_996174e56b67ac70b4615569a7fa16f1abf9e7a75666490e4f090da17c2dbc50[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
_996174e56b67ac70b4615569a7fa16f1abf9e7a75666490e4f090da17c2dbc50.dll
Size 679KB
Sample260702-vgv6jsas8x
SHA256 996174e56b67ac70b4615569a7fa16f1abf9e7a75666490e4f090da17c2dbc50
MD5 ae2039ae5b6731b6b18b3612e0b61429
SHA1 5d1138ac0ebeb2e78d1876e016292c4b6bd1c3b3
SHA512 aae1d096ecf6693662f67536a98ff739f089d12cc8475b786d7c68cb5532814b44190f22fd45023b47f442023b4fdfe4c210454d727ccbc4cca504fbf7e71d72
SSDEEP 12288:ZPQR8v+FozH+VJTDfAqybaJc9dw07iUpU26R9K6s4b:ZPHv+FozSTDYZA2dw07iUpyR9Kcb
TLSH
T1B5E44B1BA2A801A9D5FAD1B98E674417FBB3BC154722D3CF02E192590F277D89B3B710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
_996174e56b67ac70b4615569a7fa16f1abf9e7a75666490e4f090da17c2dbc50.dll

File Explorer

_996174e56b67ac70b4615569a7fa16f1abf9e7a75666490e4f090da17c2dbc50.dll

.dll 679KB

_996174e56b67ac70b4615569a7fa16f1abf9e7a75666490e4f090da17c2dbc50.dll

IMPHASH cc73d3684b534e1f682a09108fe1d0b7
SHA256 996174e56b67ac70b4615569a7fa16f1abf9e7a75666490e4f090da17c2dbc50
MD5 ae2039ae5b6731b6b18b3612e0b61429
SHA1 5d1138ac0ebeb2e78d1876e016292c4b6bd1c3b3
SHA512 aae1d096ecf6693662f67536a98ff739f089d12cc8475b786d7c68cb5532814b44190f22fd45023b47f442023b4fdfe4c210454d727ccbc4cca504fbf7e71d72
SSDEEP 12288:ZPQR8v+FozH+VJTDfAqybaJc9dw07iUpU26R9K6s4b:ZPHv+FozSTDYZA2dw07iUpyR9Kcb
TLSH
T1B5E44B1BA2A801A9D5FAD1B98E674417FBB3BC154722D3CF02E192590F277D89B3B710
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8d:23:00:9f:bf:ee:e2:7f:08:ba:46:80:db:ce:f7:aa:9f:88:f2:81:d1:f7:fa:c1:6c:94:ad:e1:d2:4c:db:9c

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 21, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ba:2b:8e:e1:83:51:fe:29:1a:00:00:00:00:00:ba

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2025 - May 28, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 30, 2025 - Apr 22, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

446976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

F:\dbs\sh\odct\1120_152402\client\onedrive\Product\Logging\dll\obj\amd64\LoggingPlatform.pdb

bcrypt

BCryptOpenAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptEncrypt BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptGenRandom

kernel32

GetLongPathNameW GetVolumePathNameW ReadFile RemoveDirectoryW SetFileAttributesW SetFileInformationByHandle SetFilePointer GetCompressedFileSizeW FindFirstFileNameW IsDebuggerPresent SetHandleInformation CreatePipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus IsWow64Process LoadLibraryExW GlobalAlloc GlobalUnlock GlobalLock GlobalFree ReadDirectoryChangesW CreateSymbolicLinkW CompareStringOrdinal CreateToolhelp32Snapshot Process32FirstW Process32NextW VerSetConditionMask GetProductInfo VerifyVersionInfoW SetLastError ReleaseMutex CreateEventW Sleep GetFileType GetEnvironmentVariableW ExpandEnvironmentStringsW GetFileAttributesW GetExitCodeProcess CreateProcessW SetProcessShutdownParameters GetSystemTimes SetThreadInformation GetProcessIoCounters GetPrivateProfileStringW WritePrivateProfileStringW SetDllDirectoryW CopyFileW MoveFileExW ReplaceFileW GetComputerNameW RegisterApplicationRestart GetFileInformationByHandleEx OpenFileById GetModuleHandleW GetDllDirectoryW SleepConditionVariableSRW GetTickCount64 FormatMessageA GetLocaleInfoEx FindFirstFileExW GetFinalPathNameByHandleW GetFileAttributesExW GetFileSizeEx GetFileSize GetFileInformationByHandle WaitForMultipleObjects WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetDiskFreeSpaceExW FindVolumeClose FindNextVolumeW FindFirstVolumeW CreateDirectoryW GetCommandLineW DeleteCriticalSection ReleaseSRWLockExclusive InitializeCriticalSectionEx K32GetModuleFileNameExW GetUserDefaultLCID GetUserGeoID LCIDToLocaleName MoveFileW LocalFree LocalAlloc GetModuleFileNameW GetVersionExW GetSystemTimeAsFileTime OpenProcess TerminateProcess GetCurrentProcess CreateMutexW WaitForSingleObject HeapFree HeapAlloc WideCharToMultiByte MultiByteToWideChar FreeLibrary GetProcAddress LoadLibraryW FindClose FindNextFileW FindFirstFileW CompareFileTime WerUnregisterFile WerRegisterFile DeleteFileW GetCurrentThreadId DeviceIoControl GetCurrentProcessId WriteFile CloseHandle SetFileTime SystemTimeToFileTime GetSystemTime GetLastError CreateFileW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared GetProcessTimes IsProcessorFeaturePresent QueryPerformanceCounter DisableThreadLibraryCalls InitializeSListHead OutputDebugStringW

