagPOINT@@@Z	1503	0x140013340
?FireRightClickEvent@TouchRepeatButton@DirectUI@@UEAAXIPEAUtagPOINT@@@Z	1504	0x14002636c
?FireStructureChangedEvent@EventManager@DirectUI@@SAJPEAVElement@2@W4StructureChangeType@@@Z	1505	0x14001c300
?FlagsProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	1506	0x14002f938
?FlushWorkingSet@HWNDElement@DirectUI@@QEAAXXZ	1507	0x14000950c
?FontColorRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1508	0x14002ee8c
?FontFaceProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1509	0x140016930
?FontProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1510	0x14003f744
?FontQualityProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1511	0x140015e24
?FontSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1512	0x14001bc78
?FontSizeRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1513	0x140003eb4
?FontStyleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1514	0x14002bf74
?FontWeightProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1515	0x14002d9f0
?FontWeightRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1516	0x1400308c0
?ForceEditTextToLTRProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	1517	0x140019a88
?ForceThemeChange@XBaby@DirectUI@@UEAAX_K_J@Z	1518	0x14003119c
?ForceThemeChange@XProvider@DirectUI@@UEAAJ_K_J@Z	1519	0x14000b8a8
?ForegroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1520	0x1400336ac
?Forward@Movie@DirectUI@@QEAAXXZ	1521	0x14001ac14
?ForwardingWindowMessage@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	1522	0x14003ec8c
?FrameDurationProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	1523	0x1400220cc
?FrameIndexProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	1524	0x140021f00
?FrameWidthProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	1525	0x140031780
?FrameworkId@Schema@DirectUI@@2HA	1526	0x1400107fc
?FreeComCtl32@TaskPage@DirectUI@@AEAAXXZ	1527	0x140013638
?FreeProvider@XElement@DirectUI@@QEAAXXZ	1528	0x140017478
?GetAbsorbsShortcut@Element@DirectUI@@QEAA_NXZ	1529	0x140003db8
?GetAccDefAction@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1530	0x1400097c4
?GetAccDesc@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1531	0x140023e8c
?GetAccHelp@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1532	0x1400411b0
?GetAccItemStatus@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1533	0x140035b24
?GetAccItemType@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1534	0x1400019c4
?GetAccName@DuiAccessible@DirectUI@@IEAAJUtagVARIANT@@HPEAPEAG@Z	1535	0x140039e44
?GetAccName@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1536	0x14002ea94
?GetAccNameAsDisplayed@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1537	0x140030e68
?GetAccNameFromContent@DuiAccessible@DirectUI@@IEAAJPEAPEAG@Z	1538	0x140031fe0
?GetAccRole@Element@DirectUI@@QEAAHXZ	1539	0x14002d2bc
?GetAccState@Element@DirectUI@@QEAAHXZ	1540	0x14000607c
?GetAccValue@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1541	0x140020c64
?GetAccessible@Element@DirectUI@@QEAA_NXZ	1542	0x1400370e8
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1543	0x140040280
?GetAccessibleImpl@HWNDElement@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1544	0x14002a7c4
?GetAccessibleImpl@HWNDHost@DirectUI@@AEAAJPEAPEAUIAccessible@@_N@Z	1545	0x14003e5d8
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1546	0x140010704
?GetAccessibleImpl@TouchEdit2@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1547	0x140025ec0
?GetAccessibleParent@DuiAccessible@DirectUI@@SAPEAVElement@2@PEAV32@@Z	1548	0x14003f77c
?GetActive@Element@DirectUI@@QEAAHXZ	1549	0x14001c850
?GetActiveState@TouchScrollBar@DirectUI@@QEAA?AW4ActiveState@2@XZ	1550	0x1400316c0
?GetActualReferencePoint@RefPointElement@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z	1551	0x140004060
?GetAdjacent@BorderLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1552	0x14002e9a8
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z	1553	0x14002f994
?GetAdjacent@FillLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1554	0x14002dea4
?GetAdjacent@FlowLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1555	0x14002e754
?GetAdjacent@GridLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1556	0x140027b44
?GetAdjacent@ItemList@DirectUI@@UEAAPEAVElement@2@PEAV32@HPEBUNavReference@2@K@Z	1557	0x14003a874
?GetAdjacent@Layout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1558	0x14002c75c
?GetAdjacent@NineGridLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1559	0x140008d0c
?GetAdjacent@RowLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1560	0x14000abd4
?GetAdjacent@Selector@DirectUI@@UEAAPEAVElement@2@PEAV32@HPEBUNavReference@2@K@Z	1561	0x14003123c
?GetAdjacent@ShellBorderLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1562	0x140024968
?GetAdjacent@TableLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1563	0x14001d620
?GetAdjacent@VerticalFlowLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1564	0x14001c878
?GetAdjacent@XBaby@DirectUI@@UEAAPEAVElement@2@PEAV32@HPEBUNavReference@2@K@Z	1565	0x14001c030
?GetAllowArrowOut@TouchScrollViewer@DirectUI@@QEAA_NXZ	1566	0x140021d5c
?GetAlpha@Element@DirectUI@@QEAAHXZ	1567	0x140006160
?GetAnimatePopupOnDismiss@TouchSelect@DirectUI@@QEAA_NXZ	1568	0x140012658
?GetAnimation@Element@DirectUI@@QEAAHXZ	1569	0x140023780
?GetAtom@Value@DirectUI@@QEAAGXZ	1570	0x140021140
?GetAtomZero@Value@DirectUI@@SAPEAV12@XZ	1571	0x14002f448
?GetAutoGrouping@CCRadioButton@DirectUI@@QEAA_NXZ	1572	0x1400026f4
?GetAutoStart@Movie@DirectUI@@QEAA_NXZ	1573	0x140036134
?GetAutoStop@Movie@DirectUI@@QEAA_NXZ	1574	0x140023988
?GetAutomationId@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@@Z	1575	0x14000c278
?GetBackgroundColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1576	0x140017740
?GetBackgroundOwner@HWNDHost@DirectUI@@IEAAPEAVElement@2@XZ	1577	0x140004e58
?GetBackgroundOwnerID@HWNDHost@DirectUI@@QEAAGXZ	1578	0x140040fac
?GetBackgroundStdColor@Element@DirectUI@@QEAAHXZ	1579	0x140021494
?GetBool@EventManager@DirectUI@@CAJPEAUtagVARIANT@@PEAVValue@2@@Z	1580	0x140022bac
?GetBool@Value@DirectUI@@QEAA_NXZ	1581	0x140012570
?GetBoolFalse@Value@DirectUI@@SAPEAV12@XZ	1582	0x1400202d8
?GetBoolTrue@Value@DirectUI@@SAPEAV12@XZ	1583	0x1400055fc
?GetBorderColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1584	0x14000c6f8
?GetBorderStdColor@Element@DirectUI@@QEAAHXZ	1585	0x14002a494
?GetBorderStyle@Element@DirectUI@@QEAAHXZ	1586	0x14001f8e8
?GetBorderThickness@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1587	0x14003d18c
?GetBoundingRect@ElementProxy@DirectUI@@IEAAJPEAUUiaRect@@@Z	1588	0x140018b58
?GetBrowser@Navigator@DirectUI@@QEAAPEAVBrowser@2@XZ	1589	0x1400271e8
?GetBuffering@TouchSlider@DirectUI@@QEAAHXZ	1590	0x140038ee8
?GetButtonClassAcceptsEnterKey@DialogElement@DirectUI@@UEAA_NXZ	1591	0x14000dcd8
?GetButtonColor@CCPushButton@DirectUI@@UEAA_NPEAUHDC__@@PEAPEAUHBRUSH__@@@Z	1592	0x140035640
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z	1593	0x14003bd44
?GetCaptured@Button@DirectUI@@QEAA_NXZ	1594	0x140027b28
?GetCaptured@TouchButton@DirectUI@@QEAA_NXZ	1595	0x14001bd58
?GetCellInfo@TableLayout@DirectUI@@QEAAPEAUCellInfo@2@H@Z	1596	0x14003f330
?GetCheckedState@TouchCheckBox@DirectUI@@QEAA?AW4CheckedStateFlags@2@XZ	1597	0x140021b18
?GetChildFromLayoutIndex@Layout@DirectUI@@QEAAPEAVElement@2@PEAV32@HPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@@Z	1598	0x14003c238
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ	1599	0x14003b408
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z	1600	0x14001c504
?GetClass@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1601	0x140009340
?GetClassInfoPtr@AccessibleButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1602	0x1400324c0
?GetClassInfoPtr@AnimationStrip@DirectUI@@SAPEAUIClassInfo@2@XZ	1603	0x14002870c
?GetClassInfoPtr@AutoButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1604	0x140001194
?GetClassInfoPtr@BaseScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1605	0x14002d0ec
?GetClassInfoPtr@Bind@DirectUI@@SAPEAUIClassInfo@2@XZ	1606	0x14002feb0
?GetClassInfoPtr@Browser@DirectUI@@SAPEAUIClassInfo@2@XZ	1607	0x14001faec
?GetClassInfoPtr@Button@DirectUI@@SAPEAUIClassInfo@2@XZ	1608	0x140028420
?GetClassInfoPtr@CCAVI@DirectUI@@SAPEAUIClassInfo@2@XZ	1609	0x14000853c
?GetClassInfoPtr@CCBase@DirectUI@@SAPEAUIClassInfo@2@XZ	1610	0x140002300
?GetClassInfoPtr@CCBaseCheckRadioButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1611	0x140018670
?GetClassInfoPtr@CCBaseScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1612	0x140036174
?GetClassInfoPtr@CCCheckBox@DirectUI@@SAPEAUIClassInfo@2@XZ	1613	0x140014088
?GetClassInfoPtr@CCCommandLink@DirectUI@@SAPEAUIClassInfo@2@XZ	1614	0x14001cedc
?GetClassInfoPtr@CCHScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1615	0x14002729c
?GetClassInfoPtr@CCListBox@DirectUI@@SAPEAUIClassInfo@2@XZ	1616	0x14003842c
?GetClassInfoPtr@CCListView@DirectUI@@SAPEAUIClassInfo@2@XZ	1617	0x1400049a0
?GetClassInfoPtr@CCProgressBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1618	0x14002c4bc
?GetClassInfoPtr@CCPushButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1619	0x14002270c
?GetClassInfoPtr@CCRadioButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1620	0x140010880
?GetClassInfoPtr@CCSysLink@DirectUI@@SAPEAUIClassInfo@2@XZ	1621	0x14000b75c
?GetClassInfoPtr@CCTrackBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1622	0x1400209cc
?GetClassInfoPtr@CCTreeView@DirectUI@@SAPEAUIClassInfo@2@XZ	1623	0x140014008
?GetClassInfoPtr@CCVScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1624	0x140006638
?GetClassInfoPtr@CheckBoxGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1625	0x14000ba1c
?GetClassInfoPtr@Clipper@DirectUI@@SAPEAUIClassInfo@2@XZ	1626	0x14002d930
?GetClassInfoPtr@Combobox@DirectUI@@SAPEAUIClassInfo@2@XZ	1627	0x140025b3c
?GetClassInfoPtr@DialogElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1628	0x14000944c
?GetClassInfoPtr@Edit@DirectUI@@SAPEAUIClassInfo@2@XZ	1629	0x140015668
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ	1630	0x14002579c
?GetClassInfoPtr@ElementWithHWND@DirectUI@@SAPEAUIClassInfo@2@XZ	1631	0x14000e038
?GetClassInfoPtr@Expandable@DirectUI@@SAPEAUIClassInfo@2@XZ	1632	0x140006b8c
?GetClassInfoPtr@Expando@DirectUI@@SAPEAUIClassInfo@2@XZ	1633	0x14001b46c
?GetClassInfoPtr@ExpandoButtonGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1634	0x14001e6c8
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1635	0x14003a4a8
?GetClassInfoPtr@HWNDHost@DirectUI@@SAPEAUIClassInfo@2@XZ	1636	0x14003c2d8
?GetClassInfoPtr@ItemList@DirectUI@@SAPEAUIClassInfo@2@XZ	1637	0x140041158
?GetClassInfoPtr@Macro@DirectUI@@SAPEAUIClassInfo@2@XZ	1638	0x14000c77c
?GetClassInfoPtr@ModernProgressBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1639	0x140030600
?GetClassInfoPtr@ModernProgressRing@DirectUI@@SAPEAUIClassInfo@2@XZ	1640	0x14003891c
?GetClassInfoPtr@Movie@DirectUI@@SAPEAUIClassInfo@2@XZ	1641	0x14003e5ac
?GetClassInfoPtr@Navigator@DirectUI@@SAPEAUIClassInfo@2@XZ	1642	0x140022828
?GetClassInfoPtr@PText@DirectUI@@SAPEAUIClassInfo@2@XZ	1643	0x140015124
?GetClassInfoPtr@Page@DirectUI@@SAPEAUIClassInfo@2@XZ	1644	0x14002f098
?GetClassInfoPtr@Pages@DirectUI@@SAPEAUIClassInfo@2@XZ	1645	0x140009610
?GetClassInfoPtr@Progress@DirectUI@@SAPEAUIClassInfo@2@XZ	1646	0x140019e7c
?GetClassInfoPtr@PushButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1647	0x1400031a4
?GetClassInfoPtr@RadioButtonGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1648	0x140026abc
?GetClassInfoPtr@RefPointElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1649	0x14001d118
?GetClassInfoPtr@RepeatButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1650	0x14001e6b8
?GetClassInfoPtr@Repeater@DirectUI@@SAPEAUIClassInfo@2@XZ	1651	0x140034b18
?GetClassInfoPtr@RichText@DirectUI@@SAPEAUIClassInfo@2@XZ	1652	0x140035780
?GetClassInfoPtr@ScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1653	0x140025e70
?GetClassInfoPtr@ScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1654	0x14000b9c0
?GetClassInfoPtr@Selector@DirectUI@@SAPEAUIClassInfo@2@XZ	1655	0x1400041f8
?GetClassInfoPtr@SelectorNoDefault@DirectUI@@SAPEAUIClassInfo@2@XZ	1656	0x140025268
?GetClassInfoPtr@SemanticZoomToggle@DirectUI@@SAPEAUIClassInfo@2@XZ	1657	0x1400328fc
?GetClassInfoPtr@StyledScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1658	0x140035178
?GetClassInfoPtr@TextGraphic@DirectUI@@SAPEAUIClassInfo@2@XZ	1659	0x14002a9dc
?GetClassInfoPtr@Thumb@DirectUI@@SAPEAUIClassInfo@2@XZ	1660	0x140032324
?GetClassInfoPtr@TouchButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1661	0x140003058
?GetClassInfoPtr@TouchCheckBox@DirectUI@@SAPEAUIClassInfo@2@XZ	1662	0x140003154
?GetClassInfoPtr@TouchCheckBoxGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1663	0x14000410c
?GetClassInfoPtr@TouchCommandButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1664	0x14003c1d4
?GetClassInfoPtr@TouchEdit2@DirectUI@@SAPEAUIClassInfo@2@XZ	1665	0x140018d3c
?GetClassInfoPtr@TouchEditBase@DirectUI@@SAPEAUIClassInfo@2@XZ	1666	0x1400071a8
?GetClassInfoPtr@TouchHWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1667	0x14001eec4
?GetClassInfoPtr@TouchHyperLink@DirectUI@@SAPEAUIClassInfo@2@XZ	1668	0x1400260d0
?GetClassInfoPtr@TouchRepeatButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1669	0x14002f43c
?GetClassInfoPtr@TouchScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1670	0x140030ab8
?GetClassInfoPtr@TouchScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1671	0x140030c6c
?GetClassInfoPtr@TouchSelect@DirectUI@@SAPEAUIClassInfo@2@XZ	1672	0x1400194e8
?GetClassInfoPtr@TouchSelectItem@DirectUI@@SAPEAUIClassInfo@2@XZ	1673	0x140015b00
?GetClassInfoPtr@TouchSlider@DirectUI@@SAPEAUIClassInfo@2@XZ	1674	0x140033040
?GetClassInfoPtr@TouchSwitch@DirectUI@@SAPEAUIClassInfo@2@XZ	1675	0x14002492c
?GetClassInfoPtr@UnknownElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1676	0x14000eaf0
?GetClassInfoPtr@Viewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1677	0x140013078
?GetClassInfoPtr@XBaby@DirectUI@@SAPEAUIClassInfo@2@XZ	1678	0x140001c78
?GetClassInfoPtr@XElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1679	0x14001b020
?GetClassInfoW@AccessibleButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1680	0x14000bbf4
?GetClassInfoW@AnimationStrip@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1681	0x140005b10
?GetClassInfoW@AutoButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1682	0x14001b9e0
?GetClassInfoW@BaseScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1683	0x14002c7c4
?GetClassInfoW@Bind@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1684	0x140021f44
?GetClassInfoW@Browser@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1685	0x140024ac0
?GetClassInfoW@Button@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1686	0x14001d1c8
?GetClassInfoW@CCAVI@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1687	0x14002eb3c
?GetClassInfoW@CCBase@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1688	0x140015d34
?GetClassInfoW@CCBaseCheckRadioButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1689	0x140024e5c
?GetClassInfoW@CCBaseScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1690	0x140002f64
?GetClassInfoW@CCCheckBox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1691	0x140005f3c
?GetClassInfoW@CCCommandLink@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1692	0x14000d514
?GetClassInfoW@CCHScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1693	0x14003ca48
?GetClassInfoW@CCListBox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1694	0x14000d4a8
?GetClassInfoW@CCListView@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1695	0x140011d50
?GetClassInfoW@CCProgressBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1696	0x14002abe8
?GetClassInfoW@CCPushButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1697	0x1400141f4
?GetClassInfoW@CCRadioButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1698	0x140002444
?GetClassInfoW@CCSysLink@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1699	0x140024064
?GetClassInfoW@CCTrackBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1700	0x14002a1cc
?GetClassInfoW@CCTreeView@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1701	0x14001a6d0
?GetClassInfoW@CCVScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1702	0x14003f7c4
?GetClassInfoW@CheckBoxGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1703	0x1400255f8
?GetClassInfoW@Clipper@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1704	0x14002b370
?GetClassInfoW@Combobox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1705	0x140014c2c
?GetClassInfoW@DialogElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1706	0x1400027c0
?GetClassInfoW@Edit@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1707	0x140039a80
?GetClassInfoW@Element@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1708	0x14000ad54
?GetClassInfoW@ElementWithHWND@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1709	0x140019c9c
?GetClassInfoW@Expandable@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1710	0x1400340e0
?GetClassInfoW@Expando@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1711	0x140012744
?GetClassInfoW@ExpandoButtonGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1712	0x1400404ec
?GetClassInfoW@HWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1713	0x140011134
?GetClassInfoW@HWNDHost@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1714	0x14003ad48
?GetClassInfoW@ItemList@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1715	0x140003908
?GetClassInfoW@Macro@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1716	0x14001fcd8
?GetClassInfoW@ModernProgressBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1717	0x14002a090
?GetClassInfoW@ModernProgressRing@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1718	0x1400385d8
?GetClassInfoW@Movie@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1719	0x1400068cc
?GetClassInfoW@Navigator@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1720	0x14002d1f0
?GetClassInfoW@PText@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1721	0x14002afd4
?GetClassInfoW@Page@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1722	0x140019b1c
?GetClassInfoW@Pages@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1723	0x140012668
?GetClassInfoW@Progress@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1724	0x140005c28
?GetClassInfoW@PushButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1725	0x140034614
?GetClassInfoW@RadioButtonGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1726	0x14001b730
?GetClassInfoW@RefPointElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1727	0x140017ea4
?GetClassInfoW@RepeatButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1728	0x140004c2c
?GetClassInfoW@Repeater@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1729	0x140021f48
?GetClassInfoW@RichText@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1730	0x14001483c
?GetClassInfoW@ScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1731	0x1400405dc
?GetClassInfoW@ScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1732	0x14003d2ac
?GetClassInfoW@Selector@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1733	0x14003f960
?GetClassInfoW@SelectorNoDefault@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1734	0x140011a18
?GetClassInfoW@SemanticZoomToggle@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1735	0x140036804
?GetClassInfoW@StyledScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1736	0x14001a3cc
?GetClassInfoW@TextGraphic@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1737	0x14003164c
?GetClassInfoW@Thumb@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1738	0x14001cf3c
?GetClassInfoW@TouchButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1739	0x14002f0f8
?GetClassInfoW@TouchCheckBox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1740	0x14000aef8
?GetClassInfoW@TouchCheckBoxGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1741	0x140037c3c
?GetClassInfoW@TouchCommandButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1742	0x1400050ec
?GetClassInfoW@TouchEdit2@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1743	0x140003a84
?GetClassInfoW@TouchEditBase@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1744	0x140006254
?GetClassInfoW@TouchHWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1745	0x140032fec
?GetClassInfoW@TouchHyperLink@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1746	0x140028fb0
?GetClassInfoW@TouchRepeatButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1747	0x1400338ec
?GetClassInfoW@TouchScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1748	0x140027e24
?GetClassInfoW@TouchScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1749	0x140023a08
?GetClassInfoW@TouchSelect@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1750	0x1400219c8
?GetClassInfoW@TouchSelectItem@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1751	0x14002bd44
?GetClassInfoW@TouchSlider@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1752	0x14001f5ec
?GetClassInfoW@TouchSwitch@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1753	0x140014870
?GetClassInfoW@UnknownElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1754	0x14001e2c0
?GetClassInfoW@Viewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1755	0x1400193f4
?GetClassInfoW@XBaby@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1756	0x14002b254
?GetClassInfoW@XElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1757	0x140025fdc
?GetClickDevice@TouchButton@DirectUI@@QEAA?AW4ClickDevice@12@XZ	1758	0x140030a04
?GetClickablePoint@Element@DirectUI@@QEAA_NPEAUtagPOINT@@@Z	1759	0x1400401a4
?GetClientAccessibleImpl@HWNDHost@DirectUI@@QEAAJPEAPEAUIAccessible@@@Z	1760	0x14000d704
?GetColorFromProperty@DirectUI@@YAJPEAVElement@1@PEBUPropertyInfo@1@HPEAK@Z	1761	0x14001a0c4
?GetColorFromValue@DirectUI@@YAJPEAVElement@1@PEAVValue@1@PEAK@Z	1762	0x14001d208
?GetColorTrans@Value@DirectUI@@SAPEAV12@XZ	1763	0x14001141c
?GetColorize@Element@DirectUI@@QEAAHXZ	1764	0x14002ef18
?GetColumn@GridItemProxy@DirectUI@@AEAAJPEAH@Z	1765	0x140022f74
?GetColumnCount@GridProxy@DirectUI@@AEAAJPEAH@Z	1766	0x1400212ec
?GetColumnHeaderItems@TableItemProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	1767	0x140028b7c
?GetColumnHeaders@TableProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	1768	0x14000b94c
?GetCommonDrawTextFlags@Element@DirectUI@@AEAAIH@Z	1769	0x140001f9c
?GetCompositingQuality@Movie@DirectUI@@QEAAHXZ	1770	0x140018f68
?GetConnect@Bind@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1771	0x140020930
?GetContainingGrid@GridItemProxy@DirectUI@@AEAAJPEAPEAUIRawElementProviderSimple@@@Z	1772	0x140028520
?GetContent@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@PEAUIAccessible@@@Z	1773	0x140034854
?GetContentAlign@Element@DirectUI@@QEAAHXZ	1774	0x140014944
?GetContentCrossfadeOpacity@TouchScrollViewer@DirectUI@@QEAAMXZ	1775	0x1400143f0
?GetContentDesiredSize@XBaby@DirectUI@@UEAA?AUtagSIZE@@HH@Z	1776	0x14002b48c
?GetContentSize@CCBase@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1777	0x140012f74
?GetContentSize@CCBaseCheckRadioButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1778	0x14003aff0
?GetContentSize@CCCommandLink@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1779	0x140030dc0
?GetContentSize@CCHScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1780	0x14000d524
?GetContentSize@CCListBox@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1781	0x14003afc4
?GetContentSize@CCListView@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1782	0x1400301a8
?GetContentSize@CCPushButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1783	0x14000eaa8
?GetContentSize@CCSysLink@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1784	0x1400047c0
?GetContentSize@CCTreeView@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1785	0x14001af60
?GetContentSize@CCVScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1786	0x14001afec
?GetContentSize@Combobox@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1787	0x14003c634
?GetContentSize@Edit@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1788	0x140039b9c
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1789	0x140004c78
?GetContentSize@Progress@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1790	0x14003a7bc
?GetContentSize@PushButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1791	0x140030bf0
?GetContentSize@RichText@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1792	0x14002af14
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1793	0x140017824
?GetContentStringAsDisplayed@Edit@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1794	0x1400065a4
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1795	0x14002a280
?GetContentStringAsDisplayed@TextGraphic@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1796	0x140018834
?GetContentStringAsDisplayed@TouchEditBase@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1797	0x1400226d8
?GetControlType@ElementProxy@DirectUI@@IEAAXPEAUtagVARIANT@@PEAUIAccessible@@@Z	1798	0x14002d050
?GetControllerFor@TouchEditBase@DirectUI@@UEAAJPEAPEAUIUnknown@@@Z	1799	0x140027d78
?GetCount@CCListBox@DirectUI@@QEAAHXZ	1800	0x14001ed4c
?GetCount@Pages@DirectUI@@QEAAIXZ	1801	0x140003a48
?GetCreationFlags@XElement@DirectUI@@UEAAIXZ	1802	0x14000f2f0
?GetCurrentCols@GridLayout@DirectUI@@IEAAIH@Z	1803	0x14001b698
?GetCurrentCols@GridLayout@DirectUI@@IEAAIPEAVElement@2@@Z	1804	0x140025adc
?GetCurrentPage@Browser@DirectUI@@QEAAPEAVElement@2@XZ	1805	0x1400249a4
?GetCurrentPageID@Browser@DirectUI@@QEAAGXZ	1806	0x14003beac
?GetCurrentRows@GridLayout@DirectUI@@IEAAIH@Z	1807	0x14000e86c
?GetCurrentRows@GridLayout@DirectUI@@IEAAIPEAVElement@2@@Z	1808	0x140025628
?GetCursor@Value@DirectUI@@QEAAPEAUCursor@2@XZ	1809	0x1400229f8
?GetCursorNull@Value@DirectUI@@SAPEAV12@XZ	1810	0x14001c9c8
?GetDPI@Element@DirectUI@@QEAAHXZ	1811	0x140006f78
?GetDataEntry@Macro@DirectUI@@QEAAPEAUIDataEntry@2@XZ	1812	0x14003d970
?GetDblListEmpty@Value@DirectUI@@SAPEAV12@XZ	1813	0x140001794
?GetDefaultButton@DialogElement@DirectUI@@UEAAPEAVElement@2@XZ	1814	0x140032e60
?GetDefaultButton@DialogElementCore@DirectUI@@QEAAPEAVElement@2@XZ	1815	0x140012760
?GetDefaultButtonTracking@DialogElement@DirectUI@@UEAA_NXZ	1816	0x14002f4a0
?GetDefaultButtonTracking@XBaby@DirectUI@@UEAA_NXZ	1817	0x140014ed4
?GetDeferObject@Element@DirectUI@@QEAAPEAVDeferCycle@2@XZ	1818	0x140039b0c
?GetDesiredSize@Element@DirectUI@@QEAAPEBUtagSIZE@@XZ	1819	0x1400260f8
?GetDesiredSize@XProvider@DirectUI@@UEAAJHHPEAUtagSIZE@@@Z	1820	0x14000dc00
?GetDirection@Element@DirectUI@@QEAAHXZ	1821	0x140023ecc
?GetDirty@Edit@DirectUI@@QEAA_NXZ	1822	0x14003f7d0
?GetDisableMouseInRectCheck@TouchRepeatButton@DirectUI@@QEAA_NXZ	1823	0x140028090
?GetDispatchFromElement@DuiAccessible@DirectUI@@IEAAJPEAVElement@2@PEAPEAUIDispatch@@@Z	1824	0x1400269e4
?GetDisplayNode@Element@DirectUI@@QEAAPEAUHGADGET__@@XZ	1825	0x140006edc
?GetDoubleList@Value@DirectUI@@QEAAPEAV?$DynamicArray@N$0A@@2@XZ	1826	0x1400159ec
?GetDrawOutlines@Movie@DirectUI@@QEAA_NXZ	1827	0x14000d6b0
?GetEdgeHighlightColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1828	0x140020730
?GetEdgeHighlightThickness@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1829	0x140011300
?GetElListNull@Value@DirectUI@@SAPEAV12@XZ	1830	0x1400029b4
?GetElement@CCBaseScrollBar@DirectUI@@UEAAPEAVElement@2@XZ	1831	0x1400206bc
?GetElement@ElementProvider@DirectUI@@UEAAPEDVElement@2@XZ	1832	0x1400330c4
?GetElement@NativeHWNDHost@DirectUI@@QEAAPEAVElement@2@XZ	1833	0x14002124c
?GetElement@ScrollBar@DirectUI@@UEAAPEAVElement@2@XZ	1834	0x140041004
?GetElement@TaskPage@DirectUI@@IEAAPEAVElement@2@XZ	1835	0x1400299dc
?GetElement@Value@DirectUI@@QEAAPEAVElement@2@XZ	1836	0x14003f47c
?GetElement@XHost@DirectUI@@QEAAPEAVElement@2@XZ	1837	0x1400136a0
?GetElementKey@ElementProvider@DirectUI@@QEAAPEBVElement@2@XZ	1838	0x140017b68
?GetElementList@Value@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@XZ	1839	0x140012cdc
?GetElementMovesOnIHMNotify@TouchEditBase@DirectUI@@QEAA_NXZ	1840	0x14000b098
?GetElementNull@Value@DirectUI@@SAPEAV12@XZ	1841	0x1400256f4
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z	1842	0x140028ed8
?GetElementProviderImpl@TouchSelect@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z	1843	0x14001d3b8
?GetElementProviderImpl@XBaby@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z	1844	0x140028ba0
?GetElementScaleFactor@Element@DirectUI@@QEAAMXZ	1845	0x140017298
?GetElementScaledFloat@Value@DirectUI@@QEAAMPEAVElement@2@@Z	1846	0x14000718c
?GetElementScaledInt@Value@DirectUI@@QEAAHPEAVElement@2@@Z	1847	0x140034e70
?GetElementScaledPoint@Value@DirectUI@@QEAAXPEAVElement@2@PEAUtagPOINT@@@Z	1848	0x14000fcdc
?GetElementScaledRect@Value@DirectUI@@QEAAXPEAVElement@2@PEAUtagRECT@@@Z	1849	0x1400314a8
?GetElementScaledSize@Value@DirectUI@@QEAAXPEAVElement@2@PEAUtagSIZE@@@Z	1850	0x14000d318
?GetEmbeddedFragmentRoots@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	1851	0x140040990
?GetEnabled@Element@DirectUI@@QEAA_NXZ	1852	0x1400405a0
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z	1853	0x14003794c
?GetEncodedContentStringLength@Element@DirectUI@@QEAA_KXZ	1854	0x140019e8c
?GetEncodedString@Value@DirectUI@@QEAAJPEAG_K@Z	1855	0x14002e15c
?GetEncodedStringLength@Value@DirectUI@@QEAA_KXZ	1856	0x140024c44
?GetEnforceSize@PushButton@DirectUI@@QEAA_NXZ	1857	0x1400260b4
?GetExpand@Macro@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1858	0x14001a84c
?GetExpandCollapseState@EventManager@DirectUI@@CAXPEAUtagVARIANT@@@Z	1859	0x140032250
?GetExpanded@Expandable@DirectUI@@QEAA_NXZ	1860	0x1400018ac
?GetExprNull@Value@DirectUI@@SAPEAV12@XZ	1861	0x140018100
?GetExpression@Value@DirectUI@@QEAAPEAVExpression@2@XZ	1862	0x1400357d0
?GetExtent@Element@DirectUI@@QEAAPEBUtagSIZE@@PEAPEAVValue@2@@Z	1863	0x140038d10
?GetFactory@RichText@DirectUI@@QEAAPEAUIDWriteFactory@@XZ	1864	0x140015ea4
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ	1865	0x1400178b8
?GetFill@Value@DirectUI@@QEAAPEBUFill@2@XZ	1866	0x1400245fc
?GetFillpartElement@TouchSlider@DirectUI@@QEAAPEAVElement@2@XZ	1867	0x14002f7c8
?GetFilterOnPaste@TouchEditBase@DirectUI@@QEAA_NXZ	1868	0x1400285d8
?GetFlags@TouchHWNDElement@DirectUI@@QEAA?AW4TouchHWNDElementFlags@2@XZ	1869	0x140028574
?GetFloat@Value@DirectUI@@QEAAMXZ	1870	0x14001098c
?GetFloatOne@Value@DirectUI@@SAPEAV12@XZ	1871	0x140013b58
?GetFloatZero@Value@DirectUI@@SAPEAV12@XZ	1872	0x1400330d0
?GetFocus@HWNDElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderFragment@@@Z	1873	0x14001b3d4
?GetFocus@HWNDElementProxy@DirectUI@@IEAAJPEAPEAUIRawElementProviderFragment@@@Z	1874	0x14002ad38
?GetFocusableElement@XBaby@DirectUI@@UEAAPEAVElement@2@XZ	1875	0x140004a84
?GetFocusedHWNDElement@HWNDElement@DirectUI@@SAPEAV12@XZ	1876	0x1400035d4
?GetFont@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1877	0x14000fb1c
?GetFont@HWNDHost@DirectUI@@IEAAPEAUHFONT__@@XZ	1878	0x140019788
?GetFontFace@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1879	0x14001dfe4
?GetFontQuality@Element@DirectUI@@QEAAHXZ	1880	0x1400171bc
?GetFontSize@Element@DirectUI@@QEAAHXZ	1881	0x140021900
?GetFontStyle@Element@DirectUI@@QEAAHXZ	1882	0x14001bfbc
?GetFontWeight@Element@DirectUI@@QEAAHXZ	1883	0x14003248c
?GetForceEditTextToLTR@TouchEditBase@DirectUI@@QEAA_NXZ	1884	0x140021730
?GetForegroundColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1885	0x140017058
?GetForegroundColorRef@RichText@DirectUI@@UEAAJPEAK@Z	1886	0x140025b0c
?GetForegroundColorRef@TouchButton@DirectUI@@UEAAJPEAK@Z	1887	0x140003174
?GetForegroundStdColor@Element@DirectUI@@QEAAHXZ	1888	0x140037f3c
?GetFragmentRoot@ElementProxy@DirectUI@@IEAAJPEAPEAUIRawElementProviderFragmentRoot@@@Z	1889	0x1400043f8
?GetFrameDuration@AnimationStrip@DirectUI@@QEAAHXZ	1890	0x140018fb8
?GetFrameIndex@AnimationStrip@DirectUI@@QEAAHXZ	1891	0x140031e7c
?GetFrameWidth@AnimationStrip@DirectUI@@QEAAHXZ	1892	0x140037290
?GetGetSheetCallback@DUIXmlParser@DirectUI@@QEAAP6APEAVValue@2@PEBGPEAX@ZXZ	1893	0x14002cf28
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ	1894	0x14002747c
?GetGraphic@Value@DirectUI@@QEAAPEAUGraphic@2@XZ	1895	0x140040190
?GetHDC@DCSurface@DirectUI@@QEAAPEAUHDC__@@XZ	1896	0x140020bd0
?GetHInstance@DUIXmlParser@DirectUI@@QEAAPEAUHINSTANCE__@@XZ	1897	0x140019260
?GetHScroll@ScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	1898	0x140009160
?GetHScroll@StyledScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	1899	0x14000e0a8
?GetHScrollbar@TouchScrollViewer@DirectUI@@QEAAJPEAPEAVElement@2@@Z	1900	0x14000b808
?GetHWND@HWNDElement@DirectUI@@UEAAPEAUHWND__@@XZ	1901	0x1400331f4
?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ	1902	0x140002db8
?GetHWND@NativeHWNDHost@DirectUI@@QEAAPEAUHWND__@@XZ	1903	0x1400177fc
?GetHWND@XHost@DirectUI@@QEAAPEAUHWND__@@XZ	1904	0x14000a25c
?GetHWNDParent@HWNDHost@DirectUI@@QEAAPEAUHWND__@@XZ	1905	0x1400385f4
?GetHandle@ResourceModuleHandles@DirectUI@@QEAAJPEBGPEAPEAUHINSTANCE__@@@Z	1906	0x14001072c
?GetHandleEnter@TouchButton@DirectUI@@QEAA_NXZ	1907	0x140026e2c
?GetHandleEnterKey@DialogElement@DirectUI@@UEAA_NXZ	1908	0x140007868
?GetHandleGlobalEnter@TouchButton@DirectUI@@QEAA_NXZ	1909	0x14001f3fc
?GetHasShield@CCPushButton@DirectUI@@QEAA_NXZ	1910	0x140027000
?GetHeight@Element@DirectUI@@QEAAHXZ	1911	0x14003aca4
?GetHighDPI@Element@DirectUI@@QEAA_NXZ	1912	0x140032510
?GetHostedElementID@XBaby@DirectUI@@UEAAJPEAG@Z	1913	0x1400074a0
?GetHostedElementID@XProvider@DirectUI@@UEAAJPEAG@Z	1914	0x140002b9c
?GetHwnd@ElementProxy@DirectUI@@IEAAJPEAPEAUHWND__@@@Z	1915	0x14001434c
?GetID@Element@DirectUI@@QEAAGXZ	1916	0x14001e370
?GetIDsOfNames@DuiAccessible@DirectUI@@UEAAJAEBU_GUID@@PEAPEAGIKPEAJ@Z	1917	0x1400296ec
?GetIHMRect@TouchHWNDElement@DirectUI@@QEAAJPEAUtagRECT@@@Z	1918	0x14002cf34
?GetIHMState@TouchHWNDElement@DirectUI@@QEAA?AW4IHMState@2@XZ	1919	0x1400408ec
?GetIMEComposing@TouchEditBase@DirectUI@@QEAA_NXZ	1920	0x14003cb44
?GetIdentityString@DuiAccessible@DirectUI@@UEAAJKPEAPEAEPEAK@Z	1921	0x14002e0bc
?GetIdentityString@HWNDHostAccessible@DirectUI@@UEAAJKPEAPEAEPEAK@Z	1922	0x1400102a8
?GetIgnoredKeyCombos@TouchEditBase@DirectUI@@QEAA?AW4TouchEditFilteredKeyComboFlags@2@XZ	1923	0x1400362f0
?GetImage@Value@DirectUI@@QEAAPEAX_NM@Z	1924	0x140037920
?GetImmediateChild@Element@DirectUI@@QEAAPEAV12@PEAV12@@Z	1925	0x140040e28
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z	1926	0x140003010
?GetImmersiveFocusRectOffsets@TouchButton@DirectUI@@UEAAXPEAUtagRECT@@@Z	1927	0x140004ac4
?GetImmersiveFocusRectOffsets@TouchCheckBox@DirectUI@@UEAAXPEAUtagRECT@@@Z	1928	0x1400023d8
?GetImmersiveFocusRectOffsets@TouchHyperLink@DirectUI@@UEAAXPEAUtagRECT@@@Z	1929	0x14001dfb0
?GetIndex@Element@DirectUI@@QEAAHXZ	1930	0x14000a278
?GetInertiaEndpointVisibleRect@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@@Z	1931	0x140009c8c
?GetInertiaEndpointZoomLevel@TouchScrollViewer@DirectUI@@QEAAMM@Z	1932	0x140005a40
?GetInnerBorderThickness@TouchEdit2@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1933	0x14002e658
?GetInnerHWND@XElement@DirectUI@@QEAAPEAUHWND__@@XZ	1934	0x140029954
?GetInputScope@TouchEdit2@DirectUI@@QEAA?AW4__MIDL___MIDL_itf_inputscope_0000_0000_0001@@XZ	1935	0x140008ab4
?GetInt@EventManager@DirectUI@@CAJPEAUtagVARIANT@@PEAVValue@2@@Z	1936	0x140031894
?GetInt@Value@DirectUI@@QEAAHXZ	1937	0x14003b468
?GetIntMinusOne@Value@DirectUI@@SAPEAV12@XZ	1938	0x1400121fc
?GetIntZero@Value@DirectUI@@SAPEAV12@XZ	1939	0x140022008
?GetIntegrateIMECandidateList@TouchEditBase@DirectUI@@QEAA_NXZ	1940	0x140017a20
?GetInteractionMode@TouchScrollViewer@DirectUI@@QEAAHXZ	1941	0x1400350ec
?GetInterpolationMode@Movie@DirectUI@@QEAAHXZ	1942	0x1400277b0
?GetInvokeHelper@InvokeManager@DirectUI@@SAJPEAPEAVInvokeHelper@2@@Z	1943	0x140030ad4
?GetIsContinuous@TouchSlider@DirectUI@@QEAA_NXZ	1944	0x140022670
?GetIsPressed@TouchSlider@DirectUI@@QEAA_NXZ	1945	0x14004080c
?GetIsReadOnly@ValueProxy@DirectUI@@AEAAJPEAH@Z	1946	0x14001f3fc
?GetIsSelected@NavigatorSelectionItemProxy@DirectUI@@AEAAJPEAVBrowser@2@PEAH@Z	1947	0x14000367c
?GetIsSelectionRequired@BrowserSelectionProxy@DirectUI@@AEAAJPEAH@Z	1948	0x140034bec
?GetIsSelectionRequired@SelectorSelectionProxy@DirectUI@@AEAAJPEAH@Z	1949	0x140034d4c
?GetIsShowOnOffFeedback@TouchSlider@DirectUI@@QEAA_NXZ	1950	0x14003e60c
?GetIsVertical@TouchSlider@DirectUI@@QEAA_NXZ	1951	0x140037698
?GetItem@GridProvider@DirectUI@@UEAAJHHPEAPEAUIRawElementProviderSimple@@@Z	1952	0x140009888
?GetItem@GridProxy@DirectUI@@AEAAJIIPEAPEAUIRawElementProviderSimple@@@Z	1953	0x140018088
?GetItemCount@TouchSelect@DirectUI@@QEAAKXZ	1954	0x140039f74
?GetItemData@TouchSelect@DirectUI@@QEAAJHPEAPEAUIUnknown@@@Z	1955	0x14001c944
?GetItemData@TouchSelectItem@DirectUI@@QEAAJPEAPEAUIUnknown@@@Z	1956	0x140028518
?GetItemHeightInPopup@TouchSelect@DirectUI@@QEAAHXZ	1957	0x14002cb84
?GetItemState@CCTreeView@DirectUI@@QEAAIQEAU_TREEITEM@@@Z	1958	0x14002cba0
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ	1959	0x140002e20
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ	1960	0x14001d080
?GetKeyFocusedElement@DialogElement@DirectUI@@UEAAPEAVElement@2@XZ	1961	0x14001ca10
?GetKeyFocusedElement@HWNDElement@DirectUI@@SAPEAVElement@2@XZ	1962	0x1400298b0
?GetKeyWithin@Element@DirectUI@@QEAA_NXZ	1963	0x14001df0c
?GetKeyWithinChild@Element@DirectUI@@QEAAPEAV12@XZ	1964	0x140015090
?GetKeyboardNavigationCapture@TouchEditBase@DirectUI@@QEAA?AW4TouchEditKeyboardNavigationCapture@2@XZ	1965	0x140005124
?GetLabel@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@@Z	1966	0x140009358
?GetLayout@Element@DirectUI@@QEAAPEAVLayout@2@PEAPEAVValue@2@@Z	1967	0x14002668c
?GetLayout@Value@DirectUI@@QEAAPEAVLayout@2@XZ	1968	0x14001ec24
?GetLayoutChildCount@Layout@DirectUI@@QEAAIPEAVElement@2@@Z	1969	0x140018a9c
?GetLayoutIndexFromChild@Layout@DirectUI@@QEAAHPEAVElement@2@0@Z	1970	0x14001b778
?GetLayoutNull@Value@DirectUI@@SAPEAV12@XZ	1971	0x14003838c
?GetLayoutPos@Element@DirectUI@@QEAAHXZ	1972	0x140032414
?GetLightDismissIHM@TouchHWNDElement@DirectUI@@QEAA_NXZ	1973	0x14000ea94
?GetLine@CCBaseScrollBar@DirectUI@@UEAAHXZ	1974	0x140034e2c
?GetLine@FlowLayout@DirectUI@@QEAAHPEAVElement@2@0@Z	1975	0x14000cca0
?GetLine@ScrollBar@DirectUI@@UEAAHXZ	1976	0x140022a54
?GetLine@VerticalFlowLayout@DirectUI@@QEAAHPEAVElement@2@0@Z	1977	0x14000ba90
?GetLineCount@RichText@DirectUI@@QEAAKXZ	1978	0x140009c34
?GetLineSize@CCTrackBar@DirectUI@@QEAAHXZ	1979	0x140023eb4
?GetLinkIndicatorsToContent@TouchScrollViewer@DirectUI@@QEAA_NXZ	1980	0x140024ae4
?GetLocation@Element@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z	1981	0x14001e8c0
?GetManipulationCompositor@TouchScrollViewer@DirectUI@@QEAAPEAUIDirectManipulationCompositor@@XZ	1982	0x14001da84
?GetManipulationHorizontalAlignment@TouchScrollViewer@DirectUI@@QEAAHXZ	1983	0x14000b9a4
?GetManipulationManager@TouchScrollViewer@DirectUI@@QEAAPEAUIDirectManipulationManager@@XZ	1984	0x14001bd10
?GetManipulationVerticalAlignment@TouchScrollViewer@DirectUI@@QEAAHXZ	1985	0x14003b984
?GetManipulationViewport@TouchScrollViewer@DirectUI@@QEAAPEAUIDirectManipulationViewport@@_N@Z	1986	0x140023890
?GetMargin@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1987	0x140031e40
?GetMaxLength@Edit@DirectUI@@QEAAHXZ	1988	0x140016e18
?GetMaxLength@TouchEditBase@DirectUI@@QEAAHXZ	1989	0x140027948
?GetMaximum@CCBaseScrollBar@DirectUI@@UEAAHXZ	1990	0x140010f94
?GetMaximum@ModernProgressBar@DirectUI@@QEAAHXZ	1991	0x1400017b8
?GetMaximum@Progress@DirectUI@@QEAAHXZ	1992	0x1400071a4
?GetMaximum@ScrollBar@DirectUI@@UEAAHXZ	1993	0x14001555c
?GetMetering@TouchSlider@DirectUI@@QEAAHXZ	1994	0x1400104d8
?GetMinSize@Element@DirectUI@@QEAAPEBUtagSIZE@@PEAPEAVValue@2@@Z	1995	0x14001f3b0
?GetMinimum@CCBaseScrollBar@DirectUI@@UEAAHXZ	1996	0x14002aac8
?GetMinimum@ModernProgressBar@DirectUI@@QEAAHXZ	1997	0x14002f994
?GetMinimum@Progress@DirectUI@@QEAAHXZ	1998	0x14000f174
?GetMinimum@ScrollBar@DirectUI@@UEAAHXZ	1999	0x14004100c
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ	2000	0x140012b98
?GetModuleBase@CallstackTracker@DirectUI@@AEAA_KPEAX_K@Z	2001	0x140030bd8
?GetMouseFocused@Element@DirectUI@@QEAA_NXZ	2002	0x140008eec
?GetMouseWithin@Element@DirectUI@@QEAA_NXZ	2003	0x140036e94
?GetMouseWithinChild@Element@DirectUI@@QEAAPEAV12@XZ	2004	0x140036e50
?GetMouseWithinHorizontalScrollRegion@TouchScrollViewer@DirectUI@@QEAA_NXZ	2005	0x14001ee60
?GetMoveCaretToEndOnSyncContent@TouchEditBase@DirectUI@@QEAA_NXZ	2006	0x14002e5d0
?GetMultiline@Edit@DirectUI@@QEAA_NXZ	2007	0x14003a1f8
?GetMultiline@TouchEditBase@DirectUI@@QEAA_NXZ	2008	0x14001400c
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ	2009	0x14000da18
?GetNote@CCCommandLink@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2010	0x14000685c
?GetNotificationSinkHWND@XElement@DirectUI@@UEAAPEAUHWND__@@XZ	2011	0x14002d504
?GetNull@Value@DirectUI@@SAPEAV12@XZ	2012	0x1400125a8
?GetOffText@TouchSwitch@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2013	0x140035af4
?GetOnText@TouchSwitch@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2014	0x140013474
?GetOptimizeMove@HWNDHost@DirectUI@@QEAA_NXZ	2015	0x14002d774
?GetOrder@ScrollBar@DirectUI@@QEAAHXZ	2016	0x14001df28
?GetOverhang@Element@DirectUI@@QEAA_NXZ	2017	0x14002c510
?GetOverrideButtonBackground@CCPushButton@DirectUI@@QEAA_NXZ	2018	0x140030528
?GetOverrideScaleFactor@DUIXmlParser@DirectUI@@QEBA_NPEAM@Z	2019	0x140039a4c
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ	2020	0x1400352d8
?GetPVLAnimationState@Element@DirectUI@@QEAAHXZ	2021	0x14000c73c
?GetPadding@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	2022	0x140035a70
?GetPage@CCBaseScrollBar@DirectUI@@UEAAHXZ	2023	0x140019240
?GetPage@Pages@DirectUI@@QEAAPEAVElement@2@I@Z	2024	0x14002f9e8
?GetPage@Pages@DirectUI@@QEAAPEAVElement@2@PEBG@Z	2025	0x140007db4
?GetPage@ScrollBar@DirectUI@@UEAAHXZ	2026	0x1400259f4
?GetPageInc@BaseScrollBar@DirectUI@@QEAAHXZ	2027	0x14000f784
?GetPageRCID@TaskPage@DirectUI@@MEAAIXZ	2028	0x140038b28
?GetPageResID@TaskPage@DirectUI@@MEAAPEBGXZ	2029	0x14001345c
?GetPages@Browser@DirectUI@@QEAAPEAVPages@2@XZ	2030	0x14001ab28
?GetParent@Element@DirectUI@@QEAAPEAV12@XZ	2031	0x140028d08
?GetParentHWND@TaskPage@DirectUI@@QEAAPEAUHWND__@@XZ	2032	0x14003e5f8
?GetParser@DUIFactory@DirectUI@@QEAAPEAVDUIXmlParser@2@XZ	2033	0x14002560c
?GetParserCommon@DUIXmlParser@DirectUI@@IEAAJPEAPEAV12@@Z	2034	0x140010748
?GetPasswordCharacter@Edit@DirectUI@@QEAAHXZ	2035	0x140014fec
?GetPasswordCharacter@TouchEditBase@DirectUI@@QEAAHXZ	2036	0x140014af8
?GetPasswordRevealMode@TouchEdit2@DirectUI@@QEAA?AW4TouchEditPasswordRevealMode@2@XZ	2037	0x140023f20
?GetPath@Movie@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2038	0x140027874
?GetPatternProvider@ElementProvider@DirectUI@@UEAAJHPEAPEAUIUnknown@@@Z	2039	0x1400110e4
?GetPinning@BaseScrollViewer@DirectUI@@QEAAHXZ	2040	0x140041688
?GetPixelOffsetMode@Movie@DirectUI@@QEAAHXZ	2041	0x14002be08
?GetPlay@AnimationStrip@DirectUI@@QEAA_NXZ	2042	0x14001f60c
?GetPlayAllFramesMode@Movie@DirectUI@@QEAA_NXZ	2043	0x14000acd4
?GetPoint@Value@DirectUI@@QEAAPEBUtagPOINT@@XZ	2044	0x140023690
?GetPointZero@Value@DirectUI@@SAPEAV12@XZ	2045	0x140011628
?GetPopupBounds@TouchSelect@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	2046	0x140008bc0
?GetPosition@CCBaseScrollBar@DirectUI@@UEAAHXZ	2047	0x14002f8cc
?GetPosition@ModernProgressBar@DirectUI@@QEAAHXZ	2048	0x14001e034
?GetPosition@Progress@DirectUI@@QEAAHXZ	2049	0x140034d20
?GetPosition@ScrollBar@DirectUI@@UEAAHXZ	2050	0x1400335dc
?GetPredictedVisibleRect@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@@Z	2051	0x14001e938
?GetPreserveAlphaChannel@Element@DirectUI@@QEBA_NXZ	2052	0x1400344dc
?GetPressed@Button@DirectUI@@QEAA_NXZ	2053	0x140028fa0
?GetPressed@TouchButton@DirectUI@@QEAA_NXZ	2054	0x14001cbe4
?GetPreventFormatChangeUpdatingModifiedState@TouchEditBase@DirectUI@@QEAA_NXZ	2055	0x1400035a4
?GetProcs@Schema@DirectUI@@CAJXZ	2056	0x14000209c
?GetPromptText@TouchEdit2@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2057	0x14002a40c
?GetPromptWithCaret@TouchEdit2@DirectUI@@QEAA_NXZ	2058	0x14000ce34
?GetPropValPairInfo@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUIClassInfo@2@PEBG2PEAPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	2059	0x1400113e8
?GetPropValPairInfo@DUIXmlParser@DirectUI@@IEAAJULINEINFO@2@PEAUIClassInfo@2@PEBG2PEAPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	2060	0x14000c4a8
?GetProperty@Bind@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2061	0x140038e44
?GetProperty@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@H@Z	2062	0x140023c64
?GetPropertyValue@ElementProvider@DirectUI@@UEAAJHPEAUtagVARIANT@@@Z	2063	0x14001851c
?GetProportional@CCBaseScrollBar@DirectUI@@UEAA_NXZ	2064	0x140024bc0
?GetProportional@ScrollBar@DirectUI@@UEAA_NXZ	2065	0x14000ca44
?GetProvider@XElement@DirectUI@@QEAAPEAUIXProvider@2@XZ	2066	0x140009c88
?GetProviderOptions@ElementProxy@DirectUI@@IEAAJPEAW4ProviderOptions@@@Z	2067	0x14003d3b0
?GetProxyCreator@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2068	0x14003df2c
?GetProxyCreator@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2069	0x14001d600
?GetProxyCreator@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2070	0x14001a9e8
?GetProxyCreator@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2071	0x140001440
?GetProxyCreator@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2072	0x14003efdc
?GetProxyCreator@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2073	0x14002a684
?GetProxyCreator@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2074	0x1400376d0
?GetProxyCreator@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2075	0x140005504
?GetProxyCreator@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2076	0x140025484
?GetProxyCreator@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2077	0x14001e538
?GetProxyCreator@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2078	0x14003d4a4
?GetProxyCreator@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2079	0x140014bd4
?GetProxyCreator@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2080	0x14001e730
?GetProxyCreator@ElementProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2081	0x14000f018
?GetProxyCreator@ExpandCollapseProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2082	0x140007a44
?GetProxyCreator@GridItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2083	0x14002d918
?GetProxyCreator@GridProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2084	0x140010dc8
?GetProxyCreator@HWNDElementProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2085	0x14002aeb8
?GetProxyCreator@InvokeProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2086	0x14003b9e4
?GetProxyCreator@RangeValueProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2087	0x140029df4
?GetProxyCreator@ScrollItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2088	0x14000f344
?GetProxyCreator@ScrollProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2089	0x140034e08
?GetProxyCreator@SelectionItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2090	0x140013628
?GetProxyCreator@SelectionProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2091	0x14003da54
?GetProxyCreator@TableItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2092	0x140034a8c
?GetProxyCreator@TableProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2093	0x140019ee0
?GetProxyCreator@ToggleProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2094	0x140033c60
?GetProxyCreator@ValueProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2095	0x140032da4
?GetRangeMax@CCTrackBar@DirectUI@@QEAAHXZ	2096	0x140001ce0
?GetRangeMax@TouchSlider@DirectUI@@QEAAHXZ	2097	0x14000297c
?GetRangeMin@CCTrackBar@DirectUI@@QEAAHXZ	2098	0x140036094
?GetRangeMin@TouchSlider@DirectUI@@QEAAHXZ	2099	0x14000bad4
?GetRawValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z	2100	0x140019e60
?GetReadOnly@TouchEditBase@DirectUI@@QEAA_NXZ	2101	0x14003c588
?GetRect@Value@DirectUI@@QEAAPEBUtagRECT@@XZ	2102	0x140012988
?GetRectZero@Value@DirectUI@@SAPEAV12@XZ	2103	0x140027d0c
?GetRefCount@Value@DirectUI@@QEBAHXZ	2104	0x14003042c
?GetReferencePoint@RefPointElement@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z	2105	0x1400088d8
?GetRegisteredDefaultButton@DialogElement@DirectUI@@UEAAPEAVElement@2@XZ	2106	0x140006a34
?GetRenderBorderThickness@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2107	0x1400385f8
?GetRenderEdgeHighlightThickness@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2108	0x14002c34c
?GetRenderMargin@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2109	0x140033230
?GetRenderMinSize@Element@DirectUI@@QEAAXPEAUtagSIZE@@@Z	2110	0x14001a8e4
?GetRenderPadding@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2111	0x14001bd80
?GetRepeat@Movie@DirectUI@@QEAA_NXZ	2112	0x140036e64
?GetResourceHInstance@DUIXmlParser@DirectUI@@QEAAPEAUHINSTANCE__@@XZ	2113	0x14003dcd0
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ	2114	0x1400072d4
?GetRoot@XProvider@DirectUI@@IEAAPEAVElement@2@XZ	2115	0x1400223a4
?GetRootRelativeBounds@Element@DirectUI@@QEAAJPEAUtagRECT@@@Z	2116	0x140018b78
?GetRow@GridItemProxy@DirectUI@@AEAAJPEAH@Z	2117	0x1400294d4
?GetRowCount@GridProxy@DirectUI@@AEAAJPEAH@Z	2118	0x140028178
?GetRowHeaderItems@TableItemProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2119	0x14001c150
?GetRowHeaders@TableProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2120	0x1400072dc
?GetRuntimeId@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2121	0x140001720
?GetRuntimeId@ElementProxy@DirectUI@@IEAAJPEAPEAUtagSAFEARRAY@@@Z	2122	0x1400378b4
?GetScaledFloat@Value@DirectUI@@QEAAMM@Z	2123	0x140005994
?GetScaledInt@Value@DirectUI@@QEAAHM@Z	2124	0x140005b2c
?GetScaledInt@Value@DirectUI@@QEAAPEBUScaledInt@2@XZ	2125	0x140012948
?GetScaledPoint@Value@DirectUI@@QEAAXMPEAUtagPOINT@@@Z	2126	0x140006c54
?GetScaledRect@Value@DirectUI@@QEAAXMPEAUtagRECT@@@Z	2127	0x14000999c
?GetScaledSize@Value@DirectUI@@QEAAXMPEAUtagSIZE@@@Z	2128	0x140014058
?GetScrollBar@ScrollProxy@DirectUI@@AEAAPEAVBaseScrollBar@2@_N@Z	2129	0x1400283a0
?GetScrollBarHelper@ScrollProxy@DirectUI@@AEAAPEAVBaseScrollBar@2@PEAVElement@2@_N@Z	2130	0x14003d214
?GetScrollPadding@TouchScrollViewer@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	2131	0x140005de0
?GetScrollPercent@ScrollProxy@DirectUI@@AEAAJ_NPEAN@Z	2132	0x140015688
?GetScrollable@ScrollProxy@DirectUI@@AEAAJ_NPEAH@Z	2133	0x14003a2f0
?GetSelected@Element@DirectUI@@QEAA_NXZ	2134	0x14002b468
?GetSelection@BrowserSelectionProxy@DirectUI@@AEAAJPEAPEAUtagSAFEARRAY@@@Z	2135	0x14001ef84
?GetSelection@Combobox@DirectUI@@QEAAHXZ	2136	0x14002384c
?GetSelection@SelectionProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2137	0x140041288
?GetSelection@Selector@DirectUI@@QEAAPEAVElement@2@XZ	2138	0x14003c178
?GetSelection@TouchEdit2@DirectUI@@QEAAJPEAJ0@Z	2139	0x1400181b0
?GetSelection@TouchSelect@DirectUI@@QEAAPEAVElement@2@XZ	2140	0x14000aeac
?GetSelectionBackgroundColor@TouchEditBase@DirectUI@@QEAAPEAVValue@2@XZ	2141	0x14000f434
?GetSelectionContainer@SelectorSelectionItemProxy@DirectUI@@AEAAJPEAPEAUIRawElementProviderSimple@@@Z	2142	0x14001a2b0
?GetSelectionForegroundColor@TouchEditBase@DirectUI@@QEAAPEAVValue@2@XZ	2143	0x140009550
?GetSelectionIndex@TouchSelect@DirectUI@@QEAAHXZ	2144	0x1400356dc
?GetShadowIntensity@Element@DirectUI@@QEAAHXZ	2145	0x140041240
?GetSheet@DUIXmlParser@DirectUI@@QEAAJPEBGPEAPEAVValue@2@@Z	2146	0x1400388f8
?GetSheet@Element@DirectUI@@QEAAPEAVStyleSheet@2@XZ	2147	0x140030678
?GetSheetContext@DUIXmlParser@DirectUI@@QEAAPEAXXZ	2148	0x14002b9b0
?GetSheetNull@Value@DirectUI@@SAPEAV12@XZ	2149	0x140037548
?GetShortcut@Element@DirectUI@@QEAAHXZ	2150	0x14000ad34
?GetShortcutChar@Element@DirectUI@@QEAAGXZ	2151	0x140004794
?GetShortcutChar@RichText@DirectUI@@QEAAGXZ	2152	0x140038060
?GetShowClearButtonMinWidth@TouchEdit2@DirectUI@@QEAAHXZ	2153	0x14000d9c0
?GetShowKeyFocus@TouchButton@DirectUI@@QEAA_NXZ	2154	0x14003950c
?GetShowTick@TouchSlider@DirectUI@@QEAA_NXZ	2155	0x1400212d8
?GetSinkRect@HWNDHost@DirectUI@@AEAAXPEBUtagRECT@@PEAU3@@Z	2156	0x14001590c
?GetSize@Value@DirectUI@@QEAAPEBUtagSIZE@@XZ	2157	0x140018318
?GetSizeZero@Value@DirectUI@@SAPEAV12@XZ	2158	0x14000b3bc
?GetSmoothingMode@Movie@DirectUI@@QEAAHXZ	2159	0x14001c8ec
?GetSnapIntervalX@TouchScrollViewer@DirectUI@@QEAAMXZ	2160	0x14001f22c
?GetSnapIntervalY@TouchScrollViewer@DirectUI@@QEAAMXZ	2161	0x140011bec
?GetSnapMode@TouchScrollViewer@DirectUI@@QEAAHXZ	2162	0x14002dd2c
?GetSnapOffsetX@TouchScrollViewer@DirectUI@@QEAAMXZ	2163	0x14002497c
?GetSnapOffsetY@TouchScrollViewer@DirectUI@@QEAAMXZ	2164	0x140005f8c
?GetSnapPointCollectionX@TouchScrollViewer@DirectUI@@QEAAPEAV?$DynamicArray@N$0A@@2@PEAPEAVValue@2@@Z	2165	0x140026f28
?GetSnapPointCollectionY@TouchScrollViewer@DirectUI@@QEAAPEAV?$DynamicArray@N$0A@@2@PEAPEAVValue@2@@Z	2166	0x14002797c
?GetState@ModernProgressBar@DirectUI@@QEAAHXZ	2167	0x1400303b4
?GetStaticColor@HWNDHost@DirectUI@@IEAA_NPEAUHDC__@@PEAPEAUHBRUSH__@@@Z	2168	0x140032670
?GetStepCount@TouchSlider@DirectUI@@QEAAHXZ	2169	0x14000329c
?GetString@EventManager@DirectUI@@CAJPEAUtagVARIANT@@PEAVValue@2@@Z	2170	0x140013f60
?GetString@Value@DirectUI@@QEAAPEBGXZ	2171	0x14002b0f0
?GetStringDynamicScaling@Value@DirectUI@@QEAAPEBGXZ	2172	0x140015ed4
?GetStringNull@Value@DirectUI@@SAPEAV12@XZ	2173	0x140022bd4
?GetStringRPNull@Value@DirectUI@@SAPEAV12@XZ	2174	0x14003893c
?GetStyle@CCTreeView@DirectUI@@QEAAKXZ	2175	0x140035a64
?GetStyleSheet@Value@DirectUI@@QEAAPEAVStyleSheet@2@XZ	2176	0x14002397c
?GetSubContent@TouchCommandButton@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2177	0x140038c64
?GetSuppressClearButton@TouchEdit2@DirectUI@@QEAA_NXZ	2178	0x140040ab0
?GetSurfaceType@Surface@DirectUI@@SA?AW4EType@12@I@Z	2179	0x140014040
?GetSurfaceType@Surface@DirectUI@@SAIW4EType@12@@Z	2180	0x14003f894
