OneDriveSetup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
OneDriveSetup.exe
Size 15.9MB
Sample240204-st945achg5
SHA256 58101fa7d0e608d612639bdd6b6cc4a1e800e41a647cbbd3e12cc02cbdc3caf7
MD5 f4a2c9c2b3d1b16d6393c56b1e1f0283
SHA1 b844cd1f3614ac621a3794649e887896fb5dfce0
SHA512 447749341851a2ee5870ae619c799b6f76d1c1c11b9003e78cf17060c1e110f1234452f65c597691d393bc3ba28228f38ce24d064c20ee48c5012d6443c2df98
SSDEEP 393216:YMwor624PaLDxccRrMPJy7L6+LBfPaL8sM6NrfM3:YMwQNeYDxVRrMPJy7LVV4N0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OneDriveSetup.exe

File Explorer

OneDriveSetup.exe

.exe 15.9MB

OneDriveSetup.exe

IMPHASH 30286873494a97382042a27f926daf86
SHA256 58101fa7d0e608d612639bdd6b6cc4a1e800e41a647cbbd3e12cc02cbdc3caf7
MD5 f4a2c9c2b3d1b16d6393c56b1e1f0283
SHA1 b844cd1f3614ac621a3794649e887896fb5dfce0
SHA512 447749341851a2ee5870ae619c799b6f76d1c1c11b9003e78cf17060c1e110f1234452f65c597691d393bc3ba28228f38ce24d064c20ee48c5012d6443c2df98
SSDEEP 393216:YMwor624PaLDxccRrMPJy7L6+LBfPaL8sM6NrfM3:YMwQNeYDxVRrMPJy7LVV4N0
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1589552

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\dbs\sh\odct\1105_210049_0\client\onedrive\Setup\Standalone\exe\obj\i386\OneDriveSetup.pdb

wer

WerReportCloseHandle WerReportSubmit WerReportSetParameter WerReportCreate

kernel32

ReleaseSRWLockShared GetThreadPriority SetPriorityClass GetPriorityClass GetPrivateProfileStringW WritePrivateProfileStringW SetFilePointer SetFileInformationByHandle ReadFile GetFinalPathNameByHandleW GetFileType GetFileSizeEx GetFileSize GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindVolumeClose FindNextVolumeW FindFirstVolumeW ExpandEnvironmentStringsW GetLongPathNameW Process32NextW Process32FirstW CreateToolhelp32Snapshot VerifyVersionInfoW VerSetConditionMask LCMapStringW WideCharToMultiByte MultiByteToWideChar K32GetModuleFileNameExW GetUserDefaultLocaleName GetUserDefaultLCID GetComputerNameW MoveFileW GetModuleHandleW IsWow64Process GetProductInfo GetVersionExW GetSystemTimeAsFileTime OpenProcess CreateProcessW TerminateProcess CreateMutexW WaitForSingleObject GetCurrentProcess GetModuleFileNameW VirtualFree WerRegisterFile LoadLibraryW GetProcAddress DeviceIoControl FindNextFileW FindFirstFileW FindClose GetCommandLineW CompareStringW UnlockFileEx LockFileEx SystemTimeToFileTime MoveFileExW CopyFileW FreeLibrary Sleep CloseHandle GetTempPathW AcquireSRWLockShared InterlockedPopEntrySList SetFileTime RemoveDirectoryW GetTempFileNameW GetFullPathNameW CreateDirectoryW GetSystemTime GetCurrentThreadId GetCurrentProcessId SetLastError WriteFile GlobalLock GlobalAlloc GetSystemDefaultLCID CreateFileW CompareFileTime DeleteCriticalSection WaitForMultipleObjectsEx FileTimeToDosDateTime FileTimeToLocalFileTime CompareStringA GetTempFileNameA RemoveDirectoryA GetSystemDefaultUILanguage GetComputerNameExW GetLocalTime GlobalMemoryStatusEx WaitForMultipleObjects QueueUserWorkItem GetVolumePathNameW SetFileAttributesW WerUnregisterFile FlushInstructionCache GetUserDefaultUILanguage FindResourceW SizeofResource LockResource LoadResource GetUserGeoID CompareStringOrdinal CreateSymbolicLinkW OpenFileById GetFileInformationByHandleEx FindResourceExW WriteConsoleW SetThreadPriority SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindFirstFileExW GetOEMCP GetACP IsValidCodePage ReadConsoleW SetStdHandle GetCurrentDirectoryW InitializeCriticalSectionEx GetProcessHeap GetConsoleMode GetConsoleOutputCP SetFilePointerEx EnumSystemLocalesW IsValidLocale GetLocaleInfoW GetTimeFormatW GetDateFormatW GetCurrentThread GetStdHandle ExitProcess VirtualAlloc FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW FreeLibraryAndExitThread ExitThread CreateThread HeapSize TlsFree TlsSetValue TlsGetValue TlsAlloc RegisterApplicationRestart ReadDirectoryChangesW SetDllDirectoryW LoadLibraryExW InterlockedPushEntrySList LoadLibraryExA VirtualProtect GetLocaleInfoEx GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetSystemTimes GetExitCodeProcess GetProcessTimes ReleaseMutex HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer LocalFree LocalAlloc LeaveCriticalSection EnterCriticalSection GetEnvironmentVariableW PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort DeleteFileW IsDebuggerPresent GetShortPathNameW CreateDirectoryA OutputDebugStringA GetModuleFileNameA GetModuleHandleExW GetTimeZoneInformation GetNativeSystemInfo GetSystemPowerStatus FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA UnlockFile HeapCompact GetSystemInfo DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapValidate UnmapViewOfFile SetEndOfFile GetFullPathNameA LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI InitializeCriticalSection TryEnterCriticalSection InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW VirtualQuery InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive GetStringTypeW SwitchToThread GetExitCodeThread InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW QueryPerformanceFrequency CreateEventExW GetTickCount64

user32

GetWindowLongW SetWindowLongW GetParent GetWindow LoadIconW MonitorFromWindow GetMonitorInfoW SetWindowTextW SetForegroundWindow GetForegroundWindow SetActiveWindow GetDlgItem DialogBoxParamW CreateDialogParamW GetWindowRect IsWindowVisible SetWindowPos IsWindow AttachThreadInput SendMessageW GetSystemMetrics GetShellWindow AllowSetForegroundWindow PostQuitMessage PostThreadMessageW UnregisterClassW GetMessageW TranslateMessage DispatchMessageW MapWindowPoints BringWindowToTop PeekMessageW GetClientRect PostMessageW EnumWindows GetClassNameW GetWindowThreadProcessId SendMessageTimeoutW RegisterClassW CreateWindowExW DestroyWindow ShowWindow MsgWaitForMultipleObjectsEx SetCursor LoadCursorW

advapi32

CreateProcessAsUserW CredDeleteW CredFree CreateProcessWithTokenW RegOverridePredefKey GetUserNameW LookupAccountNameW CryptDestroyKey CryptSetHashParam CryptImportKey AddAce DeleteAce GetAce InitializeAcl ConvertStringSidToSidW ImpersonateLoggedOnUser RevertToSelf CredReadW CredWriteW EventWrite EventUnregister EventWriteTransfer EventRegister RegGetValueA ConvertSidToStringSidW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegDeleteTreeW RegUnLoadKeyW RegLoadKeyW RegEnumKeyW RegDeleteKeyExW RegCreateKeyTransactedW SetFileSecurityW GetAclInformation FreeSid DuplicateTokenEx CreateWellKnownSid AllocateAndInitializeSid CredEnumerateW ConvertStringSecurityDescriptorToSecurityDescriptorW RegGetValueW RegSetKeyValueW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteValueW LookupPrivilegeValueW IsValidSid InitializeSid GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority GetSidLengthRequired GetLengthSid EqualSid CopySid AdjustTokenPrivileges OpenProcessToken CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey

shell32

SHCreateDirectoryExW SHFileOperationW SHGetSpecialFolderPathW SHChangeNotify SHParseDisplayName SHGetKnownFolderPath SHCreateItemFromParsingName SHGetFolderPathAndSubDirW SHSetKnownFolderPath ord526 SHGetFolderPathA SHLoadNonloadedIconOverlayIdentifiers SHGetFolderPathW CommandLineToArgvW ShellExecuteW ShellExecuteExW

ole32

CreateStreamOnHGlobal CoTaskMemAlloc PropVariantClear CoInitialize CoCreateFreeThreadedMarshaler CoGetObject CoWaitForMultipleHandles CoCreateGuid CoSetProxyBlanket CLSIDFromString CreateBindCtx StringFromGUID2 StringFromCLSID CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemFree

oleaut32

GetRecordInfoFromTypeInfo SysAllocStringLen SysStringLen VariantInit VariantClear VariantChangeType VarBstrCmp LoadTypeLi LoadRegTypeLi GetErrorInfo SysFreeString SysAllocString SysAllocStringByteLen SetErrorInfo SysStringByteLen

iphlpapi

GetAdaptersInfo

rstrtmgr

RmStartSession RmRegisterResources RmGetList RmEndSession

crypt32

CryptStringToBinaryW CryptBinaryToStringW CertVerifyCertificateChainPolicy CertFreeCertificateChain

rpcrt4

RpcServerUseProtseqW RpcStringFreeW UuidToStringW RpcBindingFromStringBindingW RpcBindingVectorFree RpcStringBindingComposeW RpcServerInqBindings RpcServerRegisterIfEx RpcServerUnregisterIf RpcBindingFree RpcBindingSetAuthInfoExW RpcEpRegisterW RpcEpUnregister RpcServerInqCallAttributesW

secur32

GetUserNameExW

shlwapi

SHCreateStreamOnFileW ord219 SHRegGetValueW PathFindExtensionW SHCreateStreamOnFileA SHDeleteValueW SHRegGetPathW SHDeleteKeyW StrStrIW SHRegGetBoolUSValueW PathIsPrefixW PathStripPathW PathSkipRootW SHGetValueW PathFindFileNameW PathIsRelativeW SHCreateStreamOnFileEx PathFileExistsW PathIsDirectoryW PathRemoveFileSpecW PathFileExistsA PathFindFileNameA PathGetDriveNumberA PathIsDirectoryA SHSetValueW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wininet

InternetSetStatusCallbackW InternetQueryOptionW InternetReadFile HttpAddRequestHeadersA InternetOpenW InternetCrackUrlA InternetCheckConnectionW HttpOpenRequestA HttpSendRequestW HttpQueryInfoA InternetCloseHandle InternetConnectA

ws2_32

htons listen setsockopt closesocket WSAStartup WSAGetLastError send htonl bind accept socket

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSEnumerateSessionsW WTSQueryUserToken

userenv

UnloadUserProfile GetDefaultUserProfileDirectoryW CreateEnvironmentBlock

wintrust

WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrustEx

ntdll

RtlUnwind

gdi32

SetDIBColorTable CreateCompatibleDC GetObjectW SelectObject DeleteObject DeleteDC CreateDIBSection

urlmon

URLOpenStreamW

gdiplus

GdipGetImagePixelFormat GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdiplusShutdown GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipAlloc GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree

comctl32

ord345

cabinet

ord23 ord22 ord20 ord10 ord14 ord11 ord13

?$TSS0@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAAVrecursive_mutex@std@@XZ@4HA ??0DebugEventDispatcher@Events@Applications@Microsoft@@QAE@ABV0123@@Z ??0DebugEventDispatcher@Events@Applications@Microsoft@@QAE@XZ ??0DebugEventListener@Events@Applications@Microsoft@@QAE@ABV0123@@Z ??0DebugEventListener@Events@Applications@Microsoft@@QAE@XZ ??0DebugEventSource@Events@Applications@Microsoft@@QAE@$$QAV0123@@Z ??0DebugEventSource@Events@Applications@Microsoft@@QAE@ABV0123@@Z ??0DebugEventSource@Events@Applications@Microsoft@@QAE@XZ ??0EventProperties@Events@Applications@Microsoft@@QAE@ABV0123@@Z ??0EventProperties@Events@Applications@Microsoft@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??0EventProperties@Events@Applications@Microsoft@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@5@@Z ??0EventProperties@Events@Applications@Microsoft@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@E@Z ??0EventProperties@Events@Applications@Microsoft@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@5@@Z ??0EventProperties@Events@Applications@Microsoft@@QAE@XZ ??0EventProperty@Events@Applications@Microsoft@@QAE@$$QAU0123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@AAV?$vector@NV?$allocator@N@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@AAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@AAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@AAV?$vector@_JV?$allocator@_J@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@ABU0123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@CW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@EW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@FW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@GW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@HW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@IW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@JW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@NW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@PBDW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@UGUID_t@123@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@Utime_ticks_t@123@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@XZ ??0EventProperty@Events@Applications@Microsoft@@QAE@_JW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@_KW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QAE@_NW4PiiKind@123@W4DataCategory@123@@Z ??0GUID_t@Events@Applications@Microsoft@@QAE@ABU0123@@Z ??0GUID_t@Events@Applications@Microsoft@@QAE@HHHABV?$initializer_list@E@std@@@Z ??0GUID_t@Events@Applications@Microsoft@@QAE@PBD@Z ??0GUID_t@Events@Applications@Microsoft@@QAE@QBE_N@Z ??0GUID_t@Events@Applications@Microsoft@@QAE@U_GUID@@@Z ??0GUID_t@Events@Applications@Microsoft@@QAE@XZ ??0IAuthTokensController@Events@Applications@Microsoft@@QAE@ABV0123@@Z ??0IAuthTokensController@Events@Applications@Microsoft@@QAE@XZ ??0ILogConfiguration@Events@Applications@Microsoft@@QAE@$$QAV0123@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QAE@ABV0123@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QAE@ABV?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@std@@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QAE@XZ ??0ILogController@Events@Applications@Microsoft@@QAE@$$QAV0123@@Z ??0ILogController@Events@Applications@Microsoft@@QAE@ABV0123@@Z ??0ILogController@Events@Applications@Microsoft@@QAE@XZ ??0ILogManager@Events@Applications@Microsoft@@QAE@ABV0123@@Z ??0ILogManager@Events@Applications@Microsoft@@QAE@XZ ??0ILogger@Events@Applications@Microsoft@@QAE@ABV0123@@Z ??0ILogger@Events@Applications@Microsoft@@QAE@XZ ??0IModule@Events@Applications@Microsoft@@QAE@ABV0123@@Z ??0IModule@Events@Applications@Microsoft@@QAE@XZ ??0ISemanticContext@Events@Applications@Microsoft@@QAE@ABV0123@@Z ??0ISemanticContext@Events@Applications@Microsoft@@QAE@XZ ??0LogConfiguration@Telemetry@Applications@Microsoft@@QAE@$$QAU0123@@Z ??0LogConfiguration@Telemetry@Applications@Microsoft@@QAE@ABU0123@@Z ??0LogConfiguration@Telemetry@Applications@Microsoft@@QAE@XZ ??0LogObfuscatorAes@@QAE@ABV0@@Z ??0LogObfuscatorAes@@QAE@XZ ??0time_ticks_t@Events@Applications@Microsoft@@QAE@ABU0123@@Z ??0time_ticks_t@Events@Applications@Microsoft@@QAE@PB_J@Z ??0time_ticks_t@Events@Applications@Microsoft@@QAE@XZ ??0time_ticks_t@Events@Applications@Microsoft@@QAE@_K@Z ??1DebugEventDispatcher@Events@Applications@Microsoft@@UAE@XZ ??1DebugEventListener@Events@Applications@Microsoft@@UAE@XZ ??1DebugEventSource@Events@Applications@Microsoft@@UAE@XZ ??1EventProperties@Events@Applications@Microsoft@@UAE@XZ ??1EventProperty@Events@Applications@Microsoft@@UAE@XZ ??1IAuthTokensController@Events@Applications@Microsoft@@UAE@XZ ??1ILogConfiguration@Events@Applications@Microsoft@@QAE@XZ ??1ILogManager@Events@Applications@Microsoft@@UAE@XZ ??1ILogger@Events@Applications@Microsoft@@UAE@XZ ??1IModule@Events@Applications@Microsoft@@UAE@XZ ??1ISemanticContext@Events@Applications@Microsoft@@UAE@XZ ??1LogConfiguration@Telemetry@Applications@Microsoft@@QAE@XZ ??1LogObfuscatorAes@@UAE@XZ ??4DebugEventDispatcher@Events@Applications@Microsoft@@QAEAAV0123@ABV0123@@Z ??4DebugEventListener@Events@Applications@Microsoft@@QAEAAV0123@ABV0123@@Z ??4DebugEventSource@Events@Applications@Microsoft@@QAEAAV0123@$$QAV0123@@Z ??4DebugEventSource@Events@Applications@Microsoft@@QAEAAV0123@ABV0123@@Z ??4EventProperties@Events@Applications@Microsoft@@QAEAAV0123@ABV0123@@Z ??4EventProperties@Events@Applications@Microsoft@@QAEAAV0123@ABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z ??4EventProperties@Events@Applications@Microsoft@@QAEAAV0123@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@ABU0123@@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@ABV?$vector@NV?$allocator@N@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@ABV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@ABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@ABV?$vector@_JV?$allocator@_J@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@C@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@E@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@F@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@G@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@H@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@I@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@J@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@N@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@PBD@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@UGUID_t@123@@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@Utime_ticks_t@123@@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@_J@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@_K@Z ??4EventProperty@Events@Applications@Microsoft@@QAEAAU0123@_N@Z ??4GUID_t@Events@Applications@Microsoft@@QAEAAU0123@ABU0123@@Z ??4IAuthTokensController@Events@Applications@Microsoft@@QAEAAV0123@ABV0123@@Z ??4ILogConfiguration@Events@Applications@Microsoft@@QAEAAV0123@$$QAV0123@@Z ??4ILogConfiguration@Events@Applications@Microsoft@@QAEAAV0123@ABV0123@@Z ??4ILogController@Events@Applications@Microsoft@@QAEAAV0123@$$QAV0123@@Z ??4ILogController@Events@Applications@Microsoft@@QAEAAV0123@ABV0123@@Z ??4ILogManager@Events@Applications@Microsoft@@QAEAAV0123@ABV0123@@Z ??4ILogger@Events@Applications@Microsoft@@QAEAAV0123@ABV0123@@Z ??4IModule@Events@Applications@Microsoft@@QAEAAV0123@ABV0123@@Z ??4ISemanticContext@Events@Applications@Microsoft@@QAEAAV0123@ABV0123@@Z ??4LogConfiguration@Telemetry@Applications@Microsoft@@QAEAAU0123@$$QAU0123@@Z ??4LogConfiguration@Telemetry@Applications@Microsoft@@QAEAAU0123@ABU0123@@Z ??4LogManagerProvider@Events@Applications@Microsoft@@QAEAAV0123@$$QAV0123@@Z ??4LogManagerProvider@Events@Applications@Microsoft@@QAEAAV0123@ABV0123@@Z ??4LogObfuscatorAes@@QAEAAV0@ABV0@@Z ??4time_ticks_t@Events@Applications@Microsoft@@QAEAAU0123@ABU0123@@Z ??8EventProperty@Events@Applications@Microsoft@@QBE_NABU0123@@Z ??8GUID_t@Events@Applications@Microsoft@@QBE_NABU0123@@Z ??AILogConfiguration@Events@Applications@Microsoft@@QAEAAVVariant@123@PBD@Z ??DILogConfiguration@Events@Applications@Microsoft@@QAEAAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@2@@std@@XZ ??MGUID_t@Events@Applications@Microsoft@@QBE_NABU0123@@Z ??YEventProperties@Events@Applications@Microsoft@@QAEAAV0123@ABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z ??_7DebugEventDispatcher@Events@Applications@Microsoft@@6B@ ??_7DebugEventListener@Events@Applications@Microsoft@@6B@ ??_7DebugEventSource@Events@Applications@Microsoft@@6B@ ??_7EventProperties@Events@Applications@Microsoft@@6B@ ??_7EventProperty@Events@Applications@Microsoft@@6B@ ??_7IAuthTokensController@Events@Applications@Microsoft@@6B@ ??_7ILogController@Events@Applications@Microsoft@@6B@ ??_7ILogManager@Events@Applications@Microsoft@@6BDebugEventDispatcher@123@@ ??_7ILogManager@Events@Applications@Microsoft@@6BIContextProvider@123@@ ??_7ILogManager@Events@Applications@Microsoft@@6BILogController@123@@ ??_7ILogger@Events@Applications@Microsoft@@6B@ ??_7IModule@Events@Applications@Microsoft@@6B@ ??_7ISemanticContext@Events@Applications@Microsoft@@6B@ ??_7LogObfuscatorAes@@6B@ ?AddEventListener@DebugEventSource@Events@Applications@Microsoft@@UAEXW4DebugEventType@234@AAVDebugEventListener@234@@Z ?AddModule@ILogConfiguration@Events@Applications@Microsoft@@QAEXPBDABV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@@Z ?AttachEventSource@DebugEventSource@Events@Applications@Microsoft@@UAE_NAAV1234@@Z ?ClearExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UAEXXZ ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPAVILogManager@234@AAVILogConfiguration@234@AAW4status_t@234@@Z ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPAVILogManager@234@PBDAAW4status_t@234@_K@Z ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPAVILogManager@234@PBD_NAAVILogConfiguration@234@AAW4status_t@234@_K@Z ?DecrementActiveHydrationsCount@QoS@@YAXXZ ?DestroyLogManager@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PBD@Z ?DetachEventSource@DebugEventSource@Events@Applications@Microsoft@@UAE_NAAV1234@@Z ?DispatchEvent@DebugEventSource@Events@Applications@Microsoft@@UAE_NVDebugEvent@234@@Z ?DispatchEventBroadcast@ILogManager@Events@Applications@Microsoft@@SA_NVDebugEvent@234@@Z ?FlushObfuscationTableToDisk@LogObfuscatorAes@@UAAXPB_W@Z ?FromJSON@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@PBD@Z ?FromLogConfiguration@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@AAULogConfiguration@Telemetry@23@@Z ?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPAVILogManager@234@AAVILogConfiguration@234@AAW4status_t@234@@Z ?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPAVILogManager@234@PBDAAW4status_t@234@@Z ?GetActiveHydrationsCount@QoS@@YAIXZ ?GetApplicationPropertyId@QoS@@YA?AW4Id@PropertyId@TelemetryConstants@@XZ ?GetDefaultConfiguration@Events@Applications@Microsoft@@YAABVILogConfiguration@123@XZ ?GetErrorType@QoS@@YG?AW4Type@ErrorType@TelemetryConstants@@JI@Z ?GetErrorType@QoS@@YG?AW4Type@ErrorType@TelemetryConstants@@JIABV?$set@IU?$less@I@std@@V?$allocator@I@2@@std@@@Z ?GetInstance@Telemetry@@CGPAV1@XZ ?GetLatency@EventProperties@Events@Applications@Microsoft@@QBE?AW4EventLatency@234@XZ ?GetModule@ILogConfiguration@Events@Applications@Microsoft@@QAE?AV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@PBD@Z ?GetModules@ILogConfiguration@Events@Applications@Microsoft@@QAEAAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@@std@@@2@@std@@XZ ?GetName@EventProperties@Events@Applications@Microsoft@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?GetPersistence@EventProperties@Events@Applications@Microsoft@@QBE?AW4EventPersistence@234@XZ ?GetPiiProperties@EventProperties@Events@Applications@Microsoft@@QBE?BV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Applications@Microsoft@@@2@@std@@@2@@std@@W4DataCategory@234@@Z ?GetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QBE_KXZ ?GetPopSample@EventProperties@Events@Applications@Microsoft@@QBENXZ ?GetPriority@EventProperties@Events@Applications@Microsoft@@QBE?AW4EventPriority@234@XZ ?GetProperties@EventProperties@Events@Applications@Microsoft@@QBEABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@W4DataCategory@234@@Z ?GetResultType@QoS@@YAPB_WJI@Z ?GetResultType@QoS@@YAPB_WW4Type@ErrorType@TelemetryConstants@@@Z ?GetTimestamp@EventProperties@Events@Applications@Microsoft@@QBE_JXZ ?GetType@EventProperties@Events@Applications@Microsoft@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?HasConfig@ILogConfiguration@Events@Applications@Microsoft@@QAE_NPBD@Z ?Hash@GUID_t@Events@Applications@Microsoft@@QBEIXZ ?IncrementActiveHydrationsCount@QoS@@YAXXZ ?Initialize@IModule@Events@Applications@Microsoft@@UAEXPAVILogManager@234@@Z ?InsertIntoIrmEnabledLibrarySet@QoS@@YAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?IsAnyLibraryIrmEnabled@QoS@@YA_NXZ ?ObfuscatePrivateInfo@LogObfuscatorAes@@UAAXPAVILoggingSession@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@AAVILogConfiguration@234@@Z ?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PBD@Z ?RemoveEventListener@DebugEventSource@Events@Applications@Microsoft@@UAEXW4DebugEventType@234@AAVDebugEventListener@234@@Z ?RemoveFromIrmEnabledLibrarySet@QoS@@YAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?SetAppEnv@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentETag@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentImpressionId@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppId@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppLanguage@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppName@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppVersion@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetApplicationId@QoS@@YAXI@Z ?SetCommercialId@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetCommonField@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABUEventProperty@234@@Z ?SetCustomField@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABUEventProperty@234@@Z ?SetDeviceClass@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceId@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceMake@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceModel@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceOrgId@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetEventExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z ?SetLatency@EventProperties@Events@Applications@Microsoft@@QAEXW4EventLatency@234@@Z ?SetLevel@EventProperties@Events@Applications@Microsoft@@QAEXE@Z ?SetName@EventProperties@Events@Applications@Microsoft@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetNetworkCost@ISemanticContext@Events@Applications@Microsoft@@UAEXW4NetworkCost@234@@Z ?SetNetworkProvider@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetNetworkType@ISemanticContext@Events@Applications@Microsoft@@UAEXW4NetworkType@234@@Z ?SetOsBuild@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetOsName@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetOsVersion@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetPersistence@EventProperties@Events@Applications@Microsoft@@QAEXW4EventPersistence@234@@Z ?SetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QAEX_K@Z ?SetPopsample@EventProperties@Events@Applications@Microsoft@@QAEXN@Z ?SetPriority@EventProperties@Events@Applications@Microsoft@@QAEXW4EventPriority@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$vector@NV?$allocator@N@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$vector@_JV?$allocator@_J@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@EW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@FW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@GW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@NW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBDW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UGUID_t@234@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Utime_ticks_t@234@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_JW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_KW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_NW4PiiKind@234@W4DataCategory@234@@Z ?SetTicket@ISemanticContext@Events@Applications@Microsoft@@UAEXW4TicketType@234@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetTimestamp@EventProperties@Events@Applications@Microsoft@@QAEX_J@Z ?SetType@EventProperties@Events@Applications@Microsoft@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserANID@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserAdvertisingId@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserId@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@234@@Z ?SetUserLanguage@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserMsaId@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserTimeZone@ISemanticContext@Events@Applications@Microsoft@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SizeUnknown@QoS@@YGIXZ ?Teardown@IModule@Events@Applications@Microsoft@@UAEXXZ ?TryGetLevel@EventProperties@Events@Applications@Microsoft@@QBE?AV?$tuple@_NE@std@@XZ ?Uninitialize@LogObfuscatorAes@@UAAXXZ ?clear@EventProperty@Events@Applications@Microsoft@@QAEXXZ ?convertUintVectorToGUID@GUID_t@Events@Applications@Microsoft@@SA?AU_GUID@@ABV?$vector@EV?$allocator@E@std@@@std@@@Z ?copydata@EventProperty@Events@Applications@Microsoft@@AAEXPBU1234@@Z ?empty@EventProperty@Events@Applications@Microsoft@@QAE_NXZ ?erase@EventProperties@Events@Applications@Microsoft@@QAEIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4DataCategory@234@@Z ?lock@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAAVrecursive_mutex@std@@XZ@4V67@A ?pack@EventProperties@Events@Applications@Microsoft@@QAEPAUevt_prop@@XZ ?stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAAVrecursive_mutex@std@@XZ ?to_bytes@GUID_t@Events@Applications@Microsoft@@QBEXAAY0BA@E@Z ?to_string@EventProperty@Events@Applications@Microsoft@@UBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?to_string@GUID_t@Events@Applications@Microsoft@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?type_name@EventProperty@Events@Applications@Microsoft@@SAPBDI@Z ?unpack@EventProperties@Events@Applications@Microsoft@@QAE_NPAUevt_prop@@I@Z evt_api_call_default

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

713KB

Virtual Size

713KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

107KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36.6MB

Virtual Size

36.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

143KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

OneDriveSetup.exe

wer

kernel32

user32

advapi32

shell32

ole32

oleaut32

iphlpapi

rstrtmgr

crypt32

rpcrt4

secur32

shlwapi

version

wininet

ws2_32

wtsapi32

userenv

wintrust

ntdll

gdi32

urlmon

gdiplus

comctl32

cabinet

generic