user32

EnumWindows GetClassNameW SystemParametersInfoW PostMessageW GetMessageW CreateWindowExW TranslateMessage SendMessageTimeoutW RegisterClipboardFormatW SetClipboardData CloseClipboard OpenClipboard ShowWindow DestroyWindow DispatchMessageW RegisterClassW UnregisterSuspendResumeNotification RegisterSuspendResumeNotification UnregisterPowerSettingNotification RegisterPowerSettingNotification GetWindowThreadProcessId

advapi32

RegEnumValueW CreateProcessWithTokenW GetUserNameW SetFileSecurityW CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegDeleteTreeW RegUnLoadKeyW RegLoadKeyW RegEnumKeyW RegDeleteKeyExW RegCreateKeyTransactedW GetAclInformation FreeSid DuplicateTokenEx CreateWellKnownSid AllocateAndInitializeSid RegSetKeyValueW RegSetValueExW RegQueryValueExW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW LookupPrivilegeValueW GetTokenInformation AdjustTokenPrivileges OpenProcessToken RegGetValueW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey CryptGetHashParam CryptHashData CryptCreateHash CryptReleaseContext CryptAcquireContextW CryptDestroyHash

shell32

SHFileOperationW CommandLineToArgvW SHGetKnownFolderPath SHGetSpecialFolderPathW SHChangeNotify SHParseDisplayName ShellExecuteExW SHCreateItemFromParsingName SHGetPropertyStoreFromParsingName SHAssocEnumHandlers SHGetFolderPathW SHGetFolderPathAndSubDirW SHSetKnownFolderPath ord526 SHCreateDirectoryExW

ole32

CoTaskMemFree StringFromCLSID CoCreateInstance StringFromGUID2 CreateBindCtx CoUninitialize CoInitializeEx CoSetProxyBlanket CoCreateGuid CreateItemMoniker GetRunningObjectTable CLSIDFromString

oleaut32

LoadTypeLi LoadRegTypeLi GetRecordInfoFromTypeInfo

crypt32

CryptBinaryToStringW CertFindExtension CryptStringToBinaryW

rpcrt4

RpcServerRegisterIfEx RpcStringFreeW UuidCreate RpcBindingFree RpcBindingFromStringBindingW RpcBindingVectorFree RpcStringBindingComposeW RpcServerInqBindings UuidToStringW RpcServerUnregisterIf RpcServerUseProtseqW RpcBindingSetAuthInfoExW RpcEpRegisterW RpcEpUnregister RpcServerInqCallAttributesW

secur32

GetUserNameExW

shlwapi

SHGetValueA PathRemoveFileSpecW SHRegGetValueW SHRegGetPathW SHRegGetBoolUSValueW SHDeleteValueW SHDeleteKeyW StrStrIW PathIsPrefixW PathIsDirectoryEmptyW SHRegGetUSValueW SHGetValueW PathStripPathW PathIsRelativeW PathFileExistsW SHSetValueW PathIsDirectoryW AssocQueryStringW SHCreateStreamOnFileW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wininet