?GetSyncContentWhileIMEComposing@TouchEditBase@DirectUI@@QEAA_NXZ	2181	0x1400142b8
?GetTargetPage@Navigator@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2182	0x14003edc8
?GetTextContentOverride@TouchSelectItem@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2183	0x140011de4
?GetTextDocument@TouchEdit2@DirectUI@@UEAAJPEAPEAUITextDocument@@@Z	2184	0x14003c658
?GetTextDocument@TouchEditBase@DirectUI@@UEAAJPEAPEAUITextDocument@@@Z	2185	0x140028bc8
?GetTextGlowSize@Element@DirectUI@@QEAAHXZ	2186	0x140022720
?GetTextHeight@Edit@DirectUI@@AEAAIXZ	2187	0x1400137cc
?GetTextHost@TouchEdit2@DirectUI@@QEAAJPEAPEAVITextHost@@@Z	2188	0x140011f10
?GetTextMode@TouchEditBase@DirectUI@@QEAA?AW4TouchEditTextMode@2@XZ	2189	0x140014c88
?GetTextSelection@TouchEdit2@DirectUI@@QEAAJPEAPEAUITextSelection@@@Z	2190	0x14003b214
?GetTextServices@TouchEdit2@DirectUI@@UEAAJPEAPEAVITextServices@@@Z	2191	0x1400209b8
?GetTextServices@TouchEditBase@DirectUI@@UEAAJPEAPEAVITextServices@@@Z	2192	0x140026d78
?GetTheme@Element@DirectUI@@AEAAJPEBGPEAPEAX@Z	2193	0x140016440
?GetThemeChanged@HWNDHost@DirectUI@@IEAAHXZ	2194	0x140039df4
?GetThemedBorder@Edit@DirectUI@@QEAA_NXZ	2195	0x14001a7e4
?GetThumb@TouchScrollBar@DirectUI@@QEAAPEAVElement@2@XZ	2196	0x14002d60c
?GetThumbElement@TouchSlider@DirectUI@@QEAAPEAVButton@2@XZ	2197	0x140017cc4
?GetThumbPosition@CCTrackBar@DirectUI@@QEAAHXZ	2198	0x14001ca34
?GetThumbValue@TouchSlider@DirectUI@@QEAAHXZ	2199	0x140014e38
?GetTickCount@TouchSlider@DirectUI@@QEAAHXZ	2200	0x14001d3c8
?GetTitleText@TouchSwitch@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2201	0x140023788
?GetToggleOnClick@TouchCheckBox@DirectUI@@QEAA_NXZ	2202	0x140033108
?GetToggleState@EventManager@DirectUI@@CAXPEAUtagVARIANT@@@Z	2203	0x140010d74
?GetToggleState@ToggleProxy@DirectUI@@AEAAJPEAW4ToggleState@@@Z	2204	0x14002ea64
?GetToggleValue@TouchSwitch@DirectUI@@QEAAHXZ	2205	0x14001da38
?GetTooltip@Element@DirectUI@@QEAA_NXZ	2206	0x14003196c
?GetTooltipMaxWidth@Element@DirectUI@@QEAAHXZ	2207	0x14000e724
?GetTooltipMaximumLineCount@TouchHWNDElement@DirectUI@@QEAAHXZ	2208	0x140040898
?GetTopLevel@Element@DirectUI@@QEAAPEAV12@XZ	2209	0x14001c5a8
?GetTrackElement@TouchSlider@DirectUI@@QEAAPEAVElement@2@XZ	2210	0x140014580
?GetTracking@CCBaseScrollBar@DirectUI@@QEAA_NXZ	2211	0x14001b488
?GetTranslatedTileRects@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@PEAII@Z	2212	0x140040a70
?GetTransparent@HWNDHost@DirectUI@@QEAA_NXZ	2213	0x140008af0
?GetTreatRightMouseButtonAsLeft@TouchButton@DirectUI@@QEAA_NXZ	2214	0x1400062b0
?GetTreeAlphaLevel@Element@DirectUI@@QEAAMXZ	2215	0x14003d1d0
?GetTrimmedLineCount@RichText@DirectUI@@QEAAKXZ	2216	0x140001ba8
?GetType@DCSurface@DirectUI@@UEBA?AW4EType@Surface@2@XZ	2217	0x14001bf8c
?GetType@Value@DirectUI@@QEBAHXZ	2218	0x14002f36c
?GetTypeInfo@DuiAccessible@DirectUI@@UEAAJIKPEAPEAUITypeInfo@@@Z	2219	0x14003b87c
?GetTypeInfoCount@DuiAccessible@DirectUI@@UEAAJPEAI@Z	2220	0x140020ba8
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	2221	0x14002cf00
?GetUIState@HWNDElement@DirectUI@@QEAAGXZ	2222	0x140011058
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ	2223	0x140025484
?GetUiaFocusDelegate@TouchEdit2@DirectUI@@UEAAPEAVElement@2@XZ	2224	0x14003eb64
?GetUnavailable@Value@DirectUI@@SAPEAV12@XZ	2225	0x1400083e4
?GetUnset@Value@DirectUI@@SAPEAV12@XZ	2226	0x140023df0
?GetVScroll@ScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	2227	0x14001e768
?GetVScroll@StyledScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	2228	0x140026b68
?GetVScrollbar@TouchScrollViewer@DirectUI@@QEAAJPEAPEAVElement@2@@Z	2229	0x140036a8c
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@P6APEBUPropertyInfo@2@XZHPEAUUpdateCache@2@@Z	2230	0x140021afc
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z	2231	0x14004160c
?GetValue@ValueProxy@DirectUI@@AEAAJPEAPEAG@Z	2232	0x140018d1c
?GetValueList@Value@DirectUI@@QEAAPEAV?$DynamicArray@PEAVValue@DirectUI@@$0A@@2@XZ	2233	0x14003dbfc
?GetValueParser@DUIXmlParser@DirectUI@@IEAAJPEAPEAVValueParser@ParserTools@2@@Z	2234	0x140023f0c
?GetVertical@ScrollBar@DirectUI@@QEAA_NXZ	2235	0x140030000
?GetViewSize@ScrollProxy@DirectUI@@AEAAJ_NPEAN@Z	2236	0x1400251e4
?GetViewer@ScrollProxy@DirectUI@@AEAAJPEAPEAVViewer@2@@Z	2237	0x14001b1a4
?GetVisible@Element@DirectUI@@QEAA_NXZ	2238	0x14002f59c
?GetVisibleRect@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@@Z	2239	0x14001d3fc
?GetVisited@TouchHyperLink@DirectUI@@QEAA_NXZ	2240	0x140037300
?GetVisualState@TouchSlider@DirectUI@@QEAAHXZ	2241	0x14002917c
?GetWantTabs@Edit@DirectUI@@QEAA_NXZ	2242	0x140013b74
?GetWidth@Element@DirectUI@@QEAAHXZ	2243	0x140004e0c
?GetWinStyle@CCBase@DirectUI@@QEAAHXZ	2244	0x14002f788
?GetWindow@DuiAccessible@DirectUI@@UEAAJPEAPEAUHWND__@@@Z	2245	0x140041600
?GetWindow@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAUHWND__@@@Z	2246	0x14000163c
?GetWindowAccessGradientColor@TouchHWNDElement@DirectUI@@QEAAPEAVValue@2@XZ	2247	0x1400352d0
?GetWindowActive@Element@DirectUI@@QEAA_NXZ	2248	0x14002e37c
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UEAAXPEAPEBGPEAI@Z	2249	0x140002e44
?GetWrapKeyboardNavigate@HWNDElement@DirectUI@@QEAA_NXZ	2250	0x14002da64
?GetX@Element@DirectUI@@QEAAHXZ	2251	0x140031eb0
?GetXBabyElement@XBaby@DirectUI@@UEAAPEAVHWNDElement@2@XZ	2252	0x140002800
?GetXBarVisibility@BaseScrollViewer@DirectUI@@QEAAHXZ	2253	0x14002c350
?GetXOffset@BaseScrollViewer@DirectUI@@QEAAHXZ	2254	0x14002c720
?GetXOffset@Viewer@DirectUI@@QEAAHXZ	2255	0x140016da8
?GetXScrollHeight@BaseScrollViewer@DirectUI@@QEAAHXZ	2256	0x1400375fc
?GetXScrollable@BaseScrollViewer@DirectUI@@QEAA_NXZ	2257	0x1400091f0
?GetXScrollable@Viewer@DirectUI@@QEAA_NXZ	2258	0x14002ec34
?GetXmlLiteDll@DUIXmlParser@DirectUI@@KAJPEAPEAUHINSTANCE__@@@Z	2259	0x140035704
?GetY@Element@DirectUI@@QEAAHXZ	2260	0x140030c10
?GetYBarVisibility@BaseScrollViewer@DirectUI@@QEAAHXZ	2261	0x14000fb58
?GetYOffset@BaseScrollViewer@DirectUI@@QEAAHXZ	2262	0x1400162a4
?GetYOffset@Viewer@DirectUI@@QEAAHXZ	2263	0x140037f0c
?GetYScrollWidth@BaseScrollViewer@DirectUI@@QEAAHXZ	2264	0x14003b480
?GetYScrollable@BaseScrollViewer@DirectUI@@QEAA_NXZ	2265	0x140033ecc
?GetYScrollable@Viewer@DirectUI@@QEAA_NXZ	2266	0x14003f890
?GetZoomMaximum@TouchScrollViewer@DirectUI@@QEAAMXZ	2267	0x14000f6c0
?GetZoomMinimum@TouchScrollViewer@DirectUI@@QEAAMXZ	2268	0x1400172f8
?GridItemPattern@Schema@DirectUI@@2HA	2269	0x140039b58
?GridItem_ColumnSpan_Property@Schema@DirectUI@@2HA	2270	0x140032044
?GridItem_Column_Property@Schema@DirectUI@@2HA	2271	0x14001c988
?GridItem_Parent_Property@Schema@DirectUI@@2HA	2272	0x14002e510
?GridItem_RowSpan_Property@Schema@DirectUI@@2HA	2273	0x14002b6c4
?GridItem_Row_Property@Schema@DirectUI@@2HA	2274	0x14003d1cc
?GridPattern@Schema@DirectUI@@2HA	2275	0x140018b30
?Grid_ColumnCount_Property@Schema@DirectUI@@2HA	2276	0x14001f068
?Grid_RowCount_Property@Schema@DirectUI@@2HA	2277	0x1400036dc
?GroupControlType@Schema@DirectUI@@2HA	2278	0x14000eb74
?HandleAccChange@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2279	0x14001ba04
?HandleAccDesc@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2280	0x140013594
?HandleAccPatternChange@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@IIHPEAUtagVARIANT@@2P6AX2@Z@Z	2281	0x14000fa84
?HandleAccRoleEvent@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@PEAVValue@2@1@Z	2282	0x140019d14
?HandleAccStateChange@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@IIHPEAUtagVARIANT@@1_N@Z	2283	0x140035378
?HandleBoolProp@EventManager@DirectUI@@CAJPEAVElement@2@P6A_N0@ZPEAUIRawElementProviderSimple@@HPEAVValue@2@3@Z	2284	0x140038bc4
?HandleChildrenEvent@EventManager@DirectUI@@CAJPEAVElement@2@PEAVValue@2@1@Z	2285	0x140039030
?HandleEnterKeyProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	2286	0x14001ef80
?HandleEnterProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2287	0x14001f238
?HandleGlobalEnterProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2288	0x140011190
?HandleRangeValue@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2289	0x14003261c
?HandleScrollPos@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2290	0x140027db4
?HandleSelectedChange@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@PEAVValue@2@@Z	2291	0x14001aa4c
?HandleStringProp@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@HPEAVValue@2@1@Z	2292	0x140027f34
?HandleToggleValue@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2293	0x140007b90
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ	2294	0x1400054ac
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z	2295	0x140010ae8
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z	2296	0x140033cd8
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2297	0x140009e10
?HandleVisibilityChange@EventManager@DirectUI@@CAJPEAVElement@2@I@Z	2298	0x140026ea4
?HasAnimation@Element@DirectUI@@QEAA_NXZ	2299	0x1400232a4
?HasBorder@Element@DirectUI@@QEAA_NXZ	2300	0x1400295f4
?HasChildren@Element@DirectUI@@QEAA_NXZ	2301	0x140003448
?HasContent@Element@DirectUI@@QEAA_NXZ	2302	0x14001c854
?HasEdgeHighlight@Element@DirectUI@@QEAA_NXZ	2303	0x140027270
?HasKeyboardFocusProperty@Schema@DirectUI@@2HA	2304	0x14000fbe0
?HasLayout@Element@DirectUI@@QEAA_NXZ	2305	0x14003eee0
?HasMargin@Element@DirectUI@@QEAA_NXZ	2306	0x14001c1e0
?HasPVLAnimationState@Element@DirectUI@@QEAA_NI@Z	2307	0x14001f560
?HasPadding@Element@DirectUI@@QEAA_NXZ	2308	0x1400093e8
?HasSelection@TouchEdit2@DirectUI@@QEAA_NXZ	2309	0x14002473c
?HasShieldProp@CCPushButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2310	0x14002ea40
?HaveWin32Focus@HWNDHost@DirectUI@@AEAA_NXZ	2311	0x140038ee0
?HeaderControlType@Schema@DirectUI@@2HA	2312	0x1400331a4
?HeaderItemControlType@Schema@DirectUI@@2HA	2313	0x140016ae0
?HeightProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2314	0x14002d818
?HelpTextProperty@Schema@DirectUI@@2HA	2315	0x140033484
?HideTouchTooltip@TouchHWNDElement@DirectUI@@QEAAJXZ	2316	0x1400350c8
?HideWindow@NativeHWNDHost@DirectUI@@QEAAXXZ	2317	0x14002e5cc
?HideWindow@XHost@DirectUI@@QEAAXXZ	2318	0x14001d9c0
?HighDPIProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2319	0x14002ae00
?Home@BaseScrollBar@DirectUI@@UEAAXXZ	2320	0x140019374
?Host@NativeHWNDHost@DirectUI@@QEAAXPEAVElement@2@@Z	2321	0x14002cdb8
?Host@XHost@DirectUI@@QEAAXPEAVElement@2@@Z	2322	0x14002c178
?Hosted@PushButton@DirectUI@@SA?AVUID@@XZ	2323	0x140029b9c
?HyperlinkControlType@Schema@DirectUI@@2HA	2324	0x140009098
?IDProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2325	0x140004ffc
?IHMNotify@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	2326	0x140002dd8
?IMEComposingProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2327	0x14001c6d0
?INITIALSTACKSKIP@CallstackTracker@DirectUI@@0HB	2328	0x14001f16c
?IgnoredKeyCombosProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2329	0x140009858
?ImageControlType@Schema@DirectUI@@2HA	2330	0x1400113e8
?ImmersiveColorSchemeChange@HWNDElement@DirectUI@@SA?AVUID@@XZ	2331	0x14001bb40
?Init@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2332	0x1400310d8
?Init@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2333	0x1400209a0
?Init@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2334	0x14003c4d0
?Init@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2335	0x140026404
?Init@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2336	0x1400256b8
?Init@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2337	0x140036cdc
?Init@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2338	0x14001cc24
?Init@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2339	0x140039e8c
?Init@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2340	0x1400191e0
?Init@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2341	0x1400205fc
?Init@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2342	0x14000dd74
?Init@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2343	0x140014ec0
?Init@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2344	0x14003a994
?Init@AutoThread@DirectUI@@QEAAJXZ	2345	0x140023b88
?Init@BrowserSelectionProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2346	0x14003982c
?Init@CallstackTracker@DirectUI@@SAHXZ	2347	0x140019450
?Init@ElementProvider@DirectUI@@MEAAJPEAVElement@2@PEAVInvokeHelper@2@@Z	2348	0x140017424
?Init@ElementProviderManager@DirectUI@@SAJXZ	2349	0x14001b5a8
?Init@ElementProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2350	0x14000d198
?Init@EventManager@DirectUI@@SAJXZ	2351	0x140013d0c
?Init@ExpandCollapseProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2352	0x1400140d4
?Init@GridItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2353	0x14003dda0
?Init@GridProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2354	0x140007ba4
?Init@HWNDElementProvider@DirectUI@@MEAAJPEAVHWNDElement@2@PEAVInvokeHelper@2@@Z	2355	0x14002c7d8
?Init@HWNDElementProxy@DirectUI@@UEAAXPEAVHWNDElement@2@@Z	2356	0x1400083c4
?Init@InvokeHelper@DirectUI@@QEAAHK@Z	2357	0x140032528
?Init@InvokeManager@DirectUI@@SAJXZ	2358	0x1400388f8
?Init@InvokeProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2359	0x1400315d8
?Init@ModernProgressBarRangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2360	0x140008f4c
?Init@NavReference@DirectUI@@QEAAXPEAVElement@2@PEAUtagRECT@@@Z	2361	0x14000b0f0
?Init@NavScoring@DirectUI@@QEAAXPEAVElement@2@HPEBUNavReference@2@@Z	2362	0x140008c78
?Init@NavigatorSelectionItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2363	0x14001db24
?Init@ProgressRangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2364	0x1400045b4
?Init@ProviderProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2365	0x140030348
?Init@RangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2366	0x140038b3c
?Init@Schema@DirectUI@@SAJXZ	2367	0x140022160
?Init@ScrollBarRangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2368	0x140035b4c
?Init@ScrollItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2369	0x140041238
?Init@ScrollProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2370	0x1400388c8
?Init@SelectionItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2371	0x140029f4c
?Init@SelectionProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2372	0x1400071e4
?Init@SelectorSelectionItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2373	0x14002cf98
?Init@SelectorSelectionProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2374	0x140029438
?Init@TableItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2375	0x14000e6d0
?Init@TableProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2376	0x140023900
?Init@ToggleProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2377	0x140017f20
?Init@ValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2378	0x140028f60
?InitOnceCallback@CallstackTracker@DirectUI@@CAHPEAT_RTL_RUN_ONCE@@PEAXPEAPEAX@Z	2379	0x1400099d8
?InitProcess@FontCache@DirectUI@@SAJXZ	2380	0x14001d5b0
?InitPropSheetPage@TaskPage@DirectUI@@MEAAXPEAU_PROPSHEETPAGEW@@@Z	2381	0x14001383c
?InitThread@FontCache@DirectUI@@SAJXZ	2382	0x14001c61c
?Initialize@AccessibleButton@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2383	0x140025e44
?Initialize@AnimationStrip@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2384	0x140002934
?Initialize@AutoButton@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2385	0x14003848c
?Initialize@BaseScrollViewer@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2386	0x140028ea4
?Initialize@Bind@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2387	0x14001595c
?Initialize@BorderLayout@DirectUI@@QEAAXXZ	2388	0x1400146e4
?Initialize@Browser@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2389	0x14000f1c0
?Initialize@Button@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2390	0x14000d6d4
?Initialize@CCBase@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2391	0x140023d48
?Initialize@CCBaseScrollBar@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2392	0x140029030
?Initialize@CCListView@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2393	0x14000e1b8
?Initialize@CCProgressBar@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2394	0x1400335f0
?Initialize@CSafeElementProxy@@IEAAJPEAVElement@DirectUI@@@Z	2395	0x1400331ec
?Initialize@CheckBoxGlyph@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2396	0x14002964c
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z	2397	0x1400054ac
?Initialize@Clipper@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2398	0x1400021fc
?Initialize@Combobox@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2399	0x1400138f0
?Initialize@DUIXmlParser@DirectUI@@IEAAJXZ	2400	0x14001f700
?Initialize@DialogElementCore@DirectUI@@QEAAXPEAUIDialogElement@2@PEAUIElementListener@2@@Z	2401	0x14003abc8
?Initialize@DuiAccessible@DirectUI@@QEAAXPEAVElement@2@@Z	2402	0x140006fb0
?Initialize@Edit@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2403	0x1400023e0
?Initialize@Element@DirectUI@@QEAAJIPEAV12@PEAK@Z	2404	0x140019fe0
?Initialize@Expando@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2405	0x140038344
?Initialize@ExpandoButtonGlyph@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2406	0x140028688
?Initialize@FillLayout@DirectUI@@QEAAXXZ	2407	0x14001c700
?Initialize@FlowLayout@DirectUI@@QEAAX_NIII@Z	2408	0x140038da0
?Initialize@GridLayout@DirectUI@@QEAAXHH@Z	2409	0x14001c148
?Initialize@HWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z	2410	0x140005764
?Initialize@HWNDElementAccessible@DirectUI@@QEAAJPEAVHWNDElement@2@@Z	2411	0x140038118
?Initialize@HWNDHost@DirectUI@@QEAAJIIPEAVElement@2@PEAK@Z	2412	0x1400287c4
?Initialize@HWNDHostAccessible@DirectUI@@QEAAJPEAVElement@2@PEAUIAccessible@@@Z	2413	0x1400091e4
?Initialize@Layout@DirectUI@@QEAAXXZ	2414	0x140005294
?Initialize@Macro@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2415	0x14001cb84
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@I@Z	2416	0x14001d27c
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBGPEAUHWND__@@PEAUHICON__@@HHHHHHI@Z	2417	0x140008698
?Initialize@Navigator@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2418	0x14003c15c
?Initialize@NineGridLayout@DirectUI@@QEAAXXZ	2419	0x1400273ac
?Initialize@PText@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2420	0x140019dd0
?Initialize@Page@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2421	0x1400068a0
?Initialize@Pages@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2422	0x14003d1e0
?Initialize@Progress@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2423	0x14000b254
?Initialize@RadioButtonGlyph@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2424	0x1400406a4
?Initialize@RefPointElement@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2425	0x14001748c
?Initialize@RepeatButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2426	0x14001ac98
?Initialize@Repeater@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2427	0x14003072c
?Initialize@RichText@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2428	0x14000bff4
?Initialize@RowLayout@DirectUI@@QEAAJHII@Z	2429	0x14004160c
?Initialize@ScrollBar@DirectUI@@QEAAJ_NPEAVElement@2@PEAK@Z	2430	0x140011c08
?Initialize@Selector@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2431	0x14002c1d0
?Initialize@SelectorNoDefault@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2432	0x14000cd44
?Initialize@SemanticZoomToggle@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2433	0x14002e4dc
?Initialize@TableLayout@DirectUI@@QEAAXHHHPEAH@Z	2434	0x1400213b0
?Initialize@TextGraphic@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2435	0x14003b650
?Initialize@Thumb@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2436	0x1400129c0
?Initialize@TouchButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2437	0x14003f4dc
?Initialize@TouchCheckBox@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2438	0x140029948
?Initialize@TouchCheckBoxGlyph@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2439	0x14002d708
?Initialize@TouchCommandButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2440	0x140041774
?Initialize@TouchEdit2@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2441	0x140035ca4
?Initialize@TouchHWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z	2442	0x14002a838
?Initialize@TouchRepeatButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2443	0x140032ddc
?Initialize@TouchScrollBar@DirectUI@@QEAAJ_NPEAVElement@2@PEAK@Z	2444	0x140014300
?Initialize@TouchSelect@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2445	0x14001577c
?Initialize@TouchSlider@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2446	0x1400099b4
?Initialize@TouchSwitch@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2447	0x140013ec4
?Initialize@UnknownElement@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2448	0x14002aeb8
?Initialize@VerticalFlowLayout@DirectUI@@QEAAX_NIII@Z	2449	0x14001aeb8
?Initialize@Viewer@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2450	0x140035ef8
?Initialize@XBaby@DirectUI@@IEAAJPEAVIXElementCP@2@PEAVXProvider@2@PEAUHWND__@@PEAVElement@2@PEAK@Z	2451	0x14001f0cc
?Initialize@XElement@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2452	0x140011b84
?Initialize@XHost@DirectUI@@QEAAJPEAVIXElementCP@2@@Z	2453	0x140024cac
?Initialize@XProvider@DirectUI@@QEAAJPEAVElement@2@PEAVIXProviderCP@2@@Z	2454	0x14000be94
?Initialize@XResourceProvider@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG11@Z	2455	0x14002ab98
?InitializeDllInfo@CallstackTracker@DirectUI@@CAHXZ	2456	0x14002eb90
?InitializeParserFromXmlReader@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUHINSTANCE__@@1@Z	2457	0x140014780
?InitializeSymbols@CallstackTracker@DirectUI@@CAHXZ	2458	0x140014654
?InnerBorderThicknessProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	2459	0x140028c24
?Insert@Element@DirectUI@@QEAAJPEAV12@I@Z	2460	0x1400400dc
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z	2461	0x140027a5c
?Insert@TouchCheckBox@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2462	0x140007b48
?Insert@TouchCheckBoxGlyph@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2463	0x14001cf5c
?Insert@TouchCommandButton@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2464	0x14003b388
?Insert@TouchEditBase@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2465	0x140012b64
?Insert@TouchSelect@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2466	0x140020034
?InsertItem@CCTreeView@DirectUI@@QEAAPEAU_TREEITEM@@PEAGIQEAU3@1@Z	2467	0x1400378e4
?InsertItem@CCTreeView@DirectUI@@QEAAPEAU_TREEITEM@@PEBUtagTVINSERTSTRUCTW@@@Z	2468	0x140029a44
?IntegrateIMECandidateListProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2469	0x1400162a8
?InteractionEnd@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	2470	0x140002630
?InteractionStart@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	2471	0x140002f2c
?InternalCreate@TableLayout@DirectUI@@SAJHHHPEAHPEAPEAVLayout@2@@Z	2472	0x14001b298
?InterpolationModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	2473	0x1400226b8
?Invoke@DuiAccessible@DirectUI@@UEAAJJAEBU_GUID@@KGPEAUtagDISPPARAMS@@PEAUtagVARIANT@@PEAUtagEXCEPINFO@@PEAI@Z	2474	0x14000321c
?Invoke@InvokeProvider@DirectUI@@UEAAJXZ	2475	0x1400067e0
?Invoke@Proxy@DirectUI@@IEAAXIPEAX@Z	2476	0x140038ec0
?InvokeAnimation@Element@DirectUI@@QEAAXHI@Z	2477	0x14002fa70
?InvokeAnimation@Element@DirectUI@@QEAAXIIMM_N@Z	2478	0x14001d980
?InvokeInvokedEvent@Schema@DirectUI@@2HA	2479	0x140022210
?InvokePattern@Schema@DirectUI@@2HA	2480	0x140001504
?IsActivityOccuring@ModernProgressBar@DirectUI@@QEAA_NXZ	2481	0x14000ccdc
?IsActivityOccuring@ModernProgressRing@DirectUI@@QEAA_NXZ	2482	0x140003924
?IsAddLayeredRef@ModernProgressBar@DirectUI@@QEAA_NXZ	2483	0x140017e10
?IsAddLayeredRef@ModernProgressRing@DirectUI@@QEAA_NXZ	2484	0x14003c7a4
?IsAutoHeight@ModernProgressBar@DirectUI@@QEAA_NXZ	2485	0x140024004
?IsBehaviorLayout@Element@DirectUI@@QEBA_NXZ	2486	0x14000a850
?IsButtonEnabledAndVisible@DialogElementCore@DirectUI@@KA_NPEAVElement@2@@Z	2487	0x1400275f4
?IsCacheDirty@Layout@DirectUI@@IEAA_NXZ	2488	0x140009948
?IsCompositedText@Element@DirectUI@@QEAA_NXZ	2489	0x140022fa4
?IsContentElementProperty@Schema@DirectUI@@2HA	2490	0x140037da4
?IsContentProtected@Edit@DirectUI@@UEAA_NXZ	2491	0x1400177ec
?IsContentProtected@Element@DirectUI@@UEAA_NXZ	2492	0x140025698
?IsContentProtected@TouchEditBase@DirectUI@@UEAA_NXZ	2493	0x140039fb4
?IsContinuousProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2494	0x14004150c
?IsControlElementProperty@Schema@DirectUI@@2HA	2495	0x140012cfc
?IsCorrectImageHlpVersion@CallstackTracker@DirectUI@@CAHXZ	2496	0x14000e5c8
?IsCrossfadeInProgress@TouchScrollViewer@DirectUI@@QEAA_NXZ	2497	0x140013ba4
?IsDefaultCAlign@Element@DirectUI@@QEAA_NXZ	2498	0x14000c408
?IsDefaultCursor@Element@DirectUI@@QEAA_NXZ	2499	0x1400351a4
?IsDescendent@Element@DirectUI@@QEAA_NPEAV12@@Z	2500	0x14001d294
?IsDescendent@XElement@DirectUI@@QEAA_NPEAVElement@2@@Z	2501	0x140002d00
?IsDescendent@XProvider@DirectUI@@UEAAJPEAVElement@2@PEA_N@Z	2502	0x140025d00
?IsDestroyed@Element@DirectUI@@QEAA_NXZ	2503	0x14001dd6c
?IsDeterminate@ModernProgressBar@DirectUI@@QEAA_NXZ	2504	0x140003c04
?IsDynamicScaled@Value@DirectUI@@QEAA_NXZ	2505	0x140040e48
?IsDynamicScaling@DUIXmlParser@DirectUI@@QEAA_NXZ	2506	0x140016a00
?IsEnabledProperty@Schema@DirectUI@@2HA	2507	0x1400355c4
?IsEqual@Value@DirectUI@@QEAA_NPEAV12@@Z	2508	0x140008368
?IsFirstElement@HWNDElement@DirectUI@@QEAA_NPEAVElement@2@@Z	2509	0x1400256c8
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ	2510	0x140019b68
?IsHosted@Element@DirectUI@@QEAA_NXZ	2511	0x140039f48
?IsIndependentAnimations@ModernProgressBar@DirectUI@@QEAA_NXZ	2512	0x14003e264
?IsKeyboardFocusableProperty@Schema@DirectUI@@2HA	2513	0x14003a7ec
?IsLastElement@HWNDElement@DirectUI@@QEAA_NPEAVElement@2@@Z	2514	0x140026624
?IsMSAAEnabled@HWNDElement@DirectUI@@UEAA_NXZ	2515	0x140012da0
?IsMSAAEnabled@TouchHWNDElement@DirectUI@@UEAA_NXZ	2516	0x14003eafc
?IsManualVisualSwapInProgress@TouchScrollViewer@DirectUI@@QEAA_NXZ	2517	0x14002de00
?IsMoveDeferred@HWNDHost@DirectUI@@IEAA_NXZ	2518	0x140006040
?IsOffscreen@Schema@DirectUI@@2HA	2519	0x140001cac
?IsPasswordProperty@Schema@DirectUI@@2HA	2520	0x140002948
?IsPatternSupported@ElementProxy@DirectUI@@IEAAJW4Pattern@Schema@2@PEA_N@Z	2521	0x14000b73c
?IsPatternSupported@ExpandCollapseProxy@DirectUI@@SA_NPEAVElement@2@@Z	2522	0x14001df04
?IsPatternSupported@GridItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2523	0x140021298
?IsPatternSupported@GridProxy@DirectUI@@SA_NPEAVElement@2@@Z	2524	0x140010a0c
?IsPatternSupported@InvokeProxy@DirectUI@@SA_NPEAVElement@2@@Z	2525	0x140005574
?IsPatternSupported@RangeValueProxy@DirectUI@@SA_NPEAVElement@2@@Z	2526	0x14000469c
?IsPatternSupported@ScrollItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2527	0x1400362a8
?IsPatternSupported@ScrollProxy@DirectUI@@SA_NPEAVElement@2@@Z	2528	0x14000e30c
?IsPatternSupported@SelectionItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2529	0x140020510
?IsPatternSupported@SelectionProxy@DirectUI@@SA_NPEAVElement@2@@Z	2530	0x1400332c0
?IsPatternSupported@TableItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2531	0x140014734
?IsPatternSupported@TableProxy@DirectUI@@SA_NPEAVElement@2@@Z	2532	0x1400171f4
?IsPatternSupported@ToggleProxy@DirectUI@@SA_NPEAVElement@2@@Z	2533	0x14003b80c
?IsPatternSupported@ValueProxy@DirectUI@@SA_NPEAVElement@2@@Z	2534	0x140002e64
?IsPeripheral@Schema@DirectUI@@2HA	2535	0x140032954
?IsPinned@BaseScrollBar@DirectUI@@QEAA_NXZ	2536	0x140009d24
?IsPointValid@Element@DirectUI@@AEAA_NNN@Z	2537	0x140009aac
?IsPopupOpen@TouchSelect@DirectUI@@QEAA_NXZ	2538	0x140030f4c
?IsPressedProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2539	0x140020274
?IsRTL@Element@DirectUI@@QEAA_NXZ	2540	0x140026c40
?IsRTLReading@Element@DirectUI@@UEAA_NXZ	2541	0x14003f15c
?IsRegisteredForAnimationStatusChanges@TouchHWNDElement@DirectUI@@QEAA_NXZ	2542	0x14000c708
?IsReorderable@ItemList@DirectUI@@QEAA_NXZ	2543	0x140039490
?IsRoot@Element@DirectUI@@QEAAHXZ	2544	0x140020b04
?IsScrollable@BaseScrollBar@DirectUI@@QEAA_NXZ	2545	0x140014d64
?IsSelfLayout@Element@DirectUI@@QEAA_NXZ	2546	0x14002aa3c
?IsShowOnOffFeedbackProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2547	0x1400035e0
?IsSmoothFillAnimation@ModernProgressBar@DirectUI@@QEAA_NXZ	2548	0x140037140
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z	2549	0x1400398dc
?IsThemeClassName@DUIXmlParser@DirectUI@@KA_NPEBUExprNode@ParserTools@2@@Z	2550	0x140011964
?IsThumbActive@TouchScrollBar@DirectUI@@QEAA_NXZ	2551	0x14002f858
?IsTileMember@TouchScrollViewer@DirectUI@@QEAA_NIPEAVElement@2@@Z	2552	0x14002557c
?IsValidAccessor@Element@DirectUI@@QEAA_NPEBUPropertyInfo@2@H_N@Z	2553	0x14001e4a8
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z	2554	0x14003bf30
?IsValidValue@Element@DirectUI@@SA_NPEBUPropertyInfo@2@PEAVValue@2@@Z	2555	0x14001422c
?IsVerticalProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2556	0x14001e01c
?IsWordWrap@Element@DirectUI@@QEAA_NXZ	2557	0x140022c74
?ItemContainerPattern@Schema@DirectUI@@2HA	2558	0x14000358c
?ItemHeightInPopupProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	2559	0x14000bc80
?ItemStatusProperty@Schema@DirectUI@@2HA	2560	0x140011c40
?ItemTypeProperty@Schema@DirectUI@@2HA	2561	0x1400241e0
?KeyFocusedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2562	0x14002661c
?KeyWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2563	0x14002369c
?KeyboardNavigate@Element@DirectUI@@SA?AVUID@@XZ	2564	0x1400177e8
?KeyboardNavigationCaptureProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2565	0x14000ab90
?LabeledByProperty@Schema@DirectUI@@2HA	2566	0x1400278d8
?LastDSConstProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2567	0x14000a470
?LayoutInvalidatedEvent@Schema@DirectUI@@2HA	2568	0x140016d80
?LayoutPosProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2569	0x140032628
?LayoutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2570	0x140016264
?Leaving@Browser@DirectUI@@SA?AVUID@@XZ	2571	0x140010b2c
?LightDismissIHMProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	2572	0x140012464
?LineDown@BaseScrollBar@DirectUI@@UEAAXI@Z	2573	0x140037dc4
?LineDown@TouchScrollBar@DirectUI@@UEAAXI@Z	2574	0x140039a7c
?LineProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2575	0x140038b5c
?LineProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2576	0x140010460
?LineSizeProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2577	0x1400242a8
?LineSpacingProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2578	0x1400387bc
?LineUp@BaseScrollBar@DirectUI@@UEAAXI@Z	2579	0x14003eff4
?LineUp@TouchScrollBar@DirectUI@@UEAAXI@Z	2580	0x14002f018
?ListControlType@Schema@DirectUI@@2HA	2581	0x14002dc6c
?ListItemControlType@Schema@DirectUI@@2HA	2582	0x14001f150
?LoadComCtl32@TaskPage@DirectUI@@AEAAJXZ	2583	0x140007ab0
?LoadCommonControlExports@AnimationStrip@DirectUI@@AEAAJXZ	2584	0x14000a8a8
?LoadFromBuffer@DUIFactory@DirectUI@@QEAAJPEBG_K0PEAVElement@2@PEAKPEAPEAV32@@Z	2585	0x14002ab7c
?LoadFromFile@DUIFactory@DirectUI@@QEAAJPEBG0PEAVElement@2@PEAKPEAPEAV32@@Z	2586	0x140031960
?LoadFromPath@Movie@DirectUI@@QEAAJPEBG@Z	2587	0x140039d00
?LoadFromResource@DUIFactory@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG1PEAVElement@2@PEAKPEAPEAV42@1@Z	2588	0x14003b9c0
?LoadFromResource@Movie@DirectUI@@QEAAJPEAUHINSTANCE__@@H@Z	2589	0x14003b604
?LoadImagesIntoAnimationStrip@AnimationStrip@DirectUI@@IEAAJXZ	2590	0x140009c3c
?LoadPage@TaskPage@DirectUI@@AEAAJPEAPEAVElement@2@PEAV32@PEAPEAVDUIXmlParser@2@@Z	2591	0x140013888
?LoadPage@TaskPage@DirectUI@@MEAAJPEAVHWNDElement@2@PEAUHINSTANCE__@@PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z	2592	0x14002ceec
?LoadParser@TaskPage@DirectUI@@MEAAJPEAPEAVDUIXmlParser@2@@Z	2593	0x140030290
?LocaleProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2594	0x140015780
?LocalizedControlTypeProperty@Schema@DirectUI@@2HA	2595	0x1400114f0
?Locate@RefPointElement@DirectUI@@SAPEAV12@PEAVElement@2@@Z	2596	0x14003d7cc
?LocationProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2597	0x14000f6a8
?LookupAccessibleRole@Schema@DirectUI@@SAHHPEA_N@Z	2598	0x140009140
?LookupControlInfos@Schema@DirectUI@@CAJXZ	2599	0x14003d5f0
?LookupElement@DUIXmlParser@DirectUI@@QEAAJPEAUIXmlReader@@PEBGPEAUHINSTANCE__@@PEAPEAUIClassInfo@2@@Z	2600	0x14003612c
?LookupElement@DUIXmlParser@DirectUI@@QEAAJULINEINFO@2@PEBGPEAUHINSTANCE__@@PEAPEAUIClassInfo@2@@Z	2601	0x140036a24
?LookupEventInfos@Schema@DirectUI@@CAJXZ	2602	0x14001ec84
?LookupPatternInfos@Schema@DirectUI@@CAJXZ	2603	0x140001e78
?LookupPropertyInfos@Schema@DirectUI@@CAJXZ	2604	0x14000f0a0
?ManipulationCompleted@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2605	0x140036c94
?ManipulationDelta@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2606	0x1400069e4
?ManipulationHorizontalAlignmentProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	2607	0x140005768
?ManipulationStarted@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2608	0x14000603c
?ManipulationStarting@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2609	0x14003a144
?ManipulationVerticalAlignmentProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	2610	0x1400380e0
?ManualStoryboardVerify@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2611	0x14003abac
?MapContentVisuals@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2612	0x1400246bc
?MapElementPoint@Element@DirectUI@@QEAAXPEAV12@PEBUtagPOINT@@PEAU3@@Z	2613	0x140019e34
?MapPropertyEnumValue@DUIXmlParser@DirectUI@@IEAAJPEBUEnumMap@2@PEBGPEAH@Z	2614	0x14001e288
?MapPropertyNameToPropertyInfo@DUIXmlParser@DirectUI@@IEAAJULINEINFO@2@PEAUIClassInfo@2@PEBGPEAPEBUPropertyInfo@2@@Z	2615	0x14001ac34
?MapRunsToClustersProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2616	0x1400414c8
?MarginProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2617	0x1400256d8
?MarkHosted@Element@DirectUI@@IEAAXXZ	2618	0x140035594
?MarkNeedsDSUpdate@Element@DirectUI@@QEAAXXZ	2619	0x14003125c
?MarkSelfLayout@Element@DirectUI@@IEAAXXZ	2620	0x14002cf10
?MaxLengthProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	2621	0x1400326a0
?MaxLengthProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2622	0x14003e12c
?MaximumProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2623	0x14003b078
?MaximumProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2624	0x140008ba0
?MaximumProp@Progress@DirectUI@@SAPEBUPropertyInfo@2@XZ	2625	0x140035e14
?MaximumProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2626	0x14002e38c
?MenuBarControlType@Schema@DirectUI@@2HA	2627	0x140024e70
?MenuClosedEvent@Schema@DirectUI@@2HA	2628	0x140039ba0
?MenuControlType@Schema@DirectUI@@2HA	2629	0x14003d6e4
?MenuItemControlType@Schema@DirectUI@@2HA	2630	0x140003b10
?MenuOpenedEvent@Schema@DirectUI@@2HA	2631	0x14000890c
?MessageCallback@Edit@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2632	0x1400295cc
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2633	0x140019258
?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2634	0x14000eee4
?MessageCallback@TouchHWNDElement@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2635	0x140014180
?MeteringProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2636	0x1400246b8
?MinSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2637	0x14000dfa4
?MinimumProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2638	0x14003288c
?MinimumProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2639	0x14003d040
?MinimumProp@Progress@DirectUI@@SAPEBUPropertyInfo@2@XZ	2640	0x1400322f8
?MinimumProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2641	0x140015d98
?MonitorPowerSettingsChange@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	2642	0x140013138
?MouseFocusedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2643	0x14002a678
?MouseOrPointerReleased@TouchSlider@DirectUI@@SA?AVUID@@XZ	2644	0x140001820
?MouseWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2645	0x14001e6b8
?MoveCaretToEndOnSyncContentProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2646	0x140004ba8
?MultilineProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	2647	0x140013dcc
?MultilineProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2648	0x1400081fc
?MultipleClick@TouchButton@DirectUI@@SA?AVUID@@XZ	2649	0x14003428c
?MultipleViewPattern@Schema@DirectUI@@2HA	2650	0x14000fc6c
?NameProperty@Schema@DirectUI@@2HA	2651	0x14000bf78
?Navigate@DuiNavigate@DirectUI@@SAPEAVElement@2@PEAV32@PEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@H@Z	2652	0x1400132f4
?Navigate@ElementProvider@DirectUI@@UEAAJW4NavigateDirection@@PEAPEAUIRawElementProviderFragment@@@Z	2653	0x140028680
?Navigate@ElementProxy@DirectUI@@IEAAJW4NavigateDirection@@PEAPEAUIRawElementProviderFragment@@@Z	2654	0x14001a644
?Navigate@XProvider@DirectUI@@UEAAJHPEA_N@Z	2655	0x140019c64
?NeedsDSUpdate@Element@DirectUI@@QEAA_NXZ	2656	0x140037f98
?NewChildElementsAdded@TouchScrollViewer@DirectUI@@QEAAXXZ	2657	0x140032654
?NewNativeWindowHandleProperty@Schema@DirectUI@@2HA	2658	0x14000e35c
?Next@DuiAccessible@DirectUI@@UEAAJKPEAUtagVARIANT@@PEAK@Z	2659	0x14000f3c8
?Next@HWNDHostAccessible@DirectUI@@UEAAJKPEAUtagVARIANT@@PEAK@Z	2660	0x14001f5e4
?NoteProp@CCCommandLink@DirectUI@@SAPEBUPropertyInfo@2@XZ	2661	0x140018884
?NotifyComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2662	0x14001bbb4
?NotifyImplicit@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2663	0x1400309c0
?NotifyStart@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2664	0x140018f38
?NotifyStoryboardComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2665	0x140014770
?NullControlType@Schema@DirectUI@@2HA	2666	0x1400248c4
?OffTextProp@TouchSwitch@DirectUI@@SAPEBUPropertyInfo@2@XZ	2667	0x14003dc0c
?OnAction@AnimationStrip@DirectUI@@IEAAXPEAUGMA_ACTIONINFO@@@Z	2668	0x14002c5cc
?OnAdd@BorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2669	0x14002a4d0
?OnAdd@Layout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2670	0x14002f4a0
?OnAdd@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2671	0x14000992c
?OnAdd@ShellBorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2672	0x140019514
?OnAdjustWindowSize@Combobox@DirectUI@@UEAAHHHI@Z	2673	0x140034b00
?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z	2674	0x140031e28
?OnChildLostFocus@DialogElement@DirectUI@@UEAA_NPEAVElement@2@@Z	2675	0x14000391c
?OnChildLostFocus@DialogElementCore@DirectUI@@QEAA_NPEAVElement@2@@Z	2676	0x14003dd38
?OnChildLostFocus@XBaby@DirectUI@@UEAA_NPEAVElement@2@@Z	2677	0x1400212d8
?OnChildReceivedFocus@DialogElement@DirectUI@@UEAA_NPEAVElement@2@@Z	2678	0x14002c3a0
?OnChildReceivedFocus@DialogElementCore@DirectUI@@QEAA_NPEAVElement@2@@Z	2679	0x14002a3f8
?OnChildReceivedFocus@XBaby@DirectUI@@UEAA_NPEAVElement@2@@Z	2680	0x14003592c
?OnCompositionChanged@HWNDElement@DirectUI@@UEAAXXZ	2681	0x140013624
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2682	0x140034d5c
?OnCustomDraw@CCBase@DirectUI@@UEAA_NPEAUtagNMCUSTOMDRAWINFO@@PEA_J@Z	2683	0x14003065c
?OnDefaultButtonTrackingChanged@DialogElementCore@DirectUI@@QEAAXPEAVValue@2@@Z	2684	0x14000c090
?OnDestroy@AnimationStrip@DirectUI@@MEAAXXZ	2685	0x14003d878
?OnDestroy@DialogElement@DirectUI@@UEAAXXZ	2686	0x140036b9c
?OnDestroy@DialogElementCore@DirectUI@@QEAAXXZ	2687	0x1400307b0
?OnDestroy@Element@DirectUI@@UEAAXXZ	2688	0x1400254b0
?OnDestroy@HWNDElement@DirectUI@@UEAAXXZ	2689	0x140007ec8
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ	2690	0x14002ef4c
?OnDestroy@ModernProgressBar@DirectUI@@MEAAXXZ	2691	0x1400302bc
?OnDestroy@ModernProgressRing@DirectUI@@MEAAXXZ	2692	0x14003b8fc
?OnDestroy@Movie@DirectUI@@UEAAXXZ	2693	0x14002b6cc
?OnDestroy@TouchHWNDElement@DirectUI@@UEAAXXZ	2694	0x1400149c8
?OnEvent@AutoButton@DirectUI@@UEAAXPEAUEvent@2@@Z	2695	0x14001861c
?OnEvent@BaseScrollViewer@DirectUI@@UEAAXPEAUEvent@2@@Z	2696	0x14003ee5c
?OnEvent@Browser@DirectUI@@UEAAXPEAUEvent@2@@Z	2697	0x1400120c8
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z	2698	0x14003bb78
?OnEvent@Expando@DirectUI@@UEAAXPEAUEvent@2@@Z	2699	0x14000dce0
?OnEvent@HWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z	2700	0x140002734
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z	2701	0x140002480
?OnEvent@Movie@DirectUI@@UEAAXPEAUEvent@2@@Z	2702	0x140035924
?OnEvent@Navigator@DirectUI@@UEAAXPEAUEvent@2@@Z	2703	0x140018154
?OnEvent@RichText@DirectUI@@UEAAXPEAUEvent@2@@Z	2704	0x14003c404
?OnEvent@ScrollBar@DirectUI@@UEAAXPEAUEvent@2@@Z	2705	0x14000ac14
?OnEvent@Selector@DirectUI@@UEAAXPEAUEvent@2@@Z	2706	0x140018f60
?OnEvent@SelectorNoDefault@DirectUI@@UEAAXPEAUEvent@2@@Z	2707	0x140003758
?OnEvent@TouchButton@DirectUI@@UEAAXPEAUEvent@2@@Z	2708	0x14001387c
?OnEvent@TouchCheckBox@DirectUI@@UEAAXPEAUEvent@2@@Z	2709	0x140006984
?OnEvent@TouchEdit2@DirectUI@@UEAAXPEAUEvent@2@@Z	2710	0x14002c570
?OnEvent@TouchHWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z	2711	0x14001d260
?OnEvent@TouchScrollBar@DirectUI@@UEAAXPEAUEvent@2@@Z	2712	0x1400397ec
?OnEvent@TouchSelect@DirectUI@@UEAAXPEAUEvent@2@@Z	2713	0x14003dd24
?OnEvent@Viewer@DirectUI@@UEAAXPEAUEvent@2@@Z	2714	0x140036864
?OnEvent@XBaby@DirectUI@@UEAAXPEAUEvent@2@@Z	2715	0x14003da64
?OnEvent@XElement@DirectUI@@UEAAXPEAUEvent@2@@Z	2716	0x14000e668
?OnGetDlgCode@DialogElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z	2717	0x140039b6c
?OnGetDlgCode@DialogElementCore@DirectUI@@QEAAXPEAUtagMSG@@PEA_J@Z	2718	0x140030cfc
?OnGetDlgCode@HWNDElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z	2719	0x14001770c
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z	2720	0x14003fa14
?OnGroupChanged@HWNDElement@DirectUI@@UEAAXH_N@Z	2721	0x1400043dc
?OnHosted@Combobox@DirectUI@@UEAAXPEAVElement@2@@Z	2722	0x140010fe8
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z	2723	0x14000af0c
?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z	2724	0x14001bb10
?OnHosted@ModernProgressBar@DirectUI@@MEAAXPEAVElement@2@@Z	2725	0x140030c8c
?OnHosted@ModernProgressRing@DirectUI@@MEAAXPEAVElement@2@@Z	2726	0x140028d2c
?OnHosted@Movie@DirectUI@@UEAAXPEAVElement@2@@Z	2727	0x140001c3c
?OnHosted@PushButton@DirectUI@@UEAAXPEAVElement@2@@Z	2728	0x140014b04
?OnHosted@RichText@DirectUI@@UEAAXPEAVElement@2@@Z	2729	0x140030c24
?OnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z	2730	0x14001afa4
?OnHosted@TouchEdit2@DirectUI@@UEAAXPEAVElement@2@@Z	2731	0x140034f1c
?OnHosted@TouchScrollBar@DirectUI@@UEAAXPEAVElement@2@@Z	2732	0x14001a8a8
?OnHosted@TouchSelect@DirectUI@@UEAAXPEAVElement@2@@Z	2733	0x140006c70
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UEAAXXZ	2734	0x1400350bc
?OnInput@BaseScrollViewer@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2735	0x140019740
?OnInput@Button@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2736	0x140017d2c
?OnInput@CCBase@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2737	0x1400256cc
?OnInput@CCCheckBox@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2738	0x140005b04
?OnInput@CCProgressBar@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2739	0x14001f398
?OnInput@CCPushButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2740	0x140031c38
?OnInput@CCRadioButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2741	0x14000e778
?OnInput@CCSysLink@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2742	0x140011ad8
?OnInput@Combobox@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2743	0x1400405e8
?OnInput@DialogElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2744	0x1400389a4
?OnInput@DialogElementCore@DirectUI@@QEAAXPEAUInputEvent@2@@Z	2745	0x14003f0d0
?OnInput@Edit@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2746	0x140008760
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2747	0x140012b30
?OnInput@HWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2748	0x140020e10
?OnInput@HWNDHost@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2749	0x1400067a0
?OnInput@RepeatButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2750	0x1400332a4
?OnInput@Selector@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2751	0x1400340d4
?OnInput@Thumb@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2752	0x14003298c
?OnInput@TouchButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2753	0x140019ef0
?OnInput@TouchEdit2@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2754	0x14001cc6c
?OnInput@TouchHWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2755	0x1400295b0
?OnInput@TouchScrollBar@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2756	0x14003b80c
?OnInput@TouchSelect@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2757	0x14000436c
?OnInput@Viewer@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2758	0x14003db5c
?OnInput@XElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2759	0x140035afc
?OnInvoke@InvokeHelper@DirectUI@@AEAAXPEAUInvokeArgs@12@@Z	2760	0x14001739c
?OnInvoke@Proxy@DirectUI@@MEAAXIPEAX@Z	2761	0x14003b6ec
?OnKeyFocusMoved@DialogElement@DirectUI@@UEAAXPEAVElement@2@0@Z	2762	0x14000b4c0
?OnKeyFocusMoved@DialogElementCore@DirectUI@@QEAAXPEAVElement@2@0@Z	2763	0x1400215b8
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z	2764	0x140034378
?OnKeyFocusMoved@Selector@DirectUI@@UEAAXPEAVElement@2@0@Z	2765	0x14003a870
?OnKeyFocusMoved@SelectorNoDefault@DirectUI@@UEAAXPEAVElement@2@0@Z	2766	0x14002a914
?OnKeyFocusMoved@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@0@Z	2767	0x14002d314
?OnKillActive@TaskPage@DirectUI@@MEAA_JXZ	2768	0x14003cd5c
?OnLayoutPosChanged@BorderLayout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2769	0x14001bc20
?OnLayoutPosChanged@Layout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2770	0x140032f1c
?OnLayoutPosChanged@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2771	0x14002e700
?OnLayoutPosChanged@ShellBorderLayout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2772	0x14001cdc0
?OnListenedEvent@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEAUEvent@2@@Z	2773	0x140039f00
?OnListenedEvent@DialogElement@DirectUI@@UEAAXPEAVElement@2@PEAUEvent@2@@Z	2774	0x1400222c8
?OnListenedEvent@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEAUEvent@2@@Z	2775	0x14002172c
?OnListenedInput@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEAUInputEvent@2@@Z	2776	0x140034430
?OnListenedInput@DialogElement@DirectUI@@UEAAXPEAVElement@2@PEAUInputEvent@2@@Z	2777	0x14002c7d0
?OnListenedInput@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEAUInputEvent@2@@Z	2778	0x14000f458
?OnListenedPropertyChanged@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2779	0x1400175fc
?OnListenedPropertyChanged@DialogElement@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2780	0x140039fac
?OnListenedPropertyChanged@ScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2781	0x1400186c8
?OnListenedPropertyChanged@StyledScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2782	0x14000ee54
?OnListenedPropertyChanged@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2783	0x1400327fc
?OnListenedPropertyChanged@TouchEdit2@DirectUI@@EEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2784	0x140021464
?OnListenedPropertyChanging@BaseScrollViewer@DirectUI@@UEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2785	0x1400033e8
?OnListenedPropertyChanging@DialogElement@DirectUI@@UEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2786	0x14001db14
?OnListenedPropertyChanging@TaskPage@DirectUI@@MEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2787	0x1400195a0
?OnListenerAttach@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@@Z	2788	0x14000441c
?OnListenerAttach@DialogElement@DirectUI@@UEAAXPEAVElement@2@@Z	2789	0x14002a688
?OnListenerAttach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z	2790	0x14002ee84
?OnListenerDetach@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@@Z	2791	0x140006b80
?OnListenerDetach@DialogElement@DirectUI@@UEAAXPEAVElement@2@@Z	2792	0x14001e84c
?OnListenerDetach@DialogElementCore@DirectUI@@QEAAXPEAVElement@2@@Z	2793	0x140002ee8
?OnListenerDetach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z	2794	0x14002a748
?OnListenerDetach@TouchEdit2@DirectUI@@EEAAXPEAVElement@2@@Z	2795	0x14000b198
?OnLostDialogFocus@Button@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2796	0x140007f74
?OnLostDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2797	0x14001f200
?OnLostDialogFocus@CCBaseCheckRadioButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2798	0x140013118
?OnLostDialogFocus@CCPushButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2799	0x14002c37c
?OnLostDialogFocus@CCSysLink@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2800	0x14000d468
?OnLostDialogFocus@CheckBoxGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2801	0x140016bbc
?OnLostDialogFocus@ExpandoButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2802	0x140018280
?OnLostDialogFocus@RadioButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2803	0x140023c18
?OnMaximumChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2804	0x14001f968
?OnMessage@CCBaseScrollBar@DirectUI@@UEAA_NI_K_JPEA_J@Z	2805	0x140030a08
?OnMessage@CCPushButton@DirectUI@@UEAA_NI_K_JPEA_J@Z	2806	0x1400220cc
?OnMessage@CCTrackBar@DirectUI@@UEAA_NI_K_JPEA_J@Z	2807	0x140036004
?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2808	0x140028dfc
?OnMessage@NativeHWNDHost@DirectUI@@UEAAJI_K_JPEA_J@Z	2809	0x140004ea0
?OnMessage@TaskPage@DirectUI@@MEAA_NI_K_JPEA_J@Z	2810	0x14001dd60
?OnMessage@XElement@DirectUI@@UEAA_NI_K_JPEA_J@Z	2811	0x1400390e4
?OnMinimumChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2812	0x14001c624
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z	2813	0x14003a52c
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z	2814	0x1400204e4
?OnNoChildWithShortcutFound@XBaby@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z	2815	0x1400054dc
?OnNotify@CCBase@DirectUI@@UEAA_NI_K_JPEA_J@Z	2816	0x140038568
?OnNotify@CCCheckBox@DirectUI@@UEAA_NI_K_JPEA_J@Z	2817	0x140030e4c
?OnNotify@CCPushButton@DirectUI@@UEAA_NI_K_JPEA_J@Z	2818	0x1400090f8
?OnNotify@CCRadioButton@DirectUI@@UEAA_NI_K_JPEA_J@Z	2819	0x14001511c
?OnNotify@CCTreeView@DirectUI@@UEAA_NI_K_JPEA_J@Z	2820	0x14003a9ec
?OnNotify@Combobox@DirectUI@@UEAA_NI_K_JPEA_J@Z	2821	0x140004c14
?OnNotify@Edit@DirectUI@@UEAA_NI_K_JPEA_J@Z	2822	0x14000cac4
?OnNotify@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2823	0x1400204f4
?OnPageChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2824	0x1400177bc
?OnPageChanging@BaseScrollBar@DirectUI@@QEAA_NPEAVValue@2@@Z	2825	0x140033538
?OnPositionChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2826	0x1400378e8
?OnPositionChanging@BaseScrollBar@DirectUI@@QEAA_NPEAVValue@2@@Z	2827	0x1400159f8
?OnPropertyChanged@AccessibleButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2828	0x140038638
?OnPropertyChanged@AnimationStrip@DirectUI@@MEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2829	0x140003c28
?OnPropertyChanged@BaseScrollViewer@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2830	0x140034ec0
?OnPropertyChanged@Browser@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2831	0x14002f278
?OnPropertyChanged@Button@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2832	0x14001d594
?OnPropertyChanged@CCBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2833	0x14002d444
?OnPropertyChanged@CCBaseCheckRadioButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2834	0x14002a6b0
?OnPropertyChanged@CCBaseScrollBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2835	0x140019364
?OnPropertyChanged@CCCommandLink@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2836	0x14003cd98
?OnPropertyChanged@CCPushButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2837	0x14003a4cc
?OnPropertyChanged@CCTrackBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2838	0x14000f7c8
?OnPropertyChanged@Combobox@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2839	0x140034518
?OnPropertyChanged@DialogElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2840	0x14003222c
?OnPropertyChanged@Edit@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2841	0x140021968
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z	2842	0x140008044
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2843	0x140035054
?OnPropertyChanged@Expando@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2844	0x140026ddc
?OnPropertyChanged@HWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2845	0x1400209a4
?OnPropertyChanged@HWNDHost@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2846	0x14001c6fc
?OnPropertyChanged@ItemList@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2847	0x140036b48
?OnPropertyChanged@Macro@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2848	0x140010e28
?OnPropertyChanged@ModernProgressBar@DirectUI@@MEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2849	0x1400027f8
?OnPropertyChanged@ModernProgressRing@DirectUI@@MEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2850	0x14001a0f8
?OnPropertyChanged@RefPointElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2851	0x140017cdc
?OnPropertyChanged@RichText@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2852	0x1400261a0
?OnPropertyChanged@ScrollBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2853	0x140020818
?OnPropertyChanged@ScrollViewer@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2854	0x14003923c
?OnPropertyChanged@Selector@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2855	0x140034088
?OnPropertyChanged@TextGraphic@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2856	0x140015194
?OnPropertyChanged@TouchButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2857	0x140022118
?OnPropertyChanged@TouchCheckBox@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2858	0x14002597c
?OnPropertyChanged@TouchCommandButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2859	0x14002fe48
?OnPropertyChanged@TouchEdit2@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2860	0x14002dcd0
?OnPropertyChanged@TouchEditBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2861	0x14002a5a4
