24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 64:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 99c72cf8b7f6… — Score 76/100 — Hybrid Analysis","description":"Malicious verdict for sample 99c72cf8b7f6…. Malware family: Trojan.Generic. Threat score 76/100. 2/23 AV engines flagged this file. 1 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/99c72cf8b7f66273d2e9d29f35bc7c1e029c36851d27e53a106b102c55d75e55","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","99c72cf8b7f66273d2e9d29f35bc7c1e029c36851d27e53a106b102c55d75e55"],"about":{"@type":"SoftwareApplication","name":"reshiki-0.12.0-windows-x64-setup.exe","applicationCategory":["compressed","innosetup"],"identifier":"99c72cf8b7f66273d2e9d29f35bc7c1e029c36851d27e53a106b102c55d75e55","additionalType":"Malicious sample"},"threatScore":76,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":2,"total":23},"behavioralIndicators":{"malicious":1,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T483,"reshiki-0.12.0-windows-x64-setup.exe" called "FindResourceW" with parameter "11111" - (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.tmp" called "FindResourceW" with parameter "92998364" - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "FindResourceW" with parameter "92966996" - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "FindResourceW" with parameter "93087156" - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "FindResourceW" with parameter "93087100" - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "FindResourceW" with parameter "92998940" - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "FindResourceW" with parameter "92968596" - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "FindResourceW" with parameter "93008204" - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "FindResourceW" with parameter "92983436" - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "FindResourceW" with parameter "93089284" - (UID: 00000000-00002700)26:T986,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001096.00000001.149917.009D1000.00000020.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp")27:T5c6,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "LoadLibraryEx failed" (Indicator: "LoadLibrary"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "LoadLibraryEx failed" (Indicator: "LoadLibrary"; Source: "00000000-00001096.00000001.149917.009D1000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp")28:T78b,"reshiki-0.12.0-windows-x64-setup.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{35286A68-3C57-41A1-BBB1-0EAE73D76C95}\PROPERTYBAG") "reshiki-0.12.0-windows-x64-setup.tmp" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "reshiki-0.12.0-windows-x64-setup.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7D83EE9B-2244-4E70-B1F5-5393042AF1E4}\PROPERTYBAG") "reshiki-0.12.0-windows-x64-setup.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A52BBA46-E9E1-435F-B3D9-28DAA648C0F6}\PROPERTYBAG") "reshiki-0.12.0-windows-x64-setup.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\PROPERTYBAG") "reshiki-0.12.0-windows-x64-setup.tmp" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "reshiki-0.12.0-windows-x64-setup.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "reshiki-0.12.0-windows-x64-setup.tmp" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "reshiki-0.12.0-windows-x64-setup.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "reshiki-0.12.0-windows-x64-setup.tmp" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "reshiki-0.12.0-windows-x64-setup.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32")29:Tbb6,"reshiki-0.12.0-windows-x64-setup.exe" queried SystemProcessInformation at 00000000-00001096-00000C15-573365368 [PID: 1096] "reshiki-0.12.0-windows-x64-setup.exe" queried SystemProcessInformation at 00000000-00001096-00000C15-573374925 [PID: 1096] "reshiki-0.12.0-windows-x64-setup.exe" queried SystemProcessInformation at 00000000-00001096-00000C15-573563358 [PID: 1096] "reshiki-0.12.0-windows-x64-setup.exe" queried SystemProcessInformation at 00000000-00001096-00000C15-573571439 [PID: 1096] "reshiki-0.12.0-windows-x64-setup.exe" queried SystemProcessInformation at 00000000-00001096-00000C15-573680526 [PID: 1096] "reshiki-0.12.0-windows-x64-setup.exe" queried SystemProcessInformation at 00000000-00001096-00000C15-573688954 [PID: 1096] "reshiki-0.12.0-windows-x64-setup.exe" queried SystemProcessInformation at 00000000-00001096-00000C15-573849644 [PID: 1096] "reshiki-0.12.0-windows-x64-setup.exe" queried SystemProcessInformation at 00000000-00001096-00000C15-573857593 [PID: 1096] "reshiki-0.12.0-windows-x64-setup.tmp" queried SystemProcessInformation at 00000000-00002700-00000C15-574719314 [PID: 2700] "reshiki-0.12.0-windows-x64-setup.tmp" queried SystemProcessInformation at 00000000-00002700-00000C15-574727938 [PID: 2700] "reshiki-0.12.0-windows-x64-setup.tmp" queried SystemProcessInformation at 00000000-00002700-00000C15-574891136 [PID: 2700] "reshiki-0.12.0-windows-x64-setup.tmp" queried SystemProcessInformation at 00000000-00002700-00000C15-574899926 [PID: 2700] "reshiki-0.12.0-windows-x64-setup.tmp" queried SystemProcessInformation at 00000000-00002700-00000C15-575178312 [PID: 2700] "reshiki-0.12.0-windows-x64-setup.tmp" queried SystemProcessInformation at 00000000-00002700-00000C15-575187268 [PID: 2700] "reshiki-0.12.0-windows-x64-setup.tmp" queried SystemProcessInformation at 00000000-00002700-00000C15-590395426 [PID: 2700] "reshiki-0.12.0-windows-x64-setup.tmp" queried SystemProcessInformation at 00000000-00002700-00000C15-590403224 [PID: 2700] "reshiki-0.12.0-windows-x64-setup.tmp" queried SystemProcessInformation at 00000000-00002700-00000C15-615517727 [PID: 2700] "reshiki-0.12.0-windows-x64-setup.tmp" queried SystemProcessInformation at 00000000-00002700-00000C15-615525301 [PID: 2700] "reshiki-0.12.0-windows-x64-setup.tmp" queried SystemProcessInformation at 00000000-00002700-00000C15-615605046 [PID: 2700] "reshiki-0.12.0-windows-x64-setup.tmp" queried SystemProcessInformation at 00000000-00002700-00000C15-615612287 [PID: 2700] "reshiki.exe" queried SystemProcessInformation at 00000000-00004092-00000C15-626110274 [PID: 4092] "reshiki.exe" queried SystemProcessInformation at 00000000-00004092-00000C15-626119518 [PID: 4092] "reshiki.exe" queried SystemProcessInformation at 00000000-00004092-00000C15-626275260 [PID: 4092] "reshiki.exe" queried SystemProcessInformation at 00000000-00004092-00000C15-626283333 [PID: 4092] "reshiki.exe" queried SystemProcessInformation at 00000000-00004092-00000C15-627204591 [PID: 4092]2a:T5eb,"reshiki-0.12.0-windows-x64-setup.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\ReShiki\is-8I2ZS7WLI2.tmp" to "%TEMP%\ReShiki\unins000.exe" "reshiki-0.12.0-windows-x64-setup.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\ReShiki\is-79Q41G6WDT.tmp" to "%TEMP%\ReShiki\build.json" "reshiki-0.12.0-windows-x64-setup.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\ReShiki\is-8ZJ2Y74PEF.tmp" to "%TEMP%\ReShiki\README.txt" "reshiki-0.12.0-windows-x64-setup.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\ReShiki\is-0ECM1V53M7.tmp" to "%TEMP%\ReShiki\reshiki.exe" "reshiki-0.12.0-windows-x64-setup.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\ReShiki\Licenses\is-8YT5C85ZBL.tmp" to "%TEMP%\ReShiki\Licenses\LICENSE" "reshiki-0.12.0-windows-x64-setup.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\ReShiki\Licenses\is-D1N70KEUQF.tmp" to "%TEMP%\ReShiki\Licenses\LICENSE-APACHE" "reshiki-0.12.0-windows-x64-setup.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\ReShiki\Licenses\is-EKFBSIMTKJ.tmp" to "%TEMP%\ReShiki\Licenses\LICENSE-MIT" "reshiki-0.12.0-windows-x64-setup.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\ReShiki\Licenses\is-XEWFKYGPG6.tmp" to "%TEMP%\ReShiki\Licenses\NOTICE" "reshiki-0.12.0-windows-x64-setup.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\ReShiki\Licenses\is-BH3AZBQD0Y.tmp" to "%TEMP%\ReShiki\Licenses\THIRD-PARTY-NOTICES.txt"2b:T141a,Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "BCryptGenRandom"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "CryptGenRandom"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found api reference "to get address of BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "00000000-00001096.00000001.149917.009D1000.00000020.mdmp") Found api reference "to get address of BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "00000000-00001096.00000001.149917.009D1000.00000020.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00001096.00000000.147996.00760000.00000004.mdmp, 00000000-00001096.00000001.149917.00760000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00001096.00000000.147996.00760000.00000004.mdmp, 00000000-00001096.00000001.149917.00760000.00000004.mdmp") Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "BCryptGenRandom"; Source: "00000000-00001096.00000001.149917.009D1000.00000020.mdmp") Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "CryptGenRandom"; Source: "00000000-00001096.00000001.149917.009D1000.00000020.mdmp") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00001096.00000001.149917.009D1000.00000020.mdmp") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001096.00000001.149917.009D1000.00000020.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00001096.00000001.149917.009D1000.00000020.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001096.00000001.149917.009D1000.00000020.mdmp") Found api reference "CryptDecodeObject" (Indicator: "CryptDecodeObject"; Source: "00000000-00002700.00000000.148092.0120A000.00000004.mdmp, 00000000-00002700.00000001.150014.0120A000.00000004.mdmp, 00000000-00002700.00000002.151135.0120A000.00000004.mdmp") Found api reference "PFXImportCertStore" (Indicator: "PFXImportCertStore"; Source: "00000000-00002700.00000000.148092.0120A000.00000004.mdmp, 00000000-00002700.00000001.150014.0120A000.00000004.mdmp, 00000000-00002700.00000002.151135.0120A000.00000004.mdmp") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "00000000-00002700.00000000.148092.0120A000.00000004.mdmp, 00000000-00002700.00000001.150014.0120A000.00000004.mdmp, 00000000-00002700.00000002.151135.0120A000.00000004.mdmp") Found api reference "CertNameToStrW" (Indicator: "CertNameToStrW"; Source: "00000000-00002700.00000000.148092.0120A000.00000004.mdmp, 00000000-00002700.00000001.150014.0120A000.00000004.mdmp, 00000000-00002700.00000002.151135.0120A000.00000004.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00002700.00000000.148092.0120A000.00000004.mdmp, 00000000-00002700.00000001.150014.0120A000.00000004.mdmp, 00000000-00002700.00000002.151135.0120A000.00000004.mdmp") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00002700.00000000.148092.0120A000.00000004.mdmp, 00000000-00002700.00000001.150014.0120A000.00000004.mdmp, 00000000-00002700.00000002.151135.0120A000.00000004.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00002700.00000000.148092.0120A000.00000004.mdmp, 00000000-00002700.00000001.150014.0120A000.00000004.mdmp, 00000000-00002700.00000002.151135.0120A000.00000004.mdmp") Found api reference "CertOpenSystemStoreW" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00002700.00000000.148092.0120A000.00000004.mdmp, 00000000-00002700.00000001.150014.0120A000.00000004.mdmp, 00000000-00002700.00000002.151135.0120A000.00000004.