General

Malware Config

Signatures

Files

• OneDriveSetup.exe

  .exe windows x64

  e35861eff59498a8462b8c59a7cde298

  
  

  Code Sign

  33:00:00:04:24:2a:2c:31:dc:36:18:25:58:00:00:00:00:04:24

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  02-09-2021 18:25

  Not After

  01-09-2022 18:25

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0c:52:4c:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  06-07-2010 20:40

  Not After

  06-07-2025 20:50

  Subject

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  fc:54:2e:65:aa:19:76:36:6b:4b:fb:82:5b:f0:36:0f:e9:f7:30:85:49:3b:67:7a:ce:e5:e7:72:d0:95:d3:4f

  Signer

  Actual PE Digest

  fc:54:2e:65:aa:19:76:36:6b:4b:fb:82:5b:f0:36:0f:e9:f7:30:85:49:3b:67:7a:ce:e5:e7:72:d0:95:d3:4f

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  20-01-2023 16:00

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  bcrypt

  BCryptGenRandom

  BCryptDestroyKey

  BCryptEncrypt

  BCryptGenerateSymmetricKey

  BCryptOpenAlgorithmProvider

  BCryptCloseAlgorithmProvider

  BCryptSetProperty

  ntdll

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  RtlPcToFileHeader

  RtlUnwindEx

  RtlUnwind

  VerSetConditionMask

  RtlCaptureContext

  wer

  WerReportSubmit

  WerReportCloseHandle

  WerReportSetParameter

  WerReportCreate

  kernel32

  QueueUserWorkItem

  SetThreadPriority

  GetThreadPriority

  SetPriorityClass

  GetPriorityClass

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetFileType

  GetVolumePathNameW

  GetUserDefaultUILanguage

  FindResourceW

  SizeofResource

  LockResource

  LoadResource

  FindResourceExW

  WriteConsoleW

  GetFileSizeEx

  GetFileSize

  GetFileInformationByHandle

  GetFileAttributesExW

  GetFileAttributesW

  GetDiskFreeSpaceExW

  FindVolumeClose

  FindNextVolumeW

  FindFirstVolumeW

  ExpandEnvironmentStringsW

  GetLongPathNameW

  VerifyVersionInfoW

  LCMapStringW

  WideCharToMultiByte

  MultiByteToWideChar

  K32GetModuleFileNameExW

  GetUserDefaultLocaleName

  GetUserDefaultLCID

  MoveFileW

  GetModuleHandleW

  GetProductInfo

  GetVersionExW

  GetSystemTimeAsFileTime

  OpenProcess

  CreateProcessW

  TerminateProcess

  GetCurrentProcess

  CreateMutexW

  WaitForSingleObject

  GetModuleFileNameW

  WerUnregisterFile

  WerRegisterFile

  LoadLibraryW

  GetProcAddress

  DeviceIoControl

  FindNextFileW

  FindFirstFileW

  FindClose

  Process32NextW

  CompareStringW

  UnlockFileEx

  LockFileEx

  SystemTimeToFileTime

  MoveFileExW

  CopyFileW

  FreeLibrary

  Sleep

  CloseHandle

  GetTempPathW

  SetFileTime

  RemoveDirectoryW

  GetTempFileNameW

  GetFullPathNameW

  CreateDirectoryW

  GetSystemTime

  GetCurrentThreadId

  GetCurrentProcessId

  SetLastError

  WriteFile

  DeleteFileW

  GetUserGeoID

  SetEnvironmentVariableW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  GetOEMCP

  GetACP

  IsValidCodePage

  ReadConsoleW

  SetStdHandle

  CompareStringOrdinal

  GetConsoleOutputCP

  EnumSystemLocalesW

  IsValidLocale

  RemoveDirectoryA

  GetShortPathNameW

  CreateDirectoryA

  CreateSymbolicLinkW

  OpenFileById

  GetFileInformationByHandleEx

  RegisterApplicationRestart

  GetComputerNameW

  ReadDirectoryChangesW

  SetDllDirectoryW

  LoadLibraryExW

  GetLocaleInfoW

  GetTimeFormatW

  GetDateFormatW

  GetCurrentThread

  GetStdHandle

  ExitProcess

  VirtualAlloc

  FileTimeToSystemTime

  SystemTimeToTzSpecificLocalTime

  PeekNamedPipe

  Process32FirstW

  GetCommandLineW

  GetDriveTypeW

  GetSystemDefaultLCID

  FreeLibraryAndExitThread

  ExitThread

  IsWow64Process

  GetSystemTimes

  GetExitCodeProcess

  GetProcessTimes

  ReleaseMutex

  CreateThread

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  InterlockedPushEntrySList

  LoadLibraryExA

  VirtualProtect

  GetLocaleInfoEx

  GetCPInfo

  CompareStringEx

  LCMapStringEx

  EncodePointer

  GetTickCount64

  CreateEventExW

  FlsFree

  FlsSetValue

  FlsGetValue

  FlsAlloc

  CreateHardLinkW

  SetFilePointerEx

  SetFileAttributesW

  FindFirstFileExW

  CreateFileW

  CompareFileTime

  DeleteCriticalSection

  InitializeCriticalSectionEx

  GetCurrentDirectoryW

  GetProcessHeap

  HeapSize

  HeapFree

  HeapReAlloc

  HeapAlloc

  HeapDestroy

  GetLastError

  RaiseException

  DecodePointer

  LocalFree

  LocalAlloc

  LeaveCriticalSection

  EnterCriticalSection

  GetEnvironmentVariableW

  GetTempFileNameA

  CompareStringA

  FileTimeToLocalFileTime

  FileTimeToDosDateTime

  WaitForMultipleObjectsEx

  VirtualFree

  FlushInstructionCache

  InterlockedPopEntrySList

  PostQueuedCompletionStatus

  WaitForMultipleObjects

  GlobalMemoryStatusEx

  GetLocalTime

  CreateToolhelp32Snapshot

  GetQueuedCompletionStatus

  CreateIoCompletionPort

  IsDebuggerPresent

  SetFilePointer

  SetFileInformationByHandle

  ReadFile

  GetConsoleMode

  GlobalLock

  GlobalAlloc

  AcquireSRWLockShared

  GetComputerNameExW

  GetSystemDefaultUILanguage

  GetFinalPathNameByHandleW

  OutputDebugStringA

  GetModuleFileNameA

  GetModuleHandleExW

  GetTimeZoneInformation

  GetNativeSystemInfo

  GetSystemPowerStatus

  FlushFileBuffers

  GetTickCount

  QueryPerformanceCounter

  MapViewOfFile

  CreateFileMappingW

  FormatMessageA

  UnlockFile

  HeapCompact

  GetSystemInfo

  DeleteFileA

  WaitForSingleObjectEx

  LoadLibraryA

  CreateFileA

  FlushViewOfFile

  OutputDebugStringW

  GetFileAttributesA

  GetDiskFreeSpaceA

  FormatMessageW

  GetTempPathA

  HeapValidate

  UnmapViewOfFile

  SetEndOfFile

  GetFullPathNameA

  LockFile

  GetDiskFreeSpaceW

  HeapCreate

  AreFileApisANSI

  InitializeCriticalSection

  TryEnterCriticalSection

  InitOnceExecuteOnce

  InitializeCriticalSectionAndSpinCount

  SetEvent

  ResetEvent

  CreateEventW

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  InitializeSListHead

  GetStartupInfoW

  VirtualQuery

  InitializeSRWLock

  ReleaseSRWLockExclusive

  AcquireSRWLockExclusive

  GetStringTypeW

  SwitchToThread

  GetExitCodeThread

  InitializeConditionVariable

  WakeConditionVariable

  WakeAllConditionVariable

  SleepConditionVariableCS

  SleepConditionVariableSRW

  QueryPerformanceFrequency

  ReleaseSRWLockShared

  user32

  PostQuitMessage

  AllowSetForegroundWindow

  GetShellWindow

  GetSystemMetrics

  SendMessageW

  AttachThreadInput

  IsWindow

  SetWindowPos

  IsWindowVisible

  BringWindowToTop

  CreateDialogParamW

  DialogBoxParamW

  GetDlgItem

  SetActiveWindow

  PostThreadMessageW

  SetForegroundWindow

  SetWindowTextW

  GetClientRect

  GetWindowRect

  MapWindowPoints

  GetWindowLongW

  SetWindowLongW

  SetWindowLongPtrW

  GetParent

  GetWindow

  LoadIconW

  MonitorFromWindow

  GetMonitorInfoW

  ShowWindow

  DestroyWindow

  GetForegroundWindow

  RegisterClassW

  SendMessageTimeoutW

  SystemParametersInfoW

  LoadCursorW

  SetCursor

  MsgWaitForMultipleObjectsEx

  PeekMessageW

  UnregisterClassW

  GetMessageW

  TranslateMessage

  DispatchMessageW

  PostMessageW

  GetWindowThreadProcessId

  EnumWindows

  GetClassNameW

  CreateWindowExW

  advapi32

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  IsValidAcl

  MapGenericMask

  RegGetValueA

  EventRegister

  EventWriteTransfer

  EventUnregister

  EventWrite

  CredWriteW

  CredReadW

  CredEnumerateW

  CredDeleteW

  CredFree

  CreateProcessWithTokenW

  RegOverridePredefKey

  LookupAccountNameW

  CryptDestroyKey

  CryptSetHashParam

  CryptImportKey

  AddAce

  DeleteAce

  GetAce

  InitializeAcl

  ConvertStringSidToSidW

  ImpersonateLoggedOnUser

  RevertToSelf

  AccessCheck

  OpenThreadToken

  ConvertSidToStringSidW

  SetNamedSecurityInfoW

  GetNamedSecurityInfoW

  SetEntriesInAclW

  StartServiceW

  StartServiceCtrlDispatcherW

  SetServiceStatus

  RegisterServiceCtrlHandlerW

  QueryServiceStatusEx

  QueryServiceStatus

  QueryServiceConfigW

  OpenServiceW

  OpenSCManagerW

  DeleteService

  CreateServiceW

  ControlService

  CloseServiceHandle

  ChangeServiceConfig2W

  ChangeServiceConfigW

  RegDeleteTreeW

  RegUnLoadKeyW

  RegLoadKeyW

  RegEnumKeyW

  RegDeleteKeyExW

  RegCreateKeyTransactedW

  GetUserNameW

  SetFileSecurityW

  GetAclInformation

  FreeSid

  DuplicateTokenEx

  CreateWellKnownSid

  AllocateAndInitializeSid

  CreateProcessAsUserW

  DuplicateToken

  RegGetValueW

  RegSetKeyValueW

  RegQueryInfoKeyW

  RegEnumValueW

  RegEnumKeyExW

  RegDeleteValueW

  LookupPrivilegeValueW

  IsValidSid

  InitializeSid

  GetTokenInformation

  GetSidSubAuthorityCount

  GetSidSubAuthority

  GetSidLengthRequired

  GetLengthSid

  EqualSid

  CopySid

  AdjustTokenPrivileges

  OpenProcessToken

  CryptDestroyHash

  CryptHashData

  CryptCreateHash

  CryptGetHashParam

  CryptReleaseContext

  CryptAcquireContextW

  RegSetValueExW

  RegQueryValueExW

  RegOpenKeyExW

  RegCreateKeyExW

  RegCloseKey

  shell32

  SHLoadNonloadedIconOverlayIdentifiers

  ShellExecuteW

  SHGetFolderPathW

  SHGetFolderPathA

  ShellExecuteExW

  SHGetKnownFolderPath

  CommandLineToArgvW

  SHCreateDirectoryExW

  SHFileOperationW

  SHGetSpecialFolderPathW

  SHChangeNotify

  SHParseDisplayName

  SHCreateItemFromParsingName

  SHGetFolderPathAndSubDirW

  SHSetKnownFolderPath

  ord526

  ole32

  CoSetProxyBlanket

  CLSIDFromString

  CreateBindCtx

  StringFromGUID2

  StringFromCLSID

  CoCreateInstance

  CoInitializeEx

  CoUninitialize

  CoTaskMemFree

  GetRunningObjectTable

  CoGetObject

  CoInitialize

  CoWaitForMultipleHandles

  CoCreateGuid

  CoCreateFreeThreadedMarshaler

  CreateItemMoniker

  CreateStreamOnHGlobal

  PropVariantClear

  CoTaskMemAlloc

  oleaut32

  SetErrorInfo

  GetErrorInfo

  SysAllocString

  VarBstrCmp

  VariantChangeType

  VariantClear

  VariantInit

  SysAllocStringLen

  LoadTypeLi

  LoadRegTypeLi

  GetRecordInfoFromTypeInfo

  SysFreeString

  SysStringLen

  SysStringByteLen

  SysAllocStringByteLen

  iphlpapi

  GetAdaptersInfo

  rstrtmgr

  RmGetList

  RmStartSession

  RmRegisterResources

  RmEndSession

  crypt32

  CertFreeCertificateChain

  CertVerifyCertificateChainPolicy

  CryptBinaryToStringW

  CryptStringToBinaryW

  rpcrt4

  RpcStringBindingComposeW

  RpcBindingVectorFree

  RpcServerInqBindings

  RpcServerRegisterIfEx

  UuidToStringW

  RpcBindingFree

  RpcBindingFromStringBindingW

  RpcExceptionFilter

  RpcStringFreeW

  RpcServerUnregisterIf

  RpcServerInqCallAttributesW

  RpcEpUnregister

  RpcEpRegisterW

  RpcBindingSetAuthInfoExW

  RpcServerUseProtseqW

  secur32

  GetUserNameExW

  shlwapi

  SHRegGetBoolUSValueW

  SHRegGetValueW

  StrStrIW

  PathIsPrefixW

  PathStripToRootW

  PathStripPathW

  PathSkipRootW

  SHGetValueW

  PathFindFileNameW

  PathIsRelativeW

  SHCreateStreamOnFileEx

  SHCreateStreamOnFileW

  ord219

  SHCreateStreamOnFileA

  SHSetValueW

  SHDeleteKeyW

  SHRegGetPathW

  SHDeleteValueW

  PathFindExtensionW

  PathRemoveFileSpecW

  PathIsDirectoryW

  PathFileExistsA

  PathFindFileNameA

  PathGetDriveNumberA

  PathIsDirectoryA

  PathFileExistsW

  version

  GetFileVersionInfoSizeW

  VerQueryValueW

  GetFileVersionInfoW

  wininet

  InternetQueryOptionW

  HttpQueryInfoA

  InternetConnectA

  HttpOpenRequestA

  InternetOpenW

  InternetCrackUrlA

  InternetCheckConnectionW

  InternetSetStatusCallbackW

  HttpAddRequestHeadersA

  InternetCloseHandle

  HttpSendRequestW

  InternetReadFile

  ws2_32

  accept

  bind

  closesocket

  htonl

  htons

  listen

  setsockopt

  socket

  WSAStartup

  WSAGetLastError

  send

  wtsapi32

  WTSFreeMemory

  WTSQueryUserToken

  WTSQuerySessionInformationW

  WTSEnumerateSessionsW

  userenv

  CreateEnvironmentBlock

  GetDefaultUserProfileDirectoryW

  UnloadUserProfile

  wintrust

  WTHelperGetProvSignerFromChain

  WTHelperProvDataFromStateData

  WinVerifyTrustEx

  gdi32

  CreateCompatibleDC

  CreateDIBSection

  SetDIBColorTable

  SelectObject

  GetObjectW

  DeleteDC

  DeleteObject

  urlmon

  URLOpenStreamW

  gdiplus

  GdipDeleteGraphics

  GdipGetImagePixelFormat

  GdipGetImageHeight

  GdipBitmapUnlockBits

  GdipBitmapLockBits

  GdipGetImageGraphicsContext

  GdipDisposeImage

  GdipCloneImage

  GdiplusStartup

  GdipFree

  GdipAlloc

  GdiplusShutdown

  GdipCreateBitmapFromScan0

  GdipCreateBitmapFromStream

  GdipGetImagePaletteSize

  GdipDrawImageI

  GdipGetImageWidth

  GdipGetImagePalette

  comctl32

  ord345

  cabinet

  ord23

  ord14

  ord13

  ord11

  ord10

  ord20

  ord22

  Exports

  Exports

  ?$TSS0@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ@4HA

  ??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z

  ??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@XZ

  ??0DebugEventListener@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z

  ??0DebugEventListener@Events@Applications@Microsoft@@QEAA@XZ

  ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z

  ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z

  ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@XZ

  ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z

  ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@5@@Z

  ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@E@Z

  ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@5@@Z

  ??0EventProperties@Events@Applications@Microsoft@@QEAA@XZ

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@$$QEAU0123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@NV?$allocator@N@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@_JV?$allocator@_J@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@CW4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@EW4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@FW4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@GW4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@HW4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@IW4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@JW4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@NW4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@PEBDW4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@UGUID_t@123@W4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@Utime_ticks_t@123@W4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@XZ

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@_JW4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@_KW4PiiKind@123@W4DataCategory@123@@Z

  ??0EventProperty@Events@Applications@Microsoft@@QEAA@_NW4PiiKind@123@W4DataCategory@123@@Z

  ??0GUID_t@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z

  ??0GUID_t@Events@Applications@Microsoft@@QEAA@HHHAEBV?$initializer_list@E@std@@@Z

  ??0GUID_t@Events@Applications@Microsoft@@QEAA@PEBD@Z

  ??0GUID_t@Events@Applications@Microsoft@@QEAA@QEBE_N@Z

  ??0GUID_t@Events@Applications@Microsoft@@QEAA@U_GUID@@@Z

  ??0GUID_t@Events@Applications@Microsoft@@QEAA@XZ

  ??0IAuthTokensController@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z

  ??0IAuthTokensController@Events@Applications@Microsoft@@QEAA@XZ

  ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z

  ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z

  ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@AEBV?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@std@@@Z

  ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@XZ

  ??0ILogController@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z

  ??0ILogController@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z

  ??0ILogController@Events@Applications@Microsoft@@QEAA@XZ

  ??0ILogManager@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z

  ??0ILogManager@Events@Applications@Microsoft@@QEAA@XZ

  ??0ILogger@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z

  ??0ILogger@Events@Applications@Microsoft@@QEAA@XZ

  ??0IModule@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z

  ??0IModule@Events@Applications@Microsoft@@QEAA@XZ

  ??0ISemanticContext@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z

  ??0ISemanticContext@Events@Applications@Microsoft@@QEAA@XZ

  ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@$$QEAU0123@@Z

  ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@AEBU0123@@Z

  ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@XZ

  ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z

  ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@PEB_J@Z

  ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@XZ

  ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@_K@Z

  ??1DebugEventDispatcher@Events@Applications@Microsoft@@UEAA@XZ

  ??1DebugEventListener@Events@Applications@Microsoft@@UEAA@XZ

  ??1DebugEventSource@Events@Applications@Microsoft@@UEAA@XZ

  ??1EventProperties@Events@Applications@Microsoft@@UEAA@XZ

  ??1EventProperty@Events@Applications@Microsoft@@UEAA@XZ

  ??1IAuthTokensController@Events@Applications@Microsoft@@UEAA@XZ

  ??1ILogConfiguration@Events@Applications@Microsoft@@QEAA@XZ

  ??1ILogManager@Events@Applications@Microsoft@@UEAA@XZ

  ??1ILogger@Events@Applications@Microsoft@@UEAA@XZ

  ??1IModule@Events@Applications@Microsoft@@UEAA@XZ

  ??1ISemanticContext@Events@Applications@Microsoft@@UEAA@XZ

  ??1LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@XZ

  ??4DebugEventDispatcher@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z

  ??4DebugEventListener@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z

  ??4DebugEventSource@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z

  ??4DebugEventSource@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z

  ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z

  ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z

  ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@std@@@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@NV?$allocator@N@std@@@std@@@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@_JV?$allocator@_J@std@@@std@@@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@C@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@E@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@F@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@G@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@H@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@I@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@J@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@N@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@PEBD@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@UGUID_t@123@@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@Utime_ticks_t@123@@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_J@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_K@Z

  ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_N@Z

  ??4GUID_t@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z

  ??4IAuthTokensController@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z

  ??4ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z

  ??4ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z

  ??4ILogController@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z

  ??4ILogController@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z

  ??4ILogManager@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z

  ??4ILogger@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z

  ??4IModule@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z

  ??4ISemanticContext@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z

  ??4LogConfiguration@Telemetry@Applications@Microsoft@@QEAAAEAU0123@$$QEAU0123@@Z

  ??4LogConfiguration@Telemetry@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z

  ??4LogManagerProvider@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z

  ??4LogManagerProvider@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z

  ??4time_ticks_t@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z

  ??8EventProperty@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z

  ??8GUID_t@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z

  ??AILogConfiguration@Events@Applications@Microsoft@@QEAAAEAVVariant@123@PEBD@Z

  ??DILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@2@@std@@XZ

  ??MGUID_t@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z

  ??YEventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z

  ??_7DebugEventDispatcher@Events@Applications@Microsoft@@6B@

  ??_7DebugEventListener@Events@Applications@Microsoft@@6B@

  ??_7DebugEventSource@Events@Applications@Microsoft@@6B@

  ??_7EventProperties@Events@Applications@Microsoft@@6B@

  ??_7EventProperty@Events@Applications@Microsoft@@6B@

  ??_7IAuthTokensController@Events@Applications@Microsoft@@6B@

  ??_7ILogController@Events@Applications@Microsoft@@6B@

  ??_7ILogManager@Events@Applications@Microsoft@@6BDebugEventDispatcher@123@@

  ??_7ILogManager@Events@Applications@Microsoft@@6BIContextProvider@123@@

  ??_7ILogManager@Events@Applications@Microsoft@@6BILogController@123@@

  ??_7ILogger@Events@Applications@Microsoft@@6B@

  ??_7IModule@Events@Applications@Microsoft@@6B@

  ??_7ISemanticContext@Events@Applications@Microsoft@@6B@

  ?AddEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z

  ?AddModule@ILogConfiguration@Events@Applications@Microsoft@@QEAAXPEBDAEBV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@@Z

  ?AttachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z

  ?ClearExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXXZ

  ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@AEAVILogConfiguration@234@AEAW4status_t@234@@Z

  ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@PEBDAEAW4status_t@234@_K@Z

  ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@PEBD_NAEAVILogConfiguration@234@AEAW4status_t@234@_K@Z

  ?DecrementActiveHydrationsCount@QoS@@YAXXZ

  ?DestroyLogManager@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PEBD@Z

  ?DetachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z

  ?DispatchEvent@DebugEventSource@Events@Applications@Microsoft@@UEAA_NVDebugEvent@234@@Z

  ?DispatchEventBroadcast@ILogManager@Events@Applications@Microsoft@@SA_NVDebugEvent@234@@Z

  ?FromJSON@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@PEBD@Z

  ?FromLogConfiguration@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@AEAULogConfiguration@Telemetry@23@@Z

  ?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPEAVILogManager@234@AEAVILogConfiguration@234@AEAW4status_t@234@@Z

  ?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPEAVILogManager@234@PEBDAEAW4status_t@234@@Z

  ?GetActiveHydrationsCount@QoS@@YAIXZ

  ?GetApplicationPropertyId@QoS@@YA?AW4Id@PropertyId@TelemetryConstants@@XZ

  ?GetDefaultConfiguration@Events@Applications@Microsoft@@YAAEBVILogConfiguration@123@XZ

  ?GetErrorType@QoS@@YA?AW4Type@ErrorType@TelemetryConstants@@JI@Z

  ?GetErrorType@QoS@@YA?AW4Type@ErrorType@TelemetryConstants@@JIAEBV?$set@IU?$less@I@std@@V?$allocator@I@2@@std@@@Z

  ?GetInstance@Telemetry@@CAPEAV1@XZ

  ?GetLatency@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventLatency@234@XZ

  ?GetLogObfuscationKeyManger@@YAJPEAPEAVILogObfuscationKeyManager@@@Z

  ?GetLogObfuscatorAes@@YAJPEAPEAVILogObfuscatorAes@@@Z

  ?GetModule@ILogConfiguration@Events@Applications@Microsoft@@QEAA?AV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@PEBD@Z

  ?GetModules@ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@@std@@@2@@std@@XZ

  ?GetName@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

  ?GetPersistence@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventPersistence@234@XZ

  ?GetPiiProperties@EventProperties@Events@Applications@Microsoft@@QEBA?BV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Applications@Microsoft@@@2@@std@@@2@@std@@W4DataCategory@234@@Z

  ?GetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QEBA_KXZ

  ?GetPopSample@EventProperties@Events@Applications@Microsoft@@QEBANXZ

  ?GetPriority@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventPriority@234@XZ

  ?GetProperties@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@W4DataCategory@234@@Z

  ?GetResultType@QoS@@YAPEB_WJI@Z

  ?GetResultType@QoS@@YAPEB_WW4Type@ErrorType@TelemetryConstants@@@Z

  ?GetTimestamp@EventProperties@Events@Applications@Microsoft@@QEBA_JXZ

  ?GetType@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

  ?HasConfig@ILogConfiguration@Events@Applications@Microsoft@@QEAA_NPEBD@Z

  ?Hash@GUID_t@Events@Applications@Microsoft@@QEBA_KXZ

  ?IncrementActiveHydrationsCount@QoS@@YAXXZ

  ?Initialize@IModule@Events@Applications@Microsoft@@UEAAXPEAVILogManager@234@@Z

  ?InsertIntoIrmEnabledLibrarySet@QoS@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z

  ?IsAnyLibraryIrmEnabled@QoS@@YA_NXZ

  ?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@AEAVILogConfiguration@234@@Z

  ?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PEBD@Z

  ?RemoveEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z

  ?RemoveFromIrmEnabledLibrarySet@QoS@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z

  ?SetAppEnv@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetAppExperimentETag@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetAppExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetAppExperimentImpressionId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetAppId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetAppLanguage@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetAppName@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetAppVersion@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetApplicationId@QoS@@YAXI@Z

  ?SetCommercialId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetCommonField@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUEventProperty@234@@Z

  ?SetCustomField@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUEventProperty@234@@Z

  ?SetDeviceClass@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetDeviceId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetDeviceMake@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetDeviceModel@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetDeviceOrgId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetEventExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z

  ?SetLatency@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventLatency@234@@Z

  ?SetLevel@EventProperties@Events@Applications@Microsoft@@QEAAXE@Z

  ?SetName@EventProperties@Events@Applications@Microsoft@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetNetworkCost@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4NetworkCost@234@@Z

  ?SetNetworkProvider@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetNetworkType@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4NetworkType@234@@Z

  ?SetOsBuild@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetOsName@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetOsVersion@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetPersistence@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventPersistence@234@@Z

  ?SetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QEAAX_K@Z

  ?SetPopsample@EventProperties@Events@Applications@Microsoft@@QEAAXN@Z

  ?SetPriority@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventPriority@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4PiiKind@234@W4DataCategory@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@NV?$allocator@N@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@6@W4PiiKind@234@W4DataCategory@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@_JV?$allocator@_J@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CW4PiiKind@234@W4DataCategory@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@EW4PiiKind@234@W4DataCategory@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@FW4PiiKind@234@W4DataCategory@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@GW4PiiKind@234@W4DataCategory@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HW4PiiKind@234@W4DataCategory@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IW4PiiKind@234@W4DataCategory@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@NW4PiiKind@234@W4DataCategory@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDW4PiiKind@234@W4DataCategory@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UGUID_t@234@W4PiiKind@234@W4DataCategory@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Utime_ticks_t@234@W4PiiKind@234@W4DataCategory@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_JW4PiiKind@234@W4DataCategory@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_KW4PiiKind@234@W4DataCategory@234@@Z

  ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_NW4PiiKind@234@W4DataCategory@234@@Z

  ?SetTicket@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4TicketType@234@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetTimestamp@EventProperties@Events@Applications@Microsoft@@QEAAX_J@Z

  ?SetType@EventProperties@Events@Applications@Microsoft@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetUserANID@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetUserAdvertisingId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetUserId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@234@@Z

  ?SetUserLanguage@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetUserMsaId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SetUserTimeZone@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

  ?SizeUnknown@QoS@@YAIXZ

  ?Teardown@IModule@Events@Applications@Microsoft@@UEAAXXZ

  ?TryGetLevel@EventProperties@Events@Applications@Microsoft@@QEBA?AV?$tuple@_NE@std@@XZ

  ?clear@EventProperty@Events@Applications@Microsoft@@QEAAXXZ

  ?convertUintVectorToGUID@GUID_t@Events@Applications@Microsoft@@SA?AU_GUID@@AEBV?$vector@EV?$allocator@E@std@@@std@@@Z

  ?copydata@EventProperty@Events@Applications@Microsoft@@AEAAXPEBU1234@@Z

  ?empty@EventProperty@Events@Applications@Microsoft@@QEAA_NXZ

  ?erase@EventProperties@Events@Applications@Microsoft@@QEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4DataCategory@234@@Z

  ?lock@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ@4V67@A

  ?pack@EventProperties@Events@Applications@Microsoft@@QEAAPEAUevt_prop@@XZ

  ?stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ

  ?to_bytes@GUID_t@Events@Applications@Microsoft@@QEBAXAEAY0BA@E@Z

  ?to_string@EventProperty@Events@Applications@Microsoft@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

  ?to_string@GUID_t@Events@Applications@Microsoft@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

  ?type_name@EventProperty@Events@Applications@Microsoft@@SAPEBDI@Z

  ?unpack@EventProperties@Events@Applications@Microsoft@@QEAA_NPEAUevt_prop@@_K@Z

  evt_api_call_default

  Sections

  .text

  Size: 3.4MB - Virtual size: 3.4MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1.0MB - Virtual size: 1.0MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 129KB - Virtual size: 150KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 126KB - Virtual size: 125KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didat

  Size: 512B - Virtual size: 72B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  _RDATA

  Size: 512B - Virtual size: 244B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 43.3MB - Virtual size: 43.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 23KB - Virtual size: 22KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