2025-07-05_f00e0eb5d59b531b7a9e5d464cad5285_black-basta_cobalt-strike_luca-stealer_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2025-07-05_f00e0eb5d59b531b7a9e5d464cad5285_black-basta_cobalt-strike_luca-stealer_satacom_vidar
Size 4.2MB
Sample250705-n2qm8sysfx
SHA256 34af4929d133438058378eeaf3d1934788a3fc56998113a69b18082fe3788c76
MD5 f00e0eb5d59b531b7a9e5d464cad5285
SHA1 3d51ac976e1223d498be8052a6ca2968c6f7dba0
SHA512 c6a22134b86f8d6046dbfbbdcaf0c3ad548f1d8374a45be5cb8ef2d6b65730b41e1ff45a77973ab5001a471d4c7bdd271556d8d429be329418b8fad34a12a1fa
SSDEEP 49152:Bv/aTS1fR0jM9KWmWHGjNtT045n5t7uEWwnjFrwJccTqx+VTyz59IcSZfV5fyUKm:EQ9FIxtDBwD4ScScUO
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-07-05_f00e0eb5d59b531b7a9e5d464cad5285_black-basta_cobalt-strike_luca-stealer_satacom_vidar

File Explorer

2025-07-05_f00e0eb5d59b531b7a9e5d464cad5285_black-basta_cobalt-strike_luca-stealer_satacom_vidar

.exe 4.2MB

2025-07-05_f00e0eb5d59b531b7a9e5d464cad5285_black-basta_cobalt-strike_luca-stealer_satacom_vidar

IMPHASH a6d76a0f2154ee41aea0e353de79c1dd
SHA256 34af4929d133438058378eeaf3d1934788a3fc56998113a69b18082fe3788c76
MD5 f00e0eb5d59b531b7a9e5d464cad5285
SHA1 3d51ac976e1223d498be8052a6ca2968c6f7dba0
SHA512 c6a22134b86f8d6046dbfbbdcaf0c3ad548f1d8374a45be5cb8ef2d6b65730b41e1ff45a77973ab5001a471d4c7bdd271556d8d429be329418b8fad34a12a1fa
SSDEEP 49152:Bv/aTS1fR0jM9KWmWHGjNtT045n5t7uEWwnjFrwJccTqx+VTyz59IcSZfV5fyUKm:EQ9FIxtDBwD4ScScUO
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

137792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\dbs\sh\odct\0311_095523\client\onedrive\Product\UpdaterService\exe\obj\amd64\OneDriveUpdaterService.pdb

kernel32

EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapFree HeapAlloc HeapSize HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetProcessHeap GetFileType SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadFile ReadConsoleW CreateFileW WriteConsoleW CompareFileTime DeleteFileW GetSystemTime LocalAlloc LocalFree CreateDirectoryW GetFullPathNameW GetTempFileNameW RemoveDirectoryW SetFileTime CopyFileW MoveFileExW SystemTimeToFileTime HeapDestroy LockFileEx UnlockFileEx OpenProcess K32GetModuleFileNameExW GetTickCount64 WaitForSingleObject SetEvent CreateEventW FindFirstFileW WerRegisterFile WerUnregisterFile ResetEvent WaitForMultipleObjects QueueUserWorkItem DeviceIoControl RtlPcToFileHeader CreateMutexW GetVersionExW MoveFileW LCIDToLocaleName GetUserGeoID GetUserDefaultLocaleName FindFirstVolumeW FindNextVolumeW FindVolumeClose GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSize GetFinalPathNameByHandleW GetLongPathNameW GetVolumePathNameW SetFileAttributesW SetFileInformationByHandle SetFilePointer GetCompressedFileSizeW FindFirstFileNameW SetHandleInformation CreatePipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus IsWow64Process GlobalAlloc GlobalUnlock GlobalLock GlobalFree ReadDirectoryChangesW CreateSymbolicLinkW CompareStringOrdinal CreateToolhelp32Snapshot SetLastError Process32NextW GetProcessTimes GetExitCodeProcess CreateProcessW SetProcessShutdownParameters GetSystemTimes SetThreadInformation GetProcessIoCounters GetPrivateProfileStringW WritePrivateProfileStringW SetDllDirectoryW ReplaceFileW GetComputerNameW RegisterApplicationRestart GetFileInformationByHandleEx OpenFileById ReleaseMutex Sleep GetEnvironmentVariableW ExpandEnvironmentStringsW WaitForMultipleObjectsEx CreateEventExW GetTickCount VerSetConditionMask GetProductInfo VerifyVersionInfoW GetDllDirectoryW LCMapStringEx CompareStringEx CreateHardLinkW AreFileApisANSI SetEndOfFile GetCurrentDirectoryW GetLocaleInfoEx AcquireSRWLockShared ReleaseSRWLockShared QueryPerformanceFrequency SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable GetNativeSystemInfo GetExitCodeThread SwitchToThread WaitForSingleObjectEx TryEnterCriticalSection RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW GetStartupInfoW InitializeCriticalSectionEx IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LeaveCriticalSection EnterCriticalSection RaiseException OutputDebugStringW IsDebuggerPresent InitOnceExecuteOnce RtlUnwind CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetSystemInfo VirtualProtect VirtualQuery GetTimeZoneInformation CreateFileMappingW MapViewOfFile UnmapViewOfFile OutputDebugStringA GetModuleFileNameA GetSystemPowerStatus UnlockFile HeapCompact DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapValidate GetFullPathNameA LockFile GetDiskFreeSpaceW HeapCreate InitializeCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock FormatMessageA Process32FirstW InterlockedPushEntrySList LoadLibraryExA DeleteCriticalSection DecodePointer CloseHandle GetLastError LoadLibraryW