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00002700.00000000.148092.0120A000.00000004.mdmp, 00000000-00002700.00000001.150014.0120A000.00000004.mdmp, 00000000-00002700.00000002.151135.0120A000.00000004.mdmp") Found api reference "CertFindChainInStore" (Indicator: "CertFindChainInStore"; Source: "00000000-00002700.00000000.148092.0120A000.00000004.mdmp, 00000000-00002700.00000001.150014.0120A000.00000004.mdmp, 00000000-00002700.00000002.151135.0120A000.00000004.mdmp") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "00000000-00002700.00000000.148092.0120A000.00000004.mdmp, 00000000-00002700.00000001.150014.0120A000.00000004.mdmp, 00000000-00002700.00000002.151135.0120A000.00000004.mdmp")2c:Tc077,Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 772710; code bytes = 30d0 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 998552; code bytes = 30d0 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 2971772; code bytes = 30d0 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 4810284; code bytes = 30d0 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 4895724; code bytes = 30d0 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 1247549; code bytes = 33c1 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 1714757; code bytes = 33c1 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 1754948; code bytes = 33c1 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 1798924; code bytes = 33c1 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 2516857; code bytes = 33c1 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 22711; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 52207; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 85973; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 88201; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 91178; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 1185715; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 1187336; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 1192069; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 1194981; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 1950355; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 2027263; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 2038698; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 2774345; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 2830586; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 2831927; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 2849711; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 2849863; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 2864319; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 2892117; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 2894201; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 3000110; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 3019963; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 3295977; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 3303102; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 3303335; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 3980423; code bytes = 8030 Found XOR loop in file "is-0ECM1V53M7.tmp" at offset 5078767; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 27779; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 27794; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 27802; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 32649; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 699259; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 741476; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 1164332; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3166901; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3166960; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3166968; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3166979; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3172401; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3651324; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3655472; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3698984; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3700459; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3893252; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3922915; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3924367; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3925323; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3931541; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3932879; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3933045; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3939635; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3940329; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3942859; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3952387; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3959779; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3961037; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3972389; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3975797; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3983617; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3987071; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3990937; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4002193; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4006789; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4011773; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4018027; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4022167; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4025633; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4026371; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4035343; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4036067; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4044199; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4049113; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4058659; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4062327; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4063551; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4064555; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4065659; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4066177; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4067267; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4077999; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4083631; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4094553; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4105507; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4117267; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4117889; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4122363; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4123011; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4128199; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4131875; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4133441; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4138789; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4139379; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4148999; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4153465; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4155667; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4157685; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4158403; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4160923; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4161635; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4164607; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4170849; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4171587; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4182451; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4186075; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4187279; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4188575; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4190657; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4191071; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4191789; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4199459; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4205405; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4207011; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4209051; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4211103; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4213123; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4215127; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4217159; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4219175; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4221081; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4224815; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4226135; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4228227; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4330277; code bytes = 30d0 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 221902; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 504937; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 1323166; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 1323269; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 1815724; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3123539; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3123572; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3123605; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3123638; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3123801; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3124043; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3192001; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3926239; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3939005; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3956099; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3961825; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3962555; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3988267; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4002303; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4013729; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4017031; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4017529; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4025199; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4025723; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4058823; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4063637; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4087955; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4104497; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4113959; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4122459; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4124945; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4144481; code bytes = 33c1 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 176401; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 176428; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 176863; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 176890; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 177139; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 177163; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 177390; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 177471; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 177494; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 177518; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 177546; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 177570; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 1194089; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 1492777; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 1520252; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 1524686; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 1527682; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 1537986; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 1562124; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 1638199; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 1694952; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 1706985; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 1972684; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 2948293; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 2970549; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 