I searched all places in IDA that call the imported
WriteFile function and put a breakpoint on them.
But while debugging I saw with ProcMon that my exe wrote to the file but even though it did not stop on the breakpoint. I also saw that file was written to.
Why is that?