user32

PostMessageW EnumWindows GetClassNameW GetWindowThreadProcessId SystemParametersInfoW GetMessageW TranslateMessage RegisterPowerSettingNotification RegisterClassW CreateWindowExW DestroyWindow ShowWindow OpenClipboard CloseClipboard SetClipboardData PostThreadMessageW DispatchMessageW LoadCursorW SetCursor MsgWaitForMultipleObjectsEx PostQuitMessage PeekMessageW SendMessageTimeoutW RegisterClipboardFormatW UnregisterPowerSettingNotification

bcrypt

BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty BCryptEncrypt BCryptGenRandom BCryptDestroyKey

rpcrt4

RpcServerInqBindings RpcServerRegisterIfEx RpcServerUnregisterIf RpcServerUseProtseqW RpcBindingSetAuthInfoExW RpcBindingVectorFree RpcBindingFromStringBindingW RpcBindingFree UuidCreate UuidToStringW RpcStringFreeW NdrServerCall2 NdrServerCallAll RpcEpUnregister RpcServerInqCallAttributesW RpcStringBindingComposeW RpcEpRegisterW

rstrtmgr

RmStartSession RmRegisterResources RmGetList RmEndSession

wer

WerReportSubmit WerReportCloseHandle WerReportSetParameter WerReportCreate

winhttp

WinHttpCrackUrl WinHttpOpenRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpOpen WinHttpReadData WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpSetOption WinHttpSetCredentials WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl

wintrust

WinVerifyTrustEx WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData

advapi32

CryptReleaseContext RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW ImpersonateLoggedOnUser RevertToSelf CryptAcquireContextW CryptGetHashParam EventWriteTransfer EventRegister RegGetValueA ReportEventW RegisterEventSourceW DeregisterEventSource CryptImportKey CryptSetHashParam CryptDestroyKey LookupAccountNameW CreateProcessWithTokenW GetUserNameW SetFileSecurityW CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegDeleteTreeW RegUnLoadKeyW RegLoadKeyW RegEnumKeyW RegDeleteKeyExW RegCreateKeyTransactedW GetAclInformation FreeSid DuplicateTokenEx CreateWellKnownSid AllocateAndInitializeSid RegGetValueW RegSetKeyValueW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteValueW LookupPrivilegeValueW GetTokenInformation AdjustTokenPrivileges OpenProcessToken CryptDestroyHash CryptHashData CryptCreateHash RegCloseKey

shell32

SHCreateDirectoryExW SHFileOperationW SHGetSpecialFolderPathW SHChangeNotify SHParseDisplayName ShellExecuteExW SHCreateItemFromParsingName SHSetKnownFolderPath ord526 SHAssocEnumHandlers SHGetFolderPathW SHGetKnownFolderPath CommandLineToArgvW SHLoadNonloadedIconOverlayIdentifiers SHGetFolderPathAndSubDirW

ole32

StringFromGUID2 CoCreateInstance CoUninitialize CoInitializeEx CoInitialize CoTaskMemAlloc CoCreateGuid CreateBindCtx CoSetProxyBlanket CreateItemMoniker GetRunningObjectTable StringFromCLSID CLSIDFromString CoCreateFreeThreadedMarshaler CoWaitForMultipleHandles CoTaskMemFree

oleaut32

LoadRegTypeLi GetErrorInfo SetErrorInfo GetRecordInfoFromTypeInfo SysStringLen LoadTypeLi VarBstrCmp VariantChangeType VariantClear VariantInit SysAllocStringLen SysAllocString SysFreeString

crypt32

CertVerifyCertificateChainPolicy CertGetEnhancedKeyUsage CryptBinaryToStringW CryptStringToBinaryW CertFreeCertificateChain CertFindExtension

secur32

GetUserNameExW

shlwapi

PathStripPathW PathStripToRootW SHDeleteKeyW SHDeleteValueW SHGetValueA SHRegGetValueW SHRegGetPathW SHRegGetBoolUSValueW AssocQueryStringW PathIsPrefixW StrStrIW SHSetValueW ord219 PathFileExistsW PathIsDirectoryW PathRemoveFileSpecW SHCreateStreamOnFileEx SHCreateStreamOnFileW PathFindFileNameW PathIsRelativeW SHGetValueW SHRegGetUSValueW PathIsDirectoryEmptyW

urlmon

URLOpenStreamW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wininet

InternetCheckConnectionW HttpQueryInfoA HttpSendRequestW InternetCrackUrlA InternetOpenW InternetCloseHandle InternetConnectA HttpAddRequestHeadersA InternetReadFile InternetQueryOptionW InternetSetStatusCallbackW HttpOpenRequestA

ws2_32

send setsockopt socket WSAStartup listen htons accept WSAGetLastError closesocket htonl bind

wtsapi32

WTSQuerySessionInformationW WTSEnumerateSessionsW WTSQueryUserToken WTSFreeMemory

userenv

CreateEnvironmentBlock GetDefaultUserProfileDirectoryW

iphlpapi

GetAdaptersInfo

?$TSS0@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ@4HA ??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@XZ ??0DebugEventListener@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0DebugEventListener@Events@Applications@Microsoft@@QEAA@XZ ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@XZ ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@5@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@E@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@5@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@XZ ??0EventProperty@Events@Applications@Microsoft@@QEAA@$$QEAU0123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@NV?$allocator@N@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@_JV?$allocator@_J@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@CW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@EW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@FW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@GW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@HW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@IW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@JW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@NW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@PEBDW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@UGUID_t@123@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@Utime_ticks_t@123@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@XZ ??0EventProperty@Events@Applications@Microsoft@@QEAA@_JW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@_KW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@_NW4PiiKind@123@W4DataCategory@123@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@HHHAEBV?$initializer_list@E@std@@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@PEBD@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@QEBE_N@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@U_GUID@@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@XZ ??0IAuthTokensController@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0IAuthTokensController@Events@Applications@Microsoft@@QEAA@XZ ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@AEBV?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@std@@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@XZ ??0ILogController@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z ??0ILogController@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogController@Events@Applications@Microsoft@@QEAA@XZ ??0ILogManager@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogManager@Events@Applications@Microsoft@@QEAA@XZ ??0ILogger@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogger@Events@Applications@Microsoft@@QEAA@XZ ??0IModule@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0IModule@Events@Applications@Microsoft@@QEAA@XZ ??0ISemanticContext@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ISemanticContext@Events@Applications@Microsoft@@QEAA@XZ ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@$$QEAU0123@@Z ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@XZ ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@PEB_J@Z ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@XZ ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@_K@Z ??1DebugEventDispatcher@Events@Applications@Microsoft@@UEAA@XZ ??1DebugEventListener@Events@Applications@Microsoft@@UEAA@XZ ??1DebugEventSource@Events@Applications@Microsoft@@UEAA@XZ ??1EventProperties@Events@Applications@Microsoft@@UEAA@XZ ??1EventProperty@Events@Applications@Microsoft@@UEAA@XZ ??1IAuthTokensController@Events@Applications@Microsoft@@UEAA@XZ ??1ILogConfiguration@Events@Applications@Microsoft@@QEAA@XZ ??1ILogManager@Events@Applications@Microsoft@@UEAA@XZ ??1ILogger@Events@Applications@Microsoft@@UEAA@XZ ??1IModule@Events@Applications@Microsoft@@UEAA@XZ ??1ISemanticContext@Events@Applications@Microsoft@@UEAA@XZ ??1LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@XZ ??4DebugEventDispatcher@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4DebugEventListener@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4DebugEventSource@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4DebugEventSource@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@NV?$allocator@N@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@_JV?$allocator@_J@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@C@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@E@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@F@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@G@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@H@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@I@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@J@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@N@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@PEBD@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@UGUID_t@123@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@Utime_ticks_t@123@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_J@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_K@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_N@Z ??4GUID_t@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??4IAuthTokensController@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogController@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4ILogController@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogManager@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogger@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4IModule@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ISemanticContext@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4LogConfiguration@Telemetry@Applications@Microsoft@@QEAAAEAU0123@$$QEAU0123@@Z ??4LogConfiguration@Telemetry@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??4LogManagerProvider@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4LogManagerProvider@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4time_ticks_t@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??8EventProperty@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z ??8GUID_t@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z ??AILogConfiguration@Events@Applications@Microsoft@@QEAAAEAVVariant@123@PEBD@Z ??DILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@2@@std@@XZ ??MGUID_t@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z ??YEventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z ??_7DebugEventDispatcher@Events@Applications@Microsoft@@6B@ ??_7DebugEventListener@Events@Applications@Microsoft@@6B@ ??_7DebugEventSource@Events@Applications@Microsoft@@6B@ ??_7EventProperties@Events@Applications@Microsoft@@6B@ ??_7EventProperty@Events@Applications@Microsoft@@6B@ ??_7IAuthTokensController@Events@Applications@Microsoft@@6B@ ??_7ILogController@Events@Applications@Microsoft@@6B@ ??_7ILogManager@Events@Applications@Microsoft@@6BDebugEventDispatcher@123@@ ??_7ILogManager@Events@Applications@Microsoft@@6BIContextProvider@123@@ ??_7ILogManager@Events@Applications@Microsoft@@6BILogController@123@@ ??_7ILogger@Events@Applications@Microsoft@@6B@ ??_7IModule@Events@Applications@Microsoft@@6B@ ??_7ISemanticContext@Events@Applications@Microsoft@@6B@ ?AddEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z ?AddModule@ILogConfiguration@Events@Applications@Microsoft@@QEAAXPEBDAEBV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@@Z ?AttachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z ?ClearExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXXZ ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@AEAVILogConfiguration@234@AEAW4status_t@234@@Z ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@PEBDAEAW4status_t@234@_K@Z ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@PEBD_NAEAVILogConfiguration@234@AEAW4status_t@234@_K@Z ?DecrementActiveHydrationsCount@QoS@@YAXXZ ?DestroyLogManager@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PEBD@Z ?DetachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z ?DispatchEvent@DebugEventSource@Events@Applications@Microsoft@@UEAA_NVDebugEvent@234@@Z ?DispatchEventBroadcast@ILogManager@Events@Applications@Microsoft@@SA_NVDebugEvent@234@@Z ?FromJSON@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@PEBD@Z ?FromLogConfiguration@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@AEAULogConfiguration@Telemetry@23@@Z ?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPEAVILogManager@234@AEAVILogConfiguration@234@AEAW4status_t@234@@Z ?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPEAVILogManager@234@PEBDAEAW4status_t@234@@Z ?GetActiveHydrationsCount@QoS@@YAIXZ ?GetApplicationPropertyId@QoS@@YA?AW4Id@PropertyId@TelemetryConstants@@XZ ?GetDefaultConfiguration@Events@Applications@Microsoft@@YAAEBVILogConfiguration@123@XZ ?GetErrorType@QoS@@YA?AW4Type@ErrorType@TelemetryConstants@@JI@Z ?GetErrorType@QoS@@YA?AW4Type@ErrorType@TelemetryConstants@@JIAEBV?$set@IU?$less@I@std@@V?$allocator@I@2@@std@@@Z ?GetInstance@Telemetry@@CAPEAV1@XZ ?GetLatency@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventLatency@234@XZ ?GetLogObfuscationKeyManger@@YAJPEAPEAVILogObfuscationKeyManager@@@Z ?GetLogObfuscatorAes@@YAJPEAPEAVILogObfuscatorAes@@@Z ?GetModule@ILogConfiguration@Events@Applications@Microsoft@@QEAA?AV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@PEBD@Z ?GetModules@ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@@std@@@2@@std@@XZ ?GetName@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?GetPersistence@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventPersistence@234@XZ ?GetPiiProperties@EventProperties@Events@Applications@Microsoft@@QEBA?BV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Applications@Microsoft@@@2@@std@@@2@@std@@W4DataCategory@234@@Z ?GetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QEBA_KXZ ?GetPopSample@EventProperties@Events@Applications@Microsoft@@QEBANXZ ?GetPriority@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventPriority@234@XZ ?GetProperties@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@W4DataCategory@234@@Z ?GetResultType@QoS@@YAPEB_WJI@Z ?GetResultType@QoS@@YAPEB_WW4Type@ErrorType@TelemetryConstants@@@Z ?GetTimestamp@EventProperties@Events@Applications@Microsoft@@QEBA_JXZ ?GetType@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?HasConfig@ILogConfiguration@Events@Applications@Microsoft@@QEAA_NPEBD@Z ?Hash@GUID_t@Events@Applications@Microsoft@@QEBA_KXZ ?IncrementActiveHydrationsCount@QoS@@YAXXZ ?Initialize@IModule@Events@Applications@Microsoft@@UEAAXPEAVILogManager@234@@Z ?InsertIntoIrmEnabledLibrarySet@QoS@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?IsAnyLibraryIrmEnabled@QoS@@YA_NXZ ?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@AEAVILogConfiguration@234@@Z ?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PEBD@Z ?RemoveEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z ?RemoveFromIrmEnabledLibrarySet@QoS@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?SetAppEnv@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentETag@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentImpressionId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppLanguage@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppName@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppVersion@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetApplicationId@QoS@@YAXI@Z ?SetCommercialId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetCommonField@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUEventProperty@234@@Z ?SetCustomField@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUEventProperty@234@@Z ?SetDeviceClass@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceMake@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceModel@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceOrgId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetEventExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z ?SetLatency@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventLatency@234@@Z ?SetLevel@EventProperties@Events@Applications@Microsoft@@QEAAXE@Z ?SetName@EventProperties@Events@Applications@Microsoft@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetNetworkCost@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4NetworkCost@234@@Z ?SetNetworkProvider@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetNetworkType@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4NetworkType@234@@Z ?SetOsBuild@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetOsName@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetOsVersion@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetPersistence@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventPersistence@234@@Z ?SetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QEAAX_K@Z ?SetPopsample@EventProperties@Events@Applications@Microsoft@@QEAAXN@Z ?SetPriority@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventPriority@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@NV?$allocator@N@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@_JV?$allocator@_J@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@EW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@FW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@GW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@NW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UGUID_t@234@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Utime_ticks_t@234@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_JW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_KW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_NW4PiiKind@234@W4DataCategory@234@@Z ?SetTicket@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4TicketType@234@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetTimestamp@EventProperties@Events@Applications@Microsoft@@QEAAX_J@Z ?SetType@EventProperties@Events@Applications@Microsoft@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserANID@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserAdvertisingId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@234@@Z ?SetUserLanguage@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserMsaId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserTimeZone@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SizeUnknown@QoS@@YAIXZ ?Teardown@IModule@Events@Applications@Microsoft@@UEAAXXZ ?TryGetLevel@EventProperties@Events@Applications@Microsoft@@QEBA?AV?$tuple@_NE@std@@XZ ?clear@EventProperty@Events@Applications@Microsoft@@QEAAXXZ ?convertUintVectorToGUID@GUID_t@Events@Applications@Microsoft@@SA?AU_GUID@@AEBV?$vector@EV?$allocator@E@std@@@std@@@Z ?copydata@EventProperty@Events@Applications@Microsoft@@AEAAXPEBU1234@@Z ?empty@EventProperty@Events@Applications@Microsoft@@QEAA_NXZ ?erase@EventProperties@Events@Applications@Microsoft@@QEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4DataCategory@234@@Z ?lock@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ@4V67@A ?pack@EventProperties@Events@Applications@Microsoft@@QEAAPEAUevt_prop@@XZ ?stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ ?to_bytes@GUID_t@Events@Applications@Microsoft@@QEBAXAEAY0BA@E@Z ?to_string@EventProperty@Events@Applications@Microsoft@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?to_string@GUID_t@Events@Applications@Microsoft@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?type_name@EventProperty@Events@Applications@Microsoft@@SAPEBDI@Z ?unpack@EventProperties@Events@Applications@Microsoft@@QEAA_NPEAUevt_prop@@_K@Z OnLoadTelemetryExtensions evt_api_call_default

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

778KB

Virtual Size

777KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

112KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

588KB

Virtual Size

592KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2025-07-05_f00e0eb5d59b531b7a9e5d464cad5285_black-basta_cobalt-strike_luca-stealer_satacom_vidar

kernel32

user32

bcrypt

rpcrt4

rstrtmgr

wer

winhttp

wintrust

advapi32

shell32

ole32

oleaut32

crypt32

secur32

shlwapi

urlmon

version

wininet

ws2_32

wtsapi32

userenv

iphlpapi

generic