InternetCheckConnectionW

ws2_32

bind htons socket setsockopt listen closesocket WSAStartup accept send WSAGetLastError htonl

wtsapi32

WTSQuerySessionInformationW WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

msvcp140

?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z ?_Getname@_Locinfo@std@@QEBAPEBDXZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@HPEBD@Z ?_Xruntime_error@std@@YAXPEBD@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?toupper@?$ctype@_W@std@@QEBA_W_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setf@ios_base@std@@QEAAHH@Z ?setf@ios_base@std@@QEAAHHH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ??Bios_base@std@@QEBA_NXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z _Wcscoll _Wcsxfrm ??0_Locinfo@std@@QEAA@PEBD@Z ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?fail@ios_base@std@@QEBA_NXZ ?eof@ios_base@std@@QEBA_NXZ ?bad@ios_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Random_device@std@@YAIXZ ?id@?$ctype@_W@std@@2V0locale@2@A ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@_W@std@@2V0locale@2@A ?widen@?$ctype@_W@std@@QEBA_WD@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A ??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ ??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z ?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z ?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_init_in_situ ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock _Xtime_get_ticks ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?flags@ios_base@std@@QEBAHXZ ?uncaught_exceptions@std@@YAHXZ ?good@ios_base@std@@QEBA_NXZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??Bid@locale@std@@QEAA_KXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xbad_function_call@std@@YAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Xbad_alloc@std@@YAXXZ _Cnd_init_in_situ _Cnd_broadcast _Thrd_join _Thrd_id _Query_perf_counter _Query_perf_frequency _Cnd_do_broadcast_at_thread_exit _Cnd_wait

userenv

GetDefaultUserProfileDirectoryW CreateEnvironmentBlock

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception __C_specific_handler wcsstr strchr __RTDynamicCast __std_type_info_destroy_list wcschr __std_terminate __std_exception_copy __std_exception_destroy _purecall strrchr wcsrchr _CxxThrowException memcmp memcpy memmove memset

api-ms-win-crt-runtime-l1-1-0

_cexit _execute_onexit_table _register_onexit_function _initterm _crt_atexit _initterm_e _initialize_onexit_table _beginthreadex _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _beginthread terminate _invalid_parameter_noinfo_noreturn _errno abort

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 _gmtime64_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file _wrename

api-ms-win-crt-string-l1-1-0

_wcsicmp iswspace towupper towlower tolower wcstok_s isxdigit _wcsnicmp _wcsdup

api-ms-win-crt-stdio-l1-1-0

_wfopen_s ungetc fflush fsetpos _fseeki64 __stdio_common_vsprintf_s fgetpos fwrite fread _get_stream_buffer_pointers fclose setvbuf __stdio_common_vswprintf fgetc fgetwc fputc fputwc ungetwc