?OnPropertyChanged@TouchHWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2862	0x140025074
?OnPropertyChanged@TouchHyperLink@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2863	0x14000a970
?OnPropertyChanged@TouchRepeatButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2864	0x14001fe9c
?OnPropertyChanged@TouchScrollBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2865	0x14002bf78
?OnPropertyChanged@TouchSelect@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2866	0x140005c24
?OnPropertyChanged@Viewer@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2867	0x140004360
?OnPropertyChanging@BaseScrollViewer@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2868	0x14004087c
?OnPropertyChanging@CCBaseScrollBar@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2869	0x14002fb74
?OnPropertyChanging@CCTrackBar@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2870	0x14003cad8
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z	2871	0x14001a394
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2872	0x14000fda4
?OnPropertyChanging@PText@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2873	0x14001293c
?OnPropertyChanging@ScrollBar@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2874	0x140013a8c
?OnPropertyChanging@TextGraphic@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2875	0x140026b04
?OnPropertyChanging@TouchCheckBox@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2876	0x140032d54
?OnPropertyChanging@TouchCheckBoxGlyph@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2877	0x140006778
?OnPropertyChanging@TouchCommandButton@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2878	0x14003ed7c
?OnPropertyChanging@TouchEdit2@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2879	0x140041234
?OnPropertyChanging@TouchEditBase@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2880	0x140035a38
?OnPropertyChanging@TouchSelect@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2881	0x14001db64
?OnPropertyChanging@Viewer@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2882	0x14003db14
?OnQueryCancel@TaskPage@DirectUI@@MEAA_JXZ	2883	0x1400356b8
?OnQueryInitialFocus@TaskPage@DirectUI@@MEAAPEAVElement@2@XZ	2884	0x14002ac00
?OnReceivedDialogFocus@Button@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2885	0x140019560
?OnReceivedDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2886	0x14000f5ac
?OnReceivedDialogFocus@CCBaseCheckRadioButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2887	0x140033260
?OnReceivedDialogFocus@CCPushButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2888	0x140035128
?OnReceivedDialogFocus@CCSysLink@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2889	0x140003134
?OnReceivedDialogFocus@CheckBoxGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2890	0x140022f70
?OnReceivedDialogFocus@ExpandoButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2891	0x140038d68
?OnReceivedDialogFocus@RadioButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2892	0x14002e1cc
?OnRegisteredDefaultButtonChanged@DialogElementCore@DirectUI@@QEAAXPEAVValue@2@0@Z	2893	0x140008dc4
?OnRemove@BorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2894	0x140037978
?OnRemove@Layout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2895	0x1400371ac
?OnRemove@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2896	0x14000f7a4
?OnRemove@ShellBorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2897	0x140014898
?OnReset@TaskPage@DirectUI@@MEAA_JXZ	2898	0x140030c68
?OnSelectedPropertyChanged@CCCommandLink@DirectUI@@UEAAXXZ	2899	0x140002604
?OnSelectedPropertyChanged@CCPushButton@DirectUI@@UEAAXXZ	2900	0x1400150e0
?OnSetActive@TaskPage@DirectUI@@MEAA_JXZ	2901	0x14003fb94
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2902	0x140029294
?OnSinkThemeChanged@XElement@DirectUI@@UEAA_NI_K_JPEA_J@Z	2903	0x140037ee4
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z	2904	0x14000cb70
?OnSysChar@XElement@DirectUI@@UEAA_NG@Z	2905	0x140005ae0
?OnTextProp@TouchSwitch@DirectUI@@SAPEBUPropertyInfo@2@XZ	2906	0x140008500
?OnThemeChanged@HWNDElement@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z	2907	0x14000d66c
?OnThemeChanged@XBaby@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z	2908	0x14001c08c
?OnToolTip@EventManager@DirectUI@@SAJPEAVElement@2@K@Z	2909	0x14001375c
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z	2910	0x1400265e8
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z	2911	0x14000a998
?OnUnHosted@ModernProgressBar@DirectUI@@MEAAXPEAVElement@2@@Z	2912	0x14002e610
?OnUnHosted@ModernProgressRing@DirectUI@@MEAAXPEAVElement@2@@Z	2913	0x14003bbe0
?OnUnHosted@PushButton@DirectUI@@UEAAXPEAVElement@2@@Z	2914	0x14002c328
?OnUnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z	2915	0x140028e1c
?OnUnHosted@TouchSelect@DirectUI@@UEAAXPEAVElement@2@@Z	2916	0x14002cd64
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z	2917	0x1400117e8
?OnWizBack@TaskPage@DirectUI@@MEAA_JXZ	2918	0x14001b674
?OnWizFinish@TaskPage@DirectUI@@MEAA_JXZ	2919	0x14000c690
?OnWizNext@TaskPage@DirectUI@@MEAA_JXZ	2920	0x14002aaa4
?OnWmSettingChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z	2921	0x1400102b8
?OnWmThemeChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z	2922	0x140029ac4
?OnWmThemeChanged@XBaby@DirectUI@@UEAAX_K_J@Z	2923	0x14003f6ec
?OnWndMsg@TaskPage@DirectUI@@AEAAHI_K_JPEA_J@Z	2924	0x1400094a0
?OpenAnimation@CCAVI@DirectUI@@AEAAXPEAUHWND__@@@Z	2925	0x14000b6d0
?OpenPopup@TouchSelect@DirectUI@@QEAAJXZ	2926	0x140032a54
?OptimizeMoveProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	2927	0x14001f26c
?OrderProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2928	0x140027c78
?Orientation@Schema@DirectUI@@2HA	2929	0x14000f3d8
?OverhangOffsetProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2930	0x14003c120
?OverhangProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2931	0x14002f808
?OverrideButtonBackgroundProp@CCPushButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2932	0x1400274c8
?OverrideZoomThreshold@TouchScrollViewer@DirectUI@@QEAAJMMH@Z	2933	0x140012080
?PaddingProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2934	0x140011aac
?PageDown@BaseScrollBar@DirectUI@@UEAAXI@Z	2935	0x140002004
?PageDown@TouchScrollBar@DirectUI@@UEAAXI@Z	2936	0x140040ba0
?PageProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2937	0x14000b360
?PageProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2938	0x1400349c4
?PageUp@BaseScrollBar@DirectUI@@UEAAXI@Z	2939	0x14000420c
?PageUp@TouchScrollBar@DirectUI@@UEAAXI@Z	2940	0x140018dac
?Paint@AnimationStrip@DirectUI@@MEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2941	0x140034c1c
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2942	0x14000a6b4
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2943	0x14003a720
?Paint@ModernProgressBar@DirectUI@@MEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2944	0x14001c6e8
?Paint@ModernProgressRing@DirectUI@@MEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2945	0x1400089e4
?Paint@Movie@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2946	0x140035938
?Paint@Progress@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2947	0x140025cc4
?Paint@RichText@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2948	0x14002fc90
?Paint@TouchCheckBox@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2949	0x1400123c4
?Paint@TouchCheckBoxGlyph@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2950	0x140023160
?Paint@TouchCommandButton@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2951	0x140040fbc
?Paint@TouchEdit2@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2952	0x14003ea00
?PaintBackground@Element@DirectUI@@QEAAXPEAUHDC__@@PEAVValue@2@AEBUtagRECT@@222@Z	2953	0x1400250c8
?PaintBorder@Element@DirectUI@@QEAAXPEAUHDC__@@PEAVValue@2@PEAUtagRECT@@AEBU5@@Z	2954	0x140029e48
?PaintContent@Element@DirectUI@@QEAAXPEAUHDC__@@PEBUtagRECT@@@Z	2955	0x140034c70
?PaintEdgeHighlight@Element@DirectUI@@QEAAXPEAUHDC__@@AEBUtagRECT@@1@Z	2956	0x14000c3b8
?PaintFocusRect@Element@DirectUI@@QEAAXPEAUHDC__@@PEBUtagRECT@@1@Z	2957	0x140006878
?PaintStringContent@Element@DirectUI@@QEAAXPEAUHDC__@@PEBUtagRECT@@PEAVValue@2@H@Z	2958	0x14002d24c
?PaneControlType@Schema@DirectUI@@2HA	2959	0x14000d2b4
?ParentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2960	0x140020e18
?ParseARGBColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAKPEA_N@Z	2961	0x14003bfb4
?ParseArgs@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEATParsedArg@12@IPEBD@Z	2962	0x1400244b0
?ParseAtomValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2963	0x1400142fc
?ParseBehavior@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@@Z	2964	0x14003c49c
?ParseBehaviorArgValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2965	0x140032e2c
?ParseBoolValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2966	0x140006a74
?ParseColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAK@Z	2967	0x140005904
?ParseDFCFill@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2968	0x14001636c
?ParseDTBFill@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2969	0x14003f7fc
?ParseDoubleListValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2970	0x14003b93c
?ParseFillValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2971	0x140041040
?ParseFloat@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAMPEA_N@Z	2972	0x140008594
?ParseFloatValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2973	0x14003519c
?ParseFunction@DUIXmlParser@DirectUI@@IEAAJPEBGPEBUExprNode@ParserTools@2@PEATParsedArg@12@IPEBD@Z	2974	0x140005fb8
?ParseGTCColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAKPEA_N@Z	2975	0x140008044
?ParseGTFStr@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2976	0x14003df64
?ParseGTMarRect@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledRECT@2@PEA_N@Z	2977	0x14000eb3c
?ParseGTMetInt@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAHPEA_N@Z	2978	0x140005ebc
?ParseGTPartSize@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledSIZE@2@PEA_N@Z	2979	0x14000dae4
?ParseGradientFill@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2980	0x1400256dc
?ParseGraphicGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2981	0x140005ec8
?ParseGraphicHelper@DUIXmlParser@DirectUI@@IEAAJ_NPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2982	0x140029400
?ParseGraphicValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2983	0x140008094
?ParseIconGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2984	0x1400281d8
?ParseImageGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2985	0x14000dce0
?ParseIntValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2986	0x140010430
?ParseLayoutValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@@Z	2987	0x140004ac8
?ParseLibrary@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAUHINSTANCE__@@@Z	2988	0x140012bc8
?ParseLiteral@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEBG@Z	2989	0x140019100
?ParseLiteralColor@DUIXmlParser@DirectUI@@IEAAJPEBGPEAK@Z	2990	0x14002f490
?ParseLiteralColorInt@DUIXmlParser@DirectUI@@IEAAJPEBGPEAH@Z	2991	0x140002164
?ParseLiteralNumber@DUIXmlParser@DirectUI@@IEAAJPEBGPEAHPEA_N@Z	2992	0x1400268dc
?ParseMagnitude@DUIXmlParser@DirectUI@@IEAAJPEBGPEAHPEA_N@Z	2993	0x14000e17c
?ParseMagnitudeFloat@DUIXmlParser@DirectUI@@IEAAJPEBGPEAMPEA_N@Z	2994	0x1400019e4
?ParseNumber@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAHPEA_N@Z	2995	0x14003c9fc
?ParsePointValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2996	0x140007550
?ParseQuotedString@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEBG@Z	2997	0x140036b10
?ParseRGBColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAKPEA_N@Z	2998	0x140037df4
?ParseRect@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledRECT@2@@Z	2999	0x14000ad30
?ParseRectRect@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledRECT@2@PEA_N@Z	3000	0x14001ca4c
?ParseRectValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3001	0x1400066a4
?ParseResStr@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	3002	0x140001684
?ParseResid@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEBG@Z	3003	0x1400047d0
?ParseSGraphicGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	3004	0x140008884
?ParseSGraphicHelper@DUIXmlParser@DirectUI@@IEAAJ_NPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3005	0x140020b54
?ParseSize@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledSIZE@2@@Z	3006	0x14001ee40
?ParseSizeSize@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledSIZE@2@PEA_N@Z	3007	0x140021310
?ParseSizeValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3008	0x14002c0ec
?ParseStringValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3009	0x14003dfcc
?ParseStyleSheets@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	3010	0x1400176a4
?ParseSysMetricInt@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAHPEA_N@Z	3011	0x140017c74
?ParseSysMetricStr@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	3012	0x14000b9dc
?ParseTheme@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@_NPEAPEAX@Z	3013	0x1400088a0
?PasswordCharacterProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	3014	0x140029df8
?PasswordCharacterProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3015	0x140037bd4
?PasswordRevealModeProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3016	0x140014274
?Paste@TouchEditBase@DirectUI@@SA?AVUID@@XZ	3017	0x140041280
?PasteText@TouchEdit2@DirectUI@@QEAAJPEBG@Z	3018	0x140004748
?PathProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3019	0x1400257f0
?PatternFromPatternId@Schema@DirectUI@@SA?AW4Pattern@12@H@Z	3020	0x140006ac0
?Pause@Movie@DirectUI@@QEAAXXZ	3021	0x14000bbdc
?PfnIsSupportedFromPattern@Schema@DirectUI@@SAP6A_NPEAVElement@2@@ZW4Pattern@12@@Z	3022	0x140016328
?PinningProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3023	0x140011d08
?PixelOffsetModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3024	0x140008294
?Play@CCAVI@DirectUI@@QEAAXPEAUHWND__@@@Z	3025	0x140034c18
?Play@Movie@DirectUI@@QEAAXXZ	3026	0x14000c1cc
?PlayAllFramesModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3027	0x140016e6c
?PlayProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	3028	0x140022174
?PopupBoundsProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	3029	0x1400345a8
?PopupChange@TouchSelect@DirectUI@@SA?AVUID@@XZ	3030	0x14001e790
?PosInLayoutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3031	0x140030a64
?PositionProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3032	0x14003fc68
?PositionProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3033	0x14000b398
?PositionProp@Progress@DirectUI@@SAPEBUPropertyInfo@2@XZ	3034	0x140019a1c
?PositionProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3035	0x14001bc78
?PostCreate@CCAVI@DirectUI@@MEAAXPEAUHWND__@@@Z	3036	0x140024c98
?PostCreate@CCBase@DirectUI@@MEAAXPEAUHWND__@@@Z	3037	0x140032b48
?PostCreate@CCBaseCheckRadioButton@DirectUI@@MEAAXPEAUHWND__@@@Z	3038	0x140040188
?PostCreate@CCCommandLink@DirectUI@@MEAAXPEAUHWND__@@@Z	3039	0x14000fffc
?PostCreate@CCTrackBar@DirectUI@@MEAAXPEAUHWND__@@@Z	3040	0x140025684
?PrepareManualSwapDeferredZoomToRect@TouchScrollViewer@DirectUI@@QEAAJPEBUtagRECT@@PEBM1PEAM2M@Z	3041	0x140031af8
?PressedProp@Button@DirectUI@@SAPEBUPropertyInfo@2@XZ	3042	0x1400196a8
?PressedProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3043	0x140007ae0
?PreventFormatChangeUpdatingModifiedStateProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3044	0x140008ed4
?PrintRTLControl@HWNDHost@DirectUI@@IEAAXPEAUHDC__@@0AEBUtagRECT@@@Z	3045	0x140024974
?ProcessIdProperty@Schema@DirectUI@@2HA	3046	0x14000330c
?ProcessingKeyboardNavigation@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3047	0x14002caa8
?ProgressBarControlType@Schema@DirectUI@@2HA	3048	0x14002cd8c
?PromptTextProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3049	0x14000146c
?PromptWithCaretProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3050	0x14001be9c
?PropSheet_SendMessage@TaskPage@DirectUI@@IEAA_JI_K_J@Z	3051	0x1400351fc
?PropertyChangedCore@Edit@DirectUI@@AEAAXPEBUPropertyInfo@2@HPEAVValue@2@PEAUHWND__@@@Z	3052	0x140035174
?PropertyChangingListener@EventManager@DirectUI@@SAJPEAVElement@2@PEBUPropertyInfo@2@PEA_N@Z	3053	0x140020ad8
?PropertyListener@EventManager@DirectUI@@SAJPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	3054	0x14000d7b0
?PropertyProp@Bind@DirectUI@@SAPEBUPropertyInfo@2@XZ	3055	0x14003b92c
?ProportionalProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3056	0x1400232fc
?QueryInterface@DuiAccessible@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3057	0x14003ca30
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3058	0x140040828
?QueryInterface@ElementProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3059	0x140031160
?QueryInterface@ExpandCollapseProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3060	0x14000a61c
?QueryInterface@GridItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3061	0x14002d9c0
?QueryInterface@GridProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3062	0x140007ad8
?QueryInterface@HWNDElementProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3063	0x14000cb7c
?QueryInterface@HWNDHostAccessible@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3064	0x14002f3fc
?QueryInterface@InvokeProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3065	0x140019ea0
?QueryInterface@RangeValueProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3066	0x140030c60
?QueryInterface@ScrollItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3067	0x14000ec20
?QueryInterface@ScrollProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3068	0x140007744
?QueryInterface@SelectionItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3069	0x140018fc4
?QueryInterface@SelectionProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3070	0x1400173b0
?QueryInterface@TableItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3071	0x140031418
?QueryInterface@TableProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3072	0x1400404dc
?QueryInterface@ToggleProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3073	0x14001934c
?QueryInterface@ValueProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3074	0x14003d16c
?QueryInterface@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3075	0x140031014
?QueryService@DuiAccessible@DirectUI@@UEAAJAEBU_GUID@@0PEAPEAX@Z	3076	0x14000a584
?QueryService@HWNDHostAccessible@DirectUI@@UEAAJAEBU_GUID@@0PEAPEAX@Z	3077	0x14002159c
?QuerySysMetric@DUIXmlParser@DirectUI@@IEAAHHPEA_N@Z	3078	0x14000b3d4
?QuerySysMetricStr@DUIXmlParser@DirectUI@@IEAAPEBGHPEAGI@Z	3079	0x14002a278
?QueueDefaultAction@Element@DirectUI@@QEAAJXZ	3080	0x140031834
?RadioButtonControlType@Schema@DirectUI@@2HA	3081	0x140013378
?RaiseChildRemovedEvent@EventManager@DirectUI@@CAJAEBUElementRuntimeId@2@PEAVElement@2@@Z	3082	0x140037adc
?RaiseGeometryEventWorker@EventManager@DirectUI@@CAJPEAURectangleChange@2@_N111@Z	3083	0x140016120
?RaiseGeometryEvents@EventManager@DirectUI@@CAJXZ	3084	0x14002f7dc
?RaiseStructureChangedEvent@EventManager@DirectUI@@CAJPEAVElement@2@W4StructureChangeType@@@Z	3085	0x140012414
?RaiseStructureEvents@EventManager@DirectUI@@CAJXZ	3086	0x14001be10
?RaiseVisibilityEvents@EventManager@DirectUI@@CAJXZ	3087	0x140013f14
?RangeMaxProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3088	0x140040468
?RangeMinProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3089	0x140030744
?RangeValuePattern@Schema@DirectUI@@2HA	3090	0x140038064
?RangeValue_IsReadOnly_Property@Schema@DirectUI@@2HA	3091	0x1400317e4
?RangeValue_LargeChange_Property@Schema@DirectUI@@2HA	3092	0x14000eaa0
?RangeValue_Maximum_Property@Schema@DirectUI@@2HA	3093	0x1400185c0
?RangeValue_Minimum_Property@Schema@DirectUI@@2HA	3094	0x140012218
?RangeValue_SmallChange_Property@Schema@DirectUI@@2HA	3095	0x1400111bc
?RangeValue_Value_Property@Schema@DirectUI@@2HA	3096	0x140022200
?RawActionProc@AnimationStrip@DirectUI@@KAXPEAUGMA_ACTIONINFO@@@Z	3097	0x14000b454
?RawActionProc@Movie@DirectUI@@SAXPEAUGMA_ACTIONINFO@@@Z	3098	0x1400306d4
?ReadOnlyProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3099	0x14002f86c
?Recalc@AccessibleButton@DirectUI@@QEAAXXZ	3100	0x1400247bc
?ReferencePointProp@RefPointElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3101	0x140040ac4
?ReflowStyle@PVLAnimation@DirectUI@@SA?AVUID@@XZ	3102	0x1400227a8
?RefreshContent@TouchEdit2@DirectUI@@UEAAJXZ	3103	0x140033c60
?RefreshContent@TouchEditBase@DirectUI@@UEAAJXZ	3104	0x140037468
?Register@AccessibleButton@DirectUI@@SAJXZ	3105	0x14001bc64
?Register@AnimationStrip@DirectUI@@SAJXZ	3106	0x140016770
?Register@AutoButton@DirectUI@@SAJXZ	3107	0x14001d454
?Register@BaseScrollViewer@DirectUI@@SAJXZ	3108	0x140023270
?Register@Bind@DirectUI@@SAJXZ	3109	0x14000628c
?Register@Browser@DirectUI@@SAJXZ	3110	0x140018f80
?Register@Button@DirectUI@@SAJXZ	3111	0x14003a160
?Register@CCAVI@DirectUI@@SAJXZ	3112	0x14003fae8
?Register@CCBase@DirectUI@@SAJXZ	3113	0x140011f88
?Register@CCBaseCheckRadioButton@DirectUI@@SAJXZ	3114	0x14001e764
?Register@CCBaseScrollBar@DirectUI@@SAJXZ	3115	0x140017dfc
?Register@CCCheckBox@DirectUI@@SAJXZ	3116	0x140003cc0
?Register@CCCommandLink@DirectUI@@SAJXZ	3117	0x1400113fc
?Register@CCHScrollBar@DirectUI@@SAJXZ	3118	0x140005114
?Register@CCListBox@DirectUI@@SAJXZ	3119	0x14002dad4
?Register@CCListView@DirectUI@@SAJXZ	3120	0x14002efcc
?Register@CCProgressBar@DirectUI@@SAJXZ	3121	0x14003a6c0
?Register@CCPushButton@DirectUI@@SAJXZ	3122	0x1400241e4
?Register@CCRadioButton@DirectUI@@SAJXZ	3123	0x1400054b4
?Register@CCSysLink@DirectUI@@SAJXZ	3124	0x14000a618
?Register@CCTrackBar@DirectUI@@SAJXZ	3125	0x140005190
?Register@CCTreeView@DirectUI@@SAJXZ	3126	0x140022f1c
?Register@CCVScrollBar@DirectUI@@SAJXZ	3127	0x14001512c
?Register@CheckBoxGlyph@DirectUI@@SAJXZ	3128	0x140018f60
?Register@ClassInfoBase@DirectUI@@QEAAJXZ	3129	0x140011e4c
?Register@Clipper@DirectUI@@SAJXZ	3130	0x140039c44
?Register@Combobox@DirectUI@@SAJXZ	3131	0x140026cfc
?Register@DialogElement@DirectUI@@SAJXZ	3132	0x140040254
?Register@Edit@DirectUI@@SAJXZ	3133	0x1400240d0
?Register@Element@DirectUI@@SAJXZ	3134	0x1400223a4
?Register@ElementWithHWND@DirectUI@@SAJXZ	3135	0x14002344c
?Register@Expandable@DirectUI@@SAJXZ	3136	0x14001f018
?Register@Expando@DirectUI@@SAJXZ	3137	0x14000bb4c
?Register@ExpandoButtonGlyph@DirectUI@@SAJXZ	3138	0x1400212b8
?Register@HWNDElement@DirectUI@@SAJXZ	3139	0x14002d748
?Register@HWNDHost@DirectUI@@SAJXZ	3140	0x14002ccb0
?Register@ItemList@DirectUI@@SAJXZ	3141	0x140018cf8
?Register@Macro@DirectUI@@SAJXZ	3142	0x140001cb8
?Register@ModernProgressBar@DirectUI@@SAJXZ	3143	0x140035594
?Register@ModernProgressRing@DirectUI@@SAJXZ	3144	0x140039bec
?Register@Movie@DirectUI@@SAJXZ	3145	0x14000b42c
?Register@Navigator@DirectUI@@SAJXZ	3146	0x14003a908
?Register@PText@DirectUI@@SAJXZ	3147	0x14002ad08
?Register@Page@DirectUI@@SAJXZ	3148	0x140006344
?Register@Pages@DirectUI@@SAJXZ	3149	0x14000d4d8
?Register@Progress@DirectUI@@SAJXZ	3150	0x14000db9c
?Register@PushButton@DirectUI@@SAJXZ	3151	0x140014f00
?Register@RadioButtonGlyph@DirectUI@@SAJXZ	3152	0x1400233a4
?Register@RefPointElement@DirectUI@@SAJXZ	3153	0x140031814
?Register@RepeatButton@DirectUI@@SAJXZ	3154	0x140019cb0
?Register@Repeater@DirectUI@@SAJXZ	3155	0x140005180
?Register@RichText@DirectUI@@SAJXZ	3156	0x14002bc6c
?Register@ScrollBar@DirectUI@@SAJXZ	3157	0x140016dd8
?Register@ScrollViewer@DirectUI@@SAJXZ	3158	0x140024458
?Register@Selector@DirectUI@@SAJXZ	3159	0x14002e258
?Register@SelectorNoDefault@DirectUI@@SAJXZ	3160	0x14000b034
?Register@SemanticZoomToggle@DirectUI@@SAJXZ	3161	0x140022dbc
?Register@StyledScrollViewer@DirectUI@@SAJXZ	3162	0x140035604
?Register@TextGraphic@DirectUI@@SAJXZ	3163	0x14000bc0c
?Register@Thumb@DirectUI@@SAJXZ	3164	0x1400268c8
?Register@TouchButton@DirectUI@@SAJXZ	3165	0x140031ee8
?Register@TouchCheckBox@DirectUI@@SAJXZ	3166	0x140016410
?Register@TouchCheckBoxGlyph@DirectUI@@SAJXZ	3167	0x1400228ac
?Register@TouchCommandButton@DirectUI@@SAJXZ	3168	0x14000e960
?Register@TouchEdit2@DirectUI@@SAJXZ	3169	0x14000dc04
?Register@TouchEditBase@DirectUI@@SAJXZ	3170	0x14002e5c8
?Register@TouchHWNDElement@DirectUI@@SAJXZ	3171	0x14000c5e0
?Register@TouchHyperLink@DirectUI@@SAJXZ	3172	0x1400192c0
?Register@TouchRepeatButton@DirectUI@@SAJXZ	3173	0x140005e48
?Register@TouchScrollBar@DirectUI@@SAJXZ	3174	0x14002dacc
?Register@TouchSelect@DirectUI@@SAJXZ	3175	0x140014c1c
?Register@TouchSelectItem@DirectUI@@SAJXZ	3176	0x14000af14
?Register@TouchSlider@DirectUI@@SAJXZ	3177	0x140039cf8
?Register@TouchSwitch@DirectUI@@SAJXZ	3178	0x14003352c
?Register@UnknownElement@DirectUI@@SAJXZ	3179	0x14002f460
?Register@Viewer@DirectUI@@SAJXZ	3180	0x14002cd64
?Register@XBaby@DirectUI@@SAJXZ	3181	0x140014918
?Register@XElement@DirectUI@@SAJXZ	3182	0x14000d168
?RegisterForAnimationStatusChanges@TouchHWNDElement@DirectUI@@QEAAXXZ	3183	0x140035fa4
?RegisterForIHMChanges@TouchHWNDElement@DirectUI@@QEAAJXZ	3184	0x14000782c
?RegisterForMonitorPowerChanges@TouchHWNDElement@DirectUI@@QEAAJXZ	3185	0x140039810
?RegisteredDefaultButtonProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3186	0x140032fac
?Release@ClassInfoBase@DirectUI@@UEAAHXZ	3187	0x14001e1c0
?Release@DuiAccessible@DirectUI@@UEAAKXZ	3188	0x14000cdc4
?Release@Element@DirectUI@@QEAAKXZ	3189	0x14003814c
?Release@ElementProvider@DirectUI@@UEAAKXZ	3190	0x140014e18
?Release@ExpandCollapseProvider@DirectUI@@UEAAKXZ	3191	0x14002bdcc
?Release@GridItemProvider@DirectUI@@UEAAKXZ	3192	0x14003bec0
?Release@GridProvider@DirectUI@@UEAAKXZ	3193	0x140021df0
?Release@HWNDElementProvider@DirectUI@@UEAAKXZ	3194	0x14003f9b4
?Release@InvokeProvider@DirectUI@@UEAAKXZ	3195	0x140035fe0
?Release@RangeValueProvider@DirectUI@@UEAAKXZ	3196	0x140020484
?Release@RefcountBase@DirectUI@@QEAAJXZ	3197	0x140026ce0
?Release@ScrollItemProvider@DirectUI@@UEAAKXZ	3198	0x14000177c
?Release@ScrollProvider@DirectUI@@UEAAKXZ	3199	0x14003046c
?Release@SelectionItemProvider@DirectUI@@UEAAKXZ	3200	0x14002c7a8
?Release@SelectionProvider@DirectUI@@UEAAKXZ	3201	0x14000814c
?Release@TableItemProvider@DirectUI@@UEAAKXZ	3202	0x14001db30
?Release@TableProvider@DirectUI@@UEAAKXZ	3203	0x140008194
?Release@ToggleProvider@DirectUI@@UEAAKXZ	3204	0x140030d94
?Release@Value@DirectUI@@QEAAXXZ	3205	0x140027ac8
?Release@ValueProvider@DirectUI@@UEAAKXZ	3206	0x14003b3bc
?Release@XProvider@DirectUI@@UEAAKXZ	3207	0x14003a2c8
?ReleaseSnapshot@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3208	0x14001f408
?ReloadIcon@Value@DirectUI@@CAPEAUHICON__@@PEAUGraphic@2@M@Z	3209	0x14003b3dc
?Remove@Element@DirectUI@@QEAAJPEAV12@@Z	3210	0x140018850
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z	3211	0x14001a6c4
?Remove@ElementProviderManager@DirectUI@@SAXPEAVElementProvider@2@@Z	3212	0x140030070
?Remove@LinkedList@DirectUI@@QEAAXPEAVLinkedListNode@2@@Z	3213	0x140018704
?RemoveAll@Element@DirectUI@@QEAAJXZ	3214	0x1400121b4
?RemoveAll@TouchSelect@DirectUI@@QEAAXXZ	3215	0x140013bf4
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z	3216	0x140039e74
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ	3217	0x140029fb4
?RemoveFromSelection@SelectionItemProvider@DirectUI@@UEAAJXZ	3218	0x140024d3c
?RemoveItem@TouchSelect@DirectUI@@QEAAJH@Z	3219	0x14003f368
?RemoveListener@Element@DirectUI@@QEAAXPEAUIElementListener@2@@Z	3220	0x14003d578
?RemoveLocalValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZ@Z	3221	0x1400244dc
?RemoveLocalValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@@Z	3222	0x14001acf8
?RemoveRichDuiTooltip@TouchSlider@DirectUI@@QEAAXXZ	3223	0x14002fbd4
?RemoveShortcutFromName@Element@DirectUI@@AEAAPEAGPEBG@Z	3224	0x14001e3dc
?RemoveTail@LinkedList@DirectUI@@QEAAPEAVLinkedListNode@2@XZ	3225	0x14003c284
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z	3226	0x14003849c
?RemoveTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3227	0x140011f9c
?RemoveTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3228	0x1400381ec
?RepeatClick@TouchRepeatButton@DirectUI@@SA?AVUID@@XZ	3229	0x140019aa8
?RepeatProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3230	0x14002b960
?Reset@DuiAccessible@DirectUI@@UEAAJXZ	3231	0x14001feec
?Reset@HWNDHostAccessible@DirectUI@@UEAAJXZ	3232	0x140029e34
?ResetInputState@TouchScrollViewer@DirectUI@@QEAAJXZ	3233	0x1400105f4
?ResetManipulations@TouchScrollViewer@DirectUI@@QEAAJXZ	3234	0x140020c08
?ResolveBindings@Macro@DirectUI@@IEAAXXZ	3235	0x14001eab8
?RestoreFocus@NativeHWNDHost@DirectUI@@QEAAHXZ	3236	0x14000c8d8
?Resume@Movie@DirectUI@@QEAAXXZ	3237	0x1400207e0
?ReturnValueParser@DUIXmlParser@DirectUI@@IEAAXPEAVValueParser@ParserTools@2@@Z	3238	0x1400112d0
?Rewind@Movie@DirectUI@@QEAAXXZ	3239	0x140021814
?RichTooltipShowing@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3240	0x14000c534
?RightClick@TouchButton@DirectUI@@SA?AVUID@@XZ	3241	0x14002a064
?RuntimeIdProperty@Schema@DirectUI@@2HA	3242	0x140032a04
?STACKDEPTH@CallstackTracker@DirectUI@@0HB	3243	0x140005e5c
?SaveFocus@NativeHWNDHost@DirectUI@@QEAAXXZ	3244	0x14000dbf8
?ScaleChanged@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3245	0x1400305e8
?ScaleFactorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3246	0x140018e38
?Scroll@BaseScrollBar@DirectUI@@SA?AVUID@@XZ	3247	0x140016678
?Scroll@ScrollProvider@DirectUI@@UEAAJW4ScrollAmount@@0@Z	3248	0x140012e78
?Scroll@ScrollProxy@DirectUI@@AEAAJW4ScrollAmount@@0@Z	3249	0x14002bcb8
?ScrollBarControlType@Schema@DirectUI@@2HA	3250	0x140015214
?ScrollIntoView@ScrollItemProvider@DirectUI@@UEAAJXZ	3251	0x14000d358
?ScrollItemPattern@Schema@DirectUI@@2HA	3252	0x140024e60
?ScrollLine@ScrollProxy@DirectUI@@AEAAJ_N0@Z	3253	0x140018088
?ScrollPaddingProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3254	0x140021f00
?ScrollPage@ScrollProxy@DirectUI@@AEAAJ_N0@Z	3255	0x140029574
?ScrollPattern@Schema@DirectUI@@2HA	3256	0x1400021cc
?ScrollToHorizontalPosition@ScrollProxy@DirectUI@@AEAAJH_N@Z	3257	0x140024098
?ScrollToVerticalPosition@ScrollProxy@DirectUI@@AEAAJH_N@Z	3258	0x14001f938
?Scroll_HorizontalScrollPercent_Property@Schema@DirectUI@@2HA	3259	0x14003ba98
?Scroll_HorizontalViewSize_Property@Schema@DirectUI@@2HA	3260	0x14002c954
?Scroll_HorizontallyScrollable_Property@Schema@DirectUI@@2HA	3261	0x140021fe4
?Scroll_VerticalScrollPercent_Property@Schema@DirectUI@@2HA	3262	0x140001168
?Scroll_VerticalViewSize_Property@Schema@DirectUI@@2HA	3263	0x140004a1c
?Scroll_VerticallyScrollable_Property@Schema@DirectUI@@2HA	3264	0x14003fc74
?Select@SelectionItemProvider@DirectUI@@UEAAJXZ	3265	0x140014878
?Select@SelectorSelectionItemProxy@DirectUI@@AEAAJXZ	3266	0x1400405f0
?SelectAll@TouchEdit2@DirectUI@@QEAAJXZ	3267	0x140033808
?SelectNone@TouchEdit2@DirectUI@@QEAAJXZ	3268	0x140023f94
?SelectedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3269	0x14002b330
?SelectionBackgroundColorProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3270	0x1400118cc
?SelectionChange@Combobox@DirectUI@@SA?AVUID@@XZ	3271	0x14003b808
?SelectionChange@Selector@DirectUI@@SA?AVUID@@XZ	3272	0x140033e20
?SelectionChange@TouchSelect@DirectUI@@SA?AVUID@@XZ	3273	0x140029874
?SelectionForegroundColorProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3274	0x1400156fc
?SelectionInvalidatedEvent@Schema@DirectUI@@2HA	3275	0x1400312e4
?SelectionItemElementAddedToSelectionEvent@Schema@DirectUI@@2HA	3276	0x14001b574
?SelectionItemElementRemovedFromSelectionEvent@Schema@DirectUI@@2HA	3277	0x14000eefc
?SelectionItemElementSelectedEvent@Schema@DirectUI@@2HA	3278	0x14002becc
?SelectionItemPattern@Schema@DirectUI@@2HA	3279	0x14003ca94
?SelectionItem_IsSelected_Property@Schema@DirectUI@@2HA	3280	0x1400179d0
?SelectionItem_SelectionContainer_Property@Schema@DirectUI@@2HA	3281	0x14000b3a0
?SelectionPattern@Schema@DirectUI@@2HA	3282	0x14001b35c
?SelectionProp@Combobox@DirectUI@@SAPEBUPropertyInfo@2@XZ	3283	0x140004998
?SelectionProp@Selector@DirectUI@@SAPEBUPropertyInfo@2@XZ	3284	0x140025468
?SelectionProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	3285	0x14001c3a0
?Selection_CanSelectMultiple_Property@Schema@DirectUI@@2HA	3286	0x140036bfc
?Selection_IsSelectionRequired_Property@Schema@DirectUI@@2HA	3287	0x14001d584
?Selection_Selection_Property@Schema@DirectUI@@2HA	3288	0x140021c1c
?SemanticChange@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3289	0x140039178
?SemanticZoomControlType@Schema@DirectUI@@2HA	3290	0x14000a898
?SendParseError@DUIXmlParser@DirectUI@@IEAAXPEBG0HHJ@Z	3291	0x140022820
?SendParseError@DUIXmlParser@DirectUI@@IEAAXPEBG0PEAUIXmlReader@@J@Z	3292	0x1400231ac
?SeparatorControlType@Schema@DirectUI@@2HA	3293	0x140017684
?SetAbsorbsShortcut@Element@DirectUI@@QEAAJ_N@Z	3294	0x14002a804
?SetAccDefAction@Element@DirectUI@@QEAAJPEBG@Z	3295	0x14000d50c
?SetAccDesc@Element@DirectUI@@QEAAJPEBG@Z	3296	0x14000f734
?SetAccHelp@Element@DirectUI@@QEAAJPEBG@Z	3297	0x14002a358
?SetAccItemStatus@Element@DirectUI@@QEAAJPEBG@Z	3298	0x1400191b8
?SetAccItemType@Element@DirectUI@@QEAAJPEBG@Z	3299	0x140012a6c
?SetAccName@Element@DirectUI@@QEAAJPEBG@Z	3300	0x14002d2f8
?SetAccRole@Element@DirectUI@@QEAAJH@Z	3301	0x1400104c8
?SetAccState@Element@DirectUI@@QEAAJH@Z	3302	0x1400221a0
?SetAccValue@Element@DirectUI@@QEAAJPEBG@Z	3303	0x14000cab4
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z	3304	0x140002af8
?SetActive@Element@DirectUI@@QEAAJH@Z	3305	0x14002a650
?SetActiveState@TouchScrollBar@DirectUI@@QEAAXW4ActiveState@2@_N@Z	3306	0x14001bd5c
?SetActivityOccuring@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3307	0x14001fb00
?SetActivityOccuring@ModernProgressRing@DirectUI@@QEAAJ_N@Z	3308	0x14002c7d0
?SetAddLayeredRef@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3309	0x1400166d4
?SetAddLayeredRef@ModernProgressRing@DirectUI@@QEAAJ_N@Z	3310	0x14002eda4
?SetAliasedRendering@RichText@DirectUI@@QEAAJ_N@Z	3311	0x140037c04
?SetAllowArrowOut@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3312	0x14002369c
?SetAlpha@Element@DirectUI@@QEAAJH@Z	3313	0x140014160
?SetAnimatePopupOnDismiss@TouchSelect@DirectUI@@QEAAJ_N@Z	3314	0x140037728
?SetAnimation@Element@DirectUI@@QEAAJH@Z	3315	0x140030680
?SetAutoGrouping@CCRadioButton@DirectUI@@QEAAJ_N@Z	3316	0x140023294
?SetAutoHeight@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3317	0x140016344
?SetAutoStart@Movie@DirectUI@@QEAAJ_N@Z	3318	0x14002f700
?SetAutoStop@Movie@DirectUI@@QEAAJ_N@Z	3319	0x140012378
?SetBackgroundColor@Element@DirectUI@@QEAAJAEBUFill@2@@Z	3320	0x140010cb8
?SetBackgroundColor@Element@DirectUI@@QEAAJK@Z	3321	0x140027644
?SetBackgroundColor@Element@DirectUI@@QEAAJKKE@Z	3322	0x1400155f0
?SetBackgroundColor@Element@DirectUI@@QEAAJKKKE@Z	3323	0x140023ba4
?SetBackgroundColor@Element@DirectUI@@QEAAJPEBGHH@Z	3324	0x140016fe8
?SetBackgroundOwnerID@HWNDHost@DirectUI@@QEAAJPEBG@Z	3325	0x14003f370
?SetBackgroundStdColor@Element@DirectUI@@QEAAJH@Z	3326	0x140024f94
?SetBaseline@RichText@DirectUI@@QEAAJH@Z	3327	0x14003db5c
?SetBorderColor@Element@DirectUI@@QEAAJK@Z	3328	0x140002ce0
?SetBorderGradientColor@Element@DirectUI@@QEAAJKKE@Z	3329	0x140033ca4
?SetBorderStdColor@Element@DirectUI@@QEAAJH@Z	3330	0x14003101c
?SetBorderStyle@Element@DirectUI@@QEAAJH@Z	3331	0x140019ed4
?SetBorderThickness@Element@DirectUI@@QEAAJHHHH@Z	3332	0x140024898
?SetBuffering@TouchSlider@DirectUI@@QEAAJH@Z	3333	0x140016334
?SetButtonClassAcceptsEnterKey@DialogElement@DirectUI@@QEAAJ_N@Z	3334	0x140009b98
?SetButtonClassAcceptsEnterKey@XBaby@DirectUI@@UEAAJ_N@Z	3335	0x14002d9fc
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UEAAJ_N@Z	3336	0x140006bf4
?SetCache@RichText@DirectUI@@QEAAXKPEAUIDUIRichTextCache@@@Z	3337	0x14003bac8
?SetCacheDirty@Layout@DirectUI@@IEAAXXZ	3338	0x140033ed8
?SetCaptured@Button@DirectUI@@QEAAJ_N@Z	3339	0x14003ec18
?SetCaptured@TouchButton@DirectUI@@QEAAJ_N@Z	3340	0x140025164
?SetCaretPosition@TouchEdit2@DirectUI@@QEAAJJ@Z	3341	0x14003f2a8
?SetCheckedState@TouchCheckBox@DirectUI@@QEAAJW4CheckedStateFlags@2@@Z	3342	0x14001dd14
?SetClass@Element@DirectUI@@QEAAJPEBG@Z	3343	0x1400207d4
?SetClassInfoPtr@AccessibleButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3344	0x1400159a8
?SetClassInfoPtr@AnimationStrip@DirectUI@@SAXPEAUIClassInfo@2@@Z	3345	0x1400134e8
?SetClassInfoPtr@AutoButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3346	0x14001dbb0
?SetClassInfoPtr@BaseScrollViewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3347	0x14000836c
?SetClassInfoPtr@Bind@DirectUI@@SAXPEAUIClassInfo@2@@Z	3348	0x14001be58
?SetClassInfoPtr@Browser@DirectUI@@SAXPEAUIClassInfo@2@@Z	3349	0x140010ad8
?SetClassInfoPtr@Button@DirectUI@@SAXPEAUIClassInfo@2@@Z	3350	0x14000ca24
?SetClassInfoPtr@CCAVI@DirectUI@@SAXPEAUIClassInfo@2@@Z	3351	0x140035eb8
?SetClassInfoPtr@CCBase@DirectUI@@SAXPEAUIClassInfo@2@@Z	3352	0x1400202c0
?SetClassInfoPtr@CCBaseCheckRadioButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3353	0x140033284
?SetClassInfoPtr@CCBaseScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3354	0x140017b00
?SetClassInfoPtr@CCCheckBox@DirectUI@@SAXPEAUIClassInfo@2@@Z	3355	0x140014b9c
?SetClassInfoPtr@CCCommandLink@DirectUI@@SAXPEAUIClassInfo@2@@Z	3356	0x14002662c
?SetClassInfoPtr@CCHScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3357	0x140019d08
?SetClassInfoPtr@CCListBox@DirectUI@@SAXPEAUIClassInfo@2@@Z	3358	0x140001d34
?SetClassInfoPtr@CCListView@DirectUI@@SAXPEAUIClassInfo@2@@Z	3359	0x140040f3c
?SetClassInfoPtr@CCProgressBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3360	0x14001fdfc
?SetClassInfoPtr@CCPushButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3361	0x14000edc0
?SetClassInfoPtr@CCRadioButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3362	0x14003df6c
?SetClassInfoPtr@CCSysLink@DirectUI@@SAXPEAUIClassInfo@2@@Z	3363	0x140023af4
?SetClassInfoPtr@CCTrackBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3364	0x140024d40
?SetClassInfoPtr@CCTreeView@DirectUI@@SAXPEAUIClassInfo@2@@Z	3365	0x140005e3c
?SetClassInfoPtr@CCVScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3366	0x140038edc
?SetClassInfoPtr@CheckBoxGlyph@DirectUI@@SAXPEAUIClassInfo@2@@Z	3367	0x14002e034
?SetClassInfoPtr@Clipper@DirectUI@@SAXPEAUIClassInfo@2@@Z	3368	0x140035310
?SetClassInfoPtr@Combobox@DirectUI@@SAXPEAUIClassInfo@2@@Z	3369	0x14001bc54
?SetClassInfoPtr@DialogElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3370	0x140015c90
?SetClassInfoPtr@Edit@DirectUI@@SAXPEAUIClassInfo@2@@Z	3371	0x140023fc8
?SetClassInfoPtr@Element@DirectUI@@SAXPEAUIClassInfo@2@@Z	3372	0x1400303b0
?SetClassInfoPtr@ElementWithHWND@DirectUI@@SAXPEAUIClassInfo@2@@Z	3373	0x14000220c
?SetClassInfoPtr@Expandable@DirectUI@@SAXPEAUIClassInfo@2@@Z	3374	0x14000b078
?SetClassInfoPtr@Expando@DirectUI@@SAXPEAUIClassInfo@2@@Z	3375	0x1400081b8
?SetClassInfoPtr@ExpandoButtonGlyph@DirectUI@@SAXPEAUIClassInfo@2@@Z	3376	0x1400371e0
?SetClassInfoPtr@HWNDElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3377	0x140033614
?SetClassInfoPtr@HWNDHost@DirectUI@@SAXPEAUIClassInfo@2@@Z	3378	0x14000ea7c
?SetClassInfoPtr@Macro@DirectUI@@SAXPEAUIClassInfo@2@@Z	3379	0x140022a38
?SetClassInfoPtr@Movie@DirectUI@@SAXPEAUIClassInfo@2@@Z	3380	0x140026514
?SetClassInfoPtr@Navigator@DirectUI@@SAXPEAUIClassInfo@2@@Z	3381	0x14002093c
?SetClassInfoPtr@PText@DirectUI@@SAXPEAUIClassInfo@2@@Z	3382	0x1400368b0
?SetClassInfoPtr@Page@DirectUI@@SAXPEAUIClassInfo@2@@Z	3383	0x140023b68
?SetClassInfoPtr@Pages@DirectUI@@SAXPEAUIClassInfo@2@@Z	3384	0x14002e868
?SetClassInfoPtr@Progress@DirectUI@@SAXPEAUIClassInfo@2@@Z	3385	0x1400021f4
?SetClassInfoPtr@PushButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3386	0x14002ec24
?SetClassInfoPtr@RadioButtonGlyph@DirectUI@@SAXPEAUIClassInfo@2@@Z	3387	0x140021e00
?SetClassInfoPtr@RefPointElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3388	0x14001aa44
?SetClassInfoPtr@RepeatButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3389	0x140027070
?SetClassInfoPtr@Repeater@DirectUI@@SAXPEAUIClassInfo@2@@Z	3390	0x140024e84
?SetClassInfoPtr@ScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3391	0x14002d304
?SetClassInfoPtr@ScrollViewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3392	0x140035a30
?SetClassInfoPtr@Selector@DirectUI@@SAXPEAUIClassInfo@2@@Z	3393	0x140002c34
?SetClassInfoPtr@SelectorNoDefault@DirectUI@@SAXPEAUIClassInfo@2@@Z	3394	0x14003cb80
?SetClassInfoPtr@StyledScrollViewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3395	0x14000d794
?SetClassInfoPtr@TextGraphic@DirectUI@@SAXPEAUIClassInfo@2@@Z	3396	0x140014b88
?SetClassInfoPtr@Thumb@DirectUI@@SAXPEAUIClassInfo@2@@Z	3397	0x1400326a0
?SetClassInfoPtr@UnknownElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3398	0x140038e8c
?SetClassInfoPtr@Viewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3399	0x14003756c
?SetClassInfoPtr@XBaby@DirectUI@@SAXPEAUIClassInfo@2@@Z	3400	0x14002802c
?SetClassInfoPtr@XElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3401	0x14003129c
?SetClient@BorderLayout@DirectUI@@AEAAXPEAVElement@2@@Z	3402	0x140016d7c
?SetColorFontPaletteIndex@RichText@DirectUI@@QEAAJH@Z	3403	0x1400414c8
?SetCompositedText@Element@DirectUI@@QEAAJ_N@Z	3404	0x1400315bc
?SetCompositingQuality@Movie@DirectUI@@QEAAJH@Z	3405	0x14001dcc0
?SetConnect@Bind@DirectUI@@QEAAJPEBG@Z	3406	0x140014d8c
?SetConstrainLayout@RichText@DirectUI@@QEAAJH@Z	3407	0x140038a5c
?SetContact@TouchScrollViewer@DirectUI@@QEAAJI_N@Z	3408	0x14000f3c0
?SetContactNeeded@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3409	0x140026450
?SetContactNotify@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3410	0x14003c950
?SetContentAlign@Element@DirectUI@@QEAAJH@Z	3411	0x140020110
?SetContentGraphic@Element@DirectUI@@QEAAJPEBGEI@Z	3412	0x1400270bc
?SetContentGraphic@Element@DirectUI@@QEAAJPEBGGG@Z	3413	0x140038e5c
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z	3414	0x14000c764
?SetCursor@Element@DirectUI@@QEAAJPEBG@Z	3415	0x140035710
?SetCursorHandle@Element@DirectUI@@QEAAJPEAUHICON__@@@Z	3416	0x140015b58
?SetDWriteFontCollection@RichText@DirectUI@@QEAAXPEAUIDWriteFontCollection@@@Z	3417	0x14002af68
?SetDWriteTextLayout@RichText@DirectUI@@QEAAXPEAUIDWriteTextLayout@@@Z	3418	0x14001aae4
?SetDataEngine@Repeater@DirectUI@@QEAAXPEAUIDataEngine@2@@Z	3419	0x14001423c
?SetDataEntry@Macro@DirectUI@@QEAAXPEAUIDataEntry@2@PEAVElement@2@@Z	3420	0x14002cad4
?SetDataEntry@PText@DirectUI@@QEAAXPEAUIDataEntry@2@@Z	3421	0x14000c340
?SetDefaultButtonTracking@DialogElement@DirectUI@@UEAAJ_N@Z	3422	0x14002ea48
?SetDefaultButtonTracking@XBaby@DirectUI@@UEAAJ_N@Z	3423	0x140027818
?SetDefaultButtonTracking@XProvider@DirectUI@@UEAAJ_N@Z	3424	0x140033484
?SetDefaultFocusID@NativeHWNDHost@DirectUI@@QEAAXPEBG@Z	3425	0x1400114f4
?SetDefaultGraphicType@Macro@DirectUI@@QEAAXE_N@Z	3426	0x14000c95c
?SetDefaultHInstance@DUIXmlParser@DirectUI@@QEAAXPEAUHINSTANCE__@@@Z	3427	0x140033268
?SetDefaultState@CCPushButton@DirectUI@@IEAAXKK@Z	3428	0x1400114ac
?SetDelegateEventHandler@TouchScrollViewer@DirectUI@@QEAAJPEAUIUnknown@@@Z	3429	0x140011e8c
?SetDeterminate@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3430	0x140009a04
?SetDirection@Element@DirectUI@@QEAAJH@Z	3431	0x140040c24
?SetDirty@Edit@DirectUI@@QEAAJ_N@Z	3432	0x1400242cc
?SetDisableAccTextExtend@RichText@DirectUI@@QEAAJ_N@Z	3433	0x140002450
?SetDisableMouseInRectCheck@TouchRepeatButton@DirectUI@@QEAAJ_N@Z	3434	0x140017ddc
?SetDisableOffscreenCaching@TouchScrollViewer@DirectUI@@QEAAX_N@Z	3435	0x140018c34
?SetDrawOutlines@Movie@DirectUI@@QEAAJ_N@Z	3436	0x1400307ec
?SetDynamicScaling@DUIXmlParser@DirectUI@@QEAAXW4DynamicScaleParsing@2@@Z	3437	0x140028288
?SetEdgeHighlightColor@Element@DirectUI@@QEAAJK@Z	3438	0x14003deac
?SetEdgeHighlightThickness@Element@DirectUI@@QEAAJHHHH@Z	3439	0x140012c54
?SetElementMovesOnIHMNotify@TouchEditBase@DirectUI@@QEAAJ_N@Z	3440	0x14001305c
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z	3441	0x140027eb8
?SetEncodedContentString@Element@DirectUI@@QEAAJPEBG@Z	3442	0x140015a2c
?SetEnforceSize@PushButton@DirectUI@@QEAAJ_N@Z	3443	0x14001a238
?SetEnsureVisibleUseLayoutCoordinates@Viewer@DirectUI@@QEAAX_N@Z	3444	0x140022bd8
?SetError@DUIFactory@DirectUI@@QEAAXPEBGZZ	3445	0x14003f150
?SetExpand@Macro@DirectUI@@QEAAJPEBG@Z	3446	0x14001cc48
?SetExpanded@Expandable@DirectUI@@QEAAJ_N@Z	3447	0x140019164
?SetFilterOnPaste@TouchEditBase@DirectUI@@QEAAJ_N@Z	3448	0x140030fd0
?SetFireContinuousSliderEvent@TouchSlider@DirectUI@@QEAAX_N@Z	3449	0x14002e548
?SetFlags@TouchHWNDElement@DirectUI@@QEAAJW4TouchHWNDElementFlags@2@0@Z	3450	0x1400219d4
?SetFocus@ElementProvider@DirectUI@@UEAAJXZ	3451	0x14000828c
?SetFocus@HWNDElement@DirectUI@@QEAAX_N@Z	3452	0x14002b68c
?SetFocus@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z	3453	0x140005e70
?SetFont@Element@DirectUI@@QEAAJPEBG@Z	3454	0x140001c0c
?SetFontColorRuns@RichText@DirectUI@@QEAAJPEBG@Z	3455	0x140028ce8
?SetFontFace@Element@DirectUI@@QEAAJPEBG@Z	3456	0x14003dfac
?SetFontQuality@Element@DirectUI@@QEAAJH@Z	3457	0x14001ca9c
?SetFontSize@Element@DirectUI@@QEAAJH@Z	3458	0x14003914c
?SetFontSizeRuns@RichText@DirectUI@@QEAAJPEBG@Z	3459	0x140030dec
?SetFontStyle@Element@DirectUI@@QEAAJH@Z	3460	0x14002c678
?SetFontWeight@Element@DirectUI@@QEAAJH@Z	3461	0x140014d80
?SetFontWeightRuns@RichText@DirectUI@@QEAAJPEBG@Z	3462	0x14002e650
?SetForceEditTextToLTR@TouchEditBase@DirectUI@@QEAAJ_N@Z	3463	0x14001c1b8
?SetForegroundColor@Element@DirectUI@@QEAAJK@Z	3464	0x1400193d8
?SetForegroundColor@Element@DirectUI@@QEAAJKKE@Z	3465	0x140031510
?SetForegroundColor@Element@DirectUI@@QEAAJKKKE@Z	3466	0x1400092e0
?SetForegroundStdColor@Element@DirectUI@@QEAAJH@Z	3467	0x140005638
?SetFrameDuration@AnimationStrip@DirectUI@@QEAAJH@Z	3468	0x14003ee38
?SetFrameIndex@AnimationStrip@DirectUI@@QEAAJH@Z	3469	0x1400131a8
?SetFrameWidth@AnimationStrip@DirectUI@@QEAAJH@Z	3470	0x1400152e4
?SetGetSheetCallback@DUIXmlParser@DirectUI@@QEAAXP6APEAVValue@2@PEBGPEAX@Z1@Z	3471	0x14003583c
?SetGraphicType@Repeater@DirectUI@@QEAAXE@Z	3472	0x140029d44
?SetHandleEnter@TouchButton@DirectUI@@QEAAJ_N@Z	3473	0x1400291a4
?SetHandleEnterKey@DialogElement@DirectUI@@QEAAJ_N@Z	3474	0x14002693c
?SetHandleEnterKey@XBaby@DirectUI@@UEAAJ_N@Z	3475	0x14003359c
?SetHandleEnterKey@XProvider@DirectUI@@IEAAX_N@Z	3476	0x140010e54
?SetHandleGlobalEnter@TouchButton@DirectUI@@QEAAJ_N@Z	3477	0x140036e18
?SetHeight@Element@DirectUI@@QEAAJH@Z	3478	0x140030ba4
?SetID@Element@DirectUI@@QEAAJPEBG@Z	3479	0x140030d38
?SetIMEComposing@TouchEditBase@DirectUI@@QEAAJ_N@Z	3480	0x14003577c
?SetIgnoredKeyCombos@TouchEditBase@DirectUI@@QEAAJW4TouchEditFilteredKeyComboFlags@2@0@Z	3481	0x140035038
?SetIndependentAnimations@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3482	0x140003bec
?SetInnerBorderThickness@TouchEdit2@DirectUI@@QEAAJHHHH@Z	3483	0x1400053f8
?SetInputScope@TouchEdit2@DirectUI@@QEAAJW4__MIDL___MIDL_itf_inputscope_0000_0000_0001@@@Z	3484	0x14000f8d8
?SetIntegrateIMECandidateList@TouchEditBase@DirectUI@@QEAAJ_N@Z	3485	0x14001a0a4
?SetInteractionMode@TouchScrollViewer@DirectUI@@QEAAJH@Z	3486	0x1400027b0
?SetInterpolationMode@Movie@DirectUI@@QEAAJH@Z	3487	0x14003e2c8
?SetIsContinuous@TouchSlider@DirectUI@@QEAAJ_N@Z	3488	0x140019324
?SetIsPressed@TouchSlider@DirectUI@@QEAAJ_N@Z	3489	0x140019588
?SetIsShowOnOffFeedback@TouchSlider@DirectUI@@QEAAJ_N@Z	3490	0x14001bba8
?SetIsVertical@TouchSlider@DirectUI@@QEAAJ_N@Z	3491	0x140028934
?SetItemData@TouchSelect@DirectUI@@QEAAJHPEAUIUnknown@@@Z	3492	0x140026d00
?SetItemData@TouchSelectItem@DirectUI@@QEAAJPEAUIUnknown@@@Z	3493	0x140026b74
?SetItemHeightInPopup@TouchSelect@DirectUI@@QEAAJH@Z	3494	0x140006d88
?SetItemState@CCTreeView@DirectUI@@QEAAXPEAU_TREEITEM@@I@Z	3495	0x14003731c
?SetKeyFocus@Element@DirectUI@@UEAAXXZ	3496	0x140020a70
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ	3497	0x140010aec
?SetKeyFocus@TouchEditBase@DirectUI@@UEAAXXZ	3498	0x14002a030
?SetKeyFocus@XBaby@DirectUI@@UEAAXXZ	3499	0x140039988
?SetKeyFocus@XElement@DirectUI@@UEAAXXZ	3500	0x140014200
?SetKeyboardNavigationCapture@TouchEditBase@DirectUI@@QEAAJW4TouchEditKeyboardNavigationCapture@2@@Z	3501	0x14004122c
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z	3502	0x14002286c
?SetLayoutCompletionNotify@Element@DirectUI@@QEAAX_N@Z	3503	0x14000f494
?SetLayoutPointerToNull@Value@DirectUI@@QEAAXXZ	3504	0x14001ae7c
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z	3505	0x140005eb4
?SetLightDismissIHM@TouchHWNDElement@DirectUI@@QEAAJ_N@Z	3506	0x14001fca8
?SetLine@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3507	0x1400309a8
?SetLine@ScrollBar@DirectUI@@UEAAJH@Z	3508	0x14001d9b4
?SetLineSize@CCTrackBar@DirectUI@@QEAAJH@Z	3509	0x1400239a4
?SetLineSpacing@RichText@DirectUI@@QEAAJH@Z	3510	0x14001e60c
?SetLinkIndicatorsToContent@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3511	0x14003d030
?SetLocale@RichText@DirectUI@@QEAAJPEBG@Z	3512	0x14000cb58
?SetManipulationHorizontalAlignment@TouchScrollViewer@DirectUI@@QEAAJH@Z	3513	0x14003e07c
?SetManipulationVerticalAlignment@TouchScrollViewer@DirectUI@@QEAAJH@Z	3514	0x14002a574
?SetMapRunsToClusters@RichText@DirectUI@@QEAAJ_N@Z	3515	0x14003bea8
?SetMargin@Element@DirectUI@@QEAAJHHHH@Z	3516	0x1400070bc
?SetMaxLength@Edit@DirectUI@@QEAAJH@Z	3517	0x140001ce8
?SetMaxLength@TouchEditBase@DirectUI@@QEAAJH@Z	3518	0x14003c1cc
?SetMaxLineCount@RichText@DirectUI@@QEAAXI@Z	3519	0x14003f38c
?SetMaximum@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3520	0x14000e160
?SetMaximum@ModernProgressBar@DirectUI@@QEAAJH@Z	3521	0x14004060c
?SetMaximum@Progress@DirectUI@@QEAAJH@Z	3522	0x1400077bc
?SetMaximum@ScrollBar@DirectUI@@UEAAJH@Z	3523	0x14000ded4
?SetMetering@TouchSlider@DirectUI@@QEAAJH@Z	3524	0x14002bd3c
?SetMinSize@Element@DirectUI@@QEAAJHH@Z	3525	0x14002ce38
?SetMinimum@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3526	0x14003e4ac
?SetMinimum@ModernProgressBar@DirectUI@@QEAAJH@Z	3527	0x1400256ac
?SetMinimum@Progress@DirectUI@@QEAAJH@Z	3528	0x14003711c
?SetMinimum@ScrollBar@DirectUI@@UEAAJH@Z	3529	0x1400220d0
?SetMoveCaretToEndOnSyncContent@TouchEditBase@DirectUI@@QEAAJ_N@Z	3530	0x14003f234
?SetMultiline@Edit@DirectUI@@QEAAJ_N@Z	3531	0x140018860
?SetMultiline@TouchEditBase@DirectUI@@QEAAJ_N@Z	3532	0x14003465c
?SetNoBrowseOnFirstAdd@Pages@DirectUI@@QEAAXXZ	3533	0x14001371c
?SetNote@CCCommandLink@DirectUI@@QEAAJPEBG@Z	3534	0x14001a644
?SetNotifyHandler@CCBase@DirectUI@@QEAAXP6AHI_K_JPEA_JPEAX@Z3@Z	3535	0x140007cb4
?SetOffText@TouchSwitch@DirectUI@@QEAAJPEBG@Z	3536	0x140005bf0
?SetOnOffText@TouchSwitch@DirectUI@@QEAAXPEBG0@Z	3537	0x1400394e4
?SetOnText@TouchSwitch@DirectUI@@QEAAJPEBG@Z	3538	0x14001ec74
?SetOptimizeMove@HWNDHost@DirectUI@@QEAAJ_N@Z	3539	0x140024f8c
?SetOrder@ScrollBar@DirectUI@@QEAAJH@Z	3540	0x14000ef64
?SetOverhang@Element@DirectUI@@QEAAJ_N@Z	3541	0x140022f68
?SetOverhangOffset@RichText@DirectUI@@QEAAJH@Z	3542	0x14001196c
?SetOverrideButtonBackground@CCPushButton@DirectUI@@QEAAJ_N@Z	3543	0x14002cba8
?SetOverrideScaleFactor@DUIXmlParser@DirectUI@@QEAAXM@Z	3544	0x14003b788
?SetOverrideScaleFactor@Element@DirectUI@@QEAAXM@Z	3545	0x1400170d0
?SetPVLAnimationState@Element@DirectUI@@QEAAXH@Z	3546	0x14003f904
?SetPadding@Element@DirectUI@@QEAAJHHHH@Z	3547	0x140004688
?SetPage@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3548	0x1400224e4
?SetPage@ScrollBar@DirectUI@@UEAAJH@Z	3549	0x14003555c
?SetParameter@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAX@Z	3550	0x14002fdd8
?SetParentSizeControl@HWNDElement@DirectUI@@QEAAX_N@Z	3551	0x14000cc2c
?SetParseErrorCallback@DUIXmlParser@DirectUI@@QEAAXP6AXPEBG0HPEAX@Z1@Z	3552	0x1400092a0
?SetParseState@DUIXmlParser@DirectUI@@AEAAXW4_DUI_PARSE_STATE@2@@Z	3553	0x14003bf6c
?SetParser@Macro@DirectUI@@QEAAXPEAVDUIXmlParser@2@@Z	3554	0x1400156b8
?SetPasswordCharacter@Edit@DirectUI@@QEAAJH@Z	3555	0x14003bc30
?SetPasswordCharacter@TouchEditBase@DirectUI@@QEAAJH@Z	3556	0x14001e9e4
?SetPasswordRevealMode@TouchEdit2@DirectUI@@QEAAJW4TouchEditPasswordRevealMode@2@@Z	3557	0x140005084
?SetPath@Movie@DirectUI@@QEAAJPEBG@Z	3558	0x140028b70
?SetPercent@ScrollProxy@DirectUI@@AEAAJPEAVBaseScrollBar@2@N@Z	3559	0x1400059c0
?SetPinned@BaseScrollBar@DirectUI@@QEAAX_N@Z	3560	0x14002fe84
?SetPinning@BaseScrollViewer@DirectUI@@QEAAJH@Z	3561	0x140023118
?SetPixelOffsetMode@Movie@DirectUI@@QEAAJH@Z	3562	0x14002fec8
?SetPlay@AnimationStrip@DirectUI@@QEAAJ_N@Z	3563	0x14003b808
?SetPlayAllFramesMode@Movie@DirectUI@@QEAAJ_N@Z	3564	0x14002aebc
?SetPopupBounds@TouchSelect@DirectUI@@QEAAJHHHH@Z	3565	0x140007324
?SetPosition@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3566	0x140020c0c
?SetPosition@ModernProgressBar@DirectUI@@QEAAJH@Z	3567	0x140030300
?SetPosition@Progress@DirectUI@@QEAAJH@Z	3568	0x14002ac1c
?SetPosition@ScrollBar@DirectUI@@UEAAJH@Z	3569	0x140004568
?SetPreprocessedXML@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z	3570	0x140027074
?SetPreserveAlphaChannel@Element@DirectUI@@QEAAX_N@Z	3571	0x14001f6f8
?SetPressed@Button@DirectUI@@QEAAJ_N@Z	3572	0x140021acc
?SetPressed@TouchButton@DirectUI@@QEAAJ_N@Z	3573	0x140035b38
?SetPreventFormatChangeUpdatingModifiedState@TouchEditBase@DirectUI@@QEAAJ_N@Z	3574	0x140021d48
?SetPromptText@TouchEdit2@DirectUI@@QEAAJPEBG@Z	3575	0x14001b54c
?SetPromptWithCaret@TouchEdit2@DirectUI@@QEAAJ_N@Z	3576	0x140026d90
?SetProperty@Bind@DirectUI@@QEAAJPEBG@Z	3577	0x140017458
?SetProportional@ScrollBar@DirectUI@@QEAAJ_N@Z	3578	0x14000facc
?SetProvider@XElement@DirectUI@@QEAAJPEAUIUnknown@@@Z	3579	0x14002f67c
?SetRangeMax@CCTrackBar@DirectUI@@QEAAJH@Z	3580	0x14002ea3c
?SetRangeMax@TouchSlider@DirectUI@@QEAAXH@Z	3581	0x14002aec4
?SetRangeMin@CCTrackBar@DirectUI@@QEAAJH@Z	3582	0x1400214f8
?SetRangeMin@TouchSlider@DirectUI@@QEAAXH@Z	3583	0x14002f824
?SetRangeMinAndRangeMax@TouchSlider@DirectUI@@QEAAXHH@Z	3584	0x14001fda8
?SetReadOnly@TouchEditBase@DirectUI@@QEAAJ_N@Z	3585	0x140005134
?SetReferencePoint@RefPointElement@DirectUI@@QEAAJHH@Z	3586	0x140009464
?SetRegisteredDefaultButton@DialogElement@DirectUI@@QEAAJPEAVElement@2@@Z	3587	0x14002c23c
?SetRegisteredDefaultButton@XBaby@DirectUI@@UEAAJPEAVElement@2@@Z	3588	0x140040964
?SetRegisteredDefaultButton@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z	3589	0x14002f114
?SetRegisteredDefaultButtonSelectedState@DialogElementCore@DirectUI@@IEAAX_N@Z	3590	0x140010e5c
?SetRelPixHeight@Element@DirectUI@@QEAAJH@Z	3591	0x1400144fc
?SetRelPixMargin@Element@DirectUI@@QEAAJHHHH@Z	3592	0x140021fe4
?SetRelPixPadding@Element@DirectUI@@QEAAJHHHH@Z	3593	0x14002fc9c
?SetRelPixWidth@Element@DirectUI@@QEAAJH@Z	3594	0x14001d810
?SetReorderable@ItemList@DirectUI@@QEAAJ_N@Z	3595	0x14003fe8c
?SetRepeat@Movie@DirectUI@@QEAAJ_N@Z	3596	0x140013500
?SetRespectLanguageDirection@TouchSlider@DirectUI@@QEAAX_N@Z	3597	0x140015930
?SetRespondToMouseScroll@TouchSlider@DirectUI@@QEAAX_N@Z	3598	0x1400264c4
?SetScaleFactor@DUIXmlParser@DirectUI@@QEAAXM@Z	3599	0x14003a308
?SetScreenCenter@HWNDElement@DirectUI@@QEAAX_N@Z	3600	0x14001e010
?SetScrollControlHost@TouchScrollViewer@DirectUI@@QEAAJPEAVElement@2@@Z	3601	0x14002245c
?SetScrollPadding@TouchScrollViewer@DirectUI@@QEAAJHHHH@Z	3602	0x140040674
?SetScrollPercent@ScrollProvider@DirectUI@@UEAAJNN@Z	3603	0x140018064
?SetScrollPercent@ScrollProxy@DirectUI@@AEAAJNN@Z	3604	0x140030648
?SetSelected@Element@DirectUI@@QEAAJ_N@Z	3605	0x1400169fc
?SetSelection@Combobox@DirectUI@@QEAAJH@Z	3606	0x14003ddc0
?SetSelection@Selector@DirectUI@@UEAAJPEAVElement@2@@Z	3607	0x14003e998
?SetSelection@SelectorNoDefault@DirectUI@@UEAAJPEAVElement@2@@Z	3608	0x14000bb4c
?SetSelection@TouchEdit2@DirectUI@@QEAAJJJ@Z	3609	0x140009144
?SetSelection@TouchSelect@DirectUI@@QEAAJPEAVElement@2@@Z	3610	0x14002df08
?SetSelectionBackgroundColor@TouchEditBase@DirectUI@@QEAAJPEAVValue@2@@Z	3611	0x14002dac0
?SetSelectionForegroundColor@TouchEditBase@DirectUI@@QEAAJPEAVValue@2@@Z	3612	0x14001d520
?SetSelectionIndex@TouchSelect@DirectUI@@QEAAJH@Z	3613	0x14002c1e4
?SetShadowIntensity@Element@DirectUI@@QEAAJH@Z	3614	0x140013c00
?SetSheet@Element@DirectUI@@QEAAJPEAVStyleSheet@2@@Z	3615	0x140013ff4
?SetShortcut@Element@DirectUI@@QEAAJH@Z	3616	0x140019670
?SetShowClearButtonMinWidth@TouchEdit2@DirectUI@@QEAAJH@Z	3617	0x140002b38
?SetShowKeyFocus@TouchButton@DirectUI@@QEAAJ_N@Z	3618	0x14001049c
?SetShowTick@TouchSlider@DirectUI@@QEAAJ_N@Z	3619	0x14001ceac
?SetSmoothFillAnimation@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3620	0x140020914
?SetSmoothingMode@Movie@DirectUI@@QEAAJH@Z	3621	0x140016644
?SetSnapIntervalX@TouchScrollViewer@DirectUI@@QEAAJM@Z	3622	0x140030000
?SetSnapIntervalY@TouchScrollViewer@DirectUI@@QEAAJM@Z	3623	0x140002334
?SetSnapMode@TouchScrollViewer@DirectUI@@QEAAJH@Z	3624	0x1400039a8
?SetSnapOffsetX@TouchScrollViewer@DirectUI@@QEAAJM@Z	3625	0x140001898
?SetSnapOffsetY@TouchScrollViewer@DirectUI@@QEAAJM@Z	3626	0x140033f28
?SetSnapPointCollectionX@TouchScrollViewer@DirectUI@@QEAAJPEAV?$DynamicArray@N$0A@@2@@Z	3627	0x14003c42c
?SetSnapPointCollectionX@TouchScrollViewer@DirectUI@@QEAAJPEBNH@Z	3628	0x14001d15c
?SetSnapPointCollectionY@TouchScrollViewer@DirectUI@@QEAAJPEAV?$DynamicArray@N$0A@@2@@Z	3629	0x14001aca8
?SetSnapPointCollectionY@TouchScrollViewer@DirectUI@@QEAAJPEBNH@Z	3630	0x140033ae8
?SetState@ModernProgressBar@DirectUI@@QEAAJH@Z	3631	0x140026cb0
?SetStdCursor@Element@DirectUI@@QEAAJH@Z	3632	0x140009154
?SetStepCount@TouchSlider@DirectUI@@QEAAXH@Z	3633	0x140015f24
?SetStopThumbBehavior@RepeatButton@DirectUI@@QEAAXXZ	3634	0x140041374
?SetString@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@P8Element@2@EAAPEBGPEAPEAVValue@2@@Z@Z	3635	0x140030f94
?SetStyle@CCTreeView@DirectUI@@QEAAKK@Z	3636	0x14002c5e0
?SetSubContent@TouchCommandButton@DirectUI@@QEAAJPEBG@Z	3637	0x14002d650
?SetSuppressClearButton@TouchEdit2@DirectUI@@QEAAJ_N@Z	3638	0x14001faf8
?SetSuppressSetContact@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3639	0x14001bd18
?SetSyncContentWhileIMEComposing@TouchEditBase@DirectUI@@QEAAJ_N@Z	3640	0x14003ba7c
?SetTargetPage@Navigator@DirectUI@@QEAAJPEBG@Z	3641	0x14002bba4
?SetTextContentOverride@TouchSelectItem@DirectUI@@QEAAJPEBG@Z	3642	0x14001bff4
?SetTextGlowSize@Element@DirectUI@@QEAAJH@Z	3643	0x1400357a0
?SetTextMode@TouchEditBase@DirectUI@@QEAAJW4TouchEditTextMode@2@@Z	3644	0x14003ed14
?SetThemeChanged@HWNDHost@DirectUI@@IEAAJH@Z	3645	0x14000b33c
?SetThemedBorder@Edit@DirectUI@@QEAAJ_N@Z	3646	0x140030f18
?SetThumbPosition@CCTrackBar@DirectUI@@QEAAJH@Z	3647	0x14001e978
?SetThumbValue@TouchSlider@DirectUI@@QEAAXH_N0@Z	3648	0x140022f84
?SetThumbValue@TouchSlider@DirectUI@@QEAAXH_N@Z	3649	0x1400071f8
?SetTickCount@TouchSlider@DirectUI@@QEAAJH@Z	3650	0x14003c110
?SetTitleText@TouchSwitch@DirectUI@@QEAAJPEBG@Z	3651	0x1400109a4
?SetToHost@XBaby@DirectUI@@UEAAJPEAVElement@2@@Z	3652	0x140019084
?SetToggleOnClick@TouchCheckBox@DirectUI@@QEAAJ_N@Z	3653	0x14002d128
?SetToggleSwitchText@TouchSwitch@DirectUI@@QEAAXPEBG@Z	3654	0x14002bc4c
?SetToggleValue@TouchSwitch@DirectUI@@QEAAXH@Z	3655	0x140013c90
?SetToggleValue@TouchSwitch@DirectUI@@QEAAXH_N0@Z	3656	0x14003b52c
?SetToggleValue@TouchSwitch@DirectUI@@QEAAXH_N@Z	3657	0x14000e8a0
?SetTooltip@Element@DirectUI@@QEAAJ_N@Z	3658	0x140016c64
?SetTooltipMaxWidth@Element@DirectUI@@QEAAJH@Z	3659	0x140030908
?SetTooltipMaximumLineCount@TouchHWNDElement@DirectUI@@QEAAJH@Z	3660	0x140018b5c
?SetTooltipText@TouchSlider@DirectUI@@QEAAXPEBG@Z	3661	0x140011f68
?SetTracking@CCBaseScrollBar@DirectUI@@QEAAJ_N@Z	3662	0x140016b90
?SetTransparent@HWNDHost@DirectUI@@QEAAJ_N@Z	3663	0x14002830c
?SetTreatRightMouseButtonAsLeft@TouchButton@DirectUI@@QEAAJ_N@Z	3664	0x140021d8c
?SetTypography@RichText@DirectUI@@QEAAJPEBG@Z	3665	0x14003e248
?SetTypographyRuns@RichText@DirectUI@@QEAAJPEBG@Z	3666	0x14001dd14
?SetUnavailableIcon@DUIXmlParser@DirectUI@@QEAAXPEAUHICON__@@@Z	3667	0x140001de0
?SetUnknownAttrCallback@DUIXmlParser@DirectUI@@QEAAXP6A_NPEBGPEAX@Z1@Z	3668	0x140006e00
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z	3669	0x14001d8a0
?SetValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@HPEAVValue@2@@Z	3670	0x140037264
?SetValue@RangeValueProvider@DirectUI@@UEAAJN@Z	3671	0x14002f264
?SetValue@ValueProvider@DirectUI@@UEAAJPEBG@Z	3672	0x1400115a0
?SetValue@ValueProxy@DirectUI@@AEAAJPEBG@Z	3673	0x140034444
?SetVertical@ScrollBar@DirectUI@@QEAAJ_N@Z	3674	0x140020c2c
?SetVerticalScript@RichText@DirectUI@@QEAAJ_N@Z	3675	0x14001689c
?SetVirtualizeElements@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3676	0x14000b280
?SetVisible@Element@DirectUI@@QEAAJ_N@Z	3677	0x14000a700
?SetVisited@TouchHyperLink@DirectUI@@QEAAJ_N@Z	3678	0x140005b70
?SetWantTabs@Edit@DirectUI@@QEAAJ_N@Z	3679	0x14002fc88
?SetWidth@Element@DirectUI@@QEAAJH@Z	3680	0x1400115dc
?SetWinStyle@CCBase@DirectUI@@QEAAJH@Z	3681	0x14000734c
?SetWindowAccessGradientColor@TouchHWNDElement@DirectUI@@QEAAJPEAVValue@2@@Z	3682	0x1400150ec
?SetWindowActive@Element@DirectUI@@QEAAJ_N@Z	3683	0x140030b88
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z	3684	0x140003f2c
?SetWrapKeyboardNavigate@HWNDElement@DirectUI@@QEAAJ_N@Z	3685	0x14000c1a0
?SetX@Element@DirectUI@@QEAAJH@Z	3686	0x1400071a8
?SetXBarVisibility@BaseScrollViewer@DirectUI@@QEAAJH@Z	3687	0x14002ee9c
?SetXML@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z	3688	0x14000d150
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z	3689	0x140034328
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEBGPEAUHINSTANCE__@@1@Z	3690	0x140001064
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJPEBG0PEAUHINSTANCE__@@1@Z	3691	0x140037968
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z	3692	0x140021420
?SetXMLFromResourceWithTheme@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@00@Z	3693	0x140038648
?SetXOffset@BaseScrollViewer@DirectUI@@QEAAJH@Z	3694	0x14000a664
?SetXOffset@Viewer@DirectUI@@QEAAJH@Z	3695	0x14003e1c0
?SetXScrollable@BaseScrollViewer@DirectUI@@QEAAJ_N@Z	3696	0x1400384e4
?SetXScrollable@Viewer@DirectUI@@QEAAJ_N@Z	3697	0x14001bbd4
?SetY@Element@DirectUI@@QEAAJH@Z	3698	0x14000a4b0
?SetYBarVisibility@BaseScrollViewer@DirectUI@@QEAAJH@Z	3699	0x14003de24
?SetYOffset@BaseScrollViewer@DirectUI@@QEAAJH@Z	3700	0x1400073d4
?SetYOffset@Viewer@DirectUI@@QEAAJH@Z	3701	0x140040f6c
?SetYScrollable@BaseScrollViewer@DirectUI@@QEAAJ_N@Z	3702	0x1400320c0
?SetYScrollable@Viewer@DirectUI@@QEAAJ_N@Z	3703	0x140038908
?SetZoomMaximum@TouchScrollViewer@DirectUI@@QEAAJM@Z	3704	0x14002403c
?SetZoomMinimum@TouchScrollViewer@DirectUI@@QEAAJM@Z	3705	0x14002e3a8
?ShadowIntensityProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3706	0x14000f4d0
?SheetProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3707	0x14000ba84
?ShiftChild@Element@DirectUI@@QEAAJII@Z	3708	0x14003b444
?ShortcutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3709	0x1400120bc
?ShouldUseDesktopPerMonitorScaling@HWNDElement@DirectUI@@QEAA_NXZ	3710	0x14002c4e0
?ShouldUsePerMonitorScaling@TouchHWNDElement@DirectUI@@QEAA_NXZ	3711	0x14003e718
?ShowAccel@HWNDElement@DirectUI@@QEAA_NXZ	3712	0x140035f44
?ShowClearButtonMinWidthProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3713	0x140026848
?ShowContextMenu@ElementProvider@DirectUI@@UEAAJXZ	3714	0x14000ebb4
?ShowFocus@HWNDElement@DirectUI@@QEAA_NXZ	3715	0x14000479c
?ShowKeyFocusProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3716	0x14000c278
?ShowRichTooltip@TouchHWNDElement@DirectUI@@QEAAJW4TOUCHTOOLTIP_INPUT@@W4TOUCHTOOLTIP_OPTION_FLAGS@@PEAVElement@2@@Z	3717	0x140028508
?ShowTickProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3718	0x1400218b0
?ShowTooltipOnRightForLTRBuild@TouchSlider@DirectUI@@QEAAXXZ	3719	0x140020a94
?ShowUIState@HWNDElement@DirectUI@@QEAAX_N0@Z	3720	0x140035220
?ShowWindow@NativeHWNDHost@DirectUI@@QEAAXH@Z	3721	0x140021900
?ShowWindow@XHost@DirectUI@@QEAAXH@Z	3722	0x14003096c
?SideGraphicProp@TextGraphic@DirectUI@@SAPEBUPropertyInfo@2@XZ	3723	0x14000f878
?SizeInLayoutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3724	0x1400026c0
?SizeZero@FlowLayout@DirectUI@@KA?AUtagSIZE@@XZ	3725	0x140025080
?SizeZero@VerticalFlowLayout@DirectUI@@KA?AUtagSIZE@@XZ	3726	0x1400309cc
?Skip@DuiAccessible@DirectUI@@UEAAJK@Z	3727	0x140014f70
?Skip@HWNDHostAccessible@DirectUI@@UEAAJK@Z	3728	0x14001db80
?SliderControlType@Schema@DirectUI@@2HA	3729	0x140027f94
?SliderUpdated@TouchSlider@DirectUI@@SA?AVUID@@XZ	3730	0x140020c50
?SmoothingModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3731	0x1400252c4
?SnapIntervalXProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3732	0x140040c60
?SnapIntervalYProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3733	0x14003eedc
?SnapModeProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3734	0x14000202c
?SnapOffsetXProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3735	0x1400324f8
?SnapOffsetYProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3736	0x140026974
?SnapPointCollectionXProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3737	0x140023078
?SnapPointCollectionYProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3738	0x140006bb4
?SnapshotTransformElement@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3739	0x140011988
?SortChildren@Element@DirectUI@@QEAAJP6AHPEBX0@Z@Z	3740	0x14000d158
?SpinnerControlType@Schema@DirectUI@@2HA	3741	0x14000c830
?SplitButtonControlType@Schema@DirectUI@@2HA	3742	0x1400172f8
?Start@AnimationStrip@DirectUI@@AEAAJXZ	3743	0x14002f608
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z	3744	0x140028afc
?StartNavigate@Browser@DirectUI@@SA?AVUID@@XZ	3745	0x1400366bc
?StartRichTooltipTimer@TouchHWNDElement@DirectUI@@QEAAJW4TOUCHTOOLTIP_INPUT@@@Z	3746	0x140023504
?StateProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3747	0x14001e4e8
?StaticWndProc@HWNDElement@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z	3748	0x14001d6c8
?StaticXHostSubclassProc@TaskPage@DirectUI@@CA_JPEAUHWND__@@I_K_J@Z	3749	0x140018d78
?StaticXmlParserError@TaskPage@DirectUI@@CAXPEBG0HPEAX@Z	3750	0x14002a154
?StatusBarControlType@Schema@DirectUI@@2HA	3751	0x14000b958
?Stop@AnimationStrip@DirectUI@@AEAAXXZ	3752	0x14001b204
?Stop@CCAVI@DirectUI@@QEAAXXZ	3753	0x14001e044
?StopAnimation@Element@DirectUI@@QEAAXI@Z	3754	0x140008284
?StopUsingCache@RichText@DirectUI@@QEAAXXZ	3755	0x140023920
?StrDupW@Value@DirectUI@@CAJPEBGPEAPEAG@Z	3756	0x14000152c
?StructureChangedEvent@Schema@DirectUI@@2HA	3757	0x14000749c
?SubContentProp@TouchCommandButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3758	0x140005980
?SuppressClearButtonProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3759	0x140039978
?SupressRightButtonDrag@Thumb@DirectUI@@QEAAX_N@Z	3760	0x14003a7f0
?SyncBackground@HWNDHost@DirectUI@@IEAAXXZ	3761	0x140006ea4
?SyncCallback@Proxy@DirectUI@@SAJPEAUHGADGET__@@PEAXPEAUEventMsg@@@Z	3762	0x140019e68
?SyncColorsAndFonts@HWNDHost@DirectUI@@AEAAXXZ	3763	0x140021078
?SyncContentWhileIMEComposingProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3764	0x140029e84
?SyncDestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ	3765	0x140033f78
?SyncDirection@HWNDHost@DirectUI@@IEAAXXZ	3766	0x14000798c
?SyncElementAlphaFromForegroundAlpha@DirectUI@@YAXPEAVElement@1@@Z	3767	0x1400254c8
?SyncFont@HWNDHost@DirectUI@@IEAAXXZ	3768	0x140015db4
?SyncForeground@HWNDHost@DirectUI@@IEAAXXZ	3769	0x14002e6f0
?SyncNoteAndGlyph@CCCommandLink@DirectUI@@IEAAXPEAUHWND__@@@Z	3770	0x1400087d0
?SyncParent@HWNDHost@DirectUI@@IEAAXXZ	3771	0x140020878
?SyncRect@HWNDHost@DirectUI@@IEAAXI_N@Z	3772	0x14003005c
?SyncScrollBar@CCBaseScrollBar@DirectUI@@QEAAXXZ	3773	0x1400030a4
?SyncStyle@HWNDHost@DirectUI@@IEAAXXZ	3774	0x14002ecf4
?SyncText@HWNDHost@DirectUI@@IEAAXXZ	3775	0x140033238
?SyncVisible@HWNDHost@DirectUI@@IEAAXXZ	3776	0x140022f2c
?SystemAlertEvent@Schema@DirectUI@@2HA	3777	0x1400309bc
?TabControlType@Schema@DirectUI@@2HA	3778	0x14002ec74
?TabItemControlType@Schema@DirectUI@@2HA	3779	0x140011710
?TableControlType@Schema@DirectUI@@2HA	3780	0x14000caa4
?TableItemPattern@Schema@DirectUI@@2HA	3781	0x14000b5c8
?TableItem_ColumnHeaderItems_Property@Schema@DirectUI@@2HA	3782	0x14002d9d8
?TableItem_RowHeaderItems_Property@Schema@DirectUI@@2HA	3783	0x14002eeac
?TablePattern@Schema@DirectUI@@2HA	3784	0x1400051fc
?Table_ColumnHeaders_Property@Schema@DirectUI@@2HA	3785	0x140032158
?Table_RowHeaders_Property@Schema@DirectUI@@2HA	3786	0x140014780
?Table_RowOrColumnMajor_Property@Schema@DirectUI@@2HA	3787	0x140023bf0
?TargetPageProp@Navigator@DirectUI@@SAPEBUPropertyInfo@2@XZ	3788	0x14002a6b0
?TelemetrySetDescription@TouchScrollViewer@DirectUI@@QEAAJPEBG@Z	3789	0x140028508
?TestDeferObject@Element@DirectUI@@QEAAPEAVDeferCycle@2@XZ	3790	0x14002f054
?TextContentOverrideProp@TouchSelectItem@DirectUI@@SAPEBUPropertyInfo@2@XZ	3791	0x140004da8
?TextControlType@Schema@DirectUI@@2HA	3792	0x14001a2e0
?TextGlowSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3793	0x14002bbf8
?TextModeProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3794	0x1400108d4
?TextPattern@Schema@DirectUI@@2HA	3795	0x140014ca4
?TextTextSelectionChangedEvent@Schema@DirectUI@@2HA	3796	0x14001d6a8
?TextTooltipShowing@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3797	0x140026908
?ThemeChange@HWNDElement@DirectUI@@SA?AVUID@@XZ	3798	0x140039e54
?ThemeChangedProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	3799	0x140018418
?ThemedBorderProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	3800	0x140035664
?ThumbControlType@Schema@DirectUI@@2HA	3801	0x1400090d8
?ThumbPositionProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3802	0x140009444
?ThumbPositionProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3803	0x140006fe0
?TickCountProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3804	0x14003c570
?TitleBarControlType@Schema@DirectUI@@2HA	3805	0x1400404d0
?TitleTextProp@TouchSwitch@DirectUI@@SAPEBUPropertyInfo@2@XZ	3806	0x14000a9fc
?ToString@Value@DirectUI@@QEBAPEAGPEAGI@Z	3807	0x140015c78
?Toggle@AutoButton@DirectUI@@SA?AVUID@@XZ	3808	0x14002a70c
?Toggle@SemanticZoomToggle@DirectUI@@SA?AVUID@@XZ	3809	0x140028b3c
?Toggle@ToggleProvider@DirectUI@@UEAAJXZ	3810	0x14002fe7c
?ToggleOnClickProp@TouchCheckBox@DirectUI@@SAPEBUPropertyInfo@2@XZ	3811	0x14002e260
?TogglePattern@Schema@DirectUI@@2HA	3812	0x140013068
?ToggleUIState@HWNDElement@DirectUI@@QEAAX_N0@Z	3813	0x1400013dc
?Toggle_ToggleState_Property@Schema@DirectUI@@2HA	3814	0x14003e524
?ToolBarControlType@Schema@DirectUI@@2HA	3815	0x14000aedc
?ToolTipClosedEvent@Schema@DirectUI@@2HA	3816	0x14001d3d4
?ToolTipControlType@Schema@DirectUI@@2HA	3817	0x140001ccc
?ToolTipOpenedEvent@Schema@DirectUI@@2HA	3818	0x140037908
?TooltipMaxWidthProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3819	0x14002f1f8
?TooltipMaximumLineCountProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3820	0x1400108ac
?TooltipProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3821	0x140008490
?TooltipTimerStarting@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3822	0x14000b9e4
?TossElement@ElementProvider@DirectUI@@UEAAXXZ	3823	0x14001023c
?TossPatternProvider@ElementProvider@DirectUI@@QEAAXW4Pattern@Schema@2@@Z	3824	0x1400073ec
?TrackScore@NavScoring@DirectUI@@QEAAHPEAVElement@2@0@Z	3825	0x14003a22c
?TrackingProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3826	0x140019924
?TransformPattern@Schema@DirectUI@@2HA	3827	0x14001126c
?TranslateThumbPositionToThumbValue@TouchSlider@DirectUI@@QEAAHH@Z	3828	0x140040f84
?TransparentProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	3829	0x14001590c
?TreatRightMouseButtonAsLeftProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3830	0x1400206b4
?TreeControlType@Schema@DirectUI@@2HA	3831	0x140001650
?TreeItemControlType@Schema@DirectUI@@2HA	3832	0x14001f9e8
?TriggeredAnimationComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ	3833	0x14003a40c
?Try@NavScoring@DirectUI@@QEAAHPEAVElement@2@HPEBUNavReference@2@K@Z	3834	0x140033a24
?TryLinePattern@Element@DirectUI@@AEAA_NPEAUtagPOINT@@AEBUtagRECT@@@Z	3835	0x1400289f0
?TryPattern@Element@DirectUI@@AEAA_NNNPEAUtagPOINT@@AEBUtagRECT@@@Z	3836	0x14001a3ec
?TrySparsePattern@Element@DirectUI@@AEAA_NPEAUtagPOINT@@AEBUtagRECT@@@Z	3837	0x1400305bc
?TypographyProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	3838	0x1400249d4
?TypographyRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	3839	0x14002020c
?UiaEvents@Element@DirectUI@@QEAA_NXZ	3840	0x140018348
?UiaHostProviderFromHwnd@Schema@DirectUI@@2P6AJPEAUHWND__@@PEAPEAUIRawElementProviderSimple@@@ZEA	3841	0x14000d620
?UiaLookupId@Schema@DirectUI@@2P6AHW4AutomationIdentifierType@@PEBU_GUID@@@ZEA	3842	0x140017808
?UiaRaiseAutomationEvent@Schema@DirectUI@@2P6AJPEAUIRawElementProviderSimple@@H@ZEA	3843	0x14000652c
?UiaRaiseAutomationPropertyChangedEvent@Schema@DirectUI@@2P6AJPEAUIRawElementProviderSimple@@HUtagVARIANT@@1@ZEA	3844	0x140017e44
?UiaRaiseStructureChangedEvent@Schema@DirectUI@@2P6AJPEAUIRawElementProviderSimple@@W4StructureChangeType@@PEAHH@ZEA	3845	0x140019fd8
?UiaReturnRawElementProvider@Schema@DirectUI@@2P6A_JPEAUHWND__@@_K_JPEAUIRawElementProviderSimple@@@ZEA	3846	0x140014f54
?UnRegister@Element@DirectUI@@SAJPEAPEAUIClassInfo@2@@Z	3847	0x14003d3b8
?UnhandledSyschar@XElement@DirectUI@@SA?AVUID@@XZ	3848	0x140027f8c
?Uninit@CallstackTracker@DirectUI@@SAXXZ	3849	0x140021ad0
?Uninit@InvokeHelper@DirectUI@@QEAAXXZ	3850	0x140039444
?UninitProcess@FontCache@DirectUI@@SAXXZ	3851	0x140006750
?UninitThread@FontCache@DirectUI@@SAXXZ	3852	0x1400056b8
?UnloadCommonControlExports@AnimationStrip@DirectUI@@AEAAXXZ	3853	0x14001c44c
?Unlock@CritSecLock@DirectUI@@QEAAXXZ	3854	0x14000b7f4
?UnregisterForAnimationStatusChanges@TouchHWNDElement@DirectUI@@QEAAXXZ	3855	0x1400394bc
?UnregisterForIHMChanges@TouchHWNDElement@DirectUI@@QEAAXXZ	3856	0x1400317f8
?UnregisterForMonitorPowerChanges@TouchHWNDElement@DirectUI@@QEAAJXZ	3857	0x14003441c
?UnvirtualizePosition@HWNDHost@DirectUI@@AEAAXXZ	3858	0x14000fa00
?UpdateChildFocus@DialogElementCore@DirectUI@@QEAAXPEAVElement@2@0@Z	3859	0x1400057bc
?UpdateChildren@Expando@DirectUI@@IEAAXPEAVValue@2@@Z	3860	0x1400335f4
?UpdateContentSize@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3861	0x140035d98
?UpdateDesiredSize@BorderLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3862	0x140029734
?UpdateDesiredSize@FillLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3863	0x14001f6c8
?UpdateDesiredSize@FlowLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3864	0x140007a84
?UpdateDesiredSize@GridLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3865	0x140033394
?UpdateDesiredSize@Layout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3866	0x14002acc4
?UpdateDesiredSize@NineGridLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3867	0x140031068
?UpdateDesiredSize@RowLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3868	0x140030250
?UpdateDesiredSize@TableLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3869	0x140032548
?UpdateDesiredSize@VerticalFlowLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3870	0x14002ed90
?UpdateElement@TouchSelect@DirectUI@@QEAAJHPEAVElement@2@PEBG@Z	3871	0x140033e0c
?UpdateLayout@Element@DirectUI@@QEAAXXZ	3872	0x140005aa4
?UpdateLayoutRect@Layout@DirectUI@@SAXPEAVElement@2@HH0HHHH@Z	3873	0x14000d824
?UpdateSheets@DUIXmlParser@DirectUI@@QEAAJPEAVElement@2@@Z	3874	0x14001f7f8
?UpdateString@TouchSelect@DirectUI@@QEAAJHPEBG@Z	3875	0x1400242dc
?UpdateStyleSheets@HWNDElement@DirectUI@@IEAAXXZ	3876	0x1400091c4
?UpdateToggleState@SemanticZoomToggle@DirectUI@@QEAAXW4SemanticZoomToggleState@@_N@Z	3877	0x140013644
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z	3878	0x140007d8c
?UpdateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3879	0x14001aeb0
?UpdateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3880	0x14002e500
?UpdateView@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3881	0x1400244ec
?UseFixedTooltipOffset@TouchSlider@DirectUI@@QEAAXXZ	3882	0x140016ef0
?UsePerMonitorScaling@TouchHWNDElement@DirectUI@@QEAAXPEAUHMONITOR__@@@Z	3883	0x14002f7e0
?UserTextChanged@TouchEditBase@DirectUI@@SA?AVUID@@XZ	3884	0x14002e344
?UserTextUpdateNoChange@TouchEditBase@DirectUI@@SA?AVUID@@XZ	3885	0x14003d94c
?UsesDesktopPerMonitorScalingProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3886	0x14003d460
?ValuePattern@Schema@DirectUI@@2HA	3887	0x140026db8
?Value_IsReadOnly_Property@Schema@DirectUI@@2HA	3888	0x14000f7a0
?Value_Value_Property@Schema@DirectUI@@2HA	3889	0x140023c14
?VerifyParentage@HWNDHost@DirectUI@@IEAAHXZ	3890	0x140007dac
?VerticalProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3891	0x14000f664
?VerticalScriptProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	3892	0x140025e54
?VirtualizedItemPattern@Schema@DirectUI@@2HA	3893	0x140016a80
?VisibleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3894	0x140037c40
?VisitedProp@TouchHyperLink@DirectUI@@SAPEBUPropertyInfo@2@XZ	3895	0x1400182bc
?VisualStateProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3896	0x140018080
?WantEvent@EventManager@DirectUI@@CA_NW4Event@Schema@2@H@Z	3897	0x14002735c
?WantEvent@EventManager@DirectUI@@SA_NW4Event@Schema@2@@Z	3898	0x140004928
?WantPropertyEvent@EventManager@DirectUI@@SA_NH@Z	3899	0x140005584
?WantTabsProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	3900	0x140009128
?WidthProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3901	0x14002fbbc
?WinStyleProp@CCBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3902	0x14003d138
?WindowAccessGradientColorProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3903	0x140022cc0
?WindowActiveProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3904	0x140006608
?WindowControlType@Schema@DirectUI@@2HA	3905	0x140040264
?WindowDpiChanged@HWNDElement@DirectUI@@SA?AVUID@@XZ	3906	0x14000b6d0
?WindowPattern@Schema@DirectUI@@2HA	3907	0x140036e70
?WindowWindowClosedEvent@Schema@DirectUI@@2HA	3908	0x140001908
?WindowWindowOpenedEvent@Schema@DirectUI@@2HA	3909	0x14001a058
?WndProc@HWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z	3910	0x1400196ec
?WndProc@NativeHWNDHost@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z	3911	0x14001bbb8
?WndProc@TouchHWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z	3912	0x14001ddfc
?WndProc@XHost@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z	3913	0x140010e9c
?WrapKeyboardNavigateProp@HWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3914	0x140019e08
?XBarVisibilityProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3915	0x140029910
?XOffsetProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3916	0x1400209e4
?XOffsetProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3917	0x140021040
?XProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3918	0x140024298
?XScrollableProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3919	0x140028a20
?XScrollableProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3920	0x1400043bc
?YBarVisibilityProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3921	0x1400218e4
?YOffsetProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3922	0x14002224c
?YOffsetProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3923	0x140018180
?YProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3924	0x14000b98c
?YScrollableProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3925	0x140014d70
?YScrollableProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3926	0x140033b30
?ZoomToRect@TouchScrollViewer@DirectUI@@QEAAJPEBUtagRECT@@_N@Z	3927	0x14002c834
?ZoomToRectManualVisualSwap@TouchScrollViewer@DirectUI@@QEAAJMMMMPEBHMMM_N@Z	3928	0x140005bfc
?_AddDependency@Element@DirectUI@@SAXPEAV12@PEBUPropertyInfo@2@HPEAUDepRecs@2@PEAVDeferCycle@2@PEAJ@Z	3929	0x14000abcc
?_BitAccurateFillRect@Macro@DirectUI@@KAXPEAUHDC__@@HHHHEEEEK@Z	3930	0x140006c54
?_BroadcastEventWorker@Element@DirectUI@@AEAAXPEAUEvent@2@@Z	3931	0x14003fd20
?_BuildChildren@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAVElement@2@@Z	3932	0x140030fcc
?_BuildElement@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAVElement@2@PEAPEAV42@@Z	3933	0x140010188
?_BuildFromBinary@DUIXmlParser@DirectUI@@IEAAJPEAVElement@2@0PEBGPEAKPEAPEAV32@@Z	3934	0x14001ac90
?_BuildStyles@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	3935	0x140034e64
?_CachedValueIsEqual@Element@DirectUI@@AEAAHPEBUPropertyInfo@2@PEAV12@@Z	3936	0x14002c158
?_CalcTabOrder@ShellBorderLayout@DirectUI@@AEAAJPEAVElement@2@@Z	3937	0x140028344
?_ClearNeedsLayout@Element@DirectUI@@QEAAXXZ	3938	0x14001969c
?_ClearTooltipState@TouchHWNDElement@DirectUI@@IEAAXXZ	3939	0x140006160
?_CreateAndSetLayout@DirectUI@@YAJPEAVElement@1@P6AJHPEAHPEAPEAVValue@1@@ZH1@Z	3940	0x1400173c0
?_CreateValue@DUIXmlParser@DirectUI@@IEAAJPEBGPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	3941	0x140039bcc
?_CtrlWndProc@HWNDHost@DirectUI@@CAHPEAXPEAUHWND__@@I_K_JPEA_J@Z	3942	0x14002ada8
?_DeleteCtrlWnd@HWNDHost@DirectUI@@AEAAXXZ	3943	0x140013a28
?_DestroyTables@DUIXmlParser@DirectUI@@QEAAXXZ	3944	0x14003ce84
?_DestroyTooltip@TouchHWNDElement@DirectUI@@IEAAXXZ	3945	0x140020328
?_DisplayNodeCallback@Element@DirectUI@@SAJPEAUHGADGET__@@PEAXPEAUEventMsg@@@Z	3946	0x140015e30
?_EndOptimizedLayoutQ@Element@DirectUI@@QEAAXXZ	3947	0x14002bec8
?_EnterOnCurrentThread@DUIXmlParser@DirectUI@@IEAAJXZ	3948	0x14000da50
?_Fill@Element@DirectUI@@IEAAXPEAUHDC__@@KHHHH_N@Z	3949	0x140037bd4
?_FireWindowDpiChangeEvent@HWNDElement@DirectUI@@IEAAXXZ	3950	0x14003a6a0
?_FlushDS@Element@DirectUI@@AEAAXPEAVDeferCycle@2@@Z	3951	0x14003d65c
?_FlushLayout@Element@DirectUI@@KAXPEAV12@PEAVDeferCycle@2@@Z	3952	0x140017b2c
?_GetBitmapSize@Macro@DirectUI@@KA_NPEAUHBITMAP__@@PEAUtagSIZE@@@Z	3953	0x140017098
?_GetBuriedSheetDependencies@Element@DirectUI@@AEAAXPEBUPropertyInfo@2@PEAV12@PEAUDepRecs@2@PEAVDeferCycle@2@PEAJ@Z	3954	0x140005080
?_GetChangesUpdatePass@Element@DirectUI@@QEAAHXZ	3955	0x14002f29c
?_GetClassForElement@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAPEAUIClassInfo@2@@Z	3956	0x140022590
?_GetClassForElementByName@DUIXmlParser@DirectUI@@IEAAJPEBGPEAPEAUIClassInfo@2@@Z	3957	0x1400381f8
?_GetComputedValue@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@PEAUUpdateCache@2@@Z	3958	0x140022bb4
?_GetContent@Viewer@DirectUI@@AEAAPEAVElement@2@XZ	3959	0x140020208
?_GetDependencies@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@HPEAUDepRecs@2@HPEAVValue@2@PEAVDeferCycle@2@@Z	3960	0x14000fc7c
?_GetLineInfo@DUIXmlParser@DirectUI@@IEAA?AULINEINFO@2@PEAUIXmlReader@@@Z	3961	0x140020434
?_GetLocalValue@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@@Z	3962	0x14000ab54
?_GetLocalValueFromVM@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@@Z	3963	0x140039c68
?_GetNeedsLayout@Element@DirectUI@@QEAAIXZ	3964	0x14001631c
?_GetPerMonitorScaleFactorForDesktopWindow@HWNDElement@DirectUI@@IEAAHPEAUHWND__@@@Z	3965	0x140015b6c
?_GetPropertyForAttribute@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUIClassInfo@2@PEAPEBUPropertyInfo@2@@Z	3966	0x14001bbcc
?_GetSpecifiedValue@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@PEAUUpdateCache@2@@Z	3967	0x140017800
?_GetSpecifiedValueIgnoreCache@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@@Z	3968	0x140009fd8
?_GetValueForStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEAUIClassInfo@2@PEBG1PEAPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	3969	0x1400325a4
?_HandleImmersiveColorSchemeChange@HWNDElement@DirectUI@@IEAAXXZ	3970	0x14001f3bc
?_InheritProperties@Element@DirectUI@@AEAAXXZ	3971	0x14002f99c
?_InitializeTables@DUIXmlParser@DirectUI@@QEAAJXZ	3972	0x140025784
?_InternalEnsureVisible@Viewer@DirectUI@@AEAA_NHHHH@Z	3973	0x140012ff4
?_InvalidateCachedDSConstraints@Element@DirectUI@@KAXPEAV12@@Z	3974	0x14001fb20
?_IsSemanticZoomControl@ElementProxy@DirectUI@@AEAA_NH@Z	3975	0x14002ee64
?_IsWindowHostUsingDoNotStealFocusFlag@ElementProxy@DirectUI@@AEAA_NXZ	3976	0x1400032e4
?_LeaveOnCurrentThread@DUIXmlParser@DirectUI@@IEAAXXZ	3977	0x140007268
?_LoadImage32BitsPerPixel@Macro@DirectUI@@KAPEAVValue@2@PEBG@Z	3978	0x140015220
?_MarkElementForDS@Element@DirectUI@@SAHPEAV12@@Z	3979	0x140015180
?_MarkElementForLayout@Element@DirectUI@@SAHPEAV12@I@Z	3980	0x1400177bc
?_OnFontPropChanged@Element@DirectUI@@IEAAXPEAVValue@2@@Z	3981	0x14001fb70
?_OnGetInfoTip@CCTreeView@DirectUI@@MEAAJPEBUtagNMTVGETINFOTIPW@@@Z	3982	0x140004fc4
?_OnItemChanged@CCTreeView@DirectUI@@MEAAJPEBUtagTVITEMCHANGE@@@Z	3983	0x140025c90
?_OnUIStateChanged@HWNDElement@DirectUI@@MEAAXGG@Z	3984	0x140009504
?_OnUIStateChanged@TouchHWNDElement@DirectUI@@MEAAXGG@Z	3985	0x14002b654
?_ParseBehavior@DUIXmlParser@DirectUI@@IEAAJPEAVElement@2@PEBG@Z	3986	0x140039214
?_ParseLayout@DUIXmlParser@DirectUI@@IEAAJPEBGPEAPEAVValue@2@@Z	3987	0x140028e2c
?_ParseValue@DUIXmlParser@DirectUI@@IEAAJPEBUPropertyInfo@2@PEBGPEAPEAVValue@2@@Z	3988	0x140017ef4
?_PostEvent@Element@DirectUI@@AEAAXPEAUEvent@2@H@Z	3989	0x14000dd74
?_PostSourceChange@Element@DirectUI@@AEAAJXZ	3990	0x140010598
?_PreSourceChange@Element@DirectUI@@AEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@1@Z	3991	0x1400375e0
?_PreSourceChange@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@HPEAVValue@2@1@Z	3992	0x140018b28
?_RecordElementBehaviors@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBG@Z	3993	0x14001c068
?_RecordElementLayout@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBG@Z	3994	0x14000fe38
?_RecordElementStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEBG_N@Z	3995	0x1400330d0
?_RecordElementTrees@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	3996	0x14002bef4
?_RecordElementWithChildren@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@_NPEAPEAG@Z	3997	0x14003a054
?_RecordInstantiateElement@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAPEAG@Z	3998	0x140006ac8
?_RecordSetElementProperties@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	3999	0x140008710
?_RecordSetValue@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBG1@Z	4000	0x1400023e4
?_RemoveLocalValue@Element@DirectUI@@IEAAJP6APEBUPropertyInfo@2@XZ_N@Z	4001	0x140038034
?_RemoveLocalValue@Element@DirectUI@@IEAAJPEBUPropertyInfo@2@_N@Z	4002	0x14002829c
?_RepeatButtonActionCallback@RepeatButton@DirectUI@@CAXPEAUGMA_ACTIONINFO@@@Z	4003	0x14000316c
?_Reset@ShellBorderLayout@DirectUI@@AEAAXXZ	4004	0x140020e30
?_ResolveStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEBGPEAPEAVValue@2@PEAI@Z	4005	0x14002e148
?_ScalePointsToPixels@DUIXmlParser@DirectUI@@AEBAHH@Z	4006	0x1400249d8
?_ScalePointsToPixels@DUIXmlParser@DirectUI@@AEBAMM@Z	4007	0x14000af18
?_ScaleRelativePixels@DUIXmlParser@DirectUI@@AEBAHH@Z	4008	0x14001cd8c
?_ScaleRelativePixels@DUIXmlParser@DirectUI@@AEBAMM@Z	4009	0x140012c68
?_SelfLayoutDoLayout@Clipper@DirectUI@@UEAAXHH@Z	4010	0x1400298e0
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z	4011	0x14003d048
?_SelfLayoutDoLayout@ScrollBar@DirectUI@@UEAAXHH@Z	4012	0x14001ed58
?_SelfLayoutDoLayout@TouchScrollBar@DirectUI@@UEAAXHH@Z	4013	0x14001a544
?_SelfLayoutDoLayout@Viewer@DirectUI@@UEAAXHH@Z	4014	0x140012370
?_SelfLayoutUpdateDesiredSize@Clipper@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4015	0x14003a060
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4016	0x1400086e0
?_SelfLayoutUpdateDesiredSize@ScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4017	0x14003b8a0
?_SelfLayoutUpdateDesiredSize@TouchScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4018	0x1400271ac
?_SelfLayoutUpdateDesiredSize@Viewer@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4019	0x140006dd8
?_SetBinaryXml@DUIXmlParser@DirectUI@@IEAAJPEBE_KPEAUHINSTANCE__@@@Z	4020	0x14003655c
?_SetGroupChanges@Element@DirectUI@@SA_NPEAV12@HPEAVDeferCycle@2@@Z	4021	0x14000faf8
?_SetNeedsLayout@Element@DirectUI@@QEAAHI@Z	4022	0x14003f114
?_SetProperties@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUIClassInfo@2@PEAVElement@2@@Z	4023	0x14001be1c
?_SetRelPixRect@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@HHHH@Z	4024	0x140028884
?_SetRelPixValue@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@H@Z	4025	0x140024728
?_SetValue@Element@DirectUI@@IEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@_N@Z	4026	0x140001b00
?_SetValue@Element@DirectUI@@IEAAJPEBUPropertyInfo@2@HPEAVValue@2@_N@Z	4027	0x14000a078
?_SetXMLFromResource@DUIXmlParser@DirectUI@@IEAAJPEBG0PEAUHINSTANCE__@@11@Z	4028	0x1400397d4
?_SetupParserState@DUIXmlParser@DirectUI@@IEAAJPEAUHINSTANCE__@@0@Z	4029	0x14003cfc0
?_SinkWndProc@HWNDHost@DirectUI@@CAHPEAXPEAUHWND__@@I_K_JPEA_J@Z	4030	0x14002bccc
?_StartOptimizedLayoutQ@Element@DirectUI@@QEAAXXZ	4031	0x14002fc40
?_SyncBackground@Element@DirectUI@@AEAAXXZ	4032	0x140023ec8
?_SyncRedrawStyle@Element@DirectUI@@AEAAXXZ	4033	0x14001be68
?_SyncVisible@Element@DirectUI@@AEAAXXZ	4034	0x140022e88
?_TransferGroupFlags@Element@DirectUI@@SAXPEAV12@H@Z	4035	0x14003d330
?_UpdateDesiredSize@Element@DirectUI@@QEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4036	0x140012d28
?_UpdateDesktopScaleFactor@HWNDElement@DirectUI@@AEAAHXZ	4037	0x140005f74
?_UpdateLayoutPosition@Element@DirectUI@@QEAAXHH@Z	4038	0x14002b1a0
?_UpdateLayoutSize@Element@DirectUI@@QEAAXHH@Z	4039	0x140033714
?_UpdatePropertyInCache@Element@DirectUI@@AEAAXPEBUPropertyInfo@2@@Z	4040	0x140035904
?_UpdateTileList@NineGridLayout@DirectUI@@AEAAXHPEAVElement@2@@Z	4041	0x14000a100
?_UsesUIAProxies@ElementProxy@DirectUI@@IEAAHXZ	4042	0x1400279a8
?_VoidPCNotifyTree@Element@DirectUI@@CAXHPEAVDeferCycle@2@@Z	4043	0x14000fe7c
?_WndProc@InvokeHelper@DirectUI@@CAHPEAXPEAUHWND__@@I_K_JPEA_J@Z	4044	0x140009690
?_ZeroRelease@Value@DirectUI@@AEAAXXZ	4045	0x140031d8c
?_atmArrow@Expando@DirectUI@@0GA	4046	0x140004a2c
?_atmClipper@Expando@DirectUI@@0GA	4047	0x14001add8
?_roleMapping@Schema@DirectUI@@0QBURoleMap@12@B	4048	0x1400105b0
?accDoDefaultAction@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@@Z	4049	0x140033dcc
?accDoDefaultAction@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@@Z	4050	0x1400100f8
?accHitTest@DuiAccessible@DirectUI@@UEAAJJJPEAUtagVARIANT@@@Z	4051	0x14001e92c
?accHitTest@HWNDHostAccessible@DirectUI@@UEAAJJJPEAUtagVARIANT@@@Z	4052	0x14003b9b8
?accLocation@DuiAccessible@DirectUI@@UEAAJPEAJ000UtagVARIANT@@@Z	4053	0x14003f1cc
?accLocation@HWNDHostAccessible@DirectUI@@UEAAJPEAJ000UtagVARIANT@@@Z	4054	0x1400207cc
?accNavigate@DuiAccessible@DirectUI@@UEAAJJUtagVARIANT@@PEAU3@@Z	4055	0x140018908
?accNavigate@HWNDHostAccessible@DirectUI@@UEAAJJUtagVARIANT@@PEAU3@@Z	4056	0x140017830
?accNavigate@HWNDHostClientAccessible@DirectUI@@UEAAJJUtagVARIANT@@PEAU3@@Z	4057	0x14001a864
?accSelect@DuiAccessible@DirectUI@@UEAAJJUtagVARIANT@@@Z	4058	0x140021e60
?accSelect@HWNDHostAccessible@DirectUI@@UEAAJJUtagVARIANT@@@Z	4059	0x140020d8c
?advanceFrameActionStart@Movie@DirectUI@@AEAAXXZ	4060	0x140035314
?advanceFrameActionStop@Movie@DirectUI@@AEAAXXZ	4061	0x140027d50
?cChangeBulk@EventManager@DirectUI@@0HB	4062	0x1400231d0
?c_RefCountBitOffset@Value@DirectUI@@0HB	4063	0x14000d25c
?c_RefCountMask@Value@DirectUI@@0JB	4064	0x140003258
?c_SingleRefCount@Value@DirectUI@@0JB	4065	0x14003b9f8
?c_rgar@AccessibleButton@DirectUI@@0QBUACCESSIBLEROLE@12@B	4066	0x14002213c
?doAction@Movie@DirectUI@@QEAAXPEAUGMA_ACTIONINFO@@@Z	4067	0x14001a6f4
?g_cRefCount@ResourceModuleHandles@DirectUI@@0JC	4068	0x140020cc0
?g_controlInfoTable@Schema@DirectUI@@0QBUControlInfo@12@B	4069	0x140031178
?g_cs@ElementProviderManager@DirectUI@@2U_RTL_CRITICAL_SECTION@@A	4070	0x14002be80
?g_cs@EventManager@DirectUI@@0U_RTL_CRITICAL_SECTION@@A	4071	0x140005480
?g_cs@InvokeManager@DirectUI@@0U_RTL_CRITICAL_SECTION@@A	4072	0x14000f5d0
?g_dwElSlot@DirectUI@@3KA	4073	0x14003d680
?g_eventInfoTable@Schema@DirectUI@@0QBUEventInfo@12@B	4074	0x1400243ec
?g_eventMapping@Schema@DirectUI@@0QBUEventMap@12@B	4075	0x1400359ac
?g_eventRegisteredMap@EventManager@DirectUI@@0PAIA	4076	0x140020f20
?g_fInited@Schema@DirectUI@@0_NA	4077	0x140008ed0
?g_fWantAnyEvent@EventManager@DirectUI@@0_NA	4078	0x14002cf34
?g_pArrayInvokeHelper@InvokeManager@DirectUI@@0PEAV?$UiaArray@PEAVInvokeHelper@DirectUI@@@2@EA	4079	0x14002fc30
?g_pArrayPprv@ElementProviderManager@DirectUI@@0PEAV?$UiaArray@PEAVElementProvider@DirectUI@@@2@EA	4080	0x140027628
?g_pArrayPropertyEvent@EventManager@DirectUI@@0PEAV?$UiaArray@H@2@EA	4081	0x140038e40
?g_patternInfoTable@Schema@DirectUI@@0QBUPatternInfo@12@B	4082	0x140034f74
?g_patternMapping@Schema@DirectUI@@0QBUPatternMap@12@B	4083	0x14003de58
?g_propertyInfoTable@Schema@DirectUI@@0QBUPropertyInfo@12@B	4084	0x14000355c
?g_rgMouseMap@HWNDHost@DirectUI@@0QAY02$$CBIA	4085	0x14001fda0
?get_BoundingRectangle@ElementProvider@DirectUI@@UEAAJPEAUUiaRect@@@Z	4086	0x1400267d4
?get_CanSelectMultiple@SelectionProvider@DirectUI@@UEAAJPEAH@Z	4087	0x14003ce48
?get_Column@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4088	0x14000845c
?get_ColumnCount@GridProvider@DirectUI@@UEAAJPEAH@Z	4089	0x1400052a0
?get_ColumnSpan@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4090	0x14001d070
?get_ContainingGrid@GridItemProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z	4091	0x1400189c0
?get_ExpandCollapseState@ExpandCollapseProvider@DirectUI@@UEAAJPEAW4ExpandCollapseState@@@Z	4092	0x140018ab8
?get_FragmentRoot@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderFragmentRoot@@@Z	4093	0x14001f66c
?get_HorizontalScrollPercent@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4094	0x14003ff0c
?get_HorizontalViewSize@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4095	0x14001b410
?get_HorizontallyScrollable@ScrollProvider@DirectUI@@UEAAJPEAH@Z	4096	0x140020750
?get_HostRawElementProvider@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z	4097	0x140006f18
?get_IsReadOnly@RangeValueProvider@DirectUI@@UEAAJPEAH@Z	4098	0x14001b894
?get_IsReadOnly@ValueProvider@DirectUI@@UEAAJPEAH@Z	4099	0x140003db8
?get_IsSelected@SelectionItemProvider@DirectUI@@UEAAJPEAH@Z	4100	0x1400123ac
?get_IsSelectionRequired@SelectionProvider@DirectUI@@UEAAJPEAH@Z	4101	0x140019d44
?get_LargeChange@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4102	0x140031cec
?get_Maximum@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4103	0x140026d74
?get_Minimum@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4104	0x14000d3e4
?get_ProviderOptions@ElementProvider@DirectUI@@UEAAJPEAW4ProviderOptions@@@Z	4105	0x1400016f8
?get_Row@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4106	0x140001d4c
?get_RowCount@GridProvider@DirectUI@@UEAAJPEAH@Z	4107	0x14002a5f8
?get_RowOrColumnMajor@TableProvider@DirectUI@@UEAAJPEAW4RowOrColumnMajor@@@Z	4108	0x140027c48
?get_RowSpan@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4109	0x140018668
?get_SelectionContainer@SelectionItemProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z	4110	0x1400234a4
?get_SmallChange@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4111	0x140020c1c
?get_ToggleState@ToggleProvider@DirectUI@@UEAAJPEAW4ToggleState@@@Z	4112	0x14001f434
?get_Value@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4113	0x1400360c0
?get_Value@ValueProvider@DirectUI@@UEAAJPEAPEAG@Z	4114	0x14002a398
?get_VerticalScrollPercent@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4115	0x1400396fc
?get_VerticalViewSize@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4116	0x14001ad4c
?get_VerticallyScrollable@ScrollProvider@DirectUI@@UEAAJPEAH@Z	4117	0x140009d60
?get_accChild@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAUIDispatch@@@Z	4118	0x140040544
?get_accChild@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAUIDispatch@@@Z	4119	0x1400057cc
?get_accChildCount@DuiAccessible@DirectUI@@UEAAJPEAJ@Z	4120	0x140031ce0
?get_accChildCount@HWNDHostAccessible@DirectUI@@UEAAJPEAJ@Z	4121	0x14000aca0
?get_accDefaultAction@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4122	0x14001ef14
?get_accDefaultAction@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4123	0x1400391b0
?get_accDescription@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4124	0x140036100
?get_accDescription@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4125	0x1400159f8
?get_accFocus@DuiAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4126	0x140032e54
?get_accFocus@HWNDHostAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4127	0x1400028dc
?get_accHelp@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4128	0x140022068
?get_accHelp@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4129	0x14001dbc4
?get_accHelpTopic@DuiAccessible@DirectUI@@UEAAJPEAPEAGUtagVARIANT@@PEAJ@Z	4130	0x140019c1c
?get_accHelpTopic@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAGUtagVARIANT@@PEAJ@Z	4131	0x14001acd4
?get_accKeyboardShortcut@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4132	0x14000cdec
?get_accKeyboardShortcut@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4133	0x14001ec00
?get_accName@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4134	0x140009a48
?get_accName@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4135	0x14002da84
?get_accParent@DuiAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4136	0x14003bc1c
?get_accParent@HWNDElementAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4137	0x14000e8ac
?get_accParent@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4138	0x14002e4f4
?get_accParent@HWNDHostClientAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4139	0x1400011bc
?get_accRole@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4140	0x140038074
?get_accRole@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4141	0x140003394
?get_accRole@HWNDHostClientAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4142	0x14000bd98
?get_accSelection@DuiAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4143	0x140037c98
?get_accSelection@HWNDHostAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4144	0x14003e0e4
?get_accState@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4145	0x14001252c
?get_accState@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4146	0x14002c890
?get_accValue@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4147	0x14002c3f0
?get_accValue@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4148	0x140007988
?put_accName@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4149	0x140026078
?put_accName@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4150	0x14001c16c
?put_accValue@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4151	0x14001c820
?put_accValue@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4152	0x14000dc90
?s_HandleDUIEventMessage@Element@DirectUI@@CA_NPEAV12@PEAUEventMsg@@@Z	4153	0x140037e48
?s_ImageHlpFuncList@CallstackTracker@DirectUI@@0PAUIMGHLPFN_LOAD@12@A	4154	0x1400232e0
?s_SyncCallback@CSafeElementProxy@@SAJPEAUHGADGET__@@PEAXPEAUEventMsg@@@Z	4155	0x140002290
?s_XMLParseError@DUIFactory@DirectUI@@CAXPEBG0HPEAX@Z	4156	0x14000d91c
?s_fdClr@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@K@12@B	4157	0x140026a08
?s_fdFill@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@PEAVValue@DirectUI@@@12@B	4158	0x140034994
?s_fdGraphic@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@PEAVValue@DirectUI@@@12@B	4159	0x1400119ac
?s_fdInt@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@H@12@B	4160	0x14003c99c
?s_fdRect@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@UScaledRECT@DirectUI@@@12@B	4161	0x14003f5e4
?s_fdSize@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@UScaledSIZE@DirectUI@@@12@B	4162	0x14001cbbc
?s_fdString@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@PEAVValue@DirectUI@@@12@B	4163	0x140029bb8
?s_hProcess@CallstackTracker@DirectUI@@0PEAXEA	4164	0x14003134c
?s_hinstImageHlp@CallstackTracker@DirectUI@@0PEAUHINSTANCE__@@EA	4165	0x14001cf18
?s_hinstNtDll@CallstackTracker@DirectUI@@0PEAUHINSTANCE__@@EA	4166	0x140036ad8
?s_initonceInit@CallstackTracker@DirectUI@@0T_RTL_RUN_ONCE@@A	4167	0x1400089e4
?s_pClassInfo@AccessibleButton@DirectUI@@0PEAUIClassInfo@2@EA	4168	0x14000eee0
?s_pClassInfo@AnimationStrip@DirectUI@@0PEAUIClassInfo@2@EA	4169	0x140022160
?s_pClassInfo@AutoButton@DirectUI@@0PEAUIClassInfo@2@EA	4170	0x1400063ac
?s_pClassInfo@BaseScrollViewer@DirectUI@@0PEAUIClassInfo@2@EA	4171	0x14001c878
?s_pClassInfo@Bind@DirectUI@@0PEAUIClassInfo@2@EA	4172	0x140040528
?s_pClassInfo@Browser@DirectUI@@0PEAUIClassInfo@2@EA	4173	0x14003d79c
?s_pClassInfo@Button@DirectUI@@0PEAUIClassInfo@2@EA	4174	0x14003fa24
?s_pClassInfo@CCAVI@DirectUI@@0PEAUIClassInfo@2@EA	4175	0x14001ed1c
?s_pClassInfo@CCBase@DirectUI@@0PEAUIClassInfo@2@EA	4176	0x14002df2c
?s_pClassInfo@CCBaseCheckRadioButton@DirectUI@@0PEAUIClassInfo@2@EA	4177	0x140022994
?s_pClassInfo@CCBaseScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4178	0x140031f50
?s_pClassInfo@CCCheckBox@DirectUI@@0PEAUIClassInfo@2@EA	4179	0x14001fac4
?s_pClassInfo@CCCommandLink@DirectUI@@0PEAUIClassInfo@2@EA	4180	0x1400135c8
?s_pClassInfo@CCHScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4181	0x140027970
?s_pClassInfo@CCListBox@DirectUI@@0PEAUIClassInfo@2@EA	4182	0x140003878
?s_pClassInfo@CCListView@DirectUI@@0PEAUIClassInfo@2@EA	4183	0x14003ce54
?s_pClassInfo@CCProgressBar@DirectUI@@0PEAUIClassInfo@2@EA	4184	0x14003c468
?s_pClassInfo@CCPushButton@DirectUI@@0PEAUIClassInfo@2@EA	4185	0x1400413f8
?s_pClassInfo@CCRadioButton@DirectUI@@0PEAUIClassInfo@2@EA	4186	0x140011d5c
?s_pClassInfo@CCSysLink@DirectUI@@0PEAUIClassInfo@2@EA	4187	0x1400267f0
?s_pClassInfo@CCTrackBar@DirectUI@@0PEAUIClassInfo@2@EA	4188	0x140010c84
?s_pClassInfo@CCTreeView@DirectUI@@0PEAUIClassInfo@2@EA	4189	0x140009358
?s_pClassInfo@CCVScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4190	0x140014eec
?s_pClassInfo@CheckBoxGlyph@DirectUI@@0PEAUIClassInfo@2@EA	4191	0x140033778
?s_pClassInfo@Clipper@DirectUI@@0PEAUIClassInfo@2@EA	4192	0x140037548
?s_pClassInfo@Combobox@DirectUI@@0PEAUIClassInfo@2@EA	4193	0x140001338
?s_pClassInfo@DialogElement@DirectUI@@0PEAUIClassInfo@2@EA	4194	0x140029768
?s_pClassInfo@Edit@DirectUI@@0PEAUIClassInfo@2@EA	4195	0x14001f5f4
?s_pClassInfo@Element@DirectUI@@0PEAUIClassInfo@2@EA	4196	0x140039b28
?s_pClassInfo@ElementWithHWND@DirectUI@@0PEAUIClassInfo@2@EA	4197	0x14001f998
?s_pClassInfo@Expandable@DirectUI@@0PEAUIClassInfo@2@EA	4198	0x140015694
?s_pClassInfo@Expando@DirectUI@@0PEAUIClassInfo@2@EA	4199	0x1400275f8
?s_pClassInfo@ExpandoButtonGlyph@DirectUI@@0PEAUIClassInfo@2@EA	4200	0x1400153d4
?s_pClassInfo@HWNDElement@DirectUI@@0PEAUIClassInfo@2@EA	4201	0x14003917c
?s_pClassInfo@HWNDHost@DirectUI@@0PEAUIClassInfo@2@EA	4202	0x140016fd8
?s_pClassInfo@Macro@DirectUI@@0PEAUIClassInfo@2@EA	4203	0x140005ccc
?s_pClassInfo@Movie@DirectUI@@0PEAUIClassInfo@2@EA	4204	0x14002a160
?s_pClassInfo@Navigator@DirectUI@@0PEAUIClassInfo@2@EA	4205	0x14002dd5c
?s_pClassInfo@PText@DirectUI@@0PEAUIClassInfo@2@EA	4206	0x140033a14
?s_pClassInfo@Page@DirectUI@@0PEAUIClassInfo@2@EA	4207	0x14001bbc0
?s_pClassInfo@Pages@DirectUI@@0PEAUIClassInfo@2@EA	4208	0x140024d20
?s_pClassInfo@Progress@DirectUI@@0PEAUIClassInfo@2@EA	4209	0x140011a2c
?s_pClassInfo@PushButton@DirectUI@@0PEAUIClassInfo@2@EA	4210	0x14001bf0c
?s_pClassInfo@RadioButtonGlyph@DirectUI@@0PEAUIClassInfo@2@EA	4211	0x140013058
?s_pClassInfo@RefPointElement@DirectUI@@0PEAUIClassInfo@2@EA	4212	0x1400299dc
?s_pClassInfo@RepeatButton@DirectUI@@0PEAUIClassInfo@2@EA	4213	0x14003c2dc
?s_pClassInfo@Repeater@DirectUI@@0PEAUIClassInfo@2@EA	4214	0x140018f28
?s_pClassInfo@ScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4215	0x140002954
?s_pClassInfo@ScrollViewer@DirectUI@@0PEAUIClassInfo@2@EA	4216	0x14001d9d4
?s_pClassInfo@Selector@DirectUI@@0PEAUIClassInfo@2@EA	4217	0x14000912c
?s_pClassInfo@SelectorNoDefault@DirectUI@@0PEAUIClassInfo@2@EA	4218	0x140005ad4
?s_pClassInfo@StyledScrollViewer@DirectUI@@0PEAUIClassInfo@2@EA	4219	0x140020058
?s_pClassInfo@TextGraphic@DirectUI@@0PEAUIClassInfo@2@EA	4220	0x140010b70
?s_pClassInfo@Thumb@DirectUI@@0PEAUIClassInfo@2@EA	4221	0x140036e0c
?s_pClassInfo@UnknownElement@DirectUI@@0PEAUIClassInfo@2@EA	4222	0x14002ed98
?s_pClassInfo@Viewer@DirectUI@@0PEAUIClassInfo@2@EA	4223	0x1400155c0
?s_pClassInfo@XBaby@DirectUI@@0PEAUIClassInfo@2@EA	4224	0x140023f54
?s_pClassInfo@XElement@DirectUI@@0PEAUIClassInfo@2@EA	4225	0x14003d518
?s_pfnImagehlpApiVersionEx@CallstackTracker@DirectUI@@0P6APEAUAPI_VERSION@@PEAU3@@ZEA	4226	0x14003e4c8
?s_pfnRtlCaptureStackBackTrace@CallstackTracker@DirectUI@@0P6AGKKPEAPEAXPEAK@ZEA	4227	0x140037228
?s_pfnSymFromAddr@CallstackTracker@DirectUI@@0P6AHPEAX_KPEA_KPEAU_SYMBOL_INFO@@@ZEA	4228	0x14002233c
?s_pfnSymGetModuleInfo64@CallstackTracker@DirectUI@@0P6AHPEAX_KPEAU_IMAGEHLP_MODULE64@@@ZEA	4229	0x14003c0ec
?s_pfnSymInitialize@CallstackTracker@DirectUI@@0P6AHPEAXPEBDH@ZEA	4230	0x14000e47c
?s_pfnSymLoadModule64@CallstackTracker@DirectUI@@0P6A_KPEAX0PEBD1_KK@ZEA	4231	0x1400344a8
?s_pfnSymSetOptions@CallstackTracker@DirectUI@@0P6AKK@ZEA	4232	0x14002d8d8
?s_uButtonFocusChangeMsg@XElement@DirectUI@@2IB	4233	0x140040390
?s_uInvokeHelperMsg@InvokeHelper@DirectUI@@0IB	4234	0x1400204e4
?s_uNavigateOutMsg@XElement@DirectUI@@2IB	4235	0x14000fd80
?s_uUnhandledSyscharMsg@XElement@DirectUI@@2IB	4236	0x140032c14
ARGBColorFromEnumI	4237	0x140019554
AllowAllScalingPlateaus	4238	0x140006cbc
BlurBitmap	4239	0x140014e20
BrushFromEnumI	4240	0x140006864
ColorFromEnumI	4241	0x14003bf10
CreateDUIWrapper	4242	0x14003bcf4
CreateDUIWrapperEx	4243	0x14002004c
CreateDUIWrapperFromResource	4244	0x14003793c
CreateDUIWrapperTouchEx	1274	0x140013a44
CreateTouchTooltip	4245	0x140018588
DUI70_DUIXmlParserCreate	4246	0x14001c95c
DUI70_DUIXmlParserCreateElement	4247	0x14003b1b4
DUI70_DUIXmlParserDestroy	4248	0x1400072ac
DUI70_DUIXmlParserSetXMLFromResource	4249	0x140010814
DUI70_ElementAddListener	4250	0x140026eb4
DUI70_ElementDestroy	4251	0x140005f28
DUI70_ElementEndDefer	4252	0x140016be8
DUI70_ElementFindDescendent	4253	0x140030d78
DUI70_ElementGetChildren	4254	0x1400351d4
DUI70_ElementGetRoot	4255	0x140021a48
DUI70_ElementRemoveListener	4256	0x140028a6c
DUI70_ElementSetAccRole	4257	0x140010e28
DUI70_ElementSetAccessible	4258	0x140034cc8
DUI70_ElementSetContentAlign	4259	0x14001ca48
DUI70_ElementSetContentString	4260	0x14002e754
DUI70_ElementSetFont	4261	0x140013ca8
DUI70_ElementSetID	4262	0x14002e914
DUI70_ElementSetLayoutPos	4263	0x140007c5c
DUI70_ElementSetVisible	4264	0x140035930
DUI70_ElementStartDefer	4265	0x14003a78c
DUI70_IsTouchButtonClickEqual	4266	0x14002b588
DUI70_RichTextCreate	4267	0x14003a0f8
DUI70_RichTextSetConstrainLayout	4268	0x14002eb0c
DUI70_ValueRelease	4269	0x14000d6cc
DUIDrawShadowText	4270	0x140004e84
DUIStopPVLAnimation	4271	0x14001bdd0
DisableAnimations	4272	0x140032370
DisableInitCallstackTracking	4273	0x140016dac
DrawShadowTextEx	4274	0x14002dc28
DuiCreateObject	1442	0x14000289c
ElementFromGadget	4275	0x14003a5bc
EnableAnimations	4276	0x14001e5a0
FlushThemeHandles	4277	0x140036bb4
ForceDebugBreak	4278	0x14000c574
GetDesktopDPI	4279	0x14002b9f4
GetElementDataEntry	4280	0x14003bad8
GetElementMacro	4281	0x1400244a0
GetFontCache	4282	0x14001bc10
GetScaleFactor	4283	0x140034268
GetThemeHandle	4284	0x140026354
HStrDup	4285	0x14001e1e8
HrSysAllocString	4286	0x140030514
InitPreprocessor	4287	0x140024e84
InitProcessPriv	4288	0x140001750
InitThread	4289	0x140010914
IsAnimationsEnabled	4290	0x14002732c
IsPalette	4291	0x1400369c4
IsUIAutomationProviderEnabled	4292	0x14000f9c4
MultiByteToUnicode	4293	0x1400290e4
NotifyAccessibilityEvent	4294	0x14000f1b4
PreprocessBuffer	4295	0x140005e0c
ProcessAlphaBitmapI	4296	0x1400108b8
PurgeThemeHandles	4297	0x140007cc8
RegisterAllControls	4298	0x14003edac
RegisterBaseControls	4299	0x1400346a0
RegisterBrowserControls	4300	0x1400227d8
RegisterCommonControls	4301	0x14001e064
RegisterExtendedControls	4302	0x1400137d0
RegisterMacroControls	4303	0x14002b9dc
RegisterMiscControls	4304	0x14003c598
RegisterPVLBehaviorFactory	4305	0x1400053c8
RegisterStandardControls	4306	0x14001df28
RegisterXControls	4307	0x14003ac84
SetDefAction	4308	0x14002af54
SetDesktopDPIOverride	4309	0x1400204d4
SkipDLLUnloadInitChecks	4310	0x14000ad44
StartMessagePump	4311	0x140003044
StopMessagePump	4312	0x140036390
StrToID	4313	0x14002e6cc
UiaHideOnGetObject	4314	0x14003cb64
UiaOnDestroySink	4315	0x140019064
UiaOnGetObject	4316	0x14002eaf8
UiaOnToolTip	4317	0x140021b94
UnInitProcessPriv	4318	0x140008bd8
UnInitThread	4319	0x14002503c
UnicodeToMultiByte	4320	0x14002ed9c