2983733; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3017542; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3027916; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3051755; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3283153; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3283171; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3339946; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3340311; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3402942; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3404540; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3404570; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3404590; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3463807; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3463870; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3463907; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3463925; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3464256; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3464274; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3471557; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3567988; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3916306; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3916846; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3918936; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3922896; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3923710; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3925310; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3927982; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3932178; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3935608; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3938296; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3939600; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3941774; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3942822; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3945012; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3951070; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3951406; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3959752; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3962382; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3967208; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3969310; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3971826; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3989444; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3990018; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3995004; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3996380; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3998582; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 3999624; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4000600; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4010532; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4011144; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4021192; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4023382; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4026332; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4028040; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4035304; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4036028; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4044168; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4053204; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4056760; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4058620; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4064544; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4065056; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4072324; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4079568; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4083620; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4085890; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4086556; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4099344; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4102586; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4105472; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4107632; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4110860; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4112902; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4113604; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4122344; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4128658; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4131086; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4148960; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4149518; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4152008; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4155628; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4158364; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4160884; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4166089; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4176112; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4185760; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4191032; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4191760; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4192340; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4193502; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4203242; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4206972; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4209012; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4211064; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4213084; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4215088; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4217120; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4219142; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4223996; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4224776; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4226116; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4228188; code bytes = 8030 Found XOR loop in file "is-8I2ZS7WLI2.tmp" at offset 4230219; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 27779; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 27794; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 27802; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 32649; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 699259; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 741476; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 1164332; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3166901; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3166960; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3166968; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3166979; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3172401; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3651324; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3655472; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3698984; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3700459; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3893252; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3922915; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3924367; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3925323; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3931541; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3932879; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3933045; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3939635; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3940329; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3942859; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3952387; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3959779; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3961037; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3972389; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3975797; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3983617; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3987071; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3990937; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4002193; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4006789; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4011773; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4018027; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4022167; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4025633; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4026371; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4035343; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4036067; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4044199; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4049113; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4058659; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4062327; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4063551; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4064555; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4065659; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4066177; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4067267; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4077999; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4083631; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4094553; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4105507; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4117267; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4117889; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4122363; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4123011; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4128199; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4131875; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4133441; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4138789; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4139379; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4148999; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4153465; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4155667; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4157685; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4158403; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4160923; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4161635; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4164607; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4170849; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4171587; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4182451; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4186075; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4187279; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4188575; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4190657; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4191071; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4191789; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4199459; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4205405; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4207011; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4209051; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4211103; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4213123; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4215127; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4217159; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4219175; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4221081; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4224815; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4226135; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4228227; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4330277; code bytes = 30d0 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 221902; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 504937; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 1323166; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 1323269; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 1815724; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3123539; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3123572; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3123605; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3123638; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3123801; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3124043; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3192001; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3926239; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3939005; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3956099; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3961825; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3962555; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3988267; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4002303; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4013729; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4017031; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4017529; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4025199; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4025723; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4058823; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4063637; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4087955; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4104497; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4113959; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4122459; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4124945; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4144481; code bytes = 33c1 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 176401; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 176428; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 176863; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 176890; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 177139; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 177163; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 177390; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 177471; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 177494; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 177518; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 177546; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 177570; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 1194089; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 1492777; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 1520252; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 1524686; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 1527682; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 1537986; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 1562124; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 1638199; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 1694952; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 1706985; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 1972684; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 2948293; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 2970549; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 2983733; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3017542; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3027916; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3051755; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3283153; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3283171; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3339946; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3340311; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3402942; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3404540; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3404570; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3404590; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3463807; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3463870; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3463907; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3463925; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3464256; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3464274; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3471557; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3567988; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3916306; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3916846; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3918936; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3922896; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3923710; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3925310; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3927982; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3932178; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3935608; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3938296; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3939600; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3941774; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3942822; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3945012; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3951070; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3951406; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3959752; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3962382; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3967208; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3969310; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3971826; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3989444; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3990018; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3995004; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3996380; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3998582; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 3999624; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4000600; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4010532; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4011144; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4021192; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4023382; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4026332; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4028040; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4035304; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4036028; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4044168; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4053204; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4056760; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4058620; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4064544; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4065056; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4072324; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4079568; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4083620; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4085890; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4086556; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4099344; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4102586; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4105472; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4107632; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4110860; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4112902; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4113604; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4122344; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4128658; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4131086; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4148960; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4149518; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4152008; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4155628; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4158364; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4160884; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4166089; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4176112; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4185760; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4191032; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4191760; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4192340; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4193502; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4203242; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4206972; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4209012; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4211064; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4213084; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4215088; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4217120; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4219142; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4223996; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4224776; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4226116; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4228188; code bytes = 8030 Found XOR loop in file "reshiki-0.12.0-windows-x64-setup.tmp" at offset 4230219; code bytes = 80302d:T480,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "reshiki-0.12.0-windows-x64-setup.exe") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "_setup64.tmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002700.00000001.150014.0120D000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002700.00000001.150014.0120D000.00000002.mdmp")2e:T6e1,Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001096.00000001.149917.009D1000.00000020.mdmp, 00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp")2f:Tcf4,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.726E7000.00000002.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.726E7000.00000002.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00002700.00000001.150014.057B0000.00000004.mdmp") Found reference to API "function SendMessage(const Wnd: HWND; const Msg, WParam, LParam: LongInt): LongInt;" (Indicator: "sendmessage"; Source: "00000000-00002700.00000001.150014.057B0000.00000004.mdmp") Found reference to API "function PostMessage(const Wnd: HWND; const Msg, WParam, LParam: LongInt): Boolean;" (Indicator: "postmessage"; Source: "00000000-00002700.00000001.150014.057B0000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00002700.00000001.150014.057B0000.00000004.mdmp")30:T7f0,"reshiki-0.12.0-windows-x64-setup.tmp" called "GetWindowTextW" with parameter "Select the language to use during the installation." - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetWindowTextW" with parameter "Information" - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetWindowTextW" with parameter "Please read the following important information before continuing." - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetWindowTextW" with parameter "When you are ready to continue with Setup, click Next." - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetWindowTextW" with parameter "&Next" - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetWindowTextW" with parameter "Select Destination Location" - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetWindowTextW" with parameter "Where should ReShiki be installed?" - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetWindowTextW" with parameter "B&rowse..." - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetWindowTextW" with parameter "Select a folder in the list below, then click OK." - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetWindowTextW" with parameter "Setup will install ReShiki into the following folder." - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetWindowTextW" with parameter "To continue, click Next. If you would like to select a different folder, click Browse." - (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetWindowTextW" with parameter "At least 75.2 MB of free disk space is required." - (UID: 00000000-00002700)31:T28fe,"reshiki-0.12.0-windows-x64-setup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000b741cf73c011c00000000c00b7400000a7480000000006006000010000020000000000000018ccce9824c020000e0f73c01e99c0777c8b6a07338f73c016fd79774a0f73c01506a0977a0cce982feffffffb0f73c01e3e2977406000000e0f73c01f0d797741e2c349a3c0100000000000000002e743c01000000000000000000000000000078f73c01a8b4a07308f83c01f0fb9974fef6aaeffeffffffd8f73c01399c9b734c020000ccf73c010c000000e99c077700000000080000000d0000000000000014f83c0120cce9820000000014f83c01db019d7300000000819ee400200d8a05a999e40001000000f862e400000000006698e4002cf83c01 (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000008a0510f58a05e05a870510f58a00905b8705e05a870500f68a05fcf43c01a854f60018f58a05b254f6003c010000aa090a6820f53c0110f58a0510f58a0520f53c0110f58a0518f53c012b5ef600bcf53c01405ef6004a5ef60000f68a0500f68a0528f83c01da60f600aa090a68f4ffffff00000000000001085365676f65205549000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0f68a05 (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000003c01088cbb03c000bb03c06f2573108cbb03e0ed3c01c8ed3c01d06f25732c8cbb03a74d257300000000108cbb03b74d257338e8029b4ebc287300000000b0ae6b031cee3c01fced3c01c06f2573108cbb0334ee3c0108ee3c01d06f25730000000000000000000000008c582876b74d2573f8eb029b00000000c0d5e982088cbb030240008068ee3c01506a097788cec4f4feffffff78ee3c0100163876484b6b0354b0347323870677e186067790d5e982000000008c582876088cbb0300000000484b6b03040000000016387640ee3c01088cbb03b04d3376dd1069d600000000b0ae6b03088cbb0313e6277300001f732c5334736cee3c0180eea074 (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000001c878a0508000000000000000000000000000000e0f73c0156b7997400040000000100001c878a05080000001c878a05080000003c01000010f83c01080000001000000014f83c014278e6001c878a05080000005ef141ff7a6fe400b9ade40038f83c019c07e500f80f1f0138f83c018b07e500f80f1f0134f83c0113caf1001dcaf100f0aeed00a8508c05a028890501000000f0aeed0000000000a0bd89053bd5ee000200000000000000584f8c058bdeee00f0aeed001198e400a0bd8905379be400f0aeed00a0bd8905939be400f0aeed0006e4ee0010e4ee000100000094f83c0198f83c0126e4ee00b8411e01ee000000d7411e01388c1101 (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4cde98284f73c013f8a06770000000001000000e4f63c01ffff00000c028b05fb8c067700000000000000000c028b05b4f73c010000000000000000000000000af49c7309000000d0366a03090000000c028b050000000070a29a7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000006ccce982b8f73c0111b997740000a673acf73c0100000000b4f73c01000000000af49c733c010000000000001c001d000c028b05e99c0777ccf73c01c450a7730000a6730c028b050af49c7350cce982fcfc0877844f0d77b500000014f83c0104000000f0f73c010c00000018f83c01648607004c01020000000000230000c06e4f0d773c01000070a29a74da4f0d77c4010000000000000c000000c8c3e98234f83c0183a29a74c401000033f83c010000000098f83c01d6af1c01c40100004cf83c014c01648694878a0500000000104fa7733d01000074f83c0175c39f73010000008cf83c01203051737a6fe400ddade40088f83c01 (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000058cee982e4f53c0111b997740000a673d8f53c0100000000e0f53c0100000000be180777e0cde982f8276b030000000048f63c01b055a77300000000000000000000a600d0f53c0108cee98270f63c01506a097700ccc4f4feffffffbe180777e99c0777ce94107fccf13c019800040058f63c01426e9f73f8cde98264f63c012e629e73000000008694107f00000000ffffffff70f63c016cf63c0174f63c0178f63c0180f63c0184f63c01c0f63c013dfe9f73000000008cf63c01a4d70b74980004009604000011270000000000000000000001000000e1d70b741796960da8f83c010c471c01980004009604000011270000 (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000c0bb3c0138cf06776c3a6a032cbc3c0101000000203a6a036c3a6a03203a6a03040000000400000000e0a374001000002cbc3c0101000000203a6a03cd9706779c970677a485e982b50f9a74203a6a030000067700000000cc2667730000000080eea07401000000580806fff8e2a3740000000004000000000000004840a274f8e2a37430bc3c0180e8a676709a6a0380e8a6762cbc3c010000000080e8a67658080106000000000000000000f47403e45e81730dfa057700000000000000000000000000f4740300000000e856d30500000000000000000000000000000000ffffffff000000000000000000000000d6767503ec767503 (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000c0bb3c0138cf06776c3a6a032cbc3c0101000000203a6a036c3a6a03203a6a03040000000400000000e0a374001000002cbc3c0101000000203a6a03cd9706779c970677a485e982b50f9a74203a6a030000067700000000cc2667730000000080eea07401000000580806fff8e2a3740000000004000000000000004840a274f8e2a37430bc3c0180e8a676709a6a0380e8a6762cbc3c010000000080e8a67658080106000000000000000000f47403e45e81730dfa057700000000000000000000000000f4740300000000e856d30500000000000000000000000000000000ffffffff000000000000000000000000de9b7503f69b7503 (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000c0bb3c0138cf06776c3a6a032cbc3c0101000000203a6a036c3a6a03203a6a03040000000400000000e0a374001000002cbc3c0101000000203a6a03cd9706779c970677a485e982b50f9a74203a6a030000067700000000cc2667730000000080eea07401000000580806fff8e2a3740000000004000000000000004840a274f8e2a37430bc3c0180e8a676709a6a0380e8a6762cbc3c010000000080e8a67658080106000000000000000000f47403e45e81730dfa057700000000000000000000000000f4740300000000e856d30500000000000000000000000000000000ffffffff000000000000000000000000eef0740302f17403 (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000075030000000008000000f8c33c01f4c33c0164f7987448f07403fc9c7103089d7103fc9c710333f01972fc9c710300000000089d7103000000000847220608c63c010f0000000f00000058a818720000000000000000000000000c000000f04a6a0358c43c01a3ce5f7674fc964044c53c019f995f76e8c53c0154c43c015243097743000000a8c43c0173f69774eac43c015c00000000000000fdfeff7f82f89774000000003464c9fdfeffffff00000000000000000000000008000000c660730302000000020000000d000000b0607303c660730300000000061f349af0c63c01ddf39774e4c43c0100000000b06073030d000000f8f39774b0607303 (UID: 00000000-00002700)32:T966,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp") Found reference to API "1345714566,5916,109,,GetWindowTextW,user32.dll,"00:39:03.156",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002700.00000001.150014.0373A000.00000004.mdmp") Found reference to API "1331182152,5916,109,,GetWindowTextW,user32.dll,"00:39:03.140",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002700.00000001.150014.0373A000.00000004.mdmp") Found reference to API "1349101206,5916,109,,GetWindowTextW,user32.dll,"00:39:03.156",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002700.00000001.150014.0373A000.00000004.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00002700.00000001.150014.057B0000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00002700.00000001.150014.057B0000.00000004.mdmp")33:T979,Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API ",,RtlGetVersion,NTDLL.dq" (Indicator: "GetVersion"; Source: "00000000-00002700.00000001.150014.0373A000.00000004.mdmp, 00000000-00002700.00000002.151135.03746000.00000004.mdmp") Found reference to API "function GetVersionComponents(const Filename: String; var Major, Minor, Revision, Build: Word): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00002700.00000001.150014.057B0000.00000004.mdmp") Found reference to API "function GetVersionNumbers(const Filename: String; var VersionMS, VersionLS: Cardinal): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00002700.00000001.150014.057B0000.00000004.mdmp") Found reference to API "function GetVersionNumbersString(const Filename: String; var Version: String): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00002700.00000001.150014.057B0000.00000004.mdmp")34:Teb4,"reshiki-0.12.0-windows-x64-setup.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shfolder.dll (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\Rstrtmgr.dll (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\MSFTEDIT.DLL (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\urlmon.dll (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00002700) "reshiki.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004092) "reshiki.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004092) "reshiki.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004092) "reshiki.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004092) "reshiki.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004092) "reshiki.exe" called "LoadLibrary" with a parameter vulkan-1.dll (UID: 00000000-00004092) "reshiki.exe" called "LoadLibrary" with a parameter d3d12.dll (UID: 00000000-00004092) "reshiki.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00004092) "reshiki.exe" called "LoadLibrary" with a parameter d3dcompiler_47.dll (UID: 00000000-00004092) "reshiki.exe" called "LoadLibrary" with a parameter opengl32.dll (UID: 00000000-00004092) "reshiki.exe" called "LoadLibrary" with a parameter gdi32 (UID: 00000000-00004092) "reshiki.exe" called "LoadLibrary" with a parameter vm3dgl64.dll (UID: 00000000-00004092) "reshiki.exe" called "LoadLibrary" with a parameter vm3dglhelper64.dll (UID: 00000000-00004092) "reshiki.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004092) "reshiki.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004092) "reshiki.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004092)35:T606,"reshiki-0.12.0-windows-x64-setup.tmp" called "MoveFileW" with parameter %TEMP%\ReShiki\is-8I2ZS7WLI2.tmp & %TEMP%\ReShiki\unins000.exe (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "MoveFileW" with parameter %TEMP%\ReShiki\is-79Q41G6WDT.tmp & %TEMP%\ReShiki\build.json (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "MoveFileW" with parameter %TEMP%\ReShiki\is-8ZJ2Y74PEF.tmp & %TEMP%\ReShiki\README.txt (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "MoveFileW" with parameter %TEMP%\ReShiki\is-0ECM1V53M7.tmp & %TEMP%\ReShiki\reshiki.exe (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "MoveFileW" with parameter %TEMP%\ReShiki\Licenses\is-8YT5C85ZBL.tmp & %TEMP%\ReShiki\Licenses\LICENSE (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "MoveFileW" with parameter %TEMP%\ReShiki\Licenses\is-D1N70KEUQF.tmp & %TEMP%\ReShiki\Licenses\LICENSE-APACHE (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "MoveFileW" with parameter %TEMP%\ReShiki\Licenses\is-EKFBSIMTKJ.tmp & %TEMP%\ReShiki\Licenses\LICENSE-MIT (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "MoveFileW" with parameter %TEMP%\ReShiki\Licenses\is-XEWFKYGPG6.tmp & %TEMP%\ReShiki\Licenses\NOTICE (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "MoveFileW" with parameter %TEMP%\ReShiki\Licenses\is-BH3AZBQD0Y.tmp & %TEMP%\ReShiki\Licenses\THIRD-PARTY-NOTICES.txt (UID: 00000000-00002700)36:T8b50,"reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter GetFinalPathNameByHandleW (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001096) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter DrawThemeTextEx (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteW (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter TaskDialogIndirect (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter IsWow64GuestMachineSupported (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter SetProcessMitigationPolicy (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter AreDpiAwarenessContextsEqual (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter AlphaBlend (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter ImmAssociateContextEx (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter SHGetStockIconInfo (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter SHGetImageList (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00002700) "reshiki-0.12.0-windows-x64-setup.tmp" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00002700) "reshiki.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter CreateDXGIFactory2 (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter CreateDXGIFactory1 (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DCompile (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromHdc (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTQueryAdapterInfo (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTCloseAdapter (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvValidateVersion (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvSetCallbackProcs (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvCreateContext (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvDeleteContext (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvSetContext (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvReleaseContext (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvCopyContext (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvCreateLayerContext (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvShareLists (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvGetProcAddress (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvDescribeLayerPlane (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvSetLayerPaletteEntries (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvGetLayerPaletteEntries (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvRealizeLayerPalette (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvSwapLayerBuffers (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvSwapMultipleBuffers (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvDescribePixelFormat (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvSetPixelFormat (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvSwapBuffers (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter DrvPresentBuffers (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter VM3DGLHelperInit (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter VM3DGLHelperCleanup (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter VM3DGLHelperGetDevCapMaxCount (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter VM3DGLHelperSetLogLevels (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter VM3DGLHelperLog (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTCreateAllocation (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTDestroyAllocation (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTSetAllocationPriority (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTQueryAllocationResidency (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTQueryResourceInfo (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTOpenResource (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTCreateDevice (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTDestroyDevice (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTLock (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTUnlock (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTGetDisplayModeList (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTSetDisplayMode (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTGetMultisampleMethodList (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTPresent (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTRender (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromDeviceName (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTGetSharedPrimaryHandle (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTEscape (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTSetVidPnSourceOwner (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTCreateOverlay (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTUpdateOverlay (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTFlipOverlay (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTDestroyOverlay (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTWaitForVerticalBlankEvent (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTSetGammaRamp (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTGetDeviceState (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTCreateDCFromMemory (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTDestroyDCFromMemory (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTSetContextSchedulingPriority (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTGetContextSchedulingPriority (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTSetProcessSchedulingPriorityClass (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTGetProcessSchedulingPriorityClass (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTReleaseProcessVidPnSourceOwners (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTGetScanLine (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTPollDisplayChildren (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTSetQueuedLimit (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTInvalidateActiveVidPn (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTCheckOcclusion (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTCreateContext (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTDestroyContext (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTCreateSynchronizationObject (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTDestroySynchronizationObject (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTWaitForSynchronizationObject (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTSignalSynchronizationObject (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTCheckMonitorPowerState (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromGdiDisplayName (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTCheckExclusiveOwnership (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTSetDisplayPrivateDriverFormat (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTSharedPrimaryLockNotification (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter D3DKMTSharedPrimaryUnLockNotification (UID: 00000000-00004092) "reshiki.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00004092)37:T44b,Sleep@KERNEL32.DLL at 00000000-00001096-54195-113-009D3EB8 Sleep@KERNEL32.DLL at 00000000-00001096-54195-114-009D3C14 Sleep@KERNEL32.DLL at 00000000-00001096-54195-118-009D423C Sleep@KERNEL32.DLL at 00000000-00001096-54195-184-009D6CC4 Sleep@KERNEL32.DLL at 00000000-00001096-54195-189-009D677C Sleep@KERNEL32.DLL at 00000000-00001096-54195-214-009D4434 Sleep@KERNEL32.DLL at 00000000-00001096-54195-2685-009D4A64 WaitForSingleObject@KERNEL32.DLL at 00000000-00001096-54195-2981-00A0B86C Sleep@KERNEL32.DLL at 00000000-00001096-54195-2993-00A688F4 WaitForSingleObject@KERNEL32.DLL at 00000000-00001096-54195-3493-00A67BCC Sleep@KERNEL32.DLL at 00000000-00001096-54195-3725-00A794F8 MsgWaitForMultipleObjects at 00000000-00001096-54195-3743-00A79F84 MsgWaitForMultipleObjects at 00000000-00001096-54195-3748-009DFBA0 WaitForSingleObject@KERNEL32.DLL at 00000000-00001096-54195-3957-009F422A Sleep@KERNEL32.DLL at 00000000-00001096-54195-3963-009F4358 WaitForSingleObject@KERNEL32.DLL at 00000000-00001096-54195-3964-009F4220 Sleep@KERNEL32.DLL at 00000000-00001096-54195-5988-009F3DFD38:T541,Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp")39:T4cc,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp")3a:Td7f,"Software\Embarcadero\Locales" in Source: reshiki-0.12.0-windows-x64-setup.exe "Software\CodeGear\Locales" in Source: reshiki-0.12.0-windows-x64-setup.exe "Software\Borland\Locales" in Source: reshiki-0.12.0-windows-x64-setup.exe "Software\Borland\Delphi\Locales" in Source: reshiki-0.12.0-windows-x64-setup.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: reshiki-0.12.0-windows-x64-setup.exe "Software\Embarcadero\Locales" in Source: 00000000-00001096.00000001.149917.009D1000.00000020.mdmp "Software\CodeGear\Locales" in Source: 00000000-00001096.00000001.149917.009D1000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00001096.00000001.149917.009D1000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00001096.00000001.149917.009D1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001096.00000001.149917.009D1000.00000020.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002700.00000001.150014.036A0000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00002700.00000001.150014.036A0000.00000004.mdmp 00000000-00002700.00000002.151135.036C3000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00002700.00000001.150014.036A0000.00000004.mdmp 00000000-00002700.00000002.151135.036C3000.00000004.mdmp "sSoftware\Wow6432" in Source: 00000000-00002700.00000001.150014.036A0000.00000004.mdmp 00000000-00002700.00000002.151135.036C3000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002700.00000001.150014.0373A000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002700.00000001.150014.0373A000.00000004.mdmp 00000000-00002700.00000002.151135.03746000.00000004.mdmp "Software\Classes\CLSID\{{3BAC2B7E-73A2-4F3A-9CE7-5E9B438C59B4}\ProgID" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\CLSID\{{3BAC2B7E-73A2-4F3A-9CE7-5E9B438C59B4}\Verb\0" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\CLSID\{{3BAC2B7E-73A2-4F3A-9CE7-5E9B438C59B4}\Verb\1" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\CLSID\{{3BAC2B7E-73A2-4F3A-9CE7-5E9B438C59B4}" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\ReShiki.EmbeddedDrawing.1\CLSID" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\ReShiki.Drawing\shell\open\command" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\CLSID\{{3BAC2B7E-73A2-4F3A-9CE7-5E9B438C59B4}\LocalServer32" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\CLSID\{{3BAC2B7E-73A2-4F3A-9CE7-5E9B438C59B4}\InprocHandler32" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\.rsk\OpenWithProgids" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\ReShiki.Drawing" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\ReShiki.EmbeddedDrawing.1" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\.reshiki\OpenWithProgids" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\.moruno\OpenWithProgids" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp3b:T11e9,Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2700:168:WilStaging_02" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2700:168:WilStaging_02" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2700:64:WilError_01" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!0a2538" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer" Process reshiki-0.12.0-windows-x64-setup.tmp created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer"3c:T148e,"Software\Embarcadero\Locales" in Source: 00000000-00001096.00000001.149917.009D1000.00000020.mdmp "Software\CodeGear\Locales" in Source: 00000000-00001096.00000001.149917.009D1000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00001096.00000001.149917.009D1000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00001096.00000001.149917.009D1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001096.00000001.149917.009D1000.00000020.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002700.00000001.150014.036A0000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00002700.00000001.150014.036A0000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00002700.00000001.150014.036A0000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00002700.00000001.150014.036A0000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00002700.00000001.150014.036A0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002700.00000001.150014.0373A000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002700.00000001.150014.0373A000.00000004.mdmp "Software\Classes\CLSID\{{3BAC2B7E-73A2-4F3A-9CE7-5E9B438C59B4}\ProgID" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\CLSID\{{3BAC2B7E-73A2-4F3A-9CE7-5E9B438C59B4}\Verb\0" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\CLSID\{{3BAC2B7E-73A2-4F3A-9CE7-5E9B438C59B4}\Verb\1" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\CLSID\{{3BAC2B7E-73A2-4F3A-9CE7-5E9B438C59B4}" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\ReShiki.EmbeddedDrawing.1\CLSID" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\ReShiki.Drawing\shell\open\command" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\CLSID\{{3BAC2B7E-73A2-4F3A-9CE7-5E9B438C59B4}\LocalServer32" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\CLSID\{{3BAC2B7E-73A2-4F3A-9CE7-5E9B438C59B4}\InprocHandler32" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\.rsk\OpenWithProgids" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\ReShiki.Drawing" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\ReShiki.EmbeddedDrawing.1" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\.reshiki\OpenWithProgids" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "Software\Classes\.moruno\OpenWithProgids" in Source: 00000000-00002700.00000001.150014.057B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00002700.00000001.150014.72681000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00002700.00000001.150014.72681000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00002700.00000001.150014.72681000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00002700.00000001.150014.72681000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00002700.00000002.151135.013BB000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002700.00000002.151135.036C3000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002700.00000002.151135.036C3000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00002700.00000002.151135.036C3000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00002700.00000002.151135.036C3000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00002700.00000002.151135.036C3000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00002700.00000002.151135.036C3000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002700.00000002.151135.03746000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002700.00000002.151135.03746000.00000004.mdmp "Registry\Machine\Software\C=" in Source: 00000000-00002700.00000002.151135.03746000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002700.00000002.151135.03746000.00000004.mdmp "Registry\Machine\Software\Cf" in Source: 00000000-00002700.00000002.151135.03746000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-" in Source: 00000000-00002700.00000002.151135.03746000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001\fdeploy" in Source: 00000000-00002700.00000002.151135.03746000.00000004.mdmp3d:T1a2a,"reshiki-0.12.0-windows-x64-setup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73890000 "reshiki-0.12.0-windows-x64-setup.exe" loaded module "KERNEL32.DLL" at base 73a60000 "reshiki-0.12.0-windows-x64-setup.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 73870000 "reshiki-0.12.0-windows-x64-setup.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76850000 "reshiki-0.12.0-windows-x64-setup.exe" loaded module "RPCRT4.DLL" at base 76780000 "reshiki-0.12.0-windows-x64-setup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 737f0000 "reshiki-0.12.0-windows-x64-setup.exe" loaded module "NTDLL.DLL" at base 77020000 "reshiki-0.12.0-windows-x64-setup.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73720000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73890000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "KERNEL32.DLL" at base 73a60000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "MSCTF.DLL" at base 76130000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "IMM32.DLL" at base 742e0000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 737f0000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 73360000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "NTDLL.DLL" at base 77020000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "RPCRT4.DLL" at base 76780000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "UXTHEME.DLL" at base 737f0000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 74bb0000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "COMCTL32" at base 73440000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "USER32.DLL" at base 740a0000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "COMCTL32.DLL" at base 73440000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "OLEAUT32.DLL" at base 768b0000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 740a0000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 740a0000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 76280000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76130000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "DWMAPI.DLL" at base 737c0000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "MSIMG32.DLL" at base 72d40000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 73f10000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 737c0000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 73870000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76850000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 72d30000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\RSTRTMGR.DLL" at base 72d00000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "SHELL32.DLL" at base 74bb0000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSWOW64\THUMBCACHE.DLL" at base 72c60000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWSCODECS.DLL" at base 731f0000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\MSFTEDIT.DLL" at base 728d0000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.GLOBALIZATION.DLL" at base 72790000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 72680000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 73a60000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 724f0000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 72150000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76950000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "SSPICLI.DLL" at base 73a40000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 71dc0000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 71980000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 8590000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 76950000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "CSCAPI.DLL" at base 71850000 "reshiki-0.12.0-windows-x64-setup.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73720000 "reshiki.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff81190000 "reshiki.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fffa13f0000 "reshiki.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fffa13f0000 "reshiki.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7fffa13f0000 "reshiki.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fffa13f0000 "reshiki.exe" loaded module "KERNEL32" at base 7fffa3bb0000 "reshiki.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fffa1210000 "reshiki.exe" loaded module "RPCRT4.DLL" at base 7fffa3fd0000 "reshiki.exe" loaded module "GDI32.DLL" at base 7fffa24e0000 "reshiki.exe" loaded module "D3D12.DLL" at base 7fff72e40000 "reshiki.exe" loaded module "DXGI.DLL" at base 7fff9ff20000 "reshiki.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 7fff9fa70000 "reshiki.exe" loaded module "D3DCOMPILER_47.DLL" at base 7fff9e150000 "reshiki.exe" loaded module "OPENGL32.DLL" at base 7fff72fb0000 "reshiki.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff9f6f0000 "reshiki.exe" loaded module "OPENGL32" at base 7fff72fb0000 "reshiki.exe" loaded module "GDI32" at base 7fffa24e0000 "reshiki.exe" loaded module "VM3DGL64.DLL" at base 7fff70250000 "reshiki.exe" loaded module "VM3DGLHELPER64.DLL" at base 7fff80f40000 "reshiki.exe" loaded module "KERNEL32.DLL" at base 7fffa3bb0000 "reshiki.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7fffa1140000 "reshiki.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 7fffa3bb00003e:T54e,"reshiki-0.12.0-windows-x64-setup.exe" was detected as "Inno Setup Module" and name: "Installer" "reshiki-0.12.0-windows-x64-setup.exe" was detected as ".NET Reactor" and name: "Protector" "reshiki-0.12.0-windows-x64-setup.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "reshiki-0.12.0-windows-x64-setup.exe" was detected as "Turbo Linker" and name: "Linker" "is-8I2ZS7WLI2.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-8I2ZS7WLI2.tmp" was detected as ".NET Reactor" and name: "Protector" "is-8I2ZS7WLI2.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-8I2ZS7WLI2.tmp" was detected as "Turbo Linker" and name: "Linker" "reshiki-0.12.0-windows-x64-setup.tmp" was detected as "Inno Setup Module" and name: "Installer" "reshiki-0.12.0-windows-x64-setup.tmp" was detected as ".NET Reactor" and name: "Protector" "reshiki-0.12.0-windows-x64-setup.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "reshiki-0.12.0-windows-x64-setup.tmp" was detected as "Turbo Linker" and name: "Linker" "_setup64.tmp" was detected as "Inno Setup Module" and name: "Installer" "_setup64.tmp" was detected as ".NET Reactor" and name: "Protector" "_setup64.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "_setup64.tmp" was detected as "Turbo Linker" and name: "Linker"3f:T942,"reshiki-0.12.0-windows-x64-setup.tmp" touched "Local Icon Cache" (Path: "HKCU\WOW6432NODE\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}") "reshiki-0.12.0-windows-x64-setup.tmp" touched "Shared Bitmap Object" (Path: "HKCU\WOW6432NODE\CLSID\{4DB26476-6787-4046-B836-E8412A9E8A27}\TREATAS") "reshiki-0.12.0-windows-x64-setup.tmp" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TREATAS") "reshiki-0.12.0-windows-x64-setup.tmp" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "reshiki-0.12.0-windows-x64-setup.tmp" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "reshiki-0.12.0-windows-x64-setup.tmp" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "reshiki-0.12.0-windows-x64-setup.tmp" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "reshiki-0.12.0-windows-x64-setup.tmp" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "reshiki-0.12.0-windows-x64-setup.tmp" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "reshiki-0.12.0-windows-x64-setup.tmp" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "reshiki-0.12.0-windows-x64-setup.tmp" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "reshiki-0.12.0-windows-x64-setup.tmp" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "reshiki-0.12.0-windows-x64-setup.tmp" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "reshiki-0.12.0-windows-x64-setup.tmp" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "reshiki-0.12.0-windows-x64-setup.tmp" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS")40:T44a,"reshiki-0.12.0-windows-x64-setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "reshiki-0.12.0-windows-x64-setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "reshiki-0.12.0-windows-x64-setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "reshiki-0.12.0-windows-x64-setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "reshiki-0.12.0-windows-x64-setup.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "reshiki-0.12.0-windows-x64-setup.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "reshiki-0.12.0-windows-x64-setup.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "reshiki-0.12.0-windows-x64-setup.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "reshiki.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "reshiki.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")41:T498,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "LoadLibraryEx failed" (Indicator: "LoadLibrary"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "LoadLibraryEx failed" (Indicator: "LoadLibrary"; Source: "00000000-00001096.00000001.149917.009D1000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001096.00000001.149917.00A83000.00000004.mdmp, 00000000-00001096.00000002.151142.00A83000.00000004.mdmp")42:T952,"ReShiki.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID 3v8qi4duwrfx8un KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Thu Oct 15 12:12:10 2026 atime=Thu Oct 15 12:12:10 2026 mtime=Wed Oct 14 21:17:02 2026 length=70531072 window=normal IDListSize 0x0214 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Temp\ReShiki\reshiki.exe""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\ReShiki.lnk]- [targetUID: 00000000-00002700] "is-0ECM1V53M7.tmp" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\ReShiki\is-0ECM1V53M7.tmp]- [targetUID: 00000000-00002700] "is-8I2ZS7WLI2.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\ReShiki\is-8I2ZS7WLI2.tmp]- [targetUID: 00000000-00002700] "reshiki-0.12.0-windows-x64-setup.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-25JT3FNJ57.tmp\reshiki-0.12.0-windows-x64-setup.tmp]- [targetUID: 00000000-00002700] "is-BH3AZBQD0Y.tmp" has type "Unicode text UTF-8 text"- Location: [%TEMP%\ReShiki\Licenses\is-BH3AZBQD0Y.tmp]- [targetUID: 00000000-00002700] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-KJ317AINMA.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00002700] "unins000.dat" has type "InnoSetup Log 64-bit ReShiki version 0x41e 3720 bytes 3v8QI4DUW\QB8OZEL\3 C:\Users\HAPUBWS\AppData\Local\Temp\ReShik"- Location: [%TEMP%\ReShiki\unins000.dat]- [targetUID: 00000000-00002700] "is-79Q41G6WDT.tmp" has type "JSON text data"- Location: [%TEMP%\ReShiki\is-79Q41G6WDT.tmp]- [targetUID: 00000000-00002700] "is-XEWFKYGPG6.tmp" has type "ASCII text"- Location: [%TEMP%\ReShiki\Licenses\is-XEWFKYGPG6.tmp]- [targetUID: 00000000-00002700] "is-EKFBSIMTKJ.tmp" has type "ASCII text"- Location: [%TEMP%\ReShiki\Licenses\is-EKFBSIMTKJ.tmp]- [targetUID: 00000000-00002700] "is-8YT5C85ZBL.tmp" has type "ASCII text"- Location: [%TEMP%\ReShiki\Licenses\is-8YT5C85ZBL.tmp]- [targetUID: 00000000-00002700] "is-8ZJ2Y74PEF.tmp" has type "Unicode text UTF-8 text with CRLF line terminators"- Location: [%TEMP%\ReShiki\is-8ZJ2Y74PEF.tmp]- [targetUID: 00000000-00002700]43:T4eb,"is-0ECM1V53M7.tmp" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections" - Location: [%TEMP%\ReShiki\is-0ECM1V53M7.tmp] "is-8I2ZS7WLI2.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections" - Location: [%TEMP%\ReShiki\is-8I2ZS7WLI2.tmp] "reshiki-0.12.0-windows-x64-setup.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections" - Location: [%TEMP%\is-25JT3FNJ57.tmp\reshiki-0.12.0-windows-x64-setup.tmp] "is-BH3AZBQD0Y.tmp" has type "Unicode text UTF-8 text" - Location: [%TEMP%\ReShiki\Licenses\is-BH3AZBQD0Y.tmp] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections" - Location: [%TEMP%\is-KJ317AINMA.tmp\_isetup\_setup64.tmp] "is-79Q41G6WDT.tmp" has type "JSON text data" - Location: [%TEMP%\ReShiki\is-79Q41G6WDT.tmp] "is-XEWFKYGPG6.tmp" has type "ASCII text" - Location: [%TEMP%\ReShiki\Licenses\is-XEWFKYGPG6.tmp] "is-EKFBSIMTKJ.tmp" has type "ASCII text" - Location: [%TEMP%\ReShiki\Licenses\is-EKFBSIMTKJ.tmp] "is-8YT5C85ZBL.tmp" has type "ASCII text" - Location: [%TEMP%\ReShiki\Licenses\is-8YT5C85ZBL.tmp] "is-8ZJ2Y74PEF.tmp" has type "Unicode text UTF-8 text with CRLF line terminators" - Location: [%TEMP%\ReShiki\is-8ZJ2Y74PEF.tmp]44:T61b,"reshiki-0.12.0-windows-x64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")45:Tcfd,"reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "RESHIKI-0.12.0-WINDOWS-X64-SETUP.EXE"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "RESHIKI-0.12.0-WINDOWS-X64-SETUP"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "reshiki-0.12.0-windows-x64-setup.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")46:T50c,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains a Wine emulator-related string Matched sigs: Able to detect virtual machine (string) Matched sigs: Able to identify sandbox environment running process Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Attempts to detect virtual machine (file access) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to query volume size47:T904,"reshiki-0.12.0-windows-x64-setup.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "reshiki-0.12.0-windows-x64-setup.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "reshiki-0.12.0-windows-x64-setup.exe" trying to access non-existent file "C:\FLTLIB.DLL" "reshiki-0.12.0-windows-x64-setup.exe" trying to access non-existent file "C:\MSVCP140.DLL" "reshiki-0.12.0-windows-x64-setup.exe" trying to access non-existent file "C:\MSVCP140.dll" "reshiki-0.12.0-windows-x64-setup.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "reshiki-0.12.0-windows-x64-setup.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "reshiki-0.12.0-windows-x64-setup.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-25JT3FNJ57.tmp\IPHLPAPI.DLL" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-25JT3FNJ57.tmp\BCRYPT.DLL" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-25JT3FNJ57.tmp\bcrypt.dll" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-25JT3FNJ57.tmp\WTSAPI32.DLL" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-25JT3FNJ57.tmp\FLTLIB.DLL" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-25JT3FNJ57.tmp\MSVCP140.DLL" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-25JT3FNJ57.tmp\MSVCP140.dll" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-25JT3FNJ57.tmp\VCRUNTIME140.DLL" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-25JT3FNJ57.tmp\VCRUNTIME140.dll"48:T727,"reshiki-0.12.0-windows-x64-setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-25JT3FNJ57.TMP" "reshiki-0.12.0-windows-x64-setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-25JT3FNJ57.tmp" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-25JT3FNJ57.tmp\WINSPOOL.DRV" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-25JT3FNJ57.tmp\winspool.drv" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-25JT3FNJ57.tmp\RESHIKI-0.12.0-WINDOWS-X64-SETUP.TMP.LOCAL" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-25JT3FNJ57.tmp\reshiki-0.12.0-windows-x64-setup.tmp.Local\" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-KJ317AINMA.TMP" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-KJ317AINMA.tmp" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Explorer\ICONCACHETODELETE" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Explorer\IconCacheToDelete" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "A:" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "B:" "reshiki-0.12.0-windows-x64-setup.tmp" trying to access non-existent file "D:"49:T76a,Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WNetGetUniversalNameW" (Indicator: "WNetGetUniversalName"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp") Found reference to API "WNetGetUniversalNameW" (Indicator: "WNetGetUniversalName"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp")4a:T43c,Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "reshiki-0.12.0-windows-x64-setup.exe")4b:T468,Found reference to API "WNetGetConnectionW" (Indicator: "NetGetConnection"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WNetEnumResourceW" (Indicator: "NetEnumResource"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WNetCloseEnum" (Indicator: "NetCloseEnum"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WNetEnumResourceW" (Indicator: "NetEnumResource"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "NetGetConnection"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp") Found reference to API "WNetCloseEnum" (Indicator: "NetCloseEnum"; Source: "00000000-00002700.00000000.148092.01203000.00000004.mdmp, 00000000-00002700.00000001.150014.01203000.00000004.mdmp, 00000000-00002700.00000002.151135.01203000.00000004.mdmp")4c:Ta03,Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "reshiki-0.12.0-windows-x64-setup.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "reshiki-0.12.0-windows-x64-setup.exe")4d:T732,Pattern match: "https://jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://www.apache.org/licenses/" Pattern match: "https://github.com/ameyanagi/cosmolkit.git?rev=252a1f3d6480fc4a0abcd51d76707f51f69b4406#252a1f3d6480fc4a0abcd51d76707f51f69b4406" Pattern match: "reshiki.app/contents/resources/licenses" Pattern match: "https://reshiki.com/this" Pattern match: "https://reshiki.com/" Pattern match: "https://reshiki.com/guide/install/" Pattern match: "https://github.com/ameyanagi/reshiki/releases" Heuristic match: "gp*3hu.kh" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "font.name" Pattern match: "http://www.virtualbox.org" Pattern match: "http://go.microsoft.com/fwlink/?linkid=215117" Pattern match: "http://go.microsoft.com/fwlink/?linkid=223554" Pattern match: "http://support.microsoft.com/kb/4023057" Pattern match: "http://www.cacetech.com" Pattern match: "http://www.winpcap.org" Pattern match: "http://www.autoitscript.com/autoit3" Pattern match: "https://www.wireshark.org" Pattern match: "https://ask.wireshark.org/" Pattern match: "https://www.wireshark.org/download.html" Pattern match: "http://www.adobe.com/support/main.html" Pattern match: "http://www.adobe.com/products/acrobat/readstep.html" Pattern match: "http://www.adobe.com" Pattern match: "http://java.com/help" Pattern match: "http://java.com" Pattern match: "http://java.sun.com" Pattern match: "https://support.mozilla.org" Pattern match: "https://www.mozilla.org" Pattern match: "https://www.mozilla.org/firefox/64.0/releasenotes" Pattern match: "https://www.msn.com/favicon.ico" Pattern match: "https://npcap.com/#download" Pattern match: "https://npcap.com/" Pattern match: "www.onet[1].xml" Heuristic match: "tobp2wjhg@ttobp2.co" Heuristic match: "]6n.se"4e:T2af0,Found URL "https://jrsoftware.org/ishelp/index.php?topic=setupcmdlinesetupkernel32.dllsoftware\microsoft\windows" - Source: "00000000-00001096.00000001.149917.009D1000.00000020.mdmp") Found URL "https://github.com/ameyanagi/reshiki/releasesan" - Source: "00000000-00001096.00000001.149917.04890000.00000004.mdmp") Found URL "https://reshiki.com/guide/install/the" - Source: "00000000-00001096.00000001.149917.04890000.00000004.mdmp") Found URL "https://reshiki.com/compact" - Source: "00000000-00001096.00000001.149917.04890000.00000004.mdmp") Found URL "https://reshiki.com/guide/install/qy7tu6xoaxkdb&" - Source: "00000000-00001096.00000001.149917.04890000.00000004.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00002700.00000001.150014.036A0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00002700.00000001.150014.036A0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00002700.00000001.150014.036A0000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00002700.00000001.150014.036A0000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00002700.00000001.150014.036A0000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00002700.00000001.150014.036A0000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00002700.00000001.150014.036A0000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00002700.00000001.150014.036A0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00002700.00000001.150014.036A0000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00002700.00000001.150014.036A0000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00002700.00000001.150014.036A0000.00000004.mdmp") Found URL "https://www.msn.com/favicon.ico" - Source: "00000000-00002700.00000001.150014.036A0000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00002700.00000001.150014.036A0000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00002700.00000002.151135.036C3000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00002700.00000002.151135.036C3000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00002700.00000002.151135.036C3000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00002700.00000002.151135.036C3000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00002700.00000002.151135.036C3000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00002700.00000002.151135.036C3000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00002700.00000002.151135.036C3000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00002700.00000002.151135.036C3000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00002700.00000002.151135.036C3000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00002700.00000002.151135.036C3000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00002700.00000002.151135.036C3000.00000004.mdmp") Found URL "https://www.msn.com/favicon.ico" - Source: "00000000-00002700.00000002.151135.036C3000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00002700.00000002.151135.036C3000.00000004.mdmp") Found URL "https://npcap.com/