api-ms-win-crt-convert-l1-1-0

wcstol _strtod_l strtoll atol atof wcstoul _wtoi wcstoll

api-ms-win-crt-heap-l1-1-0

malloc _callnewh realloc free

api-ms-win-crt-locale-l1-1-0

_free_locale _create_locale

api-ms-win-crt-math-l1-1-0

ceilf

??0IScenario@ScenarioTracking@@QEAA@AEBV01@@Z ??0IScenario@ScenarioTracking@@QEAA@XZ ??0ScenarioBase@ScenarioTracking@@QEAA@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ??0Scope@ScenarioTracking@@QEAA@V?$shared_ptr@VIScenario@ScenarioTracking@@@std@@@Z ??0StructuredEvent@@QEAA@PEBDH0AEBU_GUID@@IIII@Z ??0SuppressTransferScope@ScenarioTracking@@QEAA@XZ ??0TelemetryEvent@@QEAA@PEBD0AEBU_GUID@@II00II@Z ??0TransferScope@ScenarioTracking@@QEAA@QEBVITrace@1@@Z ??0TransferScope@ScenarioTracking@@QEAA@V?$unique_ptr@VITrace@ScenarioTracking@@U?$default_delete@VITrace@ScenarioTracking@@@std@@@std@@@Z ??1IScenario@ScenarioTracking@@UEAA@XZ ??1ScenarioBase@ScenarioTracking@@UEAA@XZ ??1Scope@ScenarioTracking@@QEAA@XZ ??1SuppressTransferScope@ScenarioTracking@@QEAA@XZ ??1TelemetryEvent@@QEAA@XZ ??1TransferScope@ScenarioTracking@@QEAA@XZ ??4IScenario@ScenarioTracking@@QEAAAEAV01@AEBV01@@Z ??_7IScenario@ScenarioTracking@@6B@ ?ApplyScenarioImplicitParameters@ScenarioTracking@@YAXPEB_WAEBV?$function@$$A6AXPEBDV?$variant@PEBDPEB_WHI_J_K_N@std@@@Z@std@@@Z ?ApplyScenarioTracking@ScenarioTracking@@YAXAEBV?$function@$$A6AXPEBDV?$variant@PEBDPEB_WHI_J_K_N@std@@@Z@std@@@Z ?AssertReconfigure@@YAXAEAVIUpdateRingSettingsManager@@@Z ?AssignLoggingSession@@YAXAEBV?$shared_ptr@VILoggingSession@@@std@@_N@Z ?CaptureTrace@ScenarioTracking@@YA?AV?$unique_ptr@VITrace@ScenarioTracking@@U?$default_delete@VITrace@ScenarioTracking@@@std@@@std@@XZ ?ClassifyScenarioOutcome@FailuresClassification@@YA?AW4Outcome@QoS@@PEB_WW423@K@Z ?ClassifyScenarioOutcome@FailuresClassification@@YA?AW4Outcome@QoS@@PEB_WW423@PEBD@Z ?ClearLoggingSession@@YAXXZ ?ClearScenarioAddedCallback@Detail@ScenarioTracking@@YAXXZ ?ConvertOutcomeToResultType@QoS@@YAPEB_WW4Outcome@1@@Z ?ConvertResultTypeToOutcome@QoS@@YA?AW4Outcome@1@PEB_W@Z ?CreateBinaryLoggingSession@@YAPEAVILoggingSession@@XZ ?CreateScopedLoggingSession@OdLog@@YAIAEBUContextOptions@1@@Z ?DecrementActiveHydrationsCount@QoS@@YAXXZ ?DestroyScopedLoggingSession@OdLog@@YAXI@Z ?DetectFromCollectorUrl@EUDBStatus@@SAXPEB_W@Z ?DisableAllLoggingContexts@OdLog@@YAXXZ ?FlushObfuscationTableToDisk@@YAXXZ ?GenerateNewObfuscationEncryptionKey@@YAJAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z ?GenerateNewObfuscationEncryptionKey@@YAJXZ ?GetActiveHydrationsCount@QoS@@YAIXZ ?GetActiveLoggingContext@OdLog@@YAIXZ ?GetApplicationPropertyId@QoS@@YA?AW4Id@PropertyId@TelemetryConstants@@XZ ?GetCurrentTraceId@ScenarioTracking@@YAIXZ ?GetDaemonAndPkgLoggingPath@@YAJAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?GetDefaultLoggingPath@@YAJAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV12@@Z ?GetDuration@ScenarioBase@ScenarioTracking@@UEAA?AV?$duration@_JU?$ratio@$00$0DOI@@std@@@chrono@std@@XZ ?GetEmptyTelemetryUsageExperimentVector@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?GetErrorType@QoS@@YA?AW4Type@ErrorType@TelemetryConstants@@JI@Z ?GetErrorType@QoS@@YA?AW4Type@ErrorType@TelemetryConstants@@JIAEBV?$set@IU?$less@I@std@@V?$allocator@I@2@@std@@@Z ?GetId@ScenarioBase@ScenarioTracking@@UEAA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?GetInstance@Telemetry@@CAPEAV1@XZ ?GetLogObfuscationKeyManger@@YAJPEAPEAVILogObfuscationKeyManager@@@Z ?GetLogObfuscatorAes@@YAJPEAPEAVILogObfuscatorAes@@@Z ?GetLoggingSession@@YA?AV?$shared_ptr@VILoggingSession@@@std@@XZ ?GetName@ScenarioBase@ScenarioTracking@@UEAA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?GetResultType@QoS@@YAPEB_WJI@Z ?GetResultType@QoS@@YAPEB_WW4Type@ErrorType@TelemetryConstants@@@Z ?GetScenarioTracePath@ScenarioTracking@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEBVITrace@1@@Z ?GetValueTranslation@TelemetryEvent@@QEAAP6A?AV?