Version Infos

Description	Data
LegalCopyright	Microsoft Corporation. All rights reserv
InternalName	bitsp
FileVersion	7.5.7600.16385 (win7_rtm.090713-
CompanyName	Microsoft Corporati
ProductName	Microsoft Windows Operating S
ProductVersion	6.1.7600
FileDescription	Background Intellig
OriginalFilename	kbdy
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2021 04:15:45.514858007 CEST	57820	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:15:45.537218094 CEST	53	57820	8.8.8.8	192.168.2.7
Sep 29, 2021 04:16:01.327946901 CEST	50848	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:16:01.348884106 CEST	53	50848	8.8.8.8	192.168.2.7
Sep 29, 2021 04:16:19.405009031 CEST	61242	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:16:19.436249971 CEST	53	61242	8.8.8.8	192.168.2.7
Sep 29, 2021 04:16:37.617613077 CEST	58562	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:16:37.637005091 CEST	53	58562	8.8.8.8	192.168.2.7
Sep 29, 2021 04:16:48.010812998 CEST	56590	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:16:48.031752110 CEST	53	56590	8.8.8.8	192.168.2.7
Sep 29, 2021 04:16:48.649585009 CEST	60501	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:16:48.669254065 CEST	53	60501	8.8.8.8	192.168.2.7
Sep 29, 2021 04:16:49.446748018 CEST	53775	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:16:49.470232964 CEST	53	53775	8.8.8.8	192.168.2.7
Sep 29, 2021 04:16:49.731686115 CEST	51837	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:16:49.764206886 CEST	53	51837	8.8.8.8	192.168.2.7
Sep 29, 2021 04:16:49.865859032 CEST	55411	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:16:49.885955095 CEST	53	55411	8.8.8.8	192.168.2.7
Sep 29, 2021 04:16:50.425120115 CEST	63668	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:16:50.444103003 CEST	53	63668	8.8.8.8	192.168.2.7
Sep 29, 2021 04:16:51.121851921 CEST	54640	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:16:51.141371012 CEST	53	54640	8.8.8.8	192.168.2.7
Sep 29, 2021 04:16:51.679373980 CEST	58739	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:16:51.699142933 CEST	53	58739	8.8.8.8	192.168.2.7
Sep 29, 2021 04:16:52.502444983 CEST	60338	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:16:52.521673918 CEST	53	60338	8.8.8.8	192.168.2.7
Sep 29, 2021 04:16:53.809134007 CEST	58717	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:16:53.830663919 CEST	53	58717	8.8.8.8	192.168.2.7
Sep 29, 2021 04:16:54.239820004 CEST	59762	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:16:54.259191990 CEST	53	59762	8.8.8.8	192.168.2.7
Sep 29, 2021 04:16:57.896445990 CEST	54329	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:16:57.917392015 CEST	53	54329	8.8.8.8	192.168.2.7
Sep 29, 2021 04:17:29.194128036 CEST	58052	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:17:29.221677065 CEST	53	58052	8.8.8.8	192.168.2.7
Sep 29, 2021 04:17:31.762718916 CEST	54008	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:17:31.792819023 CEST	53	54008	8.8.8.8	192.168.2.7
Sep 29, 2021 04:18:09.805459976 CEST	59451	53	192.168.2.7	8.8.8.8
Sep 29, 2021 04:18:09.841366053 CEST	53	59451	8.8.8.8	192.168.2.7

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll64.exe PID: 6392 Parent PID: 496

General

Start time:	04:15:51
Start date:	29/09/2021
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe 'C:\Users\user\Desktop\yPeVDkBY3n.dll'
Imagebase:	0x7ff64db90000
File size:	1136128 bytes
MD5 hash:	E0CC9D126C39A9D2FA1CAD5027EBBD18
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 6432 Parent PID: 6392

General

Start time:	04:15:52
Start date:	29/09/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\yPeVDkBY3n.dll',#1
Imagebase:	0x7ff7bf140000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6480 Parent PID: 6432

General

Start time:	04:15:53
Start date:	29/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe 'C:\Users\user\Desktop\yPeVDkBY3n.dll',#1
Imagebase:	0x7ff63d4d0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000004.00000002.334340057.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6488 Parent PID: 6392

General

Start time:	04:15:53
Start date:	29/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\yPeVDkBY3n.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ
Imagebase:	0x7ff63d4d0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000005.00000002.252235999.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 3292 Parent PID: 6480

General

Start time:	04:15:54
Start date:	29/09/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff662bf0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6552 Parent PID: 6392

General

Start time:	04:15:56
Start date:	29/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\yPeVDkBY3n.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ
Imagebase:	0x7ff63d4d0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000007.00000002.260064173.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6728 Parent PID: 6392

General

Start time:	04:16:00
Start date:	29/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\yPeVDkBY3n.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ
Imagebase:	0x7ff63d4d0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000000A.00000002.267627821.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: Netplwiz.exe PID: 2848 Parent PID: 3292

General

Start time:	04:16:34
Start date:	29/09/2021
Path:	C:\Windows\System32\Netplwiz.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\Netplwiz.exe
Imagebase:	0x7ff69e8c0000
File size:	39424 bytes
MD5 hash:	A513A767CC9CC3E694D8C9D53B90B73E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: Netplwiz.exe PID: 3584 Parent PID: 3292

General

Start time:	04:16:35
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\SbH2\Netplwiz.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\SbH2\Netplwiz.exe
Imagebase:	0x7ff7d7310000
File size:	39424 bytes
MD5 hash:	A513A767CC9CC3E694D8C9D53B90B73E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000016.00000002.362816566.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: recdisc.exe PID: 6784 Parent PID: 3292

General

Start time:	04:16:46
Start date:	29/09/2021
Path:	C:\Windows\System32\recdisc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\recdisc.exe
Imagebase:	0x7ff77db70000
File size:	192512 bytes
MD5 hash:	D2AEFB37C329E455DC2C17D3AA049666
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: recdisc.exe PID: 6696 Parent PID: 3292

General

Start time:	04:16:47
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\r4gbgdji\recdisc.exe
Imagebase:	0x7ff6c2000000
File size:	192512 bytes
MD5 hash:	D2AEFB37C329E455DC2C17D3AA049666
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000001B.00000002.388799941.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: phoneactivate.exe PID: 6768 Parent PID: 3292

General

Start time:	04:17:00
Start date:	29/09/2021
Path:	C:\Windows\System32\phoneactivate.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\phoneactivate.exe
Imagebase:	0x7ff724750000
File size:	107504 bytes
MD5 hash:	09D1974A03068D4311F1CE94B765E817
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: phoneactivate.exe PID: 4116 Parent PID: 3292

General

Start time:	04:17:05
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\lW7exk8\phoneactivate.exe
Imagebase:	0x7ff6dc4c0000
File size:	107504 bytes
MD5 hash:	09D1974A03068D4311F1CE94B765E817
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000001F.00000002.426654754.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: wermgr.exe PID: 5968 Parent PID: 3292

General

Start time:	04:17:18
Start date:	29/09/2021
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wermgr.exe
Imagebase:	0x7ff6db310000
File size:	209312 bytes
MD5 hash:	FF214585BF10206E21EA8EBA202FACFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: wermgr.exe PID: 6056 Parent PID: 3292

General

Start time:	04:17:20
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\JaJWNKcB\wermgr.exe
Imagebase:	0x7ff7e2150000
File size:	209312 bytes
MD5 hash:	FF214585BF10206E21EA8EBA202FACFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000024.00000002.458324438.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: wermgr.exe PID: 4068 Parent PID: 3292

General

Start time:	04:17:32
Start date:	29/09/2021
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wermgr.exe
Imagebase:	0x7ff6db310000
File size:	209312 bytes
MD5 hash:	FF214585BF10206E21EA8EBA202FACFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: wermgr.exe PID: 7096 Parent PID: 3292

General

Start time:	04:17:32
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\02vERQ6Eo\wermgr.exe
Imagebase:	0x7ff75f9b0000
File size:	209312 bytes
MD5 hash:	FF214585BF10206E21EA8EBA202FACFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000027.00000002.485059141.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, Virustotal, Browse Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: rdpinput.exe PID: 4312 Parent PID: 3292

General

Start time:	04:17:44
Start date:	29/09/2021
Path:	C:\Windows\System32\rdpinput.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rdpinput.exe
Imagebase:	0x7ff673710000
File size:	178688 bytes
MD5 hash:	4403785D297C55D5DF26176B4F1A52C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rdpinput.exe PID: 5240 Parent PID: 3292

General

Start time:	04:17:45
Start date:	29/09/2021
Path:	C:\Users\user\AppData\Local\iBq\rdpinput.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\iBq\rdpinput.exe
Imagebase:	0x7ff609400000
File size:	178688 bytes
MD5 hash:	4403785D297C55D5DF26176B4F1A52C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000029.00000002.514047905.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll64.exe PID: 6392 Parent PID: 496 loaddll64.exeCOMMON

Executed Functions

Function 00000001400495B0, Relevance: 8.7, APIs: 2, Strings: 2, Instructions: 1727COMMON

Download Yara Rule

Strings

}*, xrefs: 0000000140049620
}*, xrefs: 0000000140049BDD

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: b2d8981d994e193b974dd97b3248349f041180fa9e1ee75c24f96b4e32672199
Instruction ID: dfe71950bb4b00d773a2c1e4d7d9ca62016f185058a51a46645e99606ce0912a
Opcode Fuzzy Hash: b2d8981d994e193b974dd97b3248349f041180fa9e1ee75c24f96b4e32672199
Instruction Fuzzy Hash: CDF2E476601B8481EB269F17D5503EE77A1F78EBC8F9A4025EB0A077B5DB38C945C348

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140036F30, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE ref: 000000014003704B
EntryPoint.YPEVDKBY3N ref: 00000001400370EE

Strings

)8GV, xrefs: 0000000140037008
d, xrefs: 0000000140037032

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ConsoleEntryFreePoint
String ID: )8GV$d
API String ID: 3550414006-3589632123
Opcode ID: d05d8187567b24d43b5378db4c26f8457bb6311b4b9be5c519ef70a53fb6d972
Instruction ID: d510f836e5bc92855b025e221ee4853bd72dbb3d22a76ed0b2795177c136f2ac
Opcode Fuzzy Hash: d05d8187567b24d43b5378db4c26f8457bb6311b4b9be5c519ef70a53fb6d972
Instruction Fuzzy Hash: 2C91983230064096EB26EB66D0513EE23A5AB9C7D4F914526BB1E47BFBEE34CA05C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005C340, Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 886COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE ref: 000000014005D101

Strings

sy;, xrefs: 000000014005C420
sy;, xrefs: 000000014005C9ED

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InfoSystem
String ID: sy;$sy;
API String ID: 31276548-3660992706
Opcode ID: 4ba7a1a776c1b2a8194e3aee1005776fcb25fed3b21deabde970c8a1fedf5655
Instruction ID: 6e6b9d6b41ba510f9365bd6ae70f9dc3139515c8db1fe8c3f4a6c85962f57752
Opcode Fuzzy Hash: 4ba7a1a776c1b2a8194e3aee1005776fcb25fed3b21deabde970c8a1fedf5655
Instruction Fuzzy Hash: 2A82DB72215B848AEB26CF27D4507E977E1F789BC4F498426EB4A077B6DB39C941C380

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004BD40, Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 789COMMON

Download Yara Rule

Strings

}*, xrefs: 000000014004BDB0
}*, xrefs: 000000014004C37C

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: 7295418c03dacbe62c915b6dd4b980e4d41f822c5e8600d002afc3f8743a909a
Instruction ID: 589d9863290c94d963c78ae1aba4b537ce1e649f887b860e334c2c2edf70769e
Opcode Fuzzy Hash: 7295418c03dacbe62c915b6dd4b980e4d41f822c5e8600d002afc3f8743a909a
Instruction Fuzzy Hash: B872E172211B8081EBA68F23D4547ED77A1F78DBC4F8A5125EB4A477B6EB38C944C348

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D290, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 000000014005D2ED

Strings

., xrefs: 000000014005D36A

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindFirst
String ID: .
API String ID: 1974802433-248832578
Opcode ID: 676bd74008c321f1f054d2561c231ee4757c1d63a5241c01311e4a1111e2dca9
Instruction ID: 4bac0f1caae8588fed560e2f4dd75fe3b4005a9d196e6938d52e54566134f4c2
Opcode Fuzzy Hash: 676bd74008c321f1f054d2561c231ee4757c1d63a5241c01311e4a1111e2dca9
Instruction Fuzzy Hash: C841A43260564085FB76DB26E1003AD73A1A748BF8F184713EF69177E9DB7AC982C742

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140026CC0, Relevance: 2.9, Strings: 2, Instructions: 362COMMON

Download Yara Rule

Strings

)8GV, xrefs: 000000014002703B
)8GV, xrefs: 0000000140027120

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: )8GV$)8GV
API String ID: 0-993736920
Opcode ID: a474c31cc31dbb2bad411d4c623e5f6703c0a81594d7db2d3b405b35e95b2219
Instruction ID: e7db99c2ed76c24e9271fdfca30502f9120cd4f12b6678b2f47d4e41cadbe873
Opcode Fuzzy Hash: a474c31cc31dbb2bad411d4c623e5f6703c0a81594d7db2d3b405b35e95b2219
Instruction Fuzzy Hash: 3BF18F7272064095EB52EB72D8913EE6365FB993C8F900426BB0E47AFADF34CA45C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006A4B0, Relevance: 1.7, APIs: 1, Instructions: 237nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 000000014006A550

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 9f41864b2900007f84f8b1ad90144004543c6c2abfbff0cc5a6841cbcca8c7da
Instruction ID: ba306794fc56961ae9be9e8108b60f4a03202e28571258f9feaa1cffdeadac3d
Opcode Fuzzy Hash: 9f41864b2900007f84f8b1ad90144004543c6c2abfbff0cc5a6841cbcca8c7da
Instruction Fuzzy Hash: 25B16E36601B409AE712EF26D9403EE33A6F7497C8F645825EB4E47BA6DF38D524CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140048AC0, Relevance: 1.7, APIs: 1, Instructions: 185libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL ref: 0000000140048CDE

Part of subcall function 000000014005D1F0: FindNextFileW.KERNELBASE(?,?,CD3BEB56,0000000140048BFE), ref: 000000014005D21B

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindLoadNext
String ID:
API String ID: 50669962-0
Opcode ID: aa0438968589772fc8f2a9ec3ebe64abc64651e75ec2b3921e4afd98a3b5e278
Instruction ID: 5bbbb247b64301f03cc62f5655f26b2922a91791dd430743fbd3ba68f8766a4f
Opcode Fuzzy Hash: aa0438968589772fc8f2a9ec3ebe64abc64651e75ec2b3921e4afd98a3b5e278
Instruction Fuzzy Hash: 07819D3261568092FB22EB26E4513EE6365FBD83D4F814521FB4A57AEBEF38C605C704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140035270, Relevance: 1.7, APIs: 1, Instructions: 181COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140046C90: NtClose.NTDLL ref: 0000000140046CBE

ExitProcess.KERNEL32 ref: 00000001400354E1

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseExitProcess
String ID:
API String ID: 3487036407-0
Opcode ID: 5c30d9f3bf3ad5247cfe131953472b6de56d2531a4e84ebcbfa6a909151eb5a4
Instruction ID: 3d479053040576d7404e3dfab4813d6254088c9544e20b556efee73ce8d776a8
Opcode Fuzzy Hash: 5c30d9f3bf3ad5247cfe131953472b6de56d2531a4e84ebcbfa6a909151eb5a4
Instruction Fuzzy Hash: 5771BF32710A5096FB16EB72D4513EE2365AB883D9F844522BF5E53AFADF35C906C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046C90, Relevance: 1.5, APIs: 1, Instructions: 19nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL ref: 0000000140046CBE

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: daec19cacdd098f1244212ea8e14a5d3e1bd9439d57025bc9e494c2d8b520846
Instruction ID: acc9ee73913d888b71121e4cedfe861758cf19cabea33dd7822bbf7d3cf7603a
Opcode Fuzzy Hash: daec19cacdd098f1244212ea8e14a5d3e1bd9439d57025bc9e494c2d8b520846
Instruction Fuzzy Hash: 42E08CA1741A0041EF265276D0803A812809B4D7B4E194B209A7D0B3E0EA3888898716

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400524B0, Relevance: .8, Instructions: 815COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1fe821b06c1a4823bb9271ec043e796f757224c870123343ecb03a76390b80a
Instruction ID: bccbce3911ab829ef3288d496869760cb1404da12fac801df191153d1e38d36e
Opcode Fuzzy Hash: b1fe821b06c1a4823bb9271ec043e796f757224c870123343ecb03a76390b80a
Instruction Fuzzy Hash: 9172CD72601B9485FB26CF17D4503E967A1FB8EFC4F998426EB0A077A5EB39C945C380

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140065B80, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef59d8dad7016460516c65c54e0757d465c5ab080b3c9532efa0d5a42b826e15
Instruction ID: 84a8ec628d281786b49b5e6f6f6dec0d0376b1c45e732984354cafa0c8984479
Opcode Fuzzy Hash: ef59d8dad7016460516c65c54e0757d465c5ab080b3c9532efa0d5a42b826e15
Instruction Fuzzy Hash: D761947121164102FE76B72399047EE5292AFAD3E4F650B21BF6E47BF9EE38C9018740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140034870, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9551ae3eb8102b5ebebf946a3998feeee295eeedab946ed72fd7e67ef554d99f
Instruction ID: 713527809b35fed6260ebd230ad48717dd4fa7a304d79e310e96a8de0daf9cee
Opcode Fuzzy Hash: 9551ae3eb8102b5ebebf946a3998feeee295eeedab946ed72fd7e67ef554d99f
Instruction Fuzzy Hash: 5A717D32B04B4095FB12EBB2E4913DF67A5FBC8388F954025BB4957AAADF38D445CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140061360, Relevance: 6.3, APIs: 4, Instructions: 290registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 0000000140061459
RegEnumKeyW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 00000001400614B4
RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 0000000140061539
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002,?), ref: 0000000140061664

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close$EnumOpen
String ID:
API String ID: 138425441-0
Opcode ID: 672031fc434e6626b90ea1da62f3c38a687c8b9296ffac50e7f6928d6a85a361
Instruction ID: 4377045c35190c944746a6ea10b9b47c13ce871b5e3b3a15cce40fdff127085f
Opcode Fuzzy Hash: 672031fc434e6626b90ea1da62f3c38a687c8b9296ffac50e7f6928d6a85a361
Instruction Fuzzy Hash: 5BC1A43120568082FE629B16E8503EEA791E7C97E0F6C4A21FB6E47BE5DE78C941C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005F9F0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 000000014005FA4B

Strings

4aX, xrefs: 000000014005FA09

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DescriptorSecurity$ConvertString
String ID: 4aX
API String ID: 3907675253-4042356595
Opcode ID: a1249fc2010d9d5d05952f0359ba200457e66aefbced3d07103a2c3463c61beb
Instruction ID: 5c7b4eddd96f597e19123db416744eb931adcf52cf9da5c093af566d74744993
Opcode Fuzzy Hash: a1249fc2010d9d5d05952f0359ba200457e66aefbced3d07103a2c3463c61beb
Instruction Fuzzy Hash: EC216D72214B4582EA12EF66E1403DEB3A0FB8C7C4F844525EB8D07B6AEF39D625C745

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DAE0, Relevance: 3.1, APIs: 2, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44297aa2126b14dcd4d9c9accf23e52108ed4399094c5e3af94dd8103b7f7b57
Instruction ID: c5574eec75406f68cf122a08b4571db932f63f1e1c7d3e43579234279b4bb767
Opcode Fuzzy Hash: 44297aa2126b14dcd4d9c9accf23e52108ed4399094c5e3af94dd8103b7f7b57
Instruction Fuzzy Hash: A151D03130464182FA72EA63A4507EA77A2BB8CBD4F154527BF5A077E2EF7AC801C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DD30, Relevance: 3.1, APIs: 2, Instructions: 122fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 000000014005DDD8
ReadFile.KERNELBASE ref: 000000014005DE49

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 00f6d0f3771a8cfa98223a140d65de6735ec101d3a44d5ddd75e2d9def7749f0
Instruction ID: 869152f87e2051f324d9e8f0f01270def7d2743b76a8e6c9a5e95a296a3a7e26
Opcode Fuzzy Hash: 00f6d0f3771a8cfa98223a140d65de6735ec101d3a44d5ddd75e2d9def7749f0
Instruction Fuzzy Hash: A541583161464087EA62DB3AA4447AAB3A1FBD87E0F144712BB6D4B7F5DF39C802DB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBB9, Relevance: 3.1, APIs: 2, Instructions: 79filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: 8a0a731fb1e22280383dc4c244850d697ffee92b9dbadae0b2290ba2595e9be9
Instruction ID: 944ab0cbe82d54181631abf043b2a82f72de4fdca767e43f24bb2c72b9c0c91f
Opcode Fuzzy Hash: 8a0a731fb1e22280383dc4c244850d697ffee92b9dbadae0b2290ba2595e9be9
Instruction Fuzzy Hash: 8D21B431214A4581EA72DB66A0407EA3795F78CBE4F184617EFAE077E5DF7AC806C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBD2, Relevance: 3.1, APIs: 2, Instructions: 77filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: d6d835041d1b41abb3b5fe648f8f275da576c4891ed88a603463ed8b7f508fb5
Instruction ID: bee1728ae0ee1a0caa625709e376bb4aadd3217f15d1bcce0d190476addee932
Opcode Fuzzy Hash: d6d835041d1b41abb3b5fe648f8f275da576c4891ed88a603463ed8b7f508fb5
Instruction Fuzzy Hash: BE21D332311A4581EA72DA66A0407EA3795B78CBE4F184527AF9D077E5DE7AC806C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBE8, Relevance: 3.1, APIs: 2, Instructions: 76filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: 6bbc7cb38f56b555cae5d46dc9eb85d7f0e424b0d62445df59964c24eed4e9f3
Instruction ID: a00dbcca095f64b26cda9c271166364bdf2e86a9b80154192fb139b54d898421
Opcode Fuzzy Hash: 6bbc7cb38f56b555cae5d46dc9eb85d7f0e424b0d62445df59964c24eed4e9f3
Instruction Fuzzy Hash: 5521E532315A4581EA72DB62A0407EE3791F78CBE4F184517AFAD077E5DE7AC806C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140060D10, Relevance: 3.1, APIs: 2, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,000000014004890D), ref: 0000000140060D85
RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,000000014004890D), ref: 0000000140060DE8

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0af55b123fcd85ad11f65efe4d0ac2719b06ecdcd8a99680970ae4064010c44f
Instruction ID: 09cc4365fb23fa9fe14c599ab373ea3e5ec1bde103bfdbf39ccb6e9a9538c2db
Opcode Fuzzy Hash: 0af55b123fcd85ad11f65efe4d0ac2719b06ecdcd8a99680970ae4064010c44f
Instruction Fuzzy Hash: F521A37671569046EF52CB56E8003AFA391EB897F4F184621BF9C07BE8EA38D582C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBF8, Relevance: 3.1, APIs: 2, Instructions: 73filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: eb6f16229e65501cd5258548e2b4ff06530ad065b40e2a3bf9e2a9b945b11f61
Instruction ID: 68fcab11a3bde380270331896f94efb0ab36e54eb9d04e7f46ecdc112822b6b1
Opcode Fuzzy Hash: eb6f16229e65501cd5258548e2b4ff06530ad065b40e2a3bf9e2a9b945b11f61
Instruction Fuzzy Hash: 6821C132315A4541EA72DB62A0407EA3795F78CBE4F184627EFAD077E5DE7AC806C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046F60, Relevance: 1.7, APIs: 1, Instructions: 216COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0000000140046FDE

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 505a76da9390751f76a813a8bc9fce4b727984ade222f3073bfceff6bf9580dc
Instruction ID: 560481d37deeb2f3cc02cd101c0a384bc9ca8e36dca6fa428839860d024f360c
Opcode Fuzzy Hash: 505a76da9390751f76a813a8bc9fce4b727984ade222f3073bfceff6bf9580dc
Instruction Fuzzy Hash: EDA15D3271064099EB12EFB6C4913EE2365A7987C8F915126BF0D67AFAEF34C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005FDA0, Relevance: 1.6, APIs: 1, Instructions: 144synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNELBASE ref: 000000014005FEFE

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 6be956e981540fc735b56164f72d0aea79e48331418f8fd9eaab398243b5d8cf
Instruction ID: 2cd33cf12082532a652157af79f02d7873b375395221c82c38bac87e111ef697
Opcode Fuzzy Hash: 6be956e981540fc735b56164f72d0aea79e48331418f8fd9eaab398243b5d8cf
Instruction Fuzzy Hash: 6E51B2326117408AEB66EB22A0013EE6291EB9DBC4F580535FF4E477E6DF39C802D790

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D1F0, Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,?,CD3BEB56,0000000140048BFE), ref: 000000014005D21B

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: ff4ac6c2ef48f38791092f6d6c449714fc18167456ec2ef2bc1084d7df7feef3
Instruction ID: fe48dd106ee2d63de4642147a978de6f9e341aec22c75ad1205c2678dbe1ece1
Opcode Fuzzy Hash: ff4ac6c2ef48f38791092f6d6c449714fc18167456ec2ef2bc1084d7df7feef3
Instruction Fuzzy Hash: 80115B7561034082FF76DA6691047E933E1EB697C8F051013EF59472E9EB36C8D2C751

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140060BA0, Relevance: 1.5, APIs: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32 ref: 0000000140060C16

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: a3c12b60ccc1d223e9782810bc36042d204e1f874336debb41352ff4bff3a234
Instruction ID: 650aff04d41c3b1619de3e88208a4500c6b85af191ab70c767efd2679610bbe3
Opcode Fuzzy Hash: a3c12b60ccc1d223e9782810bc36042d204e1f874336debb41352ff4bff3a234
Instruction Fuzzy Hash: 1C112E72204B8486D7219F12E84039EB7A5F788B90FA89529EB8D43B58DF39D991CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046690, Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

RtlCreateHeap.NTDLL ref: 00000001400466DD

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 21b05e3ef22cad88cebd019d8e45e363c17e6ba0707ecabdd33f955b9f4b15ed
Instruction ID: 54976bf3431427af6da968cf6b263ec8d4a99ac7c2bea2f2fd5649cd882baac1
Opcode Fuzzy Hash: 21b05e3ef22cad88cebd019d8e45e363c17e6ba0707ecabdd33f955b9f4b15ed
Instruction Fuzzy Hash: B901D635706A8082EB528712FA4039A73A0F78C3C4F198524EF884B7A5EF38C8518B44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046730, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

RtlDeleteBoundaryDescriptor.NTDLL ref: 000000014004678C

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: BoundaryDeleteDescriptor
String ID:
API String ID: 3203483114-0
Opcode ID: 7b0e43f28c4f526d6edd5220e1ccf75e5ddb2081b4342278c18d43c75b4d1ee9
Instruction ID: 7e2fcedd46cf55f04110c2a11ced308778be976df41b62f125aabd7639a18320
Opcode Fuzzy Hash: 7b0e43f28c4f526d6edd5220e1ccf75e5ddb2081b4342278c18d43c75b4d1ee9
Instruction Fuzzy Hash: 70F0F878A4730141FE6A63B354543A511821FCC7C4F0E8834AF095B7A6EE38CD518699

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0000000140071DC0, Relevance: 5.7, Strings: 4, Instructions: 682COMMON

Download Yara Rule

Strings

VUUU, xrefs: 000000014007211B
ERCP, xrefs: 0000000140071EED
VUUU, xrefs: 000000014007213B
VUUU, xrefs: 0000000140072194

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU
API String ID: 0-2165971703
Opcode ID: 203c99bb3d64071a34d91be2023c6ff0f734778017a54347eb9ef20583df3fc0
Instruction ID: a95f611128f1d5d13a9bca75b656ea52fec65ffdb08565925219bb8e60db198b
Opcode Fuzzy Hash: 203c99bb3d64071a34d91be2023c6ff0f734778017a54347eb9ef20583df3fc0
Instruction Fuzzy Hash: 2252BE727046848AEB6A8F6AD5503ED7BA1F3087D8F144116FF569BAE8D73CC981C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140031DF0, Relevance: 5.3, Strings: 4, Instructions: 270COMMON

Download Yara Rule

Strings

GC,, xrefs: 00000001400321D7
GC,, xrefs: 000000014003216C
GC,, xrefs: 0000000140031FC2
GC,, xrefs: 0000000140032008

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: GC,$GC,$GC,$GC,
API String ID: 0-2774350030
Opcode ID: 98649618faad92dfac345ced2ac743c97f2c410892ae2dd8dadb9da2da6be478
Instruction ID: dd0ba4053c6bdb050c0e262549aa376da4335980b2dde8bb0cc8774c9fa84b1c
Opcode Fuzzy Hash: 98649618faad92dfac345ced2ac743c97f2c410892ae2dd8dadb9da2da6be478
Instruction Fuzzy Hash: 39B14A3232168096EA16EB22D4513EFA765FBDC7C4F854425FB4E57ABAEE38C605C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140057950, Relevance: 4.5, Strings: 2, Instructions: 1977COMMON

Download Yara Rule

Strings

}*, xrefs: 00000001400579C0
}*, xrefs: 0000000140057F89

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: a0a69438047e54f28e9ccb842af0afe3b69bef60083965763f3b059d71ba89a0
Instruction ID: 7c281f25cbc51a2c663274e483e0a5d4adc9f9b548fde4e06667abda5a9e2262
Opcode Fuzzy Hash: a0a69438047e54f28e9ccb842af0afe3b69bef60083965763f3b059d71ba89a0
Instruction Fuzzy Hash: 6E03CB72201B8482EB26CF23D4543ED67A1F78DBC4F994416EF4A177A6EB3AC945C380

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400263C0, Relevance: 4.3, Strings: 3, Instructions: 519COMMON

Download Yara Rule

Strings

@, xrefs: 0000000140026B3F
)8GV, xrefs: 0000000140026A4D
)8GV, xrefs: 00000001400267B0

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: )8GV$)8GV$@
API String ID: 0-2802744955
Opcode ID: f984950c61b0be198d0d8ef7b9bd5c68dab9f7d96fdb049334a6dcd13fc514d1
Instruction ID: d4403fa2ef2757ed15b0d897a8d3d48ae9d82dee7601a7ae60b507309942f45e
Opcode Fuzzy Hash: f984950c61b0be198d0d8ef7b9bd5c68dab9f7d96fdb049334a6dcd13fc514d1
Instruction Fuzzy Hash: 8F326E72610A8095FB22EB72D8513EE6365FB997C8F940026BB4E476FADF34CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140035520, Relevance: 3.9, Strings: 3, Instructions: 117COMMON

Download Yara Rule

Strings

GC,, xrefs: 0000000140035665
{QN, xrefs: 00000001400355E1
GC,, xrefs: 0000000140035622

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: GC,$GC,${QN
API String ID: 0-3150587038
Opcode ID: fd0f7604477b89c46016288274ae5da6e1d22dae5e6d5d6e9033f3dbe6d447d0
Instruction ID: 9244b60d004d0bd22f383007071d62e4da67c70af0efad37e4d475a9577969ab
Opcode Fuzzy Hash: fd0f7604477b89c46016288274ae5da6e1d22dae5e6d5d6e9033f3dbe6d447d0
Instruction Fuzzy Hash: D851B3726017408AEB26AF72A0517DF3392EB98398F559529FB4E0BBE9DF39C401C741

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140025DB0, Relevance: 2.9, Strings: 2, Instructions: 401COMMON

Download Yara Rule

Strings

0, xrefs: 0000000140025FF4
GC,, xrefs: 0000000140025E65

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: 0$GC,
API String ID: 0-3557465234
Opcode ID: 666bbe70a71d3c2c69398fa3d4293e156315b44e2ec60054ed199f516d69305b
Instruction ID: 8e8f5bced65d739128878f1be46f709eb140c798bd495bd8ba2efbba04664ca7
Opcode Fuzzy Hash: 666bbe70a71d3c2c69398fa3d4293e156315b44e2ec60054ed199f516d69305b
Instruction Fuzzy Hash: 90F1C132705B8086EB56DB26A5503EE77A5F788BC8F544029FF8A47BA9DF38C845C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002FB20, Relevance: 2.7, Strings: 2, Instructions: 200COMMON

Download Yara Rule

Strings

cLpS, xrefs: 000000014002FB46
cLpS, xrefs: 000000014002FB76

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: cLpS$cLpS
API String ID: 0-581437482
Opcode ID: 34fd53aa0ebdbc9f7987fe69826bd589cd4ce70c6830deca293095981677af5c
Instruction ID: d6b56411a1e340b191dd7f08d0c8a8920ca136b0ade9766ce73097337fe28e3c
Opcode Fuzzy Hash: 34fd53aa0ebdbc9f7987fe69826bd589cd4ce70c6830deca293095981677af5c
Instruction Fuzzy Hash: F5916E32700A41A6FB12EB72D5513ED2366AB983D8F900126BF1D97AFADF34D919D340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140039140, Relevance: 2.1, Strings: 1, Instructions: 866COMMON

Download Yara Rule

Strings

D, xrefs: 0000000140039B2B

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 0452af0be93170f0712028ec6d1a4f1ed763d309de66f3c97f53239ecee0938c
Instruction ID: a2166a60d7ca2b4a0d1872d5e3506bb785f107662951e93f9f6f62b20c08bf0e
Opcode Fuzzy Hash: 0452af0be93170f0712028ec6d1a4f1ed763d309de66f3c97f53239ecee0938c
Instruction Fuzzy Hash: 32827E3222468186EB13EB26D4907EF6365FBD8794F904612FB5A47AFADF38C605C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000C5C0, Relevance: 2.1, Strings: 1, Instructions: 865COMMON

Download Yara Rule

Strings

GET, xrefs: 000000014000C5D5

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: GET
API String ID: 0-1805413626
Opcode ID: 661f230471d60ecbb39933eb60000974eafe41df73c72fb050cdf984b1df2847
Instruction ID: e67aa13565bd515be4758c424d677281e7e48e69fdea67d752e56d6b70eb8f16
Opcode Fuzzy Hash: 661f230471d60ecbb39933eb60000974eafe41df73c72fb050cdf984b1df2847
Instruction Fuzzy Hash: 7182CFB262568082FB52EB26E491BEE6761F7C97C8F851022FB4A576E7CF38C505C701

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140015120, Relevance: 2.1, APIs: 1, Instructions: 555COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32 ref: 000000014001530B

Part of subcall function 0000000140046C90: NtClose.NTDLL ref: 0000000140046CBE

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseEnvironmentExpandStrings
String ID:
API String ID: 1839112984-0
Opcode ID: 0c8cab0b1b935b3a37cb31b96907ffd9b34d960d626d1d55b93d79ad55693549
Instruction ID: c0dbe0ee55e83fb6c0f3bef3624a57e5635b4c6ed11a4d6c977be8f15ec7e338
Opcode Fuzzy Hash: 0c8cab0b1b935b3a37cb31b96907ffd9b34d960d626d1d55b93d79ad55693549
Instruction Fuzzy Hash: CB427E32710A4096FB12EB72D4913EE6765EB983D8F814422BB4D4BAFAEF34C645C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140019D20, Relevance: 2.0, APIs: 1, Instructions: 546COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bfc6c16767a4c3147f6e93b555eb8a7f5f9d30cf2392766f43ebf9096de9df6
Instruction ID: abc698a25be580435ac5d46bd6b01b3c7dd535f90f9c32282677b8a643a0cbd6
Opcode Fuzzy Hash: 3bfc6c16767a4c3147f6e93b555eb8a7f5f9d30cf2392766f43ebf9096de9df6
Instruction Fuzzy Hash: 3C427D3271068095FB22EB76D8513EE2361EB993C8F904121BB0E5BAFAEF79C545C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140019580, Relevance: 2.0, APIs: 1, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d9afe0c53f9a5a2c41ab01cc5cbb1ce22ff198fc853b8768ac58896c56666a0
Instruction ID: 0bcce83d19b55e388762cc41cc2fbdfa61478623d1bee2f25155124e52c32027
Opcode Fuzzy Hash: 4d9afe0c53f9a5a2c41ab01cc5cbb1ce22ff198fc853b8768ac58896c56666a0
Instruction Fuzzy Hash: 8A128E3271468095FB22EB72D8913EE2355EB997C4F804026BB4E5BAFADF35C605C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006EB0, Relevance: 1.9, Strings: 1, Instructions: 651COMMON

Download Yara Rule

Strings

cLpS, xrefs: 00000001400072A3

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: cLpS
API String ID: 0-2886372077
Opcode ID: 39b3e9410c272ead3331ad6fef3a5a390c12b147565654b66b7ca87bf70ff1a0
Instruction ID: 96b4c198141fe6e7034ab14ad9d5ea3cda72442e6a1109ae0a48173783152c86
Opcode Fuzzy Hash: 39b3e9410c272ead3331ad6fef3a5a390c12b147565654b66b7ca87bf70ff1a0
Instruction Fuzzy Hash: CF528D7272464092FA12EB62E8517EE63A5FB9C7C4F814022BB4E57BBADF38C505C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400139D0, Relevance: 1.8, Strings: 1, Instructions: 571COMMON

Download Yara Rule

Strings

m, xrefs: 000000014001422E

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateMutex
String ID: m
API String ID: 1964310414-3775001192
Opcode ID: 8a50abe8c5a3742640caa228dc7335edec43a3508cb7c45687419c797d7a8e0e
Instruction ID: 0a9d90af75a6ede7406656d6adb6787827cf479cbe6b14872f7c626c13ea0b6d
Opcode Fuzzy Hash: 8a50abe8c5a3742640caa228dc7335edec43a3508cb7c45687419c797d7a8e0e
Instruction Fuzzy Hash: 6A529B32710A80A6F74EEB32C5913EE7369F788384F904026AB2947AE6DF34D576C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001D100, Relevance: 1.7, Strings: 1, Instructions: 497COMMON

Download Yara Rule

Strings

s( j, xrefs: 000000014001D128

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: s( j
API String ID: 0-1450404818
Opcode ID: 19985d2dc72a707ec5f83c91129fc97538500d80b5f4466283615156a38f1139
Instruction ID: 6f5b3d0b06e06ce3defbe5b62ba999e8dce43b7996f1ec96da6707378b1ebcba
Opcode Fuzzy Hash: 19985d2dc72a707ec5f83c91129fc97538500d80b5f4466283615156a38f1139
Instruction Fuzzy Hash: 14325632715B9085EB16EF66D8513ED73A5FB88B88F454026EB4E5BBAADF38C505C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140033BB0, Relevance: 1.7, Strings: 1, Instructions: 454COMMON

Download Yara Rule

Strings

U, xrefs: 000000014003408F

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 72024827e683f8274b41a935c33eff52f8b4dd36fd514cd6d3276c77a1fad1bc
Instruction ID: 04dcf981b535b3d5a04f4e0f983876b723d65533687fb2a3abc72c4897885b35
Opcode Fuzzy Hash: 72024827e683f8274b41a935c33eff52f8b4dd36fd514cd6d3276c77a1fad1bc
Instruction Fuzzy Hash: 7A22A032714A8095FB22EB76D4913EE2761EB993D4F900122BB4E5BAFADF38C545C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023530, Relevance: 1.7, Strings: 1, Instructions: 430COMMON

Download Yara Rule

Strings

Content-Type, xrefs: 000000014002385F

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: Content-Type
API String ID: 0-2058190213
Opcode ID: be166dffc27dae0f28fefab07ac9e8bc422439760b6c1762e901f21d4935f0ff
Instruction ID: 8ed0294b40edec3e111ebf6e63eddced9ff886ac8d86313f53d4d34ac86a637b
Opcode Fuzzy Hash: be166dffc27dae0f28fefab07ac9e8bc422439760b6c1762e901f21d4935f0ff
Instruction Fuzzy Hash: D0128B7271064096EB26EB72D0953EE63A5EB9D7C8F804029FB4E576B6DF34C909C341

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400389A0, Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

0, xrefs: 0000000140038A46

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID: 0
API String ID: 3535843008-4108050209
Opcode ID: 7016f170174e11ab425f8740a2873dc54fd790cf1ab3d78218ff6c8b86cc580b
Instruction ID: 021d52728ad99ff4b45c00a2ee63d530dbb35c35c3e7b67721d4418a9cae59c0
Opcode Fuzzy Hash: 7016f170174e11ab425f8740a2873dc54fd790cf1ab3d78218ff6c8b86cc580b
Instruction Fuzzy Hash: A4D1483271064185EB22EB66D8503EF6365FB987C8F944421FF4E57AAAEF34CA05C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400205A0, Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

, xrefs: 000000014002069B

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 13b354268872ef66367d09f0eaf7f41c1b6cce90139d1ccde9a6c23eddc411d2
Instruction ID: 091f4e73938a5afec608f70625f4eed5baac112ec883e15b973b01c59944fd94
Opcode Fuzzy Hash: 13b354268872ef66367d09f0eaf7f41c1b6cce90139d1ccde9a6c23eddc411d2
Instruction Fuzzy Hash: 8FB1903271164156FB26EB72C0513EE2365A78C7C8F554429BF0E67BEAEE34D906C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002EED0, Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

, xrefs: 000000014002F04E

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 266006fd5134fcae821d54f81f057cdba6f5be873c6199ef93d4c42334c526d2
Instruction ID: 79bcb73a3e0a748e54816e3c2b9a8955141e4b7d1d3c260807ef7fd3e9233e09
Opcode Fuzzy Hash: 266006fd5134fcae821d54f81f057cdba6f5be873c6199ef93d4c42334c526d2
Instruction Fuzzy Hash: 4681AF3171528042FA66AB63A5513EE6382BBDC7C0F954839BF0E57BEADE38C9019750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023140, Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

tI*k, xrefs: 0000000140023300

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: tI*k
API String ID: 0-257501792
Opcode ID: b15996fbae463eef0efc9f4e5c4cbf386dde064011b2806a6f0ecd12f6b98297
Instruction ID: 2b3e36108f388e75195695150bf3b7502d87346db4925aa772ee75e92517338c
Opcode Fuzzy Hash: b15996fbae463eef0efc9f4e5c4cbf386dde064011b2806a6f0ecd12f6b98297
Instruction Fuzzy Hash: C891B332710A41C6FB12EB73D4913ED2365AB987C8F815026BF0E67AABDE34C605C391

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140078570, Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

ERCP, xrefs: 00000001400785BF

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: ERCP
API String ID: 0-1384759551
Opcode ID: 9a8959bd3d8286152fe3b07e5e9b9c99826fd1463cb640f02497020a3b8cf481
Instruction ID: 36d71a898891e4cfc692b0c24b63e4f8a605753b41eb4ec31f3d0d909baacb04
Opcode Fuzzy Hash: 9a8959bd3d8286152fe3b07e5e9b9c99826fd1463cb640f02497020a3b8cf481
Instruction Fuzzy Hash: 8541C2677244554AE3189F2598213BE2391F7E8781B008838BBC7C3B99E97CCE41C754

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004F940, Relevance: .9, Instructions: 873COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb12e34294cccc152743157d68ecf537d73dadfb1b78744b1cf0542ab0e03321
Instruction ID: fc2f62d5942ef41123ea32f2955be4f6aadf7052ab01c2248917173129c7cd0f
Opcode Fuzzy Hash: cb12e34294cccc152743157d68ecf537d73dadfb1b78744b1cf0542ab0e03321
Instruction Fuzzy Hash: 8A82BD72301B8486EB269F23D4503EE67A5F78DFC4F964022EB4A577A6DB38C945C384

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140054BA0, Relevance: .8, Instructions: 797COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6290f3f4936625c1500c9bb5ab49f73b0f0e92f6783c0cfd327242af27f29f
Instruction ID: 8249503d4e55669e8e7119aec1729776b7b2f3ca46fae70a891a003f6664f3d4
Opcode Fuzzy Hash: 0b6290f3f4936625c1500c9bb5ab49f73b0f0e92f6783c0cfd327242af27f29f
Instruction Fuzzy Hash: 3472DF32201B9486EB26DB17E4603ED77A5FB9DBC5F894012EB4A477B6DB3AC941C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140016E80, Relevance: .7, Instructions: 739COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 570444da3395dbff037c1797def2714c1b19642f17c99ed10635228c9c88b714
Instruction ID: 4fdb0601fab6f7a848b28641239d596080eab1ec2c6ff824b21f12e2ef69b5a1
Opcode Fuzzy Hash: 570444da3395dbff037c1797def2714c1b19642f17c99ed10635228c9c88b714
Instruction Fuzzy Hash: 48722D32724A4095EB02EB76D4913EE6765EB983C4FC05012BB4E879BBEF38C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004EB60, Relevance: .7, Instructions: 687COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf02e0b346a645ce41284f4b25ae6de0e0561089bc0c4212f6de5587c4ccb21
Instruction ID: d53d10191d1a85c044aba7f3ec212ac92ce5176a248edb2932ce54add84afe44
Opcode Fuzzy Hash: bbf02e0b346a645ce41284f4b25ae6de0e0561089bc0c4212f6de5587c4ccb21
Instruction Fuzzy Hash: 9D52BE72601B8081EB269F23D4543EE77A1F78CBC4F8A5426EB4A577B6DB38D845C348

Uniqueness

Uniqueness Score: -1.00%

Function 000000014007BD50, Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1d6ac494662c45c571e96f77a6e8211c4f0b163f6c515dcb42af03e52a945a
Instruction ID: 9c06e88039ccf999e040ad7794a2e2d02b6699145a9792014979c24fd1337f6c
Opcode Fuzzy Hash: dd1d6ac494662c45c571e96f77a6e8211c4f0b163f6c515dcb42af03e52a945a
Instruction Fuzzy Hash: B4623CB76206548BD7668F26C080B6C37B1F35DFA8F25521ADF0A43799CB39D891CB90

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003B220, Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c541702096c1ae675d9f8552b841f1df762d73269a6d039e8a3e529e919bb3f5
Instruction ID: acd1ff4a64a9c803ec812a22a8ce79600e1464d52fdb42fb628072365476121f
Opcode Fuzzy Hash: c541702096c1ae675d9f8552b841f1df762d73269a6d039e8a3e529e919bb3f5
Instruction Fuzzy Hash: 64429E31301A8141FA23EB6698513EF6391EB8C7E8F544616BF5A5BBEAEE38C505C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140024440, Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc2a6e3d2e1231b3fe707f0d0f35a30ce2f56e53bfff03d4db06bbddff5caabd
Instruction ID: 78f3400fd7e206f6a511ea736ed45412fb3e7259efd4ed926287f6c9bd4c6aa7
Opcode Fuzzy Hash: fc2a6e3d2e1231b3fe707f0d0f35a30ce2f56e53bfff03d4db06bbddff5caabd
Instruction Fuzzy Hash: E6427C32204A8096EB66EB32D0513EE67A4E79D3C8F914026F79A876F7DF38C945C741

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018630, Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b59e73cc9076a064f99eafccaaec7d80d36fe4b10998ce12be5d35ec0af9fc9f
Instruction ID: 8108868c1ca7c4f1afbe8bd34af9d7f1e96dfbbf12b1edd0cffad3fdf1fa0b6f
Opcode Fuzzy Hash: b59e73cc9076a064f99eafccaaec7d80d36fe4b10998ce12be5d35ec0af9fc9f
Instruction Fuzzy Hash: 3F429E3231068095FB22EB72D8913EE6765EB983D8F844122BB0D97AFADF34C645C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023BF0, Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060d71c651ab3aed04444553114f4ea5a7531cc3ca58c37faf4133b09f387ec2
Instruction ID: 183f2e46b23aa86a2c091461a645f9a581571388db0d92becfc597eb429af356
Opcode Fuzzy Hash: 060d71c651ab3aed04444553114f4ea5a7531cc3ca58c37faf4133b09f387ec2
Instruction Fuzzy Hash: 0732AB3271064089EB16EB36D4513EE27A5EB8CBD8F555126FF0E877BADE38C4868340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400123C0, Relevance: .5, Instructions: 544COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdfece18ddf6bca480a9aef1e07074b0a3e55dc7f17be70bd55bceb11844ecf8
Instruction ID: 71edd40f2b1ab928f6f3b4ddf8d26af45cb7d1258c95c78617a62a1a74f3288a
Opcode Fuzzy Hash: fdfece18ddf6bca480a9aef1e07074b0a3e55dc7f17be70bd55bceb11844ecf8
Instruction Fuzzy Hash: BF32AC3261068195EB12EB26D4913EE2765FB983C8F814122FB4E57AFBEF38C645C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B120, Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8328b10af82aab1ef65ff433d7820bced4cba86e0066b221c3c838f9fd1e431
Instruction ID: 3ba19fba285517c5acd5c21b3c9b7592edaf423ca2de06bba8230fcf7af2400b
Opcode Fuzzy Hash: e8328b10af82aab1ef65ff433d7820bced4cba86e0066b221c3c838f9fd1e431
Instruction Fuzzy Hash: 3C429B72624A8095FB12EB62D4957EE2365FB983C8F814022FB0D57ABBDF34C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400381A0, Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ee38f4c6dee734349d5b0dcc202e437ae908f573234f4aff5f510a5883c84b0
Instruction ID: eb795f204498a8d956ef0de19ff8bd43d97085c04d8ed5933d3115b51340510f
Opcode Fuzzy Hash: 7ee38f4c6dee734349d5b0dcc202e437ae908f573234f4aff5f510a5883c84b0
Instruction Fuzzy Hash: 7022793270064186EA23EB2AD4957EF63A5EB88BD4F554626FF0A477F6EE34C506C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003A2E0, Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8d1907d2a62ce1ae108db488a351868ceb64fffc9dd42578434a0f34ae656a
Instruction ID: 697e8bd1027fccc09012cb901671f32632dfdae7722e2c733c5167ca59ce0a7a
Opcode Fuzzy Hash: 1e8d1907d2a62ce1ae108db488a351868ceb64fffc9dd42578434a0f34ae656a
Instruction Fuzzy Hash: AE227C3271064186EA23EB26D4513EF63A1FB89BD4F544625EB4A577F6EF38C50AC340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B390, Relevance: .5, Instructions: 458COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b3dc1032e7b852d429d3288fc6d56ff3ef19d98c02d1d103b4f123b92fc1f1
Instruction ID: 5c003effdee5129b35cf12aebe167f862a01b0c8d0d2f43ab9f1123e32a30f31
Opcode Fuzzy Hash: 71b3dc1032e7b852d429d3288fc6d56ff3ef19d98c02d1d103b4f123b92fc1f1
Instruction Fuzzy Hash: 8C0203B21082A489F7768B26C9413FA7BE2E759788F254906FB8A435F5D738C9C1D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000DDF0, Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e375be9be99e9838cc7803ed6e7672458d2ec84ccfc9a0c18b017f9565b827c
Instruction ID: c2c66f55aa66479377f68c186b881699d763759fa92e2ffabb716b860ed1a50b
Opcode Fuzzy Hash: 2e375be9be99e9838cc7803ed6e7672458d2ec84ccfc9a0c18b017f9565b827c
Instruction Fuzzy Hash: CD224D72710A8091EB12EB72D4913EE6765FB987C8F904116FB4E876BAEF38C245C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005C40, Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f513173c25ae17789a403cea68c9e18d94625c6d02a52581dcb230289bad16b3
Instruction ID: 217fabc6e38e1d640ccd999207fddb20e056db183073941d35cbdb4b11e649c3
Opcode Fuzzy Hash: f513173c25ae17789a403cea68c9e18d94625c6d02a52581dcb230289bad16b3
Instruction Fuzzy Hash: 10229B72620A8091EB12EB62E4957EE2365F79D7C4F814022FB4E576BBDF38C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140067A40, Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed167cb2d41bf65051b1e1e6ca4fc372791feb4efe79826a7b7afb1d034e643
Instruction ID: 3448a1cfdf5732c1482eebf940cb1862e5db89764351cf67f11e8459266109f6
Opcode Fuzzy Hash: 6ed167cb2d41bf65051b1e1e6ca4fc372791feb4efe79826a7b7afb1d034e643
Instruction Fuzzy Hash: CD026C727006418AEB12DF26D4907EE73A6F788BC4F614525EB0E977AADF34D90AC740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000BB40, Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8296aae514971c10519780c04e533f569930ad849b100b0340065f0f39cb86db
Instruction ID: a963730c34943060851cd64ea719675db259de8104656558a9074d2de6a51302
Opcode Fuzzy Hash: 8296aae514971c10519780c04e533f569930ad849b100b0340065f0f39cb86db
Instruction Fuzzy Hash: 41128F7222468096FB52EB22D4917EE6765FBD93C8F811022FB4E57AABDF38C505C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140069010, Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: 9f9cba7aa6e6b1d42b309293c9ea7f3a8c709476d01fbac2d947c588cc04c995
Instruction ID: 5afa6d75f76fbbc9d7f53df6043056336d1db5d7591574d5123318d553f9c856
Opcode Fuzzy Hash: 9f9cba7aa6e6b1d42b309293c9ea7f3a8c709476d01fbac2d947c588cc04c995
Instruction Fuzzy Hash: 19124E3272469096EB12EF72D8913DE6765FB987C8F815022BB0D57AABDF34C605C710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001E170, Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 9b801c6cfe21829965e01690717934929f301b57ebd9e24914ab7e4ccc7a8bd8
Instruction ID: ac8bef764291a5126b18a53dad73757551fec454a5992e6944e07fe4b855ac86
Opcode Fuzzy Hash: 9b801c6cfe21829965e01690717934929f301b57ebd9e24914ab7e4ccc7a8bd8
Instruction Fuzzy Hash: 2A023B32724A80A2FB52EB72D4913EE6764FB983C4F815022BB4D57AEADF35C545C710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002FEC0, Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4119716334bae8ce4a12a511c9ef3e68b40bfa4d08e13555b81686db08763198
Instruction ID: b67327a95b15ec145a913cc43aeca3e3a8a77925bd43874970612b3ea802a6ff
Opcode Fuzzy Hash: 4119716334bae8ce4a12a511c9ef3e68b40bfa4d08e13555b81686db08763198
Instruction Fuzzy Hash: A802707272064095EB02EB66D4913EE6765FB987C8F905022FB4D83ABBEF34C649C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002980, Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 8eff327b3244b5e4bcb204ecf2616417784072c62e8997917ef3bb952dc9c563
Instruction ID: 5d574d698b33f004de0812fa71b34c36bbdae31478704d480fb686f148b39898
Opcode Fuzzy Hash: 8eff327b3244b5e4bcb204ecf2616417784072c62e8997917ef3bb952dc9c563
Instruction Fuzzy Hash: EB024C72324A8096FB12EB62D4913EE6765EB983D4FC15022BB4E57AEBDF34C605C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140010880, Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d8f91d721c478637f80766b80e37fef242b82150883bd374cc6845ff3be0a72
Instruction ID: f0fb79f68922493fed5bc905321703954c20a875d362dace52344ff7232635a8
Opcode Fuzzy Hash: 8d8f91d721c478637f80766b80e37fef242b82150883bd374cc6845ff3be0a72
Instruction Fuzzy Hash: D7029272320AA19AEB42DF36C8917EE2724F748789F805016FF4B57AAAEF35C545C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001D910, Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: 05ee41dc75372f3184bd1bd526553eb93c41a596f4ef0b14bf7d6c74ff3eb6f4
Instruction ID: 9c3e8f75c9e591130820bb2956cb3806339feb13e112d9af22726fcddd3bd126
Opcode Fuzzy Hash: 05ee41dc75372f3184bd1bd526553eb93c41a596f4ef0b14bf7d6c74ff3eb6f4
Instruction Fuzzy Hash: 12026C32314A8095FB52EB72D4917EE2765EB983C4F805022BB4E97AEBDF35C649C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140033540, Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76dd430cce1ce6768c64dce55b4180b759221ef9574e8c45ed07b1ebd879cb4c
Instruction ID: d0d419901b6e3c3183ee3913f1137c5e588d0fadc92f77f7791849e6aeb29d3b
Opcode Fuzzy Hash: 76dd430cce1ce6768c64dce55b4180b759221ef9574e8c45ed07b1ebd879cb4c
Instruction Fuzzy Hash: 8A029132614A8095EB22EF32D4913EE6765FB98388F904412FB4E57AFADF34C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140017B40, Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f9fca4ef37f2f646f8f484f052d6c6cb090e5de6006e0c91dd90195c41f6835
Instruction ID: fccd9241a873054b7c24d42fb58abb6f012b2f7f19fe3a4c061a127f88627f2a
Opcode Fuzzy Hash: 3f9fca4ef37f2f646f8f484f052d6c6cb090e5de6006e0c91dd90195c41f6835
Instruction Fuzzy Hash: 41E18E3271068095FB12EB76D8917EE6765EB983C8F804021BB0D5BAEBEF35C645C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002CB80, Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b6f1b094effc9f245018c12fb0bd54aed54c11f9143a05f6df0da17f49fd19b
Instruction ID: 02ee9b89192d395c78975687d30e6fb06be8b995001c736011e159ca0d17724c
Opcode Fuzzy Hash: 9b6f1b094effc9f245018c12fb0bd54aed54c11f9143a05f6df0da17f49fd19b
Instruction Fuzzy Hash: E2E13D32714A4095EB02EB66D4913EE6765FB983D8F900012FB4D97AFAEF34CA49C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400018D0, Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b36c55cc0c64182b75bd054714d27820267f0f2f65f1b0bf4452dbf409dd159
Instruction ID: 95da75048f27146dafc5de9d612871b80806eb61125b8034b1f63b71f4cba504
Opcode Fuzzy Hash: 4b36c55cc0c64182b75bd054714d27820267f0f2f65f1b0bf4452dbf409dd159
Instruction Fuzzy Hash: 47F12C3262498096EB12EB62D8513ED6365FBD8388F814522BB4E479FBEF74CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003AAC0, Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7780c785dee08e0bb9155763342d8440fe36315939b45b58d1687e3de4f63a
Instruction ID: cf5fdc312f2229dc6ff813412d90ddbabd12b8e4de7574aebc9877f7d05b411a
Opcode Fuzzy Hash: 9e7780c785dee08e0bb9155763342d8440fe36315939b45b58d1687e3de4f63a
Instruction Fuzzy Hash: 28D19032711A4195EB12EB76D4903EE23A1EB993C4F844425BF4E57BEAEF38C605C350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140064080, Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16253b5d55ff71ace7e49d720cc951c571e11621ee8e21fa8c6a30ce5dfdcbdc
Instruction ID: bf23390ce128f79092fde7b2b9043ef6653a4f1b38eae35900255c6e9c132ad5
Opcode Fuzzy Hash: 16253b5d55ff71ace7e49d720cc951c571e11621ee8e21fa8c6a30ce5dfdcbdc
Instruction Fuzzy Hash: ABC1D4231282D04BD7569B3764503FAAE91E79A3C8F280655FFC997AEBD63CC2149B10

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002D0D0, Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f12721fbfba6283dc7958c84227ce6bb15a7590cb07e0c84499cdb4845d6b172
Instruction ID: d0d512be425b72175eef7d799d9923e381f6a995b1e0446f0295c878f1c0c086
Opcode Fuzzy Hash: f12721fbfba6283dc7958c84227ce6bb15a7590cb07e0c84499cdb4845d6b172
Instruction Fuzzy Hash: CED13972724A4091EB02EB76D4913EE6765F7983C8F904016BB4D97ABAEF38C605C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140030530, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da2952e0823b3d5a59f73c7ab384f762a6d9a624e53a469d815e2d2c0d7a72ca
Instruction ID: 96955b53f7f5b4430e01eb0035ad3df088e7672fa3a311151148bede835f9000
Opcode Fuzzy Hash: da2952e0823b3d5a59f73c7ab384f762a6d9a624e53a469d815e2d2c0d7a72ca
Instruction Fuzzy Hash: E7C16136B0564089FB22EB76D0613EF27A1AB9C388F554425BF4E976FADE34C506C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002A110, Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 8317b6107b79d8746eb836802ab66d92c4c2213a6f1849c4bee5ec7b69d23b54
Instruction ID: 08807915bc927436db1a901aa043915a979950c5e23cf508b5f0d65b77d78aa9
Opcode Fuzzy Hash: 8317b6107b79d8746eb836802ab66d92c4c2213a6f1849c4bee5ec7b69d23b54
Instruction Fuzzy Hash: 0CD17032614A8096EB02EB26D4513EE6364FBD97C4F815122FB4D57AEBDF38CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005F490, Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c98a7c03b056bf897b50c999e530441a062f43ea8ff7e63b9bd448889a0739
Instruction ID: f96005f1b71c62cd91ec633b0fa556b6f093996ab6e40a041e3cbd638a23d0d9
Opcode Fuzzy Hash: 29c98a7c03b056bf897b50c999e530441a062f43ea8ff7e63b9bd448889a0739
Instruction Fuzzy Hash: C1C1BD3270164096FB12EF76D4413ED23A4EB883A8F484622BF2D57AE6EF38D955D350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022D00, Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005ad93020e0817431c5e85dbe6d11178de2602f8c4bd9af456519582a9ff990
Instruction ID: 38de139323f3e079e5738bdd278af51575638bb101dd3218b17e6965c0953cb4
Opcode Fuzzy Hash: 005ad93020e0817431c5e85dbe6d11178de2602f8c4bd9af456519582a9ff990
Instruction Fuzzy Hash: 1DB16A3671062094FB46EBA2D8A17DE2365BB89BC8F825025FF0D67BA7DE38C505C354

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140031540, Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97dd306fff28f1ab02ecd5c90015a73acd09471cf75e7327e0331e3ccb750c21
Instruction ID: bfe4e87f351d28bd3d3693bc96d2151355ab9388d993d4a46e39ffd0a3f78ad6
Opcode Fuzzy Hash: 97dd306fff28f1ab02ecd5c90015a73acd09471cf75e7327e0331e3ccb750c21
Instruction Fuzzy Hash: E6C16332704A809AFB22EBB2D4513EE2365AB9C3D8F854521BF1E676EADF30C505C354

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140062B00, Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfd4a30f1a27aef1054c36b1d99c0610af0cc08103e55e4b01f0e7caa7c836f
Instruction ID: f23c3879964f3f83b961310f1bad7f7be1ef7afa2b68ec7d59790f469601a501
Opcode Fuzzy Hash: bcfd4a30f1a27aef1054c36b1d99c0610af0cc08103e55e4b01f0e7caa7c836f
Instruction Fuzzy Hash: A9A10231211E8145EBA79A2798543EF27A6AB8C3D4F645825FF0E5B6E9EF34C901C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B41B, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16274a22d167cb7459d5025cfc47ed7afc639167fa2c9c1057ca1fd72c03709f
Instruction ID: c0d98bc7e162404dc537a7c1af49e5fbe25e03b535df8b2493956c53732576b9
Opcode Fuzzy Hash: 16274a22d167cb7459d5025cfc47ed7afc639167fa2c9c1057ca1fd72c03709f
Instruction Fuzzy Hash: B2A114F31182A486FB778A2685413FA7FE2E719789F254402FB8A435F6C63CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140066020, Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a77b3ded0776d671925a3aad9e7cc492f01908de9f9e7db45f2ad695b1e2ca
Instruction ID: d17e179c4ad3c1814a715198efb3da372d22ab0628f3c9d9f6a3a053a6971865
Opcode Fuzzy Hash: 39a77b3ded0776d671925a3aad9e7cc492f01908de9f9e7db45f2ad695b1e2ca
Instruction Fuzzy Hash: 79A1903271164045EB22EB7298507EE67E6AB9C3C8F550925BF4D47BEAEF34CA068310

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007A60, Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb3ae0ca8b09634f6b3eb7f35d10a75bd1e51e3d218a5b4533eb8f41dc86bd2
Instruction ID: 7cb660c1bafc6db3c15f0a4866a94b05aa7759728bb06ab0739d07cd917ce7e2
Opcode Fuzzy Hash: 8bb3ae0ca8b09634f6b3eb7f35d10a75bd1e51e3d218a5b4533eb8f41dc86bd2
Instruction Fuzzy Hash: 33B18C7262464191EB12EB62E4913EE6365FB9C7C4F801022FB4E47ABBDF38C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B43D, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8327572ae460ec67bee7642bc1df1dfc8e00bf19c98c3d2f0bb37742338d2b
Instruction ID: ff1b56ecf022c2229069a5389c0477a62f006b84fd5f9f69eebb894724ab9066
Opcode Fuzzy Hash: dc8327572ae460ec67bee7642bc1df1dfc8e00bf19c98c3d2f0bb37742338d2b
Instruction Fuzzy Hash: 44A125F21182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B424, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92fc6e297697f72d3d55b197ac04fe50775a4f95a26f4c9e919e5e137ab98750
Instruction ID: f965aa676d2cc64f6a485257af634002c7fef1377d4791c8bed9b1b7e56d6411
Opcode Fuzzy Hash: 92fc6e297697f72d3d55b197ac04fe50775a4f95a26f4c9e919e5e137ab98750
Instruction Fuzzy Hash: 79A115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B42D, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e075c1df208aa39fb877a834bfc4403f559291216783e55fb63477ae2eadfdc
Instruction ID: 86c182e730ead1fa639f737d8458d4edb1cdee6041daaa12aedc2aef895c7c0c
Opcode Fuzzy Hash: 1e075c1df208aa39fb877a834bfc4403f559291216783e55fb63477ae2eadfdc
Instruction Fuzzy Hash: 83A115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B436, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68406ce4345875cbc0110dbe212228596ffa7fd34d07f9d141f7f6a9cf54bfa
Instruction ID: 7a8579acbe1e06e5dcc528155c10978c06d1d02f61772b3afab02cdca005db6d
Opcode Fuzzy Hash: b68406ce4345875cbc0110dbe212228596ffa7fd34d07f9d141f7f6a9cf54bfa
Instruction Fuzzy Hash: 3EA115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B446, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a2fa5d4e375044cfc16d96b5b502da69406d12098659286745a9d4aecf6a6c
Instruction ID: 9b5f4d2890da7bc9148b0c777fb781a5a0913674a9f0c1f21bc34f13756e8484
Opcode Fuzzy Hash: 20a2fa5d4e375044cfc16d96b5b502da69406d12098659286745a9d4aecf6a6c
Instruction Fuzzy Hash: 37A114F31182A489FB778A2685413FA7FE2E719789F254402FB8A475F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140069A50, Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847c53cd22c21084d67cb822d3c8f80ec4024bd4884789ed31c06eb0f484aec6
Instruction ID: 9e8436de532ad8a8b9d83a7ce7f67d33a1e65f1b543d517c902b78be038a8119
Opcode Fuzzy Hash: 847c53cd22c21084d67cb822d3c8f80ec4024bd4884789ed31c06eb0f484aec6
Instruction Fuzzy Hash: 6FA19F3271464095EB22EB72D4913EE63A5A78C7C8F914426FF0D57AFAEE38C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001010, Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b042d90c0f8c1feaf42d72467fc8ea1d5898c5b9afd74594c11dc23e78b13021
Instruction ID: 891caef274385c1d9a1a05b5f8e139ad0eea2bdcde326525a3acf11d5ee056db
Opcode Fuzzy Hash: b042d90c0f8c1feaf42d72467fc8ea1d5898c5b9afd74594c11dc23e78b13021
Instruction Fuzzy Hash: 79918D7270164095EB16EF66E4507EE23A5ABDC7C4F448425BF4E97BA6EE34C906C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002EA00, Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece24c6383d481359da45c4a9ca9543c9b728e9b17bacba2c33916ec7d8e2a7a
Instruction ID: 09ec91f3f7d35e473cfa3e72b303784d96220d522314983c3d838af10b8059fe
Opcode Fuzzy Hash: ece24c6383d481359da45c4a9ca9543c9b728e9b17bacba2c33916ec7d8e2a7a
Instruction Fuzzy Hash: C4A16E32314A8095FB22EB72D8513EE2365EB987D4F940426BB4D57AFADF34CA05C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018300, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce67bfafa3a41e60d72f08d4a165a2184096e63d57257d43e1b540ba17e5e704
Instruction ID: 9282ef7f3f2e177ec3162a27807bc3d77d508fe5c2bed51c5ff564ba7b898efa
Opcode Fuzzy Hash: ce67bfafa3a41e60d72f08d4a165a2184096e63d57257d43e1b540ba17e5e704
Instruction Fuzzy Hash: 99912232B15A4099FB12EBB2D4913ED23659B9C7C8F814525BF0DA76EBEE34C609C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002E1B0, Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: e13badc4eecd54d72134e33fa3c908df50463b4c7afbc823f6efb99f8860a50f
Instruction ID: a01e236db0e61280ae7bc249da652572acbbc64743681568c883ee8cb5c556df
Opcode Fuzzy Hash: e13badc4eecd54d72134e33fa3c908df50463b4c7afbc823f6efb99f8860a50f
Instruction Fuzzy Hash: D7916C3272468092FB12EB62D4957DE6365FB9C7C4F811022BB4D43AABDF78C544CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400276C0, Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edcdc2154c5838ab1c8625022021c2da12bae5cdd39a93ebf1f5cb6a04e32108
Instruction ID: bfac23c94d9038130fb0cc9f6c7292f6f1aa2b418e68c536fc9a693e481bc66c
Opcode Fuzzy Hash: edcdc2154c5838ab1c8625022021c2da12bae5cdd39a93ebf1f5cb6a04e32108
Instruction Fuzzy Hash: 1E91B13270164096FB22EB22D4517EE23A0EB9C3C8F855426BB4E57AFADF34C944C351

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140064E80, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bede4ae264e8185b0f9f24becd31f8195eff363a0612df846459a6d3a9af60c0
Instruction ID: 348a5c641c523964159132b8cb670365254cd557f13034448bd6fc243d7f1d42
Opcode Fuzzy Hash: bede4ae264e8185b0f9f24becd31f8195eff363a0612df846459a6d3a9af60c0
Instruction Fuzzy Hash: AB81503271064095FB12EB76D8913EE63A5AB9D7C8F944621BF0D4BAEAEF34C605C350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140016100, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e54b42b1a183fcc3e26b712d0c98e0febe665e521d345cd27406ffce54824ba
Instruction ID: 4362bffb4ce140633d60009826b42a117c21897de7dbf4a94b418fc321f1d931
Opcode Fuzzy Hash: 0e54b42b1a183fcc3e26b712d0c98e0febe665e521d345cd27406ffce54824ba
Instruction Fuzzy Hash: 35812032714A809AFB12EB72D4513ED2365EB9C388F814425BB4E67AEBEF35C605C354

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140032650, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 1556071639309c0f3bf9c98b804d70b10111ac1c0d30ce30fda26827df1e6222
Instruction ID: a8b049447ef23dc7a2f3147d56ae0c312f8ac6a7955db6ed7517384e00930876
Opcode Fuzzy Hash: 1556071639309c0f3bf9c98b804d70b10111ac1c0d30ce30fda26827df1e6222
Instruction Fuzzy Hash: 0371893270264096FB66AB7294503EE6391EB9C7C8F054526BB1D47BEAEF39C905C360

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400663F0, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d7b3c9e63ec17fbb3decf34851c1318d937a82485f1e960baa699eab580419
Instruction ID: 4c1290556f20f3e20b66d81894b0d385f6ea8bc2319cc982c81cb2944955426d
Opcode Fuzzy Hash: 53d7b3c9e63ec17fbb3decf34851c1318d937a82485f1e960baa699eab580419
Instruction Fuzzy Hash: 6E61B031301A4041EA66E737A9517EF97929F9D7D0FA44621BF5E877FAEE38C9028700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D850, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ec1b3edf0780c5c25e1336ba948ef3e7aec6e0b63b2610df3acb1851feab05
Instruction ID: 50d9e92313d7fbe24902196c924c1612cff9653e99501bbf2772a847790ebefc
Opcode Fuzzy Hash: 17ec1b3edf0780c5c25e1336ba948ef3e7aec6e0b63b2610df3acb1851feab05
Instruction Fuzzy Hash: 7D618D3271464496FB22EB72C0913EE23A5ABDC7C8F854422BF4D57AEAEE35C501C791

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001620, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e611ef6babe13b88f779e8dc5a7611e7c7a64f37548e21c7e35d19833addd5d9
Instruction ID: f8f81a1e6eeb4aa67bd22a5a7a70358e1ddf5b3241a247c9d5674b6b5ab46101
Opcode Fuzzy Hash: e611ef6babe13b88f779e8dc5a7611e7c7a64f37548e21c7e35d19833addd5d9
Instruction Fuzzy Hash: 9061C43262465091FB21EB26E0517EE6360FBCD7C4F815122BB5D47AEAEF79C541CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400319F0, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: ac7f08871eadb0e88aebf12c8c96c3d08f64978839d47a5fff32e650f5283656
Instruction ID: f33abad4c1c8ba015261be05896130ca5dc3e7c07ce7e813c180037223ea8262
Opcode Fuzzy Hash: ac7f08871eadb0e88aebf12c8c96c3d08f64978839d47a5fff32e650f5283656
Instruction Fuzzy Hash: 08718E32714A809AEB12EF76D4913EE7761F798388F844026FB4D47AAADF74C548CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400688A0, Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: c6b0428fc7416c9690bb78137e55356240e86da8257680fa94455239788aca03
Instruction ID: 125c4d10a522e701d1fb6d0f1aef761f583aa31ccbb75f1db25899523a723602
Opcode Fuzzy Hash: c6b0428fc7416c9690bb78137e55356240e86da8257680fa94455239788aca03
Instruction Fuzzy Hash: 0151633271468052FB22EBB6E4513EE6761EBD83C4F951122BB4D47AEADE38C544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140031340, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f431bbfb257fb34b4f249f0b6c1a5781a1840d33aa954166e75b638a15f3be8f
Instruction ID: 50cb9f747c07e87171e39f534f7bbd71060f83f950b2ada1a46c15cbddfc577a
Opcode Fuzzy Hash: f431bbfb257fb34b4f249f0b6c1a5781a1840d33aa954166e75b638a15f3be8f
Instruction Fuzzy Hash: A0511B32700A4096FB12EB76D4917EE2365AB9C7C8F954421BF0DA7AEADF34C605C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002F840, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1a38846fc5b12dd28166e38272f044d4b391af603d2f1471411a8db1635f5ab
Instruction ID: 9602d307e9de31d357e639a9611a18ab9b6f2b9e1d5f0c6a8a00986c6f50d329
Opcode Fuzzy Hash: e1a38846fc5b12dd28166e38272f044d4b391af603d2f1471411a8db1635f5ab
Instruction Fuzzy Hash: 7F51AD32200A40A2EA22EB22D9957FE63A5F7DC7D0F854626FB0D836B6DF34C556D710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002DDE0, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 92949d39d4540ea38b5c00f16dffcfa1214f5dbdd9c806517ba7762cbc11b342
Instruction ID: aca98edda921e0e11dbb2b437e66833b6d9475281c93859f86ded24665675a69
Opcode Fuzzy Hash: 92949d39d4540ea38b5c00f16dffcfa1214f5dbdd9c806517ba7762cbc11b342
Instruction Fuzzy Hash: E5516E3271465095FB52EB76E4913EE6761EBD8388F850026BB4E479EADF38C948CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400611A0, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8619ee3f9ccd1f320a5fbfbf5c9367aa5b7df2049cee1b1ea35a7e4b7e812f95
Instruction ID: fec891e6c53086f7b9094a78f95b73510c7007b912bc3ef8a41aa8e11e9acb14
Opcode Fuzzy Hash: 8619ee3f9ccd1f320a5fbfbf5c9367aa5b7df2049cee1b1ea35a7e4b7e812f95
Instruction Fuzzy Hash: 01413D31B2066095FB12EB7798513EE13A6ABDC7C4F994421BF0E97AEADE38C5058314

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022A00, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a10d479a193238a188e8adb5c0a2baa624421bbad2986b298b06f84ca2b66ec
Instruction ID: 4d6ce7f696a26fe9a74b6bb9734e6d6bbac3d85ccec2ef1c97bdec5ab73240ea
Opcode Fuzzy Hash: 9a10d479a193238a188e8adb5c0a2baa624421bbad2986b298b06f84ca2b66ec
Instruction Fuzzy Hash: FC51D732610B9085E785DF36E4813DD33A9F748F88F58413AAB8D4B7AADF348152C764

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400286B0, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 0dd31b007056381f4657a5f1dbdce23ecbf955912ad383fd51e82bbfc18d9e36
Instruction ID: a9185cf0004c76bb3001b2cb896eaa84c5f9aff40342764b4326ba4d96cea24c
Opcode Fuzzy Hash: 0dd31b007056381f4657a5f1dbdce23ecbf955912ad383fd51e82bbfc18d9e36
Instruction Fuzzy Hash: 9F514632310B81A2E74EDB32E5813D9B369FB8C384F908415EB9813AA6DF35D676D704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022340, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0bc628afaa724f2a407568f7776cab89400c990b0d91b82c0bf42df1747497
Instruction ID: 1e1e8128ca37617077ad8d3bddb138d765a5f71e348f586f351b06e9a9582713
Opcode Fuzzy Hash: 8d0bc628afaa724f2a407568f7776cab89400c990b0d91b82c0bf42df1747497
Instruction Fuzzy Hash: 5C51C773611B9085E745DF36E8813DD37A8F748F88F58413AEB894B6AADF308156C760

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140063BD0, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a990b53e0665ad0886faa979631976ec8b00dc7985899795eb44eacb3e5b3434
Instruction ID: 5f416d68214368cc8d497caad67b5ad9eebcd67f96a0df70edf52f54e079c757
Opcode Fuzzy Hash: a990b53e0665ad0886faa979631976ec8b00dc7985899795eb44eacb3e5b3434
Instruction Fuzzy Hash: DE31F53221099842FBA6471B9C613F93292E79C3E4F649625FB8E537F4D67DC8038B80

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005370, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bce42950a1e8a62078921d64ca997753bf7c09f413ca20ce6f360246a445e94
Instruction ID: 604a730c127844f2816d2636316060c5dd02da03d6f4240a24423d76594c64fe
Opcode Fuzzy Hash: 5bce42950a1e8a62078921d64ca997753bf7c09f413ca20ce6f360246a445e94
Instruction Fuzzy Hash: 55313F32610B9091E749DB36D9813DD73A9F78CB84FA58526A39847AA6DF35C177C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007EA0, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.273313020.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.273299533.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273522073.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.273553468.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.273571147.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc6e0ee29a39c7d5a8b9bac5d98e7e3adc62a080d0eb157144b98198d9367420
Instruction ID: 1d8fa33d8030516f9812c7435f1c2f5fee2e6c5a40d503ba1f82db291cb841dc
Opcode Fuzzy Hash: cc6e0ee29a39c7d5a8b9bac5d98e7e3adc62a080d0eb157144b98198d9367420
Instruction Fuzzy Hash: 7131DC32600B4080E745DF3699813EDB3E9FBACB88FA9853697484A9B6DF35C157D310

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 6480 Parent PID: 6432 rundll32.exeCOMMON

Executed Functions

Function 0000022F45AE2252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0000022F45AE23B0
VirtualProtect.KERNELBASE ref: 0000022F45AE2471
RtlAvlRemoveNode.NTDLL ref: 0000022F45AE25B4
VirtualProtect.KERNELBASE ref: 0000022F45AE2677

Memory Dump Source

Source File: 00000004.00000002.334620127.0000022F45AE0000.00000040.00000001.sdmp, Offset: 0000022F45AE0000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 1b7364fe05784c0d538cd9139a7fe293888203eef7f027fb4700ba767af59258
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 22B15176618BD486D770DB5AE440B9EB7A1F7D9B84F108026EF8953B58CB79C842CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0000022F45AE2057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000022F45AE29A8), ref: 0000022F45AE20A7

Memory Dump Source

Source File: 00000004.00000002.334620127.0000022F45AE0000.00000040.00000001.sdmp, Offset: 0000022F45AE0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 293df405513204529525fe8c72669d6369dde914828085fd7a37fcf8dc74f54f
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 83315C72615B9086D790EF1AE45475A7BB0F389BC4F204026EF8D87B28DF3AC446CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6488 Parent PID: 6392 rundll32.exeCOMMON

Executed Functions

Function 000002620B502252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000002620B5023B0
VirtualProtect.KERNELBASE ref: 000002620B502471
RtlAvlRemoveNode.NTDLL ref: 000002620B5025B4
VirtualProtect.KERNELBASE ref: 000002620B502677

Memory Dump Source

Source File: 00000005.00000002.252498282.000002620B500000.00000040.00000001.sdmp, Offset: 000002620B500000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: f1819e72a306005da94d4feebd729ff2ce86c0c1f2b93c14cc7e7313c24f1a07
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 2AB15376618BC586D770CB1AF44079EBBA1F7D9B80F108026EEC957B58DB7AC8458F40

Uniqueness

Uniqueness Score: -1.00%

Function 000002620B502057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000002620B5029A8), ref: 000002620B5020A7

Memory Dump Source

Source File: 00000005.00000002.252498282.000002620B500000.00000040.00000001.sdmp, Offset: 000002620B500000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 83b3ce27ce6d1e79e96c0022329def3aff5115517181a5ed4e7810abecab0d59
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 0E312976615B90C6D790DF1AE49475A7BA0F389BD4F209026EF8D97B28DF3AC446CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6552 Parent PID: 6392 rundll32.exeCOMMON

Executed Functions

Function 000001EE3EA92252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001EE3EA923B0
VirtualProtect.KERNELBASE ref: 000001EE3EA92471
RtlAvlRemoveNode.NTDLL ref: 000001EE3EA925B4
VirtualProtect.KERNELBASE ref: 000001EE3EA92677

Memory Dump Source

Source File: 00000007.00000002.260704985.000001EE3EA90000.00000040.00000001.sdmp, Offset: 000001EE3EA90000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 8fa986e0574413cc6ab8e4405b73b6147dc64eaf242af12b94e767ae53d8183f
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 75B12276618BC886D770CB1AF4407DEB7A1F7C9B80F108126EE8957B68DB79C8518F40

Uniqueness

Uniqueness Score: -1.00%

Function 000001EE3EA92057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001EE3EA929A8), ref: 000001EE3EA920A7

Memory Dump Source

Source File: 00000007.00000002.260704985.000001EE3EA90000.00000040.00000001.sdmp, Offset: 000001EE3EA90000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: d52d24b0745808cf2b31ba169698f70ab789c27e32f8efcfc07e189c02b30ee7
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: FC314B76615B9486D780DF1AE45479A7BA0F389BC4F214026FF8D87B28DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6728 Parent PID: 6392 rundll32.exeCOMMON

Executed Functions

Function 0000025810FC2252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0000025810FC23B0
VirtualProtect.KERNELBASE ref: 0000025810FC2471
RtlAvlRemoveNode.NTDLL ref: 0000025810FC25B4
VirtualProtect.KERNELBASE ref: 0000025810FC2677

Memory Dump Source

Source File: 0000000A.00000002.268148898.0000025810FC0000.00000040.00000001.sdmp, Offset: 0000025810FC0000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 24983518fede651ffa71e8764cf05f22a58886ef540502b84514a58612d5ba14
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 4CB15676618BC486D770CB1AE841B9EB7A0F7C9B80F108026DE8D67B58CB7DC9528F40

Uniqueness

Uniqueness Score: -1.00%

Function 0000025810FC2057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000025810FC29A8), ref: 0000025810FC20A7

Memory Dump Source

Source File: 0000000A.00000002.268148898.0000025810FC0000.00000040.00000001.sdmp, Offset: 0000025810FC0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: bfbb1c44b8ad033eef5bf5c695627ab4685be72514b8536a1b6d629563b138e2
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 2F315A72615B90C6D790DF1AE85575A7BA0F389BC4F208026EF8D97B68DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: Netplwiz.exe PID: 3584 Parent PID: 3292 Netplwiz.exeCOMMON

Executed Functions

Function 0000022266432252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00000222664323B0
VirtualProtect.KERNELBASE ref: 0000022266432471
RtlAvlRemoveNode.NTDLL ref: 00000222664325B4
VirtualProtect.KERNELBASE ref: 0000022266432677

Memory Dump Source

Source File: 00000016.00000002.363613819.0000022266430000.00000040.00000001.sdmp, Offset: 0000022266430000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 3f323bc6da962fcf49a7f9abeddab80cc2553b9475c7cd04a58351d7ea8e4df7
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 93B14277618BC486D7708B5AF4407AEB7A0F789B80F148026EE8967F58CB7EC8558F40

Uniqueness

Uniqueness Score: -1.00%

Function 0000022266432057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,00000222664329A8), ref: 00000222664320A7

Memory Dump Source

Source File: 00000016.00000002.363613819.0000022266430000.00000040.00000001.sdmp, Offset: 0000022266430000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 4c29ed0e8714994fa66986072949a62be7bfb3ce9a5133a74156da9de8e51378
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: B9314872615B8086D790DF5AE45476A7BA4F389BC4F209026EF8D97B68DF3AC446CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7D7312B04, Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 226synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF7D7312B40

Part of subcall function 00007FF7D7311138: _vsnwprintf.MSVCRT ref: 00007FF7D7311178

CreateMutexExW.KERNEL32 ref: 00007FF7D7312B7C
CloseHandle.KERNEL32 ref: 00007FF7D7312BA2
WaitForSingleObjectEx.KERNEL32 ref: 00007FF7D7312BBE
ReleaseMutex.KERNEL32 ref: 00007FF7D7312C84

Part of subcall function 00007FF7D73116D0: GetLastError.KERNEL32 ref: 00007FF7D73116D4

Strings

Local\SM0:%d:%d:%hs, xrefs: 00007FF7D7312B4B
x, xrefs: 00007FF7D7312B55

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: Mutex$CloseCreateCurrentErrorHandleLastObjectProcessReleaseSingleWait_vsnwprintf
String ID: Local\SM0:%d:%d:%hs$x
API String ID: 226711808-4178846994
Opcode ID: 29386fccad7ddf6ba7f2bd2ae70033962b23ec7f558ce25624d10900e814b8c0
Instruction ID: 6326fee0fc8c49eb01b266dcde05e7bd16e63bbe5ca27aaa2ff1f85fb64d48c4
Opcode Fuzzy Hash: 29386fccad7ddf6ba7f2bd2ae70033962b23ec7f558ce25624d10900e814b8c0
Instruction Fuzzy Hash: DC914532B08AC286FB64BB62E84467DA360AF94B90FD5453ADE4D47694DE3CE453C330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D731286C, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 117registrymemoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32 ref: 00007FF7D73128A4
memset.MSVCRT ref: 00007FF7D73128B4
LoadCursorW.USER32 ref: 00007FF7D73128D2
GetStockObject.GDI32 ref: 00007FF7D73128DE
RegisterClassW.USER32 ref: 00007FF7D7312902
GetUserDefaultUILanguage.KERNEL32 ref: 00007FF7D731291E
GetLocaleInfoW.KERNEL32 ref: 00007FF7D7312941
CreateWindowExW.USER32 ref: 00007FF7D73129AE
GetLastError.KERNEL32 ref: 00007FF7D73129BC
CreateWindowExW.USER32 ref: 00007FF7D7312A0E
UsersRunDllW.NETPLWIZ ref: 00007FF7D7312A28
DestroyWindow.USER32 ref: 00007FF7D7312A31

Strings

StubWindow32, xrefs: 00007FF7D73128EC, 00007FF7D731296D, 00007FF7D73129D9

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Create$ClassCursorDefaultDestroyErrorHeapInfoInformationLanguageLastLoadLocaleObjectRegisterStockUserUsersmemset
String ID: StubWindow32
API String ID: 2498089391-234383714
Opcode ID: b59b81597f886c5643299d07e033301dc326521417026872827919de45fbe9b1
Instruction ID: a19340323c6862935f0391697db7d65b473ad031f3cf41445c66eee7da066242
Opcode Fuzzy Hash: b59b81597f886c5643299d07e033301dc326521417026872827919de45fbe9b1
Instruction Fuzzy Hash: 6B515C72A09B8286E7109F50F4446ADB7A4FB48794FD1013ADE8D07B28DF3CD556C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D7313AD0, Relevance: 9.0, APIs: 6, Instructions: 50timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF7D7313B01
GetCurrentProcessId.KERNEL32 ref: 00007FF7D7313B0F
GetCurrentThreadId.KERNEL32 ref: 00007FF7D7313B1B
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF7D7313B27
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF7D7313B37
QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0 ref: 00007FF7D7313B52

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: faf30ef9eff24cf57f57a0b386a1454f14c9bfcb9e15d76bfa89b01a0b3bbecf
Instruction ID: 3f27e620ee9e85dec6af3ae8392726243148447137185e966be3955631c288d6
Opcode Fuzzy Hash: faf30ef9eff24cf57f57a0b386a1454f14c9bfcb9e15d76bfa89b01a0b3bbecf
Instruction Fuzzy Hash: 20112122604F818ADB50EF71EC4516873A4FB49758BC10A3AEE6D43754EF7CD5A58360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D7311728, Relevance: 6.2, APIs: 4, Instructions: 241threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7D7311829
memset.MSVCRT ref: 00007FF7D7311878
IsDebuggerPresent.KERNEL32 ref: 00007FF7D731191A
OutputDebugStringW.KERNEL32 ref: 00007FF7D73119A7

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDebugDebuggerOutputPresentStringThreadmemset
String ID:
API String ID: 3402966819-0
Opcode ID: b41f9533fc19335cf688305ba60f1d1c7620de238dbdbbc807d4ef9c957067f5
Instruction ID: 97d04759037773e038f425629b68137e21f2051f6e04936db1be38455327a611
Opcode Fuzzy Hash: b41f9533fc19335cf688305ba60f1d1c7620de238dbdbbc807d4ef9c957067f5
Instruction Fuzzy Hash: 6EB13832A09BC682EB64AB55E4403ADA7A0BB85B90FC5403EDD8D47794DF3CE856C770

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D7313D70, Relevance: 2.5, APIs: 2, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7D7313D92
HeapFree.KERNEL32 ref: 00007FF7D7313DA0

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 199e6ea84503724b70affd2f7b3b58d7a5ce54a533a414dabda5612385e63888
Instruction ID: ccd61d9a17da9735275bc98e78c5dee784984130c8bd2e87f5cf76ffb0d5a873
Opcode Fuzzy Hash: 199e6ea84503724b70affd2f7b3b58d7a5ce54a533a414dabda5612385e63888
Instruction Fuzzy Hash: 1CF01D32E19A9182E715AB46FA4002DA365FB58BD0BD4803ADE4D17B58DF28E4638320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D7313930, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7D731393B

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 868885a218fd2d00ef78babefa4f0eb766331b80ca1877c91e825d742b2b0fdb
Instruction ID: 69493c5cd53c85bc4c6c44f9ae21dcbcc8c6ab785d4bd639e898df5c72ae84b8
Opcode Fuzzy Hash: 868885a218fd2d00ef78babefa4f0eb766331b80ca1877c91e825d742b2b0fdb
Instruction Fuzzy Hash: 14B09250E25883C1D708BB21AC8206853E46B58310FC10476C40D80120DE5C91DF8720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D7311230, Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 151windowthreadCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32 ref: 00007FF7D7311311
GetCurrentThreadId.KERNEL32 ref: 00007FF7D731138A

Part of subcall function 00007FF7D73111B0: _vsnwprintf.MSVCRT ref: 00007FF7D73111E8

Strings

%hs(%d) tid(%x) %08X %ws, xrefs: 00007FF7D731139D
CallContext:[%hs] , xrefs: 00007FF7D731140D
%hs!%p: , xrefs: 00007FF7D7311355
[%hs], xrefs: 00007FF7D731144D
LogHr, xrefs: 00007FF7D73112CA
, xrefs: 00007FF7D73113D7
[%hs(%hs)], xrefs: 00007FF7D7311434
Msg:[%ws] , xrefs: 00007FF7D73113F2
%hs(%d)\%hs!%p: , xrefs: 00007FF7D7311337
(caller: %p) , xrefs: 00007FF7D7311375
Exception, xrefs: 00007FF7D73112DC
ReturnHr, xrefs: 00007FF7D73112D3
FailFast, xrefs: 00007FF7D73112C1

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentFormatMessageThread_vsnwprintf
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%d)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $ReturnHr$[%hs(%hs)]$[%hs]
API String ID: 223436642-2849347638
Opcode ID: 2b9e87caf1579d6d4167360b9d0d795b27ec80f9b8d19c09739ff6ac6d368cda
Instruction ID: e9b57a82bcd74bd62d445735cbc449a1b042d35efc0150eeae0519f4987af541
Opcode Fuzzy Hash: 2b9e87caf1579d6d4167360b9d0d795b27ec80f9b8d19c09739ff6ac6d368cda
Instruction Fuzzy Hash: A2611761A09A8281EB64EF91E8105FDA3A0BF48B88FC5413BDE4D57758EF3CE5468770

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D7312730, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 00007FF7D731275D
GetWindow.USER32 ref: 00007FF7D731276D
GetClassNameW.USER32 ref: 00007FF7D7312784
CompareStringOrdinal.KERNEL32 ref: 00007FF7D73127A8
GetWindow.USER32 ref: 00007FF7D73127B9
GetWindow.USER32 ref: 00007FF7D73127CA
GetWindowLongPtrW.USER32 ref: 00007FF7D73127DF
SetWindowLongPtrW.USER32 ref: 00007FF7D73127FA
SendMessageW.USER32 ref: 00007FF7D731280D
DestroyIcon.USER32 ref: 00007FF7D731281B
GetWindowLongPtrW.USER32 ref: 00007FF7D7312826
SetWindowLongPtrW.USER32 ref: 00007FF7D731283C
SHFreeShared.SHLWAPI ref: 00007FF7D7312847

Strings

IME, xrefs: 00007FF7D731279C

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Long$ClassCompareDestroyFreeIconMessageNameOrdinalProcSendSharedString
String ID: IME
API String ID: 182733252-3278629642
Opcode ID: 6229397ac1c51f31017851ef575b92bd8a67c894c6ef52fe3c02a1fcebf2d845
Instruction ID: 10bd03e9d1f7d2532c11c4d7528925213f4fff6bcec5429247d43128b42cd1db
Opcode Fuzzy Hash: 6229397ac1c51f31017851ef575b92bd8a67c894c6ef52fe3c02a1fcebf2d845
Instruction Fuzzy Hash: 0D318661B186C682FB54AB25B81477DA391AF99B51FC4413ACD0E467A8DF3CE447C330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D7312D20, Relevance: 19.6, APIs: 13, Instructions: 107memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32 ref: 00007FF7D7312D44
GetLastError.KERNEL32 ref: 00007FF7D7312D7F
CloseHandle.KERNEL32 ref: 00007FF7D7312D8A
SetLastError.KERNEL32 ref: 00007FF7D7312D9A
GetLastError.KERNEL32 ref: 00007FF7D7312DAE
CloseHandle.KERNEL32 ref: 00007FF7D7312DB9
SetLastError.KERNEL32 ref: 00007FF7D7312DC9
GetLastError.KERNEL32 ref: 00007FF7D7312DD9
ReleaseMutex.KERNEL32 ref: 00007FF7D7312DE4
SetLastError.KERNEL32 ref: 00007FF7D7312DF4
GetProcessHeap.KERNEL32 ref: 00007FF7D7312E25
HeapFree.KERNEL32 ref: 00007FF7D7312E33
ReleaseMutex.KERNEL32 ref: 00007FF7D7312E41

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$CloseHandleHeapMutexRelease$FreeObjectProcessSingleWait
String ID:
API String ID: 1242941757-0
Opcode ID: ddc016737efb16f71490d1e50252b2d645b3a1d06d3c066d251d62e35ce6ee9f
Instruction ID: a81942339a398ef97822dc9627e7f472005b523b9ca45804950f48149500b876
Opcode Fuzzy Hash: ddc016737efb16f71490d1e50252b2d645b3a1d06d3c066d251d62e35ce6ee9f
Instruction Fuzzy Hash: E6418625B08AC282FB647B61D45423DA3A0AF54B91FE9413EDE4E47A99DF2CE4538330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D7312A5C, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 114synchronizationCOMMON

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32(?,00007FF7D7312468), ref: 00007FF7D7312A86
GetLastError.KERNEL32(?,00007FF7D7312468), ref: 00007FF7D7312A9C
CloseHandle.KERNEL32(?,00007FF7D7312468), ref: 00007FF7D7312AA7
SetLastError.KERNEL32(?,00007FF7D7312468), ref: 00007FF7D7312AB3
GetCurrentProcessId.KERNEL32 ref: 00007FF7D7312B40
CreateMutexExW.KERNEL32 ref: 00007FF7D7312B7C
CloseHandle.KERNEL32 ref: 00007FF7D7312BA2

Strings

internal\sdk\inc\wil\resultmacros.h, xrefs: 00007FF7D7312AC3
Local\SM0:%d:%d:%hs, xrefs: 00007FF7D7312B4B
x, xrefs: 00007FF7D7312B55

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorHandleLast$CurrentMutexProcessSemaphore
String ID: Local\SM0:%d:%d:%hs$internal\sdk\inc\wil\resultmacros.h$x
API String ID: 656119268-824890558
Opcode ID: cca7cf566b57738bd132412b366fe051534a0e364dc34ab5bc51d84866725d71
Instruction ID: 55dc8aa6c5f149a54c29cef910c4d29c83535bc0bb5345bf438580678ca3d368
Opcode Fuzzy Hash: cca7cf566b57738bd132412b366fe051534a0e364dc34ab5bc51d84866725d71
Instruction Fuzzy Hash: 31419035708A8186E720AF51E8402ADA7A0FB88B90FD5403ADF8D47B59DF7CD452C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D7311D4C, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 87synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF7D7311D5E

Strings

wil, xrefs: 00007FF7D7311D73

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectSingleWait
String ID: wil
API String ID: 24740636-1589926490
Opcode ID: 19b08da60de56fe462db9de07068f64202d685830d8255200f4d4f6256f4de63
Instruction ID: 31f56331e1ca09ef18da0983e441f150404e17bef3661548a05bd0e6864f60ae
Opcode Fuzzy Hash: 19b08da60de56fe462db9de07068f64202d685830d8255200f4d4f6256f4de63
Instruction Fuzzy Hash: C6316321A1C5C283F7706B61E5003BEA3A29F81791FE0813BDD19869D8DE3CE8478771

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D7312F94, Relevance: 15.2, APIs: 8, Strings: 2, Instructions: 172memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7D7312FD3
HeapAlloc.KERNEL32 ref: 00007FF7D7312FE4
CloseHandle.KERNEL32 ref: 00007FF7D7313195
CloseHandle.KERNEL32 ref: 00007FF7D73131A7
GetProcessHeap.KERNEL32 ref: 00007FF7D73131B6
HeapFree.KERNEL32 ref: 00007FF7D73131C4

Strings

_p0, xrefs: 00007FF7D7313069
X, xrefs: 00007FF7D731312C

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$CloseHandleProcess$AllocFree
String ID: X$_p0
API String ID: 826427307-2400676777
Opcode ID: 41ba48f6ab9c52f8bbb0712697fd0eda5ab9d4ab2e6e4e9be9e4dda91ae9df2e
Instruction ID: 6faacf08779bdb6db7763b7ebfe29b5de449ec283ba14bfe992e8203806860dc
Opcode Fuzzy Hash: 41ba48f6ab9c52f8bbb0712697fd0eda5ab9d4ab2e6e4e9be9e4dda91ae9df2e
Instruction Fuzzy Hash: F161B436B08AC181EB15AF11E8506AEA3A4FF84B94FE5403ADE4D47B88DE3DD547C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D7311E90, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

OpenSemaphoreW.KERNEL32 ref: 00007FF7D7311F2F
GetLastError.KERNEL32 ref: 00007FF7D7311F3D
OpenSemaphoreW.KERNEL32 ref: 00007FF7D7311FBB
CloseHandle.KERNEL32 ref: 00007FF7D7311FFA
CloseHandle.KERNEL32 ref: 00007FF7D7312009
CloseHandle.KERNEL32 ref: 00007FF7D7312032

Strings

_p0, xrefs: 00007FF7D7311F08
wil, xrefs: 00007FF7D7311F58

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle$OpenSemaphore$ErrorLast
String ID: _p0$wil
API String ID: 3685679691-1814513734
Opcode ID: 436dc81374fa38214d3e3201d4fa527000193885199e28d58948c06016274e46
Instruction ID: 647469b0ee0a0c9d6eda1c81cd0e75f702a1d8a2c86f482f636a0294fd739ea8
Opcode Fuzzy Hash: 436dc81374fa38214d3e3201d4fa527000193885199e28d58948c06016274e46
Instruction Fuzzy Hash: BA516125B19AC285EB60AB21D8506FDA395EF88B84FD5413BDE4D47B48DE3CD506C330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D73133DC, Relevance: 10.6, APIs: 7, Instructions: 143sleepCOMMON

Download Yara Rule

APIs

GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7D7313404
Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF7D731343B
_amsg_exit.MSVCRT ref: 00007FF7D7313459
_initterm.MSVCRT ref: 00007FF7D73134E4
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7D7313511
exit.MSVCRT ref: 00007FF7D73135B6
_cexit.MSVCRT ref: 00007FF7D73135C5

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_cexit_inittermexit
String ID:
API String ID: 642454821-0
Opcode ID: fdf13257d048395c311507be2ede3708da67d9cedd2c90198a18d1e3ba8004e4
Instruction ID: 3498980ed1f3235841af9b143863d6dceea45b6f48babaa7d39a7d571650970a
Opcode Fuzzy Hash: fdf13257d048395c311507be2ede3708da67d9cedd2c90198a18d1e3ba8004e4
Instruction Fuzzy Hash: D8611571A08A9282FB65AB55E95027DB7A4FB44B84FC5003BDD4D93694DF3CE862C730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D73120A0, Relevance: 7.6, APIs: 5, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,00000000), ref: 00007FF7D731217D
HeapAlloc.KERNEL32(?,?,?,00000000), ref: 00007FF7D731218E
GetProcessHeap.KERNEL32(?,?,?,00000000), ref: 00007FF7D731219C
HeapFree.KERNEL32(?,?,?,00000000), ref: 00007FF7D73121AB
memcpy_s.MSVCRT ref: 00007FF7D7312245

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$AllocFreememcpy_s
String ID:
API String ID: 3519707287-0
Opcode ID: dd198df7f46920dab7068ead275fd6b4964c56c1e7c1edfb28071f46c1fc8413
Instruction ID: 717e37088816dba91ffbc72d5ba4f7535b37d6fa377aa169a76003deffe38a51
Opcode Fuzzy Hash: dd198df7f46920dab7068ead275fd6b4964c56c1e7c1edfb28071f46c1fc8413
Instruction Fuzzy Hash: C851BC62B08B8986EB54EF25A80026DB7A1FB18F94B95853ADF0D43754DF38D4A7C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D7311670, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7D7311697
GetProcAddress.KERNEL32 ref: 00007FF7D73116AE

Strings

RtlDllShutdownInProgress, xrefs: 00007FF7D73116A4
ntdll.dll, xrefs: 00007FF7D7311690

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: RtlDllShutdownInProgress$ntdll.dll
API String ID: 1646373207-582119455
Opcode ID: 84b697f5536a33f7bffe1c9b17310cce9c4cd5f52eb4636878a7d8649a3b5b10
Instruction ID: 4dd7940d27c8a0c710b07751f89703f19295fdf48227a4b8ce85b973c884876b
Opcode Fuzzy Hash: 84b697f5536a33f7bffe1c9b17310cce9c4cd5f52eb4636878a7d8649a3b5b10
Instruction Fuzzy Hash: 84F07464E0AB8381FB15BB95F8541B8A3B4AF29751FC9143FCC0D06364EE2CA56A8330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D7312EAC, Relevance: 6.3, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF7D7312F14
CloseHandle.KERNEL32 ref: 00007FF7D7312F27
CloseHandle.KERNEL32 ref: 00007FF7D7312F3A

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 6c586b4b01464b622f6ea1fd6cc189d235e77a42eb802b1575c44da04eb5a30f
Instruction ID: 5ddd4b81a6969c190432bab867ef585ec8e2f19deb82ff21da1c54d00159afa8
Opcode Fuzzy Hash: 6c586b4b01464b622f6ea1fd6cc189d235e77a42eb802b1575c44da04eb5a30f
Instruction Fuzzy Hash: AA210C25B0AA8285EB24AB52D45017DA764FF94B90FE9403ADF8E47B59CE3CE4528330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D7313670, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF7D73136E3
RtlLookupFunctionEntry.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF7D7313702
RtlVirtualUnwind.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF7D731374F
__raise_securityfailure.LIBCMT ref: 00007FF7D7313834

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 20d244cf367758d843f710cffe30a87f82f579beffacf6120c461ede34b2ce26
Instruction ID: 33eb7e1eac1ecee463cd6cafcf74330f162a50aecfb1482c5db319d9e107cd4e
Opcode Fuzzy Hash: 20d244cf367758d843f710cffe30a87f82f579beffacf6120c461ede34b2ce26
Instruction Fuzzy Hash: 9A41D575A08B85C1EB10AB58F880369B3A4FB88744FD1413ADD8E42764DF7CE166C730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7D7312290, Relevance: 5.0, APIs: 4, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7D73122C1
HeapFree.KERNEL32 ref: 00007FF7D73122CF
GetProcessHeap.KERNEL32 ref: 00007FF7D73122ED
HeapFree.KERNEL32 ref: 00007FF7D73122FB

Memory Dump Source

Source File: 00000016.00000002.365785652.00007FF7D7311000.00000020.00020000.sdmp, Offset: 00007FF7D7310000, based on PE: true

Associated: 00000016.00000002.365773412.00007FF7D7310000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365802020.00007FF7D7314000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.365814773.00007FF7D7317000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 90bd1aef0b33854bf0504c11e278b307e5fe548102ad1b4b3b40ed8758058df9
Instruction ID: 524b23340ba562d6165f02c329022bcfb836192a9ca22054485a8e6e6d5fbcf7
Opcode Fuzzy Hash: 90bd1aef0b33854bf0504c11e278b307e5fe548102ad1b4b3b40ed8758058df9
Instruction Fuzzy Hash: 2B011B72A04B8586DB009F56F84405DB7B5FB58F95BA9813ADF8D03B18DF38E4A2C760

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: recdisc.exe PID: 6696 Parent PID: 3292 recdisc.exeCOMMON

Executed Functions

Function 000001DB1BC62252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001DB1BC623B0
VirtualProtect.KERNELBASE ref: 000001DB1BC62471
RtlAvlRemoveNode.NTDLL ref: 000001DB1BC625B4
VirtualProtect.KERNELBASE ref: 000001DB1BC62677

Memory Dump Source

Source File: 0000001B.00000002.390035449.000001DB1BC60000.00000040.00000001.sdmp, Offset: 000001DB1BC60000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 9912d1ac73c1d7d065d49615909e8df1dcac106c2f4716d8072a522b5799ca16
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: A8B13576618BC486D7708B1AF490BDABBA1F7C9B80F11802ADE8957B58DB79C841CF44

Uniqueness

Uniqueness Score: -1.00%

Function 000001DB1BC62057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001DB1BC629A8), ref: 000001DB1BC620A7

Memory Dump Source

Source File: 0000001B.00000002.390035449.000001DB1BC60000.00000040.00000001.sdmp, Offset: 000001DB1BC60000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: d9cc2fc38d6423d758654bbbacc5f686bd0186d5c7a12a3d36c674f8b4e456bc
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 95314B72615B8086D780DF1AF49479A7BA0F389BC4F215026EF8E87B18DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF6C200D96C, Relevance: 23.3, APIs: 10, Strings: 3, Instructions: 577memorycomfileCOMMON

Download Yara Rule

APIs

CoCreateGuid.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200DAF5

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200DC22
CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200DCB9
SysAllocString.OLEAUT32 ref: 00007FF6C200DCFF
SysAllocString.OLEAUT32 ref: 00007FF6C200DE12
SHCreateStreamOnFileEx.SHLWAPI ref: 00007FF6C200E02E
CoTaskMemAlloc.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200E052
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200E0A3
SysFreeString.OLEAUT32 ref: 00007FF6C200E0AD
SysFreeString.OLEAUT32 ref: 00007FF6C200E0B7

Strings

%s{%.8x-%.4x-%.4x-%.2x%.2x-%.2x%.2x%.2x%.2x%.2x%.2x}.iso, xrefs: 00007FF6C200DB4F
CRecoveryDiskCreator::_BuildImageWorker, xrefs: 00007FF6C200D9DB
W, xrefs: 00007FF6C200DA5D

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateString$AllocFree$InstanceTask$FileGuidMessageStreamTrace
String ID: %s{%.8x-%.4x-%.4x-%.2x%.2x-%.2x%.2x%.2x%.2x%.2x%.2x}.iso$CRecoveryDiskCreator::_BuildImageWorker$W
API String ID: 3170175229-1751773481
Opcode ID: 1c20b4961ac13a861927cdb412ff31298b59ca9a163dd4184311cfa0574ad3db
Instruction ID: 423c4a4cb97fb74ec11d46e7d98cedf6228206b4420a82b015c32d95b20ea730
Opcode Fuzzy Hash: 1c20b4961ac13a861927cdb412ff31298b59ca9a163dd4184311cfa0574ad3db
Instruction Fuzzy Hash: 9A520B66B18A968AE704CF6AE45026977A0FB88B4DF114137EE8DD7B64DF7CD441CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C20062CC, Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 180fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6C20063EA
memset.MSVCRT ref: 00007FF6C20063FE
FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C2006440
FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C2006498
FindNextFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C20064E4
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6C20064EE

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

FindClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C2006551
FindClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C200655A

Strings

etl, xrefs: 00007FF6C2006403, 00007FF6C200644A
W, xrefs: 00007FF6C2006384
%s.0.?.%s, xrefs: 00007FF6C2006454
%s.0.%s, xrefs: 00007FF6C200640D
SxGet0XLogFileCount, xrefs: 00007FF6C2006340

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseFirstmemset$ErrorLastMessageNextTrace
String ID: %s.0.%s$%s.0.?.%s$SxGet0XLogFileCount$W$etl
API String ID: 2874308255-70511399
Opcode ID: a94853733c7cba1326c47dcbcfed1dd2468b5d19a2a5fa5a52c62387ef6e0dfa
Instruction ID: d9c5e74e3297e6e39c0f340996993bb1f833f5df89cab4cb0fa47a25dbdf6154
Opcode Fuzzy Hash: a94853733c7cba1326c47dcbcfed1dd2468b5d19a2a5fa5a52c62387ef6e0dfa
Instruction Fuzzy Hash: 67717166B086918AFB208F65E8802A977A1FB4879DF410137EE9DC77A4DF7CD541CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200A050, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 199fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6C200A106
CoCreateGuid.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200A12C
GetLogicalDriveStringsW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C200A159
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C200A196
GetDiskFreeSpaceExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C200A1B2
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6C200A265
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C200A294
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6C200A2AA

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6C200A340

Strings

RdFindTempDrive, xrefs: 00007FF6C200A0C1
%s{%.8x-%.4x-%.4x-%.2x%.2x-%.2x%.2x%.2x%.2x%.2x%.2x}.dat, xrefs: 00007FF6C200A20C

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle$CreateDrive$DiskFileFreeGuidLogicalMessageSpaceStringsTraceTypememset
String ID: %s{%.8x-%.4x-%.4x-%.2x%.2x-%.2x%.2x%.2x%.2x%.2x%.2x}.dat$RdFindTempDrive
API String ID: 3550180382-300051755
Opcode ID: 72ac90cf0c6ded9dc59aa882a623fd9d78351ac9009dc4f6e10a297bad980962
Instruction ID: 735402d80b4e1e2493989070ad59fe7bed9cac521b2c0e1bc5e6be209f8d420c
Opcode Fuzzy Hash: 72ac90cf0c6ded9dc59aa882a623fd9d78351ac9009dc4f6e10a297bad980962
Instruction Fuzzy Hash: 60917C22B086918AF710CF64A4416AE77A4FB447ADF520237EFA9837E4DF78D495CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C20092C4, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 234memorywindowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6C2009325
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6C200935F
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6C20094A5
CoTaskMemAlloc.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C20094E0
iswspace.MSVCRT ref: 00007FF6C200954F
iswspace.MSVCRT ref: 00007FF6C20095A0
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6C20095C6
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C20095D5

Strings

ntdll.dll, xrefs: 00007FF6C2009358
netmsg.dll, xrefs: 00007FF6C2009389

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeTaskiswspace$AllocFormatHandleLibraryMessageModulememset
String ID: netmsg.dll$ntdll.dll
API String ID: 1186426598-2071567507
Opcode ID: fa91be068556c0c5e961110a2beca11109941fa752d2110fb5bd151c7afdadc3
Instruction ID: d9e5c1d281f501bf8e3070ad41d2939e070c1476769e521f3ddd40e06756f7d9
Opcode Fuzzy Hash: fa91be068556c0c5e961110a2beca11109941fa752d2110fb5bd151c7afdadc3
Instruction Fuzzy Hash: B6A1AB32B19A9686FB14CF65D85067D23A5BF98B8EF420136DE8E83794DFBCE4458340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C20115EC, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 139filenativeCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6C201167A
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C20116D5
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6C20117E4

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

memset.MSVCRT ref: 00007FF6C201175C
NtQueryInformationFile.NTDLL ref: 00007FF6C2011778

Part of subcall function 00007FF6C20073DC: RtlNtStatusToDosError.NTDLL ref: 00007FF6C20073EE

NtSetInformationFile.NTDLL ref: 00007FF6C20117B8

Strings

SxSetFileAttributes, xrefs: 00007FF6C2011655
sh.IsValid(), xrefs: 00007FF6C201171D

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Informationmemset$CloseCreateErrorHandleMessageQueryStatusTrace
String ID: SxSetFileAttributes$sh.IsValid()
API String ID: 783909709-3816765370
Opcode ID: ed5210dc624fc64ddb43fa6b3c9ec84c693b0bee40fdd3edff8115f9633ed3f1
Instruction ID: 9da60fb708277e8eef8aedc2b3bb6ac5dbf2d1080bc87c90d779513eeb5403d2
Opcode Fuzzy Hash: ed5210dc624fc64ddb43fa6b3c9ec84c693b0bee40fdd3edff8115f9633ed3f1
Instruction Fuzzy Hash: 87517B22B08A428AF724DFA5D8507AD22B1FB4875DF11013ADE8D93B95DFBCD546C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2011460, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98filenativeCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C2011526
NtQueryInformationFile.NTDLL ref: 00007FF6C201156D

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6C20115AE

Strings

#, xrefs: 00007FF6C2011550
_GetFileAttributesTag, xrefs: 00007FF6C20114BB

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: File$CloseCreateHandleInformationMessageQueryTrace
String ID: #$_GetFileAttributesTag
API String ID: 3634956694-673822615
Opcode ID: 3d30ab8f0b4624ec37ac5b96d1754d4321b65dc7778a93d42261f778c2ff9beb
Instruction ID: 7d61c2a0fb1e5c78b7ae3eca43d6305de52ce4c03b4636b614de4500e40e9de2
Opcode Fuzzy Hash: 3d30ab8f0b4624ec37ac5b96d1754d4321b65dc7778a93d42261f778c2ff9beb
Instruction Fuzzy Hash: 20418D32704B418AE714CF28D4403A877A1FB487ADF414636EA9D87BD9DF78DA50C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C20065A0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80fileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C2006631
DeviceIoControl.API-MS-WIN-CORE-IO-L1-1-0 ref: 00007FF6C200668F

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6C20066C3

Strings

SxCompressLogFile, xrefs: 00007FF6C20065EE

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseControlCreateDeviceFileHandleMessageTrace
String ID: SxCompressLogFile
API String ID: 2663220265-919497057
Opcode ID: d44571be62503be28417dd6b1e3a606ed07ee794ac213518f3bb45ec5fff318a
Instruction ID: c62553de0d59d33a8cffe3a124e53bbcbc0d6d961f09dcd688123213a1b1d2d3
Opcode Fuzzy Hash: d44571be62503be28417dd6b1e3a606ed07ee794ac213518f3bb45ec5fff318a
Instruction Fuzzy Hash: D1314131B046818AF7108FA5D4803AD76A5FB4875DF51023AEE9D83B94DF7CD545C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2003E4C, Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 217registrywindowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6C2003EAF
GetDlgItem.USER32 ref: 00007FF6C2003EC0
SendMessageW.USER32 ref: 00007FF6C2003ED7

Part of subcall function 00007FF6C2004334: GetDlgItem.USER32 ref: 00007FF6C2004372

GetDlgItem.USER32 ref: 00007FF6C2003F10
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6C2003F4F
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6C2003F7F
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6C2003FCD
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6C20041E1

Strings

CMainWnd::OnBurningImageComplete, xrefs: 00007FF6C2003E62
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsBackup, xrefs: 00007FF6C2003F71, 00007FF6C200414A
RecDiscUsageSuppressPrompt, xrefs: 00007FF6C2003F98

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseItem$MessageOpenSendmemset
String ID: CMainWnd::OnBurningImageComplete$RecDiscUsageSuppressPrompt$SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsBackup
API String ID: 2046772566-1243368926
Opcode ID: 0adbc2c6b8d002b8d7398b3d8aeddad4e88765867c575d57c31fc09d53fcba73
Instruction ID: d185542cd144a6864809b0bbdaefb60fafa36048cbabb860a3bb2c71d4bb1073
Opcode Fuzzy Hash: 0adbc2c6b8d002b8d7398b3d8aeddad4e88765867c575d57c31fc09d53fcba73
Instruction Fuzzy Hash: DBA14A32B08BC28AF7508FA5E8803A977A4FB44769F414236DE9DD7B94DFB8D5488704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2007C5C, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6C2007CC0
GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF6C2007D36
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6C2007FA9

Strings

SxGetUserAccessLevelForHandle, xrefs: 00007FF6C2007C8C

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandleInformationTokenmemset
String ID: SxGetUserAccessLevelForHandle
API String ID: 1981903484-454589811
Opcode ID: e6710642178c42920f9173f969efdd628b95d495f84023497a8207c60acd9bb8
Instruction ID: 6667f82e18fc26a2681d48e902f4cb14171dde2858901cd7624c424469f9d5e3
Opcode Fuzzy Hash: e6710642178c42920f9173f969efdd628b95d495f84023497a8207c60acd9bb8
Instruction Fuzzy Hash: CEB12972B187818AF7508FA4D4406AD37A1EB4476EF120236DE9D9BBE4DFB8E445C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2004208, Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6C2004242
EnableWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF6C2003DC8), ref: 00007FF6C200424E
GetDlgItem.USER32 ref: 00007FF6C200425A
SetFocus.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF6C2003DC8), ref: 00007FF6C2004263
GetDlgItem.USER32 ref: 00007FF6C2004270
EnableWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF6C2003DC8), ref: 00007FF6C200427C
GetDlgItem.USER32 ref: 00007FF6C200428B
GetDlgItem.USER32 ref: 00007FF6C200429A
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF6C2003DC8), ref: 00007FF6C20042B1
EnableWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF6C2003DC8), ref: 00007FF6C20042C1
GetDlgItem.USER32 ref: 00007FF6C20042D0
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF6C2003DC8), ref: 00007FF6C20042E5

Part of subcall function 00007FF6C2004334: GetDlgItem.USER32 ref: 00007FF6C2004372

Strings

CMainWnd::SetReadyState, xrefs: 00007FF6C200421A

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$EnableWindow$MessageSend$Focus
String ID: CMainWnd::SetReadyState
API String ID: 1803637510-2683562918
Opcode ID: 44b05fee2445cff0c1e6df99b917b45ff986c15f0f808f70e2d3677fe8726e22
Instruction ID: d5434f24ab68173ffc7387a5fbcf7090bfe200a331340d6e8006f82a2cdd7f8f
Opcode Fuzzy Hash: 44b05fee2445cff0c1e6df99b917b45ff986c15f0f808f70e2d3677fe8726e22
Instruction Fuzzy Hash: E7314F35B0868283E710DF22E85456E6765FF88B8DF418036DE8E87B68DEBCE5858740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2002E2C, Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C20046EC: memset.MSVCRT ref: 00007FF6C2004758
Part of subcall function 00007FF6C20046EC: CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C2004999

#344.COMCTL32 ref: 00007FF6C2003094

Strings

CMainWnd::OnCreateDisc, xrefs: 00007FF6C2002E49
, xrefs: 00007FF6C2003087

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: #344FreeTaskmemset
String ID: $CMainWnd::OnCreateDisc
API String ID: 1321781552-316585318
Opcode ID: 4912388c2da1a53a07b63ab3d9e0cad36429fb084b8a23fc37fe5cd7212f4386
Instruction ID: 0a9fab567bc6f09a084709982bf2e12b58706435fc5d0d4a736eb7e8c2fb94e1
Opcode Fuzzy Hash: 4912388c2da1a53a07b63ab3d9e0cad36429fb084b8a23fc37fe5cd7212f4386
Instruction Fuzzy Hash: 58712A35B147928AFB14CF65E49436D22A0FB48749F11403ADE8ED7BA4DFBDE4458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2003A0C, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6C2003A64
GetDlgItem.USER32 ref: 00007FF6C2003A76
SendMessageW.USER32 ref: 00007FF6C2003A8B
GetDlgItem.USER32 ref: 00007FF6C2003A9A
SendMessageW.USER32 ref: 00007FF6C2003AAF
SendMessageW.USER32 ref: 00007FF6C2003AC3
SendMessageW.USER32 ref: 00007FF6C2003AD7

Part of subcall function 00007FF6C200998C: LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6C20099B3
Part of subcall function 00007FF6C200998C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6C20099C0

_wcsicmp.MSVCRT ref: 00007FF6C2003B16
MessageBoxW.USER32 ref: 00007FF6C2003B56
GetDlgItem.USER32 ref: 00007FF6C2003C3C
SendMessageW.USER32 ref: 00007FF6C2003C51

Strings

CMainWnd::OnBuildingImageComplete, xrefs: 00007FF6C2003A26

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Send$Item$ErrorLastLoadString_wcsicmp
String ID: CMainWnd::OnBuildingImageComplete
API String ID: 350853197-723030664
Opcode ID: 094ac6a3ea69e3a1ddb4cb881c8d07f166837b9b6b5e1be2db436c660e642bb1
Instruction ID: 9ef82e3b6f7a8dc9c78f1aedf80eea6cb4c82cbc19b7bc99f46de2f88b4368f1
Opcode Fuzzy Hash: 094ac6a3ea69e3a1ddb4cb881c8d07f166837b9b6b5e1be2db436c660e642bb1
Instruction Fuzzy Hash: 4B714A32B04A829AFB149F61D4947AA2360FB4474EF41443ADF8D8BB94DFBDE965C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200BDD0, Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 331comCOMMON

Download Yara Rule

APIs

CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200BF4B
CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200BF7D
VariantClear.OLEAUT32 ref: 00007FF6C200C019
CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200C0A2
SysFreeString.OLEAUT32 ref: 00007FF6C200C146

Part of subcall function 00007FF6C200F5D8: CoTaskMemRealloc.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,00007FF6C200C1C8), ref: 00007FF6C200F65E
Part of subcall function 00007FF6C200F5D8: CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,00007FF6C200C1C8), ref: 00007FF6C200F680

CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200C1FE
SysFreeString.OLEAUT32 ref: 00007FF6C200C20B
VariantClear.OLEAUT32 ref: 00007FF6C200C225
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6C200C2CD
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6C200C300

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

Strings

CRecoveryDiskCreator::_EnumerateRecordersWorker, xrefs: 00007FF6C200BE29

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Free$CreateInstanceTask$ClearCriticalSectionStringVariant$EnterLeaveMessageReallocTrace
String ID: CRecoveryDiskCreator::_EnumerateRecordersWorker
API String ID: 4212135896-2161428994
Opcode ID: 168326aae5767bad63f0beafc8a9e0416e79460ee3808f1180f1ce6075cc7c4d
Instruction ID: 6ba80116ceef14ab144867ef9afab1a1eefb69b50933427f3194a85811b5d3e1
Opcode Fuzzy Hash: 168326aae5767bad63f0beafc8a9e0416e79460ee3808f1180f1ce6075cc7c4d
Instruction Fuzzy Hash: E5F10826B04B868AFB10CFA9D8406AD33B2FB58B4DB424436DE8D97B64DFB8D554C344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2001420, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 148fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C20014CB
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C20014F5
ConvertStringSecurityDescriptorToSecurityDescriptorW.API-MS-WIN-SECURITY-SDDL-L1-1-0 ref: 00007FF6C200157C
CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C20015BD
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6C20015C7
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF6C2001650

Strings

dwErr, xrefs: 00007FF6C200161E
::DeleteFile( strTracingDirectory ), xrefs: 00007FF6C200153D
%SystemRoot%\Logs\RecoveryDisc, xrefs: 00007FF6C200149C
GetAndEnsureTracingDirectory, xrefs: 00007FF6C200143E
O:BAG:BAD:P(A;OICI;GA;;;BA)(A;OICI;GA;;;SY), xrefs: 00007FF6C2001571

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: DescriptorFileSecurity$AttributesConvertCreateDeleteDirectoryErrorFreeLastLocalString
String ID: %SystemRoot%\Logs\RecoveryDisc$::DeleteFile( strTracingDirectory )$GetAndEnsureTracingDirectory$O:BAG:BAD:P(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)$dwErr
API String ID: 1878476082-1225089910
Opcode ID: dd68092aafd48837d85fa3c4640720c27c94aace0ef9591502a8c19a8fdc120b
Instruction ID: 854833655d380829c37856998dcc1eb5f3c71887c1306806f8d6db0d4e8d1388
Opcode Fuzzy Hash: dd68092aafd48837d85fa3c4640720c27c94aace0ef9591502a8c19a8fdc120b
Instruction Fuzzy Hash: E2615A76B04A828AFB108F68D4406AC73A4EB4474EF464437EE8EC7B95EFB8E555C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C20053E4, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 64serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6C2001278), ref: 00007FF6C200542D
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6C2001278), ref: 00007FF6C200543B
OpenServiceW.API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6C2001278), ref: 00007FF6C2005455
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6C2001278), ref: 00007FF6C2005463
CloseServiceHandle.API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6C2001278), ref: 00007FF6C20054A5

Strings

rpcss, xrefs: 00007FF6C200544B
ServicesActive, xrefs: 00007FF6C2005418

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastOpenService$CloseHandleManager
String ID: ServicesActive$rpcss
API String ID: 48634454-3137198264
Opcode ID: 23e36dddc023bdcd8721532af856e4f7d9bf95c08e0042d673cbf33393a44413
Instruction ID: 9b3d62d219f3b9b483ccee458372d717cb6cab8e3ee5103d36cb18691b04ba71
Opcode Fuzzy Hash: 23e36dddc023bdcd8721532af856e4f7d9bf95c08e0042d673cbf33393a44413
Instruction Fuzzy Hash: 92217F36B18B4286F7509F21A44456937A5FB88B8EF5A403ADE8E83750DFBCE5868700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200E2E8, Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 241comCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6C200E39F
SysFreeString.OLEAUT32 ref: 00007FF6C200E3D3
VariantClear.OLEAUT32 ref: 00007FF6C200E3ED
CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200E4CA
VariantClear.OLEAUT32 ref: 00007FF6C200E560
CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200E5F2

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

SysFreeString.OLEAUT32 ref: 00007FF6C200E655
_wcsicmp.MSVCRT ref: 00007FF6C200E693

Strings

CRecoveryDiskCreator::_FindRecorder, xrefs: 00007FF6C200E355

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: ClearCreateFreeInstanceStringVariant$MessageTrace_wcsicmpmemset
String ID: CRecoveryDiskCreator::_FindRecorder
API String ID: 1290773211-3709551844
Opcode ID: 7482b01b74d5759504f14f1d4d835f9e4de78ae6b2a93a9898f9c84d1ddcca90
Instruction ID: d530fa04ee1ae91f288fcce7b369bade7a0ec922738558a39db405eaed96d1ab
Opcode Fuzzy Hash: 7482b01b74d5759504f14f1d4d835f9e4de78ae6b2a93a9898f9c84d1ddcca90
Instruction Fuzzy Hash: 04B10926B19B8686FB10CF65E48426977B0FB88B49F111136EE8D97B64DF7DD844CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C20083F8, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 175COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6C200849D
memset.MSVCRT ref: 00007FF6C20084AE

Part of subcall function 00007FF6C2001020: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C2001073

GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C200855D
GetVolumeNameForVolumeMountPointW.API-MS-WIN-CORE-FILE-L1-2-0 ref: 00007FF6C20085E4
GetVolumeNameForVolumeMountPointW.API-MS-WIN-CORE-FILE-L1-2-0 ref: 00007FF6C200865D

Strings

::GetVolumePathName( strPath, STRING_CCH_PARAM( wszRootPath ) ), xrefs: 00007FF6C200859D
::GetVolumeNameForVolumeMountPoint( wszVolume, pwszUnique, cchUnique ), xrefs: 00007FF6C20086A1
::GetVolumeNameForVolumeMountPoint( wszRootPath, STRING_CCH_PARAM( wszVolume ) ), xrefs: 00007FF6C200862D
SxGetUniqueVolumeForPath, xrefs: 00007FF6C2008466

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Volume$Name$MountPointmemset$MessagePathTrace
String ID: ::GetVolumeNameForVolumeMountPoint( wszRootPath, STRING_CCH_PARAM( wszVolume ) )$::GetVolumeNameForVolumeMountPoint( wszVolume, pwszUnique, cchUnique )$::GetVolumePathName( strPath, STRING_CCH_PARAM( wszRootPath ) )$SxGetUniqueVolumeForPath
API String ID: 815328395-2794229056
Opcode ID: 9ceaae255dec59affb4ded67644989fa1c57347005de3b8a49c143ca65a7d782
Instruction ID: 33e8fd90785e9e5deb67e8b7db3bbb575c6d13811c740063b23dfc9988fd8bc5
Opcode Fuzzy Hash: 9ceaae255dec59affb4ded67644989fa1c57347005de3b8a49c143ca65a7d782
Instruction Fuzzy Hash: 2E813F22B286818AF750CF55E4907AA66A0FB8874DF411037EE8EC77A5DFBCD545CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2003C8C, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 106windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C2004334: GetDlgItem.USER32 ref: 00007FF6C2004372

GetDlgItem.USER32 ref: 00007FF6C2003D0A
EnableWindow.USER32 ref: 00007FF6C2003D18
GetDlgItem.USER32 ref: 00007FF6C2003D48
GetDlgItem.USER32 ref: 00007FF6C2003D7F
SendMessageW.USER32 ref: 00007FF6C2003D93
GetDlgItem.USER32 ref: 00007FF6C2003DA6
SendMessageW.USER32 ref: 00007FF6C2003DBA
#344.COMCTL32 ref: 00007FF6C2003E39

Strings

CMainWnd::OnEnumDevicesComplete, xrefs: 00007FF6C2003C9F

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$MessageSend$#344EnableWindow
String ID: CMainWnd::OnEnumDevicesComplete
API String ID: 3720442498-3534488746
Opcode ID: 5779323c6c8e3d734990075a65c4944ccc0b945e1339991aa83203aff1fad4b1
Instruction ID: 3b3a3c454bc7ba710f3bedc88846ea2642f3ef71f3b81e6a0c729307e36886fb
Opcode Fuzzy Hash: 5779323c6c8e3d734990075a65c4944ccc0b945e1339991aa83203aff1fad4b1
Instruction Fuzzy Hash: 17416926B046928AF710DF65D8947AD2660FB48B4DF01403AEE8EC7B99DFBCD4458740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2006DF4, Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 170COMMON

Download Yara Rule

APIs

StartTraceW.API-MS-WIN-EVENTING-CONTROLLER-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6C200182C), ref: 00007FF6C2006FB7

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C2007003

Strings

etl, xrefs: 00007FF6C2006F0A, 00007FF6C2007048, 00007FF6C2007076
BuiltInRecoveryDiscTracing, xrefs: 00007FF6C2006FAD
%s.0.%s, xrefs: 00007FF6C2006F14
%s.0.%d.%s, xrefs: 00007FF6C2007052
SxStartTracing, xrefs: 00007FF6C2006E51
%s.0.1.%s, xrefs: 00007FF6C2007080

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Trace$FreeMessageStartTask
String ID: %s.0.%d.%s$%s.0.%s$%s.0.1.%s$BuiltInRecoveryDiscTracing$SxStartTracing$etl
API String ID: 1477059575-1917877428
Opcode ID: a24caf2a65c537bdb2dae4e53b9a10d9494dee96f1deb65d8b24ea6885ed08f9
Instruction ID: 55f90fa05dcd5cb34b55a5737890010fe1aae37147d5944920274fea154782e0
Opcode Fuzzy Hash: a24caf2a65c537bdb2dae4e53b9a10d9494dee96f1deb65d8b24ea6885ed08f9
Instruction Fuzzy Hash: BD713B72B046928AF740DFA5E4803A93B61EB0475DF11113AEE4ED7BA8DFB9D945C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2001688, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 166registryCOMMON

Download Yara Rule

APIs

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6C200173A
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6C2001765

Part of subcall function 00007FF6C200722C: CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C2007311

Part of subcall function 00007FF6C2001420: GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C20014CB
Part of subcall function 00007FF6C2001420: DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C20014F5
Part of subcall function 00007FF6C2001420: LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF6C2001650

Part of subcall function 00007FF6C2006DF4: CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C2007003

Part of subcall function 00007FF6C200715C: EnableTraceEx2.API-MS-WIN-EVENTING-CONTROLLER-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF,?,1E0000ED), ref: 00007FF6C20071E7

CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C20018D2
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6C20018F2

Part of subcall function 00007FF6C20066EC: CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C20067FA

Strings

RecoveryDiscTracingFlags, xrefs: 00007FF6C200177A
RecoveryDisc, xrefs: 00007FF6C20017CF
Software\Microsoft\Windows\CurrentVersion\RecoveryDiscCreator, xrefs: 00007FF6C2001757
StartTracing, xrefs: 00007FF6C200169E

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Free$Task$CloseFile$AttributesDeleteEnableLocalOpenTrace
String ID: RecoveryDisc$RecoveryDiscTracingFlags$Software\Microsoft\Windows\CurrentVersion\RecoveryDiscCreator$StartTracing
API String ID: 1954996398-1460735053
Opcode ID: cfd5b3538bef89d470195396798ad40ab20a855e2d81e4c288d81e0da451f6fe
Instruction ID: 287d14f949761da3558315e66a0054ab7e9f439acd4a027eb0730fe2709c2f87
Opcode Fuzzy Hash: cfd5b3538bef89d470195396798ad40ab20a855e2d81e4c288d81e0da451f6fe
Instruction Fuzzy Hash: AD813732F18A869AF7109FB8D4407EC67B1EB0435DF414236DE5D96B99EEB8E244C384

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2006B68, Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 158fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C2006C9A
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6C2006CA5
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C2006D05
MoveFileExW.API-MS-WIN-CORE-FILE-L2-1-0 ref: 00007FF6C2006D57
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6C2006D61

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

Strings

%s.%d.%s, xrefs: 00007FF6C2006C70, 00007FF6C2006CD5, 00007FF6C2006D24
etl, xrefs: 00007FF6C2006C5E, 00007FF6C2006D11
SxRotateLogs, xrefs: 00007FF6C2006BC5

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: File$ErrorLast$AttributesDeleteMessageMoveTrace
String ID: %s.%d.%s$SxRotateLogs$etl
API String ID: 256827172-2650887704
Opcode ID: a08546561fdccfd089f67cf22017c238da7094b5f3034e28a420f62d2c7831da
Instruction ID: 9d757abb1aaf48c0b54181a297078e6c239e18a1d897c76b68526f598082638f
Opcode Fuzzy Hash: a08546561fdccfd089f67cf22017c238da7094b5f3034e28a420f62d2c7831da
Instruction Fuzzy Hash: 0D713B72B04A8299F710DF65D8406A823A5FB0479DF414537DE8DD7BA5EFB8E645C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200B558, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 137libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6C200B6B0
LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6C200B6C1
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6C200B6CC
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6C200B6D7

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6C200B721

Strings

sources\spwizres.dll, xrefs: 00007FF6C200B684
sources\boot.wim, xrefs: 00007FF6C200B61C
CRecoveryDiskCreator::VerifyInstallationMedia, xrefs: 00007FF6C200B5B7

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Error$LibraryMode$FreeLastLoadMessageTrace
String ID: CRecoveryDiskCreator::VerifyInstallationMedia$sources\boot.wim$sources\spwizres.dll
API String ID: 1331554232-553822860
Opcode ID: b5f49de6c3a5a2f787b58643e8626ed84b931fb7e8be06e7b799709d20d9f143
Instruction ID: 361ee86cb433b1979e92b48f006f67729dcf92b1ee4b8a06ddd7ba760ef95ed4
Opcode Fuzzy Hash: b5f49de6c3a5a2f787b58643e8626ed84b931fb7e8be06e7b799709d20d9f143
Instruction Fuzzy Hash: B3511A26F04B928AF714CFA5E8542AC23B5BB04B4DF52013ADE8D97B94DFB8E845C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200D54C, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 282fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6C200D5F3
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C200D90B

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C200D86D
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6C200D8A5
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6C200D92A

Strings

CRecoveryDiskCreator::_AddAllFiles, xrefs: 00007FF6C200D5B1
winre_server.dat, xrefs: 00007FF6C200D812

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFileHandle$CreateDeleteMessageTracememset
String ID: CRecoveryDiskCreator::_AddAllFiles$winre_server.dat
API String ID: 2049824008-1457360413
Opcode ID: 31a05b46dabacd72d153346b2930e785105fc2d3f2405bbef35fd66dd76f6486
Instruction ID: 1c6cda058017ba715c75d627d62fbf5a5cb9c8452d8afaaab14826e3922c9739
Opcode Fuzzy Hash: 31a05b46dabacd72d153346b2930e785105fc2d3f2405bbef35fd66dd76f6486
Instruction Fuzzy Hash: ECC12926B187828AF710DFA9D4143AD27B1EB4476DF020136DE9DDBB98EEB8E505C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2008180, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

CoTaskMemRealloc.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00007FF6C200225C), ref: 00007FF6C200825B
GetVolumePathNamesForVolumeNameW.API-MS-WIN-CORE-FILE-L1-2-0(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00007FF6C200225C), ref: 00007FF6C2008283
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00007FF6C200225C), ref: 00007FF6C2008291

Part of subcall function 00007FF6C2007FE8: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C2008073

CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C20083C3

Strings

dwErr, xrefs: 00007FF6C20082F2
SxGetPresentableVolumeName, xrefs: 00007FF6C20081E2
W, xrefs: 00007FF6C200820A

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: TaskVolume$ErrorFreeLastMessageNameNamesPathReallocTrace
String ID: SxGetPresentableVolumeName$W$dwErr
API String ID: 194766475-2788423482
Opcode ID: 910be897b79805d783f067149d6bb5d072b1ddb6f8258a39c45530e9a668efe2
Instruction ID: 30502ac91d527c4936eada23cb49c3eb78eeef114fa5b20096fdb11208c8b9f8
Opcode Fuzzy Hash: 910be897b79805d783f067149d6bb5d072b1ddb6f8258a39c45530e9a668efe2
Instruction Fuzzy Hash: C9618E22B087928AF754CF61D8806AD3264FB4879DF11513AEE9E977A4DFB8D842C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C20033F0, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 146windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32 ref: 00007FF6C2003455
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C2002921), ref: 00007FF6C2003470
GetDlgItem.USER32 ref: 00007FF6C20034F2
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C2002921), ref: 00007FF6C2003509
GetDlgItem.USER32 ref: 00007FF6C2003518
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C2002921), ref: 00007FF6C200352D

Strings

CMainWnd::OnTaskComplete, xrefs: 00007FF6C2003407

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Item$ActiveLastPopup
String ID: CMainWnd::OnTaskComplete
API String ID: 258380207-3980599414
Opcode ID: 2773566ab403d19a4fe069b4f1da378ac34a45f2861db4fb564956bcb0809703
Instruction ID: d0146a4b68a7a4dde40c41704c8766c11587623c160641ac1cd1f6a8d3486fe4
Opcode Fuzzy Hash: 2773566ab403d19a4fe069b4f1da378ac34a45f2861db4fb564956bcb0809703
Instruction Fuzzy Hash: 65514021F0869386F7569F6AD89077D22A0AF4474EF16013BDE8ECB795DFACE8418700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C20075D0, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 131memorylibraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,?,?,?,00000000,00000001,00000000,?,?,00007FF6C2009443), ref: 00007FF6C2007618
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,00000000,00000001,00000000,?,?,00007FF6C2009443), ref: 00007FF6C2007669
GetSystemDirectoryW.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,?,?,?,00000000,00000001,00000000,?,?,00007FF6C2009443), ref: 00007FF6C2007691
LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,00000000,00000001,00000000,?,?,00007FF6C2009443), ref: 00007FF6C2007736
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000,00000001,00000000,?,?,00007FF6C2009443), ref: 00007FF6C2007777

Part of subcall function 00007FF6C2007548: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00007FF6C20059DE,?,?,?,00007FF6C200760E), ref: 00007FF6C2007557
Part of subcall function 00007FF6C2007548: RtlGetLastNtStatus.NTDLL ref: 00007FF6C200755F

LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,00000000,00000001,00000000,?,?,00007FF6C2009443), ref: 00007FF6C2007767

Strings

SxLoadSystem32LibraryEx, xrefs: 00007FF6C20075F2

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Last$DirectoryErrorLocalSystem$AllocFreeLibraryLoadStatus
String ID: SxLoadSystem32LibraryEx
API String ID: 2340862698-1433201278
Opcode ID: 8d4bce87636784af6b4ac2d612c8c4fbba8ed5afbf9883f137274a7fb35869cb
Instruction ID: f8e875cc770efc9a095d26231144880cbddb6dfbb11bbb31433326976f14303b
Opcode Fuzzy Hash: 8d4bce87636784af6b4ac2d612c8c4fbba8ed5afbf9883f137274a7fb35869cb
Instruction Fuzzy Hash: A951A125F086929AF714DFA598001AD2AB5FF0478EF11413ADE5ED77A4EFBCE8418B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2008980, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6C20089DC
SHParseDisplayName.SHELL32 ref: 00007FF6C2008A2B
SHGetDesktopFolder.SHELL32 ref: 00007FF6C2008A48
StrRetToBufW.SHLWAPI ref: 00007FF6C2008AAC
ILFree.SHELL32 ref: 00007FF6C2008ACF

Strings

W, xrefs: 00007FF6C20089EB
SxGetDisplayNameOf, xrefs: 00007FF6C20089A4

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: DesktopDisplayFolderFreeNameParsememset
String ID: SxGetDisplayNameOf$W
API String ID: 1460904011-3584366358
Opcode ID: e525cb66666e6dbf26b23b0cc8c681e045d711fa77ec61c71127b095bbda1fda
Instruction ID: 7739f505b304c110cc429e1407fa0c72bd24660ba1082c265df44869d79b3cca
Opcode Fuzzy Hash: e525cb66666e6dbf26b23b0cc8c681e045d711fa77ec61c71127b095bbda1fda
Instruction Fuzzy Hash: BD413D36B28A8186E750CF25E48476A6760FB88789F055036EF8EC7B69DFBCD544CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2003794, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6C20037D7
GetDlgItem.USER32 ref: 00007FF6C20037E7
SendMessageW.USER32 ref: 00007FF6C20037FC
GetDlgItem.USER32 ref: 00007FF6C2003808
SendMessageW.USER32 ref: 00007FF6C200381D
#345.COMCTL32 ref: 00007FF6C2003860

Strings

CMainWnd::OnNonBlankMediaDetected, xrefs: 00007FF6C20037AE

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemMessageSend$#345memset
String ID: CMainWnd::OnNonBlankMediaDetected
API String ID: 2877658923-2912023204
Opcode ID: bb4b5f07037027f3fb3b19056fac7cb0046edcaabda40db69c5d73c75d39c6b9
Instruction ID: 3b139569c6b9a754b58139b39cf9a7de1b8ed6e8296a6502973b56e47abf9cc3
Opcode Fuzzy Hash: bb4b5f07037027f3fb3b19056fac7cb0046edcaabda40db69c5d73c75d39c6b9
Instruction Fuzzy Hash: 5C312936B08A429AF720DF61E4447AA67A1FB8874DF41413ADE8D83B98DEBCD5498704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2002D60, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6C2002D98
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6C2002A0A), ref: 00007FF6C2002DB1
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6C2002A0A), ref: 00007FF6C2002DCC
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6C2002A0A), ref: 00007FF6C2002DD5
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6C2002A0A), ref: 00007FF6C2002DE9
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6C2002A0A), ref: 00007FF6C2002DFF

Strings

CMainWnd::OnDestroy, xrefs: 00007FF6C2002D72

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$FreeItemTask
String ID: CMainWnd::OnDestroy
API String ID: 1165796942-434572
Opcode ID: df69931d05efae3bf6daf7d6c10c1160ef1053f7432ec336970427d046e71724
Instruction ID: 8837cdf609943ed8119432c06bcb65c7daa266889805af4248190ae56354df64
Opcode Fuzzy Hash: df69931d05efae3bf6daf7d6c10c1160ef1053f7432ec336970427d046e71724
Instruction Fuzzy Hash: DF113031B0859282FB149F61F894A6A6661FBC8BCEF424036DE8D8BF55DE6CD9468700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C20051BC, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6C20051F3
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF6C2005050), ref: 00007FF6C200520C
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF6C2005050), ref: 00007FF6C2005227
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF6C2005050), ref: 00007FF6C2005230
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF6C2005050), ref: 00007FF6C2005244
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF6C2005050), ref: 00007FF6C200525A

Strings

CSourceWnd::OnDestroy, xrefs: 00007FF6C20051CE

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$FreeItemTask
String ID: CSourceWnd::OnDestroy
API String ID: 1165796942-2719471359
Opcode ID: f5035174234a10fcc9e0779bcfb397d399b722204a67f56ba517a6a8f431bf5d
Instruction ID: 06fedd47163ca88fb36c421d8c87c625cc8f10d3fdc351407fe1ec64eb0b4851
Opcode Fuzzy Hash: f5035174234a10fcc9e0779bcfb397d399b722204a67f56ba517a6a8f431bf5d
Instruction Fuzzy Hash: A4113031B0899282FB109F61F994A6A2A61FBC9FCDF414036DE8D8BF55DE6CD5468700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C20119CC, Relevance: 12.1, APIs: 8, Instructions: 128sleepCOMMON

Download Yara Rule

APIs

GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6C20119D1
_amsg_exit.MSVCRT ref: 00007FF6C2011A0C
Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF6C2011A18
_initterm.MSVCRT ref: 00007FF6C2011AA6
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6C2011AD3
exit.MSVCRT ref: 00007FF6C2011B64
_cexit.MSVCRT ref: 00007FF6C2011B73
_ismbblead.MSVCRT ref: 00007FF6C2011B96

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_cexit_initterm_ismbbleadexit
String ID:
API String ID: 3033372379-0
Opcode ID: bb6e3b0140eb1f9f0e7e81991a5fc721ebdddac2ad30b1373aa19b30c4b41c69
Instruction ID: 5afe004d463be316829b27e47986e52c67193d1c13db138252d57621f2efeb15
Opcode Fuzzy Hash: bb6e3b0140eb1f9f0e7e81991a5fc721ebdddac2ad30b1373aa19b30c4b41c69
Instruction Fuzzy Hash: 05512761B0C64686E7648F19E85437967A1BB4475EF960037DDCEC37E2DFBCE8848600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200CC9C, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00007FF6C200CD47
SysFreeString.OLEAUT32 ref: 00007FF6C200CD66
SysAllocStringLen.OLEAUT32 ref: 00007FF6C200CD78
wcschr.MSVCRT ref: 00007FF6C200CDCA

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

SysFreeString.OLEAUT32 ref: 00007FF6C200CDF3

Strings

CRecoveryDiskCreator::_AddDirectory, xrefs: 00007FF6C200CCF8

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Freewcschr$AllocMessageTrace
String ID: CRecoveryDiskCreator::_AddDirectory
API String ID: 690185092-635239506
Opcode ID: dd80bd45e2d08657ab3874f26086279e2db06c0ea5c7874721d67f907970a4e3
Instruction ID: 7856e4c2ebe6c5005b0ceac3961e2894b8b88f6f84a3d64c415566f0d0f3c18c
Opcode Fuzzy Hash: dd80bd45e2d08657ab3874f26086279e2db06c0ea5c7874721d67f907970a4e3
Instruction Fuzzy Hash: ED415B22B0479286FB14CF61D8402A92664FF48B8EF16403BDE4E977A4DFBDE842C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2005078, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6C20050C6

Part of subcall function 00007FF6C200998C: LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6C20099B3
Part of subcall function 00007FF6C200998C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6C20099C0

SetWindowTextW.USER32 ref: 00007FF6C2005104

Part of subcall function 00007FF6C200231C: memset.MSVCRT ref: 00007FF6C20023AA
Part of subcall function 00007FF6C200231C: memset.MSVCRT ref: 00007FF6C20023B9
Part of subcall function 00007FF6C200231C: IsWindow.USER32 ref: 00007FF6C20023C1
Part of subcall function 00007FF6C200231C: DestroyIcon.USER32 ref: 00007FF6C2002611
Part of subcall function 00007FF6C200231C: ImageList_Destroy.COMCTL32 ref: 00007FF6C2002624

SendMessageW.USER32 ref: 00007FF6C200515F
EndDialog.USER32 ref: 00007FF6C2005171
SendMessageW.USER32 ref: 00007FF6C2005187

Strings

CSourceWnd::OnInitDialog, xrefs: 00007FF6C2005092

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: DestroyMessageSendWindowmemset$DialogErrorIconImageItemLastList_LoadStringText
String ID: CSourceWnd::OnInitDialog
API String ID: 179090782-923331898
Opcode ID: 33e8e80be795c6ecc1130cf4a1067e2352e34172d3e4d2b53f1c988857ea7d2d
Instruction ID: dbdb8051145f065318b7b660bc6d4b01e174bcf16278e21ed3f255ff704f260f
Opcode Fuzzy Hash: 33e8e80be795c6ecc1130cf4a1067e2352e34172d3e4d2b53f1c988857ea7d2d
Instruction Fuzzy Hash: 88315A26B046928AF710CFA5D8907AD2770FB4878DF51403ADE8D97B59DFB8D8118740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C20038C0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6C2003918
SendMessageW.USER32 ref: 00007FF6C200392D
GetDlgItem.USER32 ref: 00007FF6C2003939
SendMessageW.USER32 ref: 00007FF6C200394E

Part of subcall function 00007FF6C200998C: LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6C20099B3
Part of subcall function 00007FF6C200998C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6C20099C0

MessageBoxW.USER32 ref: 00007FF6C20039BA

Strings

CMainWnd::OnUnsupportedMediaDetected, xrefs: 00007FF6C20038D8

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$ItemSend$ErrorLastLoadString
String ID: CMainWnd::OnUnsupportedMediaDetected
API String ID: 1288618192-2190019715
Opcode ID: e966aea68e73c7e233439e0687563774a748caa3147650888b1d5fbb46a9c9e1
Instruction ID: ac87ea50418664bd1a4f6c65056e478a63b472d951bf370b67280e5f428aa4ab
Opcode Fuzzy Hash: e966aea68e73c7e233439e0687563774a748caa3147650888b1d5fbb46a9c9e1
Instruction Fuzzy Hash: AF315822F04A528AF700DFA1D8947AD2371BB4874DF41403ADE8D97B99EFB8E8498740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2004490, Relevance: 10.5, APIs: 7, Instructions: 43windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6C20044A5
GetWindowLongPtrW.USER32 ref: 00007FF6C20044BC
SetWindowLongPtrW.USER32 ref: 00007FF6C20044CE
SendMessageW.USER32(?,?,?,00007FF6C2003CF1), ref: 00007FF6C20044E4
SendMessageW.USER32(?,?,?,00007FF6C2003CF1), ref: 00007FF6C20044F7
GetWindowLongPtrW.USER32 ref: 00007FF6C2004507
SetWindowLongPtrW.USER32 ref: 00007FF6C2004519

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: LongWindow$MessageSend$Item
String ID:
API String ID: 1628110938-0
Opcode ID: c574fc7a049b3accf713bc38738139b28681a069fb41ed2a5526d369553245b0
Instruction ID: b67ccd4a9e3f801c4315733a81e5c3c5c756d04ddb74372d215346d0e82c81e7
Opcode Fuzzy Hash: c574fc7a049b3accf713bc38738139b28681a069fb41ed2a5526d369553245b0
Instruction Fuzzy Hash: 8C01B915B0474243E7149F76A99452A2261EF88BEEB514235DE6E83FD5CE7CD8458300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200C658, Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 403commemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

SysAllocString.OLEAUT32 ref: 00007FF6C200C758
SHCreateStreamOnFileW.SHLWAPI ref: 00007FF6C200C849
CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200C894
SysFreeString.OLEAUT32 ref: 00007FF6C200CC04

Strings

CRecoveryDiskCreator::_WriteWorker, xrefs: 00007FF6C200C6B1

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateString$AllocFileFreeInstanceMessageStreamTrace
String ID: CRecoveryDiskCreator::_WriteWorker
API String ID: 906049158-2071204749
Opcode ID: 6d3a84af336c1c42a41d34d96331157013837015b62699f4726ac7671bfee890
Instruction ID: 1b7abbf51678c3545782556940c31e248a8cced1f01e55e869428708359ad413
Opcode Fuzzy Hash: 6d3a84af336c1c42a41d34d96331157013837015b62699f4726ac7671bfee890
Instruction Fuzzy Hash: 1502FA66B04B868AFB60CFAAD4506AD27B1EF4478DB11003BDE4DD7B64DEB8E412D344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2011EC0, Relevance: 9.0, APIs: 6, Instructions: 50timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF6C2011EF1
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6C2011EFF
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6C2011F0B
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF6C2011F17
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF6C2011F27
QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0 ref: 00007FF6C2011F42

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 6afea252aaaf28d78e81b491a594ed5670a3c83851c07a77273ca867d199cb4c
Instruction ID: e5b1249adc6109fcb632bdb826935f61353b8ef2c8aeaca3f13db06a689d69d6
Opcode Fuzzy Hash: 6afea252aaaf28d78e81b491a594ed5670a3c83851c07a77273ca867d199cb4c
Instruction Fuzzy Hash: 71111D22704B418AEB00DF75E84506933E4FB4875DB411A36EEAE83B54EFBCD5E58340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200D064, Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 221fileCOMMON

Download Yara Rule

APIs

SHCreateStreamOnFileW.SHLWAPI ref: 00007FF6C200D181

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

CoCreateGuid.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200D1EF
SHCreateStreamOnFileEx.SHLWAPI ref: 00007FF6C200D2B3

Strings

CRecoveryDiskCreator::_FindOrMakeFile, xrefs: 00007FF6C200D0C9
%s{%.8x-%.4x-%.4x-%.2x%.2x-%.2x%.2x%.2x%.2x%.2x%.2x}.dat, xrefs: 00007FF6C200D248

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Create$FileStream$GuidMessageTrace
String ID: %s{%.8x-%.4x-%.4x-%.2x%.2x-%.2x%.2x%.2x%.2x%.2x%.2x}.dat$CRecoveryDiskCreator::_FindOrMakeFile
API String ID: 1007484809-3325412388
Opcode ID: 6302e4568ac1d42ff03c4498e0b032d61946c2680404c0f851df55de868cca3b
Instruction ID: f3346a4363f71f00a26d24302ccb3d281e0ebe1f7ff67850ea737c052b37533e
Opcode Fuzzy Hash: 6302e4568ac1d42ff03c4498e0b032d61946c2680404c0f851df55de868cca3b
Instruction Fuzzy Hash: CAA13766B08B818AF7608FA5D4406AD37B1FB4878DF12403AEE8CD7B58EE78D456C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200E6EC, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6C200E77C
WinReGetConfig.REAGENT ref: 00007FF6C200E7CA

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

Part of subcall function 00007FF6C2009D24: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C2009EDC

Strings

winre.wim, xrefs: 00007FF6C200E8CF
CRecoveryDiskCreator::_GetNativeWimName, xrefs: 00007FF6C200E757
WinReGetConfig ( (LPWSTR)wszOfflineSystemRoot, &winreConfig), xrefs: 00007FF6C200E80A

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageTrace$Configmemset
String ID: CRecoveryDiskCreator::_GetNativeWimName$WinReGetConfig ( (LPWSTR)wszOfflineSystemRoot, &winreConfig)$winre.wim
API String ID: 2515146432-1156561181
Opcode ID: 0b6b5caa3235c00b65832f04e718a9bac893e552dc020236dabe3ce6098c40ed
Instruction ID: af35c59f58d40543e5b913063365e3ef6aeeb364ec7da4c349c927a7978086a5
Opcode Fuzzy Hash: 0b6b5caa3235c00b65832f04e718a9bac893e552dc020236dabe3ce6098c40ed
Instruction Fuzzy Hash: A1515D72B086C28AE721CF69E8402A973A1FB4874DF610536EE8C97B69DF7CD541CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200AE7C, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 134threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6C200AF37
CreateThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6C200AFCB
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6C200B039
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6C200B04F

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

Strings

CRecoveryDiskAsync::Start, xrefs: 00007FF6C200AEDE

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$CloseCreateEnterHandleLeaveMessageThreadTrace
String ID: CRecoveryDiskAsync::Start
API String ID: 3209573955-1955561346
Opcode ID: f1cb38f796a062bf688043eadeccb18fc71eba09b234a653192dbab83dd588d2
Instruction ID: 07b7f585df9664be6a711db6103b0406b716f8a227bb67c3087e2b19715d891a
Opcode Fuzzy Hash: f1cb38f796a062bf688043eadeccb18fc71eba09b234a653192dbab83dd588d2
Instruction Fuzzy Hash: 78514932B04B828AEB14CF65D84066C33A4FB44B9EB15413BDE9D87BA8DF78D842C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200BBEC, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6C200BCAB
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6C200BD62

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

CoTaskMemAlloc.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200BCD7
memset.MSVCRT ref: 00007FF6C200BD0B

Strings

CRecoveryDiskCreator::GetCDDrives, xrefs: 00007FF6C200BC43

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$AllocEnterLeaveMessageTaskTracememset
String ID: CRecoveryDiskCreator::GetCDDrives
API String ID: 1485420771-2353700715
Opcode ID: 0b6ec9edcfb4dfacc047727564cabc537bcb1c9e67084ba3ccfd6e6d353c65c3
Instruction ID: f4a9852db343973c1622d452f1839e8de6917efedbf61f3401b18db3806bb9f0
Opcode Fuzzy Hash: 0b6ec9edcfb4dfacc047727564cabc537bcb1c9e67084ba3ccfd6e6d353c65c3
Instruction Fuzzy Hash: B8415922B046929AFB11CF65D8507B82664FF4479DF11403AEE8EA7B64DFBCD842C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200BA40, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6C2003D2F), ref: 00007FF6C200BAFF
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6C200BBB3

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

CoTaskMemAlloc.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6C2003D2F), ref: 00007FF6C200BB28
memset.MSVCRT ref: 00007FF6C200BB5C

Strings

CRecoveryDiskCreator::GetRecorders, xrefs: 00007FF6C200BA97

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$AllocEnterLeaveMessageTaskTracememset
String ID: CRecoveryDiskCreator::GetRecorders
API String ID: 1485420771-250353455
Opcode ID: 698975f73d0ad543b555559eaa4f6019cf2237c2a63115329ca4aea834302c5d
Instruction ID: e59d05a571f4a5f81c4c7aa8efd1fdba1f4279f61c0d141bfb67d688b5bb82d2
Opcode Fuzzy Hash: 698975f73d0ad543b555559eaa4f6019cf2237c2a63115329ca4aea834302c5d
Instruction Fuzzy Hash: B5413822B046929AFB11CF65D8407A82774FF4479DF11403AEE8DA7769DFBDD8428700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200EA78, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109registryCOMMON

Download Yara Rule

APIs

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000090,00007FF6C200B48C,00000001,00007FF6C20029DC), ref: 00007FF6C200EB55
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000090,00007FF6C200B48C,00000001,00007FF6C20029DC), ref: 00007FF6C200EB7F

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000090,00007FF6C200B48C,00000001,00007FF6C20029DC), ref: 00007FF6C200EBF1

Strings

CRecoveryDiskCreator::_ReadOverridePath, xrefs: 00007FF6C200EAD1
Software\Microsoft\Windows\CurrentVersion\RecoveryDiscCreator, xrefs: 00007FF6C200EB71

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$MessageOpenTrace
String ID: CRecoveryDiskCreator::_ReadOverridePath$Software\Microsoft\Windows\CurrentVersion\RecoveryDiscCreator
API String ID: 2474424771-2715232156
Opcode ID: 88594c1a020d91ca04c54f774318f521cd08eee700112a85c3dc36d4eac154a0
Instruction ID: 38ffd23ba058f24bb861c98522cea9694332f122223609bdcf78e8f4a60e4674
Opcode Fuzzy Hash: 88594c1a020d91ca04c54f774318f521cd08eee700112a85c3dc36d4eac154a0
Instruction Fuzzy Hash: 9F414F22B08A9285FB108F65D8802AD33B4FB487ADF524237DE9DA7B95DFB8D451C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2004B4C, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6C2004BD2
VerSetConditionMask.API-MS-WIN-CORE-SYSINFO-L1-2-0 ref: 00007FF6C2004BE1
VerifyVersionInfoW.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-1 ref: 00007FF6C2004BFB
VerifyVersionInfoW.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-1 ref: 00007FF6C2004C1F

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

Strings

_IsServerSku, xrefs: 00007FF6C2004BAE

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoVerifyVersion$ConditionMaskMessageTracememset
String ID: _IsServerSku
API String ID: 2325211307-2824982861
Opcode ID: a456985ced4d0b0dd8f23dbf495563a1b785a01deb635c127a833aeee336fb69
Instruction ID: bce899163c6d8d6cbfc98a1be3fe83e174a813009450607c40ebdc0acbe27e85
Opcode Fuzzy Hash: a456985ced4d0b0dd8f23dbf495563a1b785a01deb635c127a833aeee336fb69
Instruction Fuzzy Hash: 84313A6270878285FB608F25E4513AA23A0FB8878DF914037DE8D87B95DFBCE545C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200722C, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

ControlTraceW.API-MS-WIN-EVENTING-CONTROLLER-L1-1-0 ref: 00007FF6C20072D2
ControlTraceW.API-MS-WIN-EVENTING-CONTROLLER-L1-1-0 ref: 00007FF6C20072EA

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C2007311

Strings

SxStopTracing, xrefs: 00007FF6C2007275
BuiltInRecoveryDiscTracing, xrefs: 00007FF6C20072C9, 00007FF6C20072DE

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Trace$Control$FreeMessageTask
String ID: BuiltInRecoveryDiscTracing$SxStopTracing
API String ID: 997754273-679121635
Opcode ID: 317b647a7a05d657256b2380bf204a146cee84b682ec88e6908dd824ba31af25
Instruction ID: b02c03e890e76d0f8055cf014700f98e87bd190fe31465e6b08a392cb288de86
Opcode Fuzzy Hash: 317b647a7a05d657256b2380bf204a146cee84b682ec88e6908dd824ba31af25
Instruction Fuzzy Hash: EB213821B087828AFB14DFA5E8503A82660BB1874EF41043BEE8ED77A4DFACD546C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C20061CC, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

CoTaskMemAlloc.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C2006242
memset.MSVCRT ref: 00007FF6C2006274

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C20062A8

Strings

W, xrefs: 00007FF6C2006299
SxAllocateEventTraceProp, xrefs: 00007FF6C2006210

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Task$AllocFreeMessageTracememset
String ID: SxAllocateEventTraceProp$W
API String ID: 628906861-4229482847
Opcode ID: 3b8db632145a786b62a4ae2443f2d97e296102ae9d4248b4b84a9bbf2c1066e2
Instruction ID: c3362b14d8b34490299922f4502b6276e3843731222746f7f77fe1f80521ff76
Opcode Fuzzy Hash: 3b8db632145a786b62a4ae2443f2d97e296102ae9d4248b4b84a9bbf2c1066e2
Instruction Fuzzy Hash: 1A21AC72B0868287FB608F54E1443697361FB88B4EF41423AEA8D8B7A5DFBCD545CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2005284, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6C20052BB
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF6C2005023), ref: 00007FF6C20052D2
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF6C2005023), ref: 00007FF6C20052E6
EndDialog.USER32 ref: 00007FF6C200532B

Strings

CSourceWnd::OnOK, xrefs: 00007FF6C2005296

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$DialogItem
String ID: CSourceWnd::OnOK
API String ID: 3626491743-3405268103
Opcode ID: a392c0932b1eb1f115ba4ebba0e97c9f2fda9b4f0836ee4798442c3adc20dca7
Instruction ID: af7cd3f8c8fe024468d23ba735244312605ed43476ebc43ef1967f8c1ce797da
Opcode Fuzzy Hash: a392c0932b1eb1f115ba4ebba0e97c9f2fda9b4f0836ee4798442c3adc20dca7
Instruction Fuzzy Hash: 74119032B08A8282EB20CF65E48066A6760FB88B8DF514036EE8D87B95DFBCD541C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2005A90, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6C2005AC3
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6C2005B36

Strings

BreakOnTrackedError, xrefs: 00007FF6C2005B03
TrackFailure, xrefs: 00007FF6C2005AD2
SYSTEM\CurrentControlSet\Services\SPP\Debug\Tracing, xrefs: 00007FF6C2005AB5

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpen
String ID: BreakOnTrackedError$SYSTEM\CurrentControlSet\Services\SPP\Debug\Tracing$TrackFailure
API String ID: 47109696-3959884676
Opcode ID: a34fb45ded57ca69c1f43521f5359e1f70e83260d91f8b4ec308c9e41e8efa1a
Instruction ID: b8ba2354eb21b162b45618593c498e924ced3946225ea53ccdf5d8c91239bba7
Opcode Fuzzy Hash: a34fb45ded57ca69c1f43521f5359e1f70e83260d91f8b4ec308c9e41e8efa1a
Instruction Fuzzy Hash: EB113D72B1865286E7108F65E4813693BB4FB4178AF624036DA8DC6664EFBEE984C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2010C34, Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 00007FF6C2010D59
SysFreeString.OLEAUT32 ref: 00007FF6C2010D83
SysFreeString.OLEAUT32 ref: 00007FF6C2010DBD
SysFreeString.OLEAUT32 ref: 00007FF6C2010DF4
SysFreeString.OLEAUT32 ref: 00007FF6C2010E1B

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Free
String ID:
API String ID: 1391021980-0
Opcode ID: d83183be0c504e87c1458809d3eb9ee06af6498f899e75fc7e39edccae2e8ec8
Instruction ID: 09e745afce5023bde9900754e06af52699f79abb3bc7696ad05394fc63501719
Opcode Fuzzy Hash: d83183be0c504e87c1458809d3eb9ee06af6498f899e75fc7e39edccae2e8ec8
Instruction Fuzzy Hash: 2F619076B04B4686EB10DF1AE9441AD77A6FB88BDDB068032DE8D87764DFB8D485C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2005E84, Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 153COMMON

Download Yara Rule

APIs

LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,00007FF6C2007786,?,?,?,?,?,?,00000000,00000001), ref: 00007FF6C2005F2D

Part of subcall function 00007FF6C2005C9C: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C2005D6C

LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,00007FF6C2007786,?,?,?,?,?,?,00000000,00000001), ref: 00007FF6C2006094
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,00007FF6C2007786,?,?,?,?,?,?,00000000,00000001), ref: 00007FF6C20060B9

Strings

FAILED, xrefs: 00007FF6C2005EDE
FAILED[TRACK], xrefs: 00007FF6C2005ED3

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLocal$MessageTrace
String ID: FAILED$FAILED[TRACK]
API String ID: 3345579459-1805536916
Opcode ID: 8db3b2c9acdb3a5c9057cc7c23cacd3b4645b17410187aec84ba7d498b4added
Instruction ID: 271f5a30f7bd63447e4fcaf1f7e31cf562dda3261dfd2a179c7e84e8e4f3c40b
Opcode Fuzzy Hash: 8db3b2c9acdb3a5c9057cc7c23cacd3b4645b17410187aec84ba7d498b4added
Instruction Fuzzy Hash: F971F776A08B8586EB64CF15D04063977A1FB48F8EB164136EE8D87794CFB8E891C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2005848, Relevance: 7.6, APIs: 5, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88377c1150ca71af79ed72cd84d313f494f09a764dd7d9cfd4295f19d3bacf17
Instruction ID: 0c79dbe285cb9b69b09e2a68e05ef796bf9d90291b8ee3e9d26d2fd7fda0a7ea
Opcode Fuzzy Hash: 88377c1150ca71af79ed72cd84d313f494f09a764dd7d9cfd4295f19d3bacf17
Instruction Fuzzy Hash: DB616C32B0868385FB15CF16A8502792A65BB44B5EF5B4037DE8D877A4DFBCE986C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2010E70, Relevance: 7.6, APIs: 5, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00000000,?,00000000,?,00007FF6C200FA84), ref: 00007FF6C2010EA1
LoadRegTypeLib.OLEAUT32 ref: 00007FF6C2010ECA
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6C2010F9A
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6C2010FB9
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00000000,?,00000000,?,00007FF6C200FA84), ref: 00007FF6C201101D

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave$LoadType
String ID:
API String ID: 1959213018-0
Opcode ID: b461cf527f919b4d436310faeaed830e9f17702ae43183023364c3c103aa7b30
Instruction ID: 19f75066b60f7e0b21c4550e4bfa4bbf48963ed8101fc3d6a97be33c531a9127
Opcode Fuzzy Hash: b461cf527f919b4d436310faeaed830e9f17702ae43183023364c3c103aa7b30
Instruction Fuzzy Hash: 3C510826B04B4682EB55CF26E8843682361FF44B8EF064036DE8E87B60DFBDE494D340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200B080, Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

CoInitializeEx.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200B09D
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6C200B0C5
WakeAllConditionVariable.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF6C200B0EC
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6C200B0F6
CoUninitialize.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200B120

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$ConditionEnterInitializeLeaveUninitializeVariableWake
String ID:
API String ID: 3442074688-0
Opcode ID: 7c746c1a44ed73e0d63db920082a6f6561cda2b721e9b89542fb3c517664a6f5
Instruction ID: 4a54e949a77815e86925bcdff04b31b98c5862f74f544fad6a516e2435df8582
Opcode Fuzzy Hash: 7c746c1a44ed73e0d63db920082a6f6561cda2b721e9b89542fb3c517664a6f5
Instruction Fuzzy Hash: 63210836B08A4582EB14DF66E8542697760FF88F8EF054036DE8E83365DFB8D885C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C20079BC, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000070,00007FF6C200EBA0), ref: 00007FF6C2007A7A
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6C2007B00

Strings

SxRegReadString, xrefs: 00007FF6C20079D8
WimFile, xrefs: 00007FF6C20079C2

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: QueryValue
String ID: SxRegReadString$WimFile
API String ID: 3660427363-2292348767
Opcode ID: 49df693cd0e34bef57fbb9690515b1fb0533a12c195e688dbbada0796074f3df
Instruction ID: a3c65124ca5221a2d40623208d1d2912ed7982d1b68122e6769639a8d90ed5d9
Opcode Fuzzy Hash: 49df693cd0e34bef57fbb9690515b1fb0533a12c195e688dbbada0796074f3df
Instruction Fuzzy Hash: 17517C26B046918BFB14CF65D8807AD37B0FB4479EF114136EE4987BA8DF79D9018B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2002880, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF6C20028B2
SetWindowLongPtrW.USER32 ref: 00007FF6C20028FE
SetWindowLongPtrW.USER32 ref: 00007FF6C20029E9

Strings

CMainWnd::OnCancel, xrefs: 00007FF6C2002970

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: LongWindow
String ID: CMainWnd::OnCancel
API String ID: 1378638983-3336471996
Opcode ID: 04b0904633ebd609a8745b261ff2d65672473c110012a02204587ad9586b0a63
Instruction ID: da739c9b367126f9a13c1837862d7facaf64f1c66db055f2e094ea1676dde10b
Opcode Fuzzy Hash: 04b0904633ebd609a8745b261ff2d65672473c110012a02204587ad9586b0a63
Instruction Fuzzy Hash: 5141D221F0C6C74AF6749E26A5841396691BF4578EF124137DDCEC7B86DEBCE9418300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200D3C4, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 00007FF6C200D4FF

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

SysAllocString.OLEAUT32 ref: 00007FF6C200D4A8

Strings

winre_server.dat, xrefs: 00007FF6C200D3D4
CRecoveryDiskCreator::_AddFile, xrefs: 00007FF6C200D41F

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: String$AllocFreeMessageTrace
String ID: CRecoveryDiskCreator::_AddFile$winre_server.dat
API String ID: 1042920870-3589462722
Opcode ID: 94ed8e62c7e249323a75190bd090cff81c8dc2d7d525a5056f9d6bc7c62f9d43
Instruction ID: 7b5d6dde8487aa18c13a6882ac26ec78dcd6e80a708549707fc468c0f92ddc6a
Opcode Fuzzy Hash: 94ed8e62c7e249323a75190bd090cff81c8dc2d7d525a5056f9d6bc7c62f9d43
Instruction Fuzzy Hash: 78414C26B147928AFB14CFA6D8402AC2764FB48B9DF164037DE4D97B65DFB8E442C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2008834, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

BcdOpenSystemStore.BCD(?,?,?,?,?,?,?,?,?,000000B8,00000000,?,00007FF6C2003176), ref: 00007FF6C200889C
BcdOpenObject.BCD(?,?,?,?,?,?,?,?,?,000000B8,00000000,?,00007FF6C2003176), ref: 00007FF6C20088CE
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,?,?,?,?,?,000000B8,00000000,?,00007FF6C2003176), ref: 00007FF6C200894F

Strings

SxBcdGetOSDescriptionString, xrefs: 00007FF6C2008847

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Open$FreeObjectStoreSystemTask
String ID: SxBcdGetOSDescriptionString
API String ID: 3055255-329709486
Opcode ID: a14c0cb42120b19d1e66513a82806af379e6632752f59844f39b8b3683037019
Instruction ID: 006bb7d9dfb28a7059bfae96e6b1305f95cd42fe2db24d3515fe643803837f10
Opcode Fuzzy Hash: a14c0cb42120b19d1e66513a82806af379e6632752f59844f39b8b3683037019
Instruction Fuzzy Hash: 4A413A26B046829EFB109FB5C4845AC26B4FF0474DF25103ADE4DA7B65EF78E896C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200A748, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6C200A7BB
CoWaitForMultipleHandles.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF6C200A80E

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6C200A84F

Strings

RdSleep, xrefs: 00007FF6C200A794

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateEventHandleHandlesMessageMultipleTraceWait
String ID: RdSleep
API String ID: 3070032689-2996006937
Opcode ID: 3e3f0fc7cafe76899777d9d5c95826caf02ab1210c4bc784ea1d34bb8e49ce1e
Instruction ID: 51dd764b88b39e8cd7af81894cb86e297a18dbab00f76aee39bc5f8ba5c225bc
Opcode Fuzzy Hash: 3e3f0fc7cafe76899777d9d5c95826caf02ab1210c4bc784ea1d34bb8e49ce1e
Instruction Fuzzy Hash: 18318022B046828AFB14CF64D4512AC2264FB5476DF51023BEE6D83BD4EFBCD941C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200A584, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6C200A637
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6C200A64B
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6C200A6A9

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

Strings

RdCheckRead, xrefs: 00007FF6C200A5D5

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorFileHandleLastMessageTrace
String ID: RdCheckRead
API String ID: 3005582999-3613760608
Opcode ID: ef7d9791528ad8ea7003002c790765d498c62f4fc548ad2edccf3ba188f16904
Instruction ID: e367a1f970ddfe631e68845da1dfa007ece639566df225cf359b04f6847bb929
Opcode Fuzzy Hash: ef7d9791528ad8ea7003002c790765d498c62f4fc548ad2edccf3ba188f16904
Instruction Fuzzy Hash: 07319C22B0868286FB20CF51E15177A2364FB847ADF110237EE9D87B94DFBDD9468B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200A9EC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6C200AA52
WakeAllConditionVariable.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF6C200AA7A
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6C200AADB

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

Strings

CRecoveryDiskAsync::SetPercentComplete, xrefs: 00007FF6C200AA37

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$ConditionEnterLeaveMessageTraceVariableWake
String ID: CRecoveryDiskAsync::SetPercentComplete
API String ID: 3246515623-1306872072
Opcode ID: 20371860efcf6f1475dbc0a8c83febfb80bde1083c7ee3026a81ea5310b1175f
Instruction ID: 10cea009452b03223579c4944b61e91f133a91fe4606f5d6664d6315a138ffba
Opcode Fuzzy Hash: 20371860efcf6f1475dbc0a8c83febfb80bde1083c7ee3026a81ea5310b1175f
Instruction Fuzzy Hash: 9D313B22B0868286EB24CF25E55116D6761FB88B4DF414137EE8E877A8DF7CD941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2008080, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C2008166

Strings

?, xrefs: 00007FF6C2008154
::StringCchCopy( pwszVolumeName, cchVolumeName, pwszShortest ), xrefs: 00007FF6C2008141
NULL, xrefs: 00007FF6C20080E1

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageTrace
String ID: ::StringCchCopy( pwszVolumeName, cchVolumeName, pwszShortest )$?$NULL
API String ID: 471583391-684994505
Opcode ID: 3d48df085bf4ef9a9d9c655aa269573b2307d2345f6f9f489989223253f5fb60
Instruction ID: ee974e7c88862260c92e789b7be242e5cd3e6ce1a2db5e26857b2d804b97ba83
Opcode Fuzzy Hash: 3d48df085bf4ef9a9d9c655aa269573b2307d2345f6f9f489989223253f5fb60
Instruction Fuzzy Hash: C2215E72A08B8481E6608F41F800BAAB3A5FB84B99F514226EEDD43798CFBCD554CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2001E68, Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6C2001EE7
wcsstr.MSVCRT ref: 00007FF6C200203F
wcsstr.MSVCRT ref: 00007FF6C2002070

Strings

GetDeviceNameOf, xrefs: 00007FF6C2001E9E

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: wcsstr$memset
String ID: GetDeviceNameOf
API String ID: 2699601629-2950804554
Opcode ID: 6eb63e50555eb27793024e2d5a4e6f78f8b16dbc04f9b03d21a881b2b704f844
Instruction ID: 7c526eb77db467fb3268e008a444363de63659b90490d91153b04ed9c028d339
Opcode Fuzzy Hash: 6eb63e50555eb27793024e2d5a4e6f78f8b16dbc04f9b03d21a881b2b704f844
Instruction Fuzzy Hash: 2E817122B1868296F760DF28E48417AA2A1FB44749F411137EE9EC7799DFBCD945CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2004FA0, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF6C2004FCB
SetWindowLongPtrW.USER32 ref: 00007FF6C2004FF8
EndDialog.USER32 ref: 00007FF6C2005013
SetWindowLongPtrW.USER32 ref: 00007FF6C2005030

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: LongWindow$Dialog
String ID:
API String ID: 106538970-0
Opcode ID: 6f73e5d7b7651d757cbab338b8323a10fb363ea4b63775c248a8ae357476c7ca
Instruction ID: d723b2ba043da821c1de772e7a8d9634332211cadb12e23f7f9426ed060ebf83
Opcode Fuzzy Hash: 6f73e5d7b7651d757cbab338b8323a10fb363ea4b63775c248a8ae357476c7ca
Instruction Fuzzy Hash: 4921D320B0C69342FA149F26958463E6A50BF84B8AF520037DEDD87B84DFFDE8414780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200A38C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

GetTempPathW.API-MS-WIN-CORE-FILE-L1-2-0 ref: 00007FF6C200A48F
GetTempPathW.API-MS-WIN-CORE-FILE-L1-2-0 ref: 00007FF6C200A4D2

Strings

RdGetTempPath, xrefs: 00007FF6C200A3E1

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: PathTemp$MessageTrace
String ID: RdGetTempPath
API String ID: 4010785195-3883686742
Opcode ID: 7f7915eed659752c04e4f8c5c1eb434986596b28411147e4951a01ec1941ef13
Instruction ID: 7481d35592b84cb1e6b029ccc395f5b6b803e7ece06d2a0b31b220482c237bf9
Opcode Fuzzy Hash: 7f7915eed659752c04e4f8c5c1eb434986596b28411147e4951a01ec1941ef13
Instruction Fuzzy Hash: C1513A36F086928AF710CFA5D8811AD23B5BB48749B52403BEE4DD77A5EFB8E941C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2004DF0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF6C2004E6B
DialogBoxParamW.USER32 ref: 00007FF6C2004EF9

Strings

CSourceWnd::CreateAndShow, xrefs: 00007FF6C2004E20

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: DialogParamWindow
String ID: CSourceWnd::CreateAndShow
API String ID: 2019275597-1004598736
Opcode ID: 105c498096705f967bf737554e45c92639289fee041b3b81b937fdb567178623
Instruction ID: 730f57eec6cc0ef4526300ef3321629fc87e3a0dcb4108bbfd5d619c5a98e270
Opcode Fuzzy Hash: 105c498096705f967bf737554e45c92639289fee041b3b81b937fdb567178623
Instruction Fuzzy Hash: BC417A72B047819AFB10CF64D4402AD32A4FB5474DF42493AEE8C87B98DFB8DA15C348

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C20030E0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6C2003135
GetNativeSystemInfo.API-MS-WIN-CORE-SYSINFO-L1-2-0 ref: 00007FF6C20031B2

Strings

CMainWnd::_PrepareMediaLabel, xrefs: 00007FF6C2003102

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoNativeSystemmemset
String ID: CMainWnd::_PrepareMediaLabel
API String ID: 2938629079-1472883605
Opcode ID: d19b49551571a2668a7cfa5198b05065add56f1a64285abb9f7289c265a8fb51
Instruction ID: f3c99d228353b6072002de8736bf205bb38c5c98b9550de644a8fdeed41ecea7
Opcode Fuzzy Hash: d19b49551571a2668a7cfa5198b05065add56f1a64285abb9f7289c265a8fb51
Instruction Fuzzy Hash: 3C511736B14A918AF711CFA5D4802AD23B1FB58B8DF41443BDE8D93B99DE79DA11C380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C20032A4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C2004490: GetDlgItem.USER32 ref: 00007FF6C20044A5
Part of subcall function 00007FF6C2004490: GetWindowLongPtrW.USER32 ref: 00007FF6C20044BC
Part of subcall function 00007FF6C2004490: SetWindowLongPtrW.USER32 ref: 00007FF6C20044CE
Part of subcall function 00007FF6C2004490: SendMessageW.USER32(?,?,?,00007FF6C2003CF1), ref: 00007FF6C20044E4

GetDlgItem.USER32 ref: 00007FF6C200339B
EnableWindow.USER32 ref: 00007FF6C20033A6

Strings

CMainWnd::OnEnumerateDevices, xrefs: 00007FF6C20032B9

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$ItemLong$EnableMessageSend
String ID: CMainWnd::OnEnumerateDevices
API String ID: 605027342-2275032555
Opcode ID: dcf3b3d074ac72c7b91575fbd967aa8a99b8709e07c76a092afbf8f33e2993d2
Instruction ID: 70c319933de4759394b99e22c1da42707f6149c2fa6e2187f93258ee095419a2
Opcode Fuzzy Hash: dcf3b3d074ac72c7b91575fbd967aa8a99b8709e07c76a092afbf8f33e2993d2
Instruction Fuzzy Hash: 04410926B147818AFB45CF6AD4D03AD22A0FB48749F51413ADE8DC7BA5DFB9D4618700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2003600, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

CMainWnd::OnProgress, xrefs: 00007FF6C2003621

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: CMainWnd::OnProgress
API String ID: 0-27580894
Opcode ID: 85f25ca3275923c858e6ec546773e9932f4f9c5f46a4a00729a30eea808196a1
Instruction ID: 8bd1e9990a6a1498a06a57cfdc4132a2a65dae6ee9020aa1c220c931f8df4f40
Opcode Fuzzy Hash: 85f25ca3275923c858e6ec546773e9932f4f9c5f46a4a00729a30eea808196a1
Instruction Fuzzy Hash: C5318C31B0878186F7208F51D48466972A5FB98B4EF12813BDE8DC3B94CFBDE9458B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2008F7C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C2008CF0: CoTaskMemAlloc.API-MS-WIN-CORE-COM-L1-1-0(?,?,00000000,00007FF6C2008FB5,?,00000001,?,00007FF6C2009149,?,?,?,00007FF6C20092BD), ref: 00007FF6C2008D2E

CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,00000001,?,00007FF6C2009149,?,?,?,00007FF6C20092BD,?,?,?,?,00007FF6C20013B1), ref: 00007FF6C2008FFE
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,00000001,?,00007FF6C2009149,?,?,?,00007FF6C20092BD,?,?,?,?,00007FF6C20013B1), ref: 00007FF6C2009011

Strings

%s%s(0x%08X[0x%08X]), xrefs: 00007FF6C2008F88

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Task$Free$Alloc
String ID: %s%s(0x%08X[0x%08X])
API String ID: 1499894389-3734769691
Opcode ID: 75f856db3b2ac939331e6772e31ad36bcd173864403600948fe4e0cec69643f6
Instruction ID: 47df5c2213605a31b432a2da19faf3933fc310566199699c148c4423b1e26a6c
Opcode Fuzzy Hash: 75f856db3b2ac939331e6772e31ad36bcd173864403600948fe4e0cec69643f6
Instruction Fuzzy Hash: 2211B672B04AD18BEB14DF16E4408697364FB48B99F1A8032DF8997311DEBDEC818700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2001080, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C200112D

Strings

NULL, xrefs: 00007FF6C20010D8
NULL, xrefs: 00007FF6C20010F5

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageTrace
String ID: NULL$NULL
API String ID: 471583391-284533664
Opcode ID: 1fc4d52659fbefe528d76fcc723ab98b3fa92cab805dca9e340900471b19bfe5
Instruction ID: 8a268ded0c41789805df4ada248bb4e8e34b8cba31db401658312472d5de4e53
Opcode Fuzzy Hash: 1fc4d52659fbefe528d76fcc723ab98b3fa92cab805dca9e340900471b19bfe5
Instruction Fuzzy Hash: DE118F62B0CBC581EA21CF44B540A6AA6A1FB54799F564235EEDE837E5DFBCC4508600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C2007BA8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6C20041AF), ref: 00007FF6C2007C21

Strings

SxRegWriteDWORD, xrefs: 00007FF6C2007BCA
RecDiscUsageSuppressPrompt, xrefs: 00007FF6C2007BF5

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Value
String ID: RecDiscUsageSuppressPrompt$SxRegWriteDWORD
API String ID: 3702945584-1609550515
Opcode ID: dea2edf3d72a6487bd565ad3fe9b2d66d7ac7870d4ee1573f69c857482b8a668
Instruction ID: 89f505c806c5c554d5f82637474364a4d3735eb8dfcf31be584756594e25140b
Opcode Fuzzy Hash: dea2edf3d72a6487bd565ad3fe9b2d66d7ac7870d4ee1573f69c857482b8a668
Instruction Fuzzy Hash: 2F117371B28781C6F7408F55E8807A66A60FB8475AF501036FE8E8B764DFBCC544CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C200A874, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6C2009C52,?,?,?,00007FF6C200B844), ref: 00007FF6C200A8D4
InitializeConditionVariable.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF6C200A90F

Part of subcall function 00007FF6C2002694: TraceMessage.API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0 ref: 00007FF6C20026A7

Strings

CRecoveryDiskAsync::FinalConstruct, xrefs: 00007FF6C200A8B4

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize$ConditionCountCriticalMessageSectionSpinTraceVariable
String ID: CRecoveryDiskAsync::FinalConstruct
API String ID: 2053117497-1811533429
Opcode ID: c6a36985674aec5a527ecf80a2feca017882abe3ab5e387b9895e34db61f5402
Instruction ID: 2583d730ffe9d96f9c264693afa578883ebe466136ddf48624d8e1dc0aaae5db
Opcode Fuzzy Hash: c6a36985674aec5a527ecf80a2feca017882abe3ab5e387b9895e34db61f5402
Instruction Fuzzy Hash: 07112E21B1868286FB20DF50D4412B92260FB5870EF410037EE8D87795EFBCE686C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6C20056AC, Relevance: 5.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.398970166.00007FF6C2001000.00000020.00020000.sdmp, Offset: 00007FF6C2000000, based on PE: true

Associated: 0000001B.00000002.398953075.00007FF6C2000000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399037241.00007FF6C2013000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.399091694.00007FF6C201A000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.399131314.00007FF6C2021000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08afda7b3dfd6364901d90fa68bf01669fa44c8f1fe40a71aaa6cbc3b4a5ab7a
Instruction ID: 0efa4b1467197ab5114e3222d2a20048fb76d7bd3f3b9692f3600c980583baee
Opcode Fuzzy Hash: 08afda7b3dfd6364901d90fa68bf01669fa44c8f1fe40a71aaa6cbc3b4a5ab7a
Instruction Fuzzy Hash: 51416C31B0968281FB65CF15A5543752AA0BB44B4EF124037DE8DDBBA1DFEDE982C740

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report yPeVDkBY3n

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution