185302

Sharing

Copy URL Twitter E-mail

General

Target
185302
Size 174KB
Sample260424-mt65kse16w
SHA256 0bafe5fe9752d68860c103368b547435db48a70cfc90ec7e0f48c74d5589daa1
MD5 9d8f8170a6432030daa3cf1864e16dc4
SHA1 f53d4986cf12d0ca3ca1877b321c910b69a4e4d5
SHA512 4a8b9989a1d2b476e311b738935c88833d320df9615046545004a3014fa293661f9107cb9e6b9f241dcbb7fc7d00bc6f079db1f5e04cc66a7cde51335630a649
SSDEEP 3072:P6+y8HSENEwzbU1xx6otS+qyAwNF25XQVW7sYMGq+OsKD70as2G6DwGENwRDIEOH:P6+FHSxfSp2casmDZpxNoFkw
TLSH
T14B04182276F58575E9F32AF11A7CB1755A7EF9E10B2281EF6284139E4A207C0CE313D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

185302

.exe 174KB

IMPHASH f29841159aea5deac59b967f37940923
SHA256 0bafe5fe9752d68860c103368b547435db48a70cfc90ec7e0f48c74d5589daa1
MD5 9d8f8170a6432030daa3cf1864e16dc4
SHA1 f53d4986cf12d0ca3ca1877b321c910b69a4e4d5
SHA512 4a8b9989a1d2b476e311b738935c88833d320df9615046545004a3014fa293661f9107cb9e6b9f241dcbb7fc7d00bc6f079db1f5e04cc66a7cde51335630a649
SSDEEP 3072:P6+y8HSENEwzbU1xx6otS+qyAwNF25XQVW7sYMGq+OsKD70as2G6DwGENwRDIEOH:P6+FHSxfSp2casmDZpxNoFkw
TLSH
T14B04182276F58575E9F32AF11A7CB1755A7EF9E10B2281EF6284139E4A207C0CE313D6
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

c9:f2:2d:4d:e1:c8:0e:2d:03:ce:37:b4:70:28:46:04:59:cb:60:83:cf:6f:33:05:98:78:1e:38:ee:06:7b:b3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

0f:77:36:19:b8:7e:8c:44:40:03:53:64:a5:8c:3e:ad:70:a6:ec:78

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:73:77:d3:38:af:38:d3:bf:f6:00:00:00:00:00:73

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 7, 2015 - Jan 7, 2017

Minor OS version

Major OS version

Entry point

45415

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

FileSyncConfig.pdb

kernel32

FindFirstFileW FindClose CreateFileW CreateDirectoryW CompareStringOrdinal IsWow64Process SetFileAttributesW GetFileAttributesW DeleteFileW VerifyVersionInfoW GetDiskFreeSpaceExW GetCurrentProcess Sleep CloseHandle IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter EncodePointer OutputDebugStringW GetFileInformationByHandle GetVolumePathNameW RemoveDirectoryW SetFileInformationByHandle SetFilePointerEx SetFileTime GetSystemDirectoryW MoveFileExW ReplaceFileW DecodePointer GetFileInformationByHandleEx GetCurrentDirectoryW GetVolumeInformationByHandleW SetLastError DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException IsDebuggerPresent

msvcp120

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ _Mtx_init _Mtx_destroy _Mtx_lock _Mtx_unlock ?_Throw_C_error@std@@YAXH@Z ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?_BADOFF@std@@3_JB ??_7ios_base@std@@6B@ ??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?_Orphan_all@_Container_base0@std@@QAEXXZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?_Winerror_map@std@@YAPBDH@Z ?_Syserror_map@std@@YAPBDH@Z ??0id@locale@std@@QAE@I@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?uncaught_exception@std@@YA_NXZ ?_Xbad_function_call@std@@YAXXZ ??1ios_base@std@@UAE@XZ ?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ

msvcr120

_read _close ??3@YAXPAX@Z _purecall ??2@YAPAXI@Z __crtTerminateProcess __crtUnhandledException _crt_debugger_hook _except_handler4_common _controlfp_s _invoke_watson __crtSetUnhandledExceptionFilter ??1type_info@@UAE@XZ _onexit __dllonexit _calloc_crt _unlock _lock ?terminate@@YAXXZ _commode _fmode _wcmdln _initterm _initterm_e __setusermatherr _configthreadlocale _cexit _exit exit __set_app_type __wgetmainargs _amsg_exit __crtGetShowWindowMode _XcptFilter printf fprintf __iob_func memset memcpy __CxxFrameHandler3 _CxxThrowException ??_V@YAXPAX@Z memmove free ??0exception@std@@QAE@ABV01@@Z ??1exception@std@@UAE@XZ ?what@exception@std@@UBEPBDXZ _wcsicmp ??0exception@std@@QAE@ABQBDH@Z wcsrchr fclose feof ferror fflush fread _fseeki64 fwrite vfwprintf _wfopen _errno _wfullpath wcscpy_s _wcsnicmp _wfindfirst64i32 _gmtime64 _chsize _write _get_osfhandle _open_osfhandle _vsnprintf _vsnwprintf malloc

ole32

PropVariantClear CoTaskMemAlloc CoTaskMemFree CoCreateInstance CreateBindCtx CoInitialize CoUninitialize

ntdll

VerSetConditionMask NtQueryDirectoryFile RtlNtStatusToDosError

advapi32

RegQueryValueExW InitializeAcl SetNamedSecurityInfoW RegGetValueW RegDeleteTreeW RegSetValueExW RegDeleteValueW RegDeleteKeyExW RegCreateKeyExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegCloseKey

shell32

SHChangeNotify SHParseDisplayName ord526 ord709 SHGetKnownFolderPath SHBindToParent SHGetDataFromIDListW SHFileOperationW

shlwapi

PathIsPrefixW

telemetry

??0ScenarioQosDelegatedSyncWrapper@QoS@@IAE@W4_ScenarioId@Bici@@@Z ??1ScenarioQosDelegatedSyncWrapper@QoS@@UAE@XZ ?RecordScenario@ScenarioQosDelegatedSyncWrapper@QoS@@UAEXHW4_ErrorType@Bici@@@Z ??1ScenarioQosSyncWrapper@QoS@@UAE@XZ ?RecordFailedAssert@QoS@@YAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00I0_N@Z ?DefineDatapointValueList@ScenarioQosSyncWrapper@QoS@@IAEXPAV?$vector@W4DatapointValueType@ValueNode@@V?$allocator@W4DatapointValueType@ValueNode@@@std@@@std@@@Z ??0ScenarioQosSyncWrapper@QoS@@IAE@W4_ScenarioId@Bici@@@Z ?RecordScenario@ScenarioQosSyncPerf@QoS@@UAEXW4SyncType@12@IIIII@Z ?RecordScenario@ScenarioQosSyncPerf@QoS@@UAEXW4SyncType@12@IIII@Z ??0ScenarioQosSyncPerfWrapper@QoS@@IAE@W4_ScenarioId@Bici@@@Z ?RecordUploadDownloadScenario@ScenarioQosSyncWrapper@QoS@@UAEXHW4_ErrorType@Bici@@IHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@11II@Z ?RecordScenarioWithSize@ScenarioQosSyncWrapper@QoS@@UAEXHW4_ErrorType@Bici@@I@Z ?GetTxnContextString@ScenarioQosWrapper@QoS@@UAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ??1ScenarioQosWrapper@QoS@@MAE@XZ ??1ScenarioQosSyncPerfWrapper@QoS@@UAE@XZ ?RecordScenario@ScenarioQosSyncWrapper@QoS@@UAEXHW4_ErrorType@Bici@@@Z

loggingplatform

?LoggingWriteStructuredEvent@@YGXPBDI0ABU_GUID@@IIIQAUStructuredEventParameter@@@Z ?LoggingRotateIfNeeded@@YGXXZ ?StripPrivateInfoFromString@@YG?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_W@Z

propsys

PropVariantToGUID

??0ScenarioQosChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosClientPolicy@QoS@@QAE@ABV01@@Z ??0ScenarioQosClientPolicy@QoS@@QAE@XZ ??0ScenarioQosDelegatedSyncWrapper@QoS@@QAE@ABV01@@Z ??0ScenarioQosDownloadFile@QoS@@QAE@ABV01@@Z ??0ScenarioQosDownloadFile@QoS@@QAE@_N@Z ??0ScenarioQosGetSpecialFolderInfo@QoS@@QAE@ABV01@@Z ??0ScenarioQosGetSpecialFolderInfo@QoS@@QAE@XZ ??0ScenarioQosLogUpload@QoS@@QAE@ABV01@@Z ??0ScenarioQosLogUpload@QoS@@QAE@XZ ??0ScenarioQosPartnerDefault@QoS@@QAE@ABV01@@Z ??0ScenarioQosPartnerDefault@QoS@@QAE@XZ ??0ScenarioQosPartnerDelete@QoS@@QAE@ABV01@@Z ??0ScenarioQosPartnerDelete@QoS@@QAE@XZ ??0ScenarioQosPartnerDownload@QoS@@QAE@ABV01@@Z ??0ScenarioQosPartnerDownload@QoS@@QAE@XZ ??0ScenarioQosPartnerLookup@QoS@@QAE@ABV01@@Z ??0ScenarioQosPartnerLookup@QoS@@QAE@XZ ??0ScenarioQosPartnerReload@QoS@@QAE@ABV01@@Z ??0ScenarioQosPartnerReload@QoS@@QAE@XZ ??0ScenarioQosPartnerRename@QoS@@QAE@ABV01@@Z ??0ScenarioQosPartnerRename@QoS@@QAE@XZ ??0ScenarioQosPartnerReset@QoS@@QAE@ABV01@@Z ??0ScenarioQosPartnerReset@QoS@@QAE@XZ ??0ScenarioQosPartnerStart@QoS@@QAE@ABV01@@Z ??0ScenarioQosPartnerStart@QoS@@QAE@XZ ??0ScenarioQosPartnerStop@QoS@@QAE@ABV01@@Z ??0ScenarioQosPartnerStop@QoS@@QAE@XZ ??0ScenarioQosPartnerUpload@QoS@@QAE@ABV01@@Z ??0ScenarioQosPartnerUpload@QoS@@QAE@XZ ??0ScenarioQosPollingChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosPollingChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosQuotaStatus@QoS@@QAE@ABV01@@Z ??0ScenarioQosQuotaStatus@QoS@@QAE@_N@Z ??0ScenarioQosSelectiveSyncEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosSelectiveSyncEnumeration@QoS@@QAE@XZ ??0ScenarioQosStartupChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosStartupChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosStorageProvisioning@QoS@@QAE@ABV01@@Z ??0ScenarioQosStorageProvisioning@QoS@@QAE@XZ ??0ScenarioQosSubScopeMapping@QoS@@QAE@ABV01@@Z ??0ScenarioQosSubScopeMapping@QoS@@QAE@XZ ??0ScenarioQosSyncPerf@QoS@@QAE@ABV01@@Z ??0ScenarioQosSyncPerf@QoS@@QAE@XZ ??0ScenarioQosSyncPerfWrapper@QoS@@QAE@ABV01@@Z ??0ScenarioQosSyncVerification@QoS@@QAE@ABV01@@Z ??0ScenarioQosSyncVerification@QoS@@QAE@XZ ??0ScenarioQosSyncWrapper@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadCrossScopeCopy@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadCrossScopeCopy@QoS@@QAE@XZ ??0ScenarioQosUploadExternalFile@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadExternalFile@QoS@@QAE@XZ ??0ScenarioQosUploadFile@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadFile@QoS@@QAE@_N@Z ??0ScenarioQosUploadMetadata@QoS@@QAE@ABV01@@Z ??0ScenarioQosUploadMetadata@QoS@@QAE@_N0@Z ??0ScenarioQosWNSNotificationChangeEnumeration@QoS@@QAE@ABV01@@Z ??0ScenarioQosWNSNotificationChangeEnumeration@QoS@@QAE@_N@Z ??0ScenarioQosWrapper@QoS@@QAE@ABV01@@Z ??1ScenarioQosChangeEnumeration@QoS@@UAE@XZ ??1ScenarioQosClientPolicy@QoS@@UAE@XZ ??1ScenarioQosDownloadFile@QoS@@UAE@XZ ??1ScenarioQosGetSpecialFolderInfo@QoS@@UAE@XZ ??1ScenarioQosLogUpload@QoS@@UAE@XZ ??1ScenarioQosPartnerDefault@QoS@@UAE@XZ ??1ScenarioQosPartnerDelete@QoS@@UAE@XZ ??1ScenarioQosPartnerDownload@QoS@@UAE@XZ ??1ScenarioQosPartnerLookup@QoS@@UAE@XZ ??1ScenarioQosPartnerReload@QoS@@UAE@XZ ??1ScenarioQosPartnerRename@QoS@@UAE@XZ ??1ScenarioQosPartnerReset@QoS@@UAE@XZ ??1ScenarioQosPartnerStart@QoS@@UAE@XZ ??1ScenarioQosPartnerStop@QoS@@UAE@XZ ??1ScenarioQosPartnerUpload@QoS@@UAE@XZ ??1ScenarioQosPollingChangeEnumeration@QoS@@UAE@XZ ??1ScenarioQosQuotaStatus@QoS@@UAE@XZ ??1ScenarioQosSelectiveSyncEnumeration@QoS@@UAE@XZ ??1ScenarioQosStartupChangeEnumeration@QoS@@UAE@XZ ??1ScenarioQosStorageProvisioning@QoS@@UAE@XZ ??1ScenarioQosSubScopeMapping@QoS@@UAE@XZ ??1ScenarioQosSyncPerf@QoS@@UAE@XZ ??1ScenarioQosSyncVerification@QoS@@UAE@XZ ??1ScenarioQosUploadCrossScopeCopy@QoS@@UAE@XZ ??1ScenarioQosUploadExternalFile@QoS@@UAE@XZ ??1ScenarioQosUploadFile@QoS@@UAE@XZ ??1ScenarioQosUploadMetadata@QoS@@UAE@XZ ??1ScenarioQosWNSNotificationChangeEnumeration@QoS@@UAE@XZ ??4ScenarioQosChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosClientPolicy@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosDelegatedSyncWrapper@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosDownloadFile@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosGetSpecialFolderInfo@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosLogUpload@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosPartnerDefault@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosPartnerDelete@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosPartnerDownload@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosPartnerLookup@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosPartnerReload@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosPartnerRename@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosPartnerReset@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosPartnerStart@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosPartnerStop@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosPartnerUpload@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosPollingChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosQuotaStatus@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSelectiveSyncEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosStartupChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosStorageProvisioning@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSubScopeMapping@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncPerf@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncPerfWrapper@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncVerification@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosSyncWrapper@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadCrossScopeCopy@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadExternalFile@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadFile@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosUploadMetadata@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosWNSNotificationChangeEnumeration@QoS@@QAEAAV01@ABV01@@Z ??4ScenarioQosWrapper@QoS@@QAEAAV01@ABV01@@Z ??_7ScenarioQosChangeEnumeration@QoS@@6B@ ??_7ScenarioQosClientPolicy@QoS@@6B@ ??_7ScenarioQosDelegatedSyncWrapper@QoS@@6B@ ??_7ScenarioQosDownloadFile@QoS@@6B@ ??_7ScenarioQosGetSpecialFolderInfo@QoS@@6B@ ??_7ScenarioQosLogUpload@QoS@@6B@ ??_7ScenarioQosPartnerDefault@QoS@@6B@ ??_7ScenarioQosPartnerDelete@QoS@@6B@ ??_7ScenarioQosPartnerDownload@QoS@@6B@ ??_7ScenarioQosPartnerLookup@QoS@@6B@ ??_7ScenarioQosPartnerReload@QoS@@6B@ ??_7ScenarioQosPartnerRename@QoS@@6B@ ??_7ScenarioQosPartnerReset@QoS@@6B@ ??_7ScenarioQosPartnerStart@QoS@@6B@ ??_7ScenarioQosPartnerStop@QoS@@6B@ ??_7ScenarioQosPartnerUpload@QoS@@6B@ ??_7ScenarioQosPollingChangeEnumeration@QoS@@6B@ ??_7ScenarioQosQuotaStatus@QoS@@6B@ ??_7ScenarioQosSelectiveSyncEnumeration@QoS@@6B@ ??_7ScenarioQosStartupChangeEnumeration@QoS@@6B@ ??_7ScenarioQosStorageProvisioning@QoS@@6B@ ??_7ScenarioQosSubScopeMapping@QoS@@6B@ ??_7ScenarioQosSyncPerf@QoS@@6B@ ??_7ScenarioQosSyncPerfWrapper@QoS@@6B@ ??_7ScenarioQosSyncVerification@QoS@@6B@ ??_7ScenarioQosSyncWrapper@QoS@@6B@ ??_7ScenarioQosUploadCrossScopeCopy@QoS@@6B@ ??_7ScenarioQosUploadExternalFile@QoS@@6B@ ??_7ScenarioQosUploadFile@QoS@@6B@ ??_7ScenarioQosUploadMetadata@QoS@@6B@ ??_7ScenarioQosWNSNotificationChangeEnumeration@QoS@@6B@ ??_7ScenarioQosWrapper@QoS@@6B@ ?DefaultOrMostSevereErrorTypeRecorded@ScenarioQosWrapper@QoS@@QAE?AW4_ErrorType@Bici@@W434@@Z ?GetApiId@ScenarioQosWrapper@QoS@@IAE?AW4_ApiId@Bici@@XZ ?GetMostSevereErrorTypeRecorded@ScenarioQosWrapper@QoS@@QAE?AW4_ErrorType@Bici@@XZ

Sharing

General

Malware Config

Signatures

File Explorer

185302

PE Signature issue

kernel32

msvcp120

msvcr120

ole32

ntdll

advapi32

shell32

shlwapi

telemetry

loggingplatform

propsys

generic