$variant@Umonostate@std@@PEBDH@std@@AEBUStructuredEventParameter@@@Z_K@Z ?GuidToString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBU_GUID@@@Z ?IncrementActiveHydrationsCount@QoS@@YAXXZ ?InsertIntoIrmEnabledLibrarySet@QoS@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?IsAnyLibraryIrmEnabled@QoS@@YA_NXZ ?IsAssertIdDisabled@@YA_NPEB_W@Z ?IsEUDBCollectorUrl@EUDBStatus@@SA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?IsInEUDB@EUDBStatus@@SA_NXZ ?IsRecorded@ScenarioBase@ScenarioTracking@@UEAA_NXZ ?IsValidLoggingContext@OdLog@@YA_NI@Z ?LoggingAddToMultiValueCommonDatapoint@@YAXPEB_W0@Z ?LoggingFinalizeBasicCommonDatapoints@@YAXXZ ?LoggingGetCallbackCount@@YA_KXZ ?LoggingGetLogObfuscationKey@@YAJAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?LoggingInitializeForExternalComponent@@YAJPEB_W0_NG11W4TelemetryTransportType@@0K1@Z ?LoggingReconfigure@@YAXPEAVIUpdateRingSettingsManager@@@Z ?LoggingRecordAssert@@YAXPEB_W000I0_NI1@Z ?LoggingRecordAssert@@YAXPEB_W00I0_NI1@Z ?LoggingRecordUnexpectedCrash@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0K@Z ?LoggingRegisterCallback@@YA_KP6AXPEAXPEBDI1AEBU_GUID@@IIIQEAUStructuredEventParameter@@@Z0@Z ?LoggingRemoveFromMultiValueCommonDatapoint@@YAXPEB_W0@Z ?LoggingResetAccountSpecificCommonDatapoints@@YAXXZ ?LoggingRotate@@YAXXZ ?LoggingRotateIfNeeded@@YAXXZ ?LoggingSanitizeFilename@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBD@Z ?LoggingSendTelemetryEvent@@YAXAEAUTelemetryEvent@@QEAUStructuredEventParameter@@@Z ?LoggingSetCommonDatapoint@@YAXPEB_W0@Z ?LoggingSetCommonDatapointUserId@@YAXPEB_WW4UserIdType@@@Z ?LoggingSetDeviceTicket@@YAXPEB_W@Z ?LoggingSetExperimentSetupData@@YAXPEBDIQEAUExperimentSetupData@@I1@Z ?LoggingSetLoggingPrivacyLevel@@YAXW4LoggingPrivacyLevel@@@Z ?LoggingShouldSample@@YA_NN@Z ?LoggingSwitchTelemetryPipeline@@YAXW4TelemetryTransportType@@UTelemetryPipelineSwitchFlags@@@Z ?LoggingTranslateNativeType@@YA?AV?$variant@Umonostate@std@@PEBDH@std@@IAEBUStructuredEventParameter@@@Z ?LoggingUninitializeForExternalComponent@@YAXXZ ?LoggingUnregisterCallback@@YAX_K@Z ?LoggingUpdateCollectorUrl@@YAXPEB_W@Z ?LoggingWriteDebugString@@YAXHPEBDI0_NPEB_WZZ ?LoggingWriteDeviceFailureDatagramEntry@@YAXPEB_W0@Z ?LoggingWriteStructuredEvent@@YAXAEBUStructuredEvent@@QEAUStructuredEventParameter@@@Z ?MarkScenarioReported@ScenarioTracking@@YAXPEB_W@Z ?NarrowStringToWideString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEBD@Z ?ObserveTrace@ScenarioTracking@@YAPEAVITrace@1@XZ ?OneDriveAssertWorker@@YAXPEB_WW4OneDriveAssertType@@0I000ZZ ?OutcomeToTelemetryValue@QoS@@YA?AV?$variant@Umonostate@std@@PEBDH@std@@AEBUStructuredEventParameter@@@Z ?OverrideAsserts@@YAXP6AXPEB_W000I0_N@Z@Z ?OverrideDefaultLoggingContext@OdLog@@YAXI@Z ?ReconfigureLoggingContext@OdLog@@YAXPEAVIUpdateRingSettingsManager@@@Z ?Record@ScenarioBase@ScenarioTracking@@UEAAXXZ ?Register@FailuresClassification@@YAX$$QEAV?$function@$$A6A?AW4Outcome@QoS@@PEB_WW412@K@Z@std@@@Z ?RegisterSensitiveRootPath@@YAXPEB_W0@Z ?RemoveFromIrmEnabledLibrarySet@QoS@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?RemoveOldLogs@LoggingCleanup@@YAJAEAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@II_N@Z ?RemoveOldLogs@LoggingCleanup@@YAJAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z ?RemovePrivateInfo@@YAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?ReportExternalAssert@@YAXPEB_W_N0I0@Z ?Reset@FailuresClassification@@YAXXZ ?RestoreFromCache@EUDBStatus@@SAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?SaveCopyOfObfuscationKeyStore@@YAJAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?SaveCopyOfObfuscationKeyStore@@YAJXZ ?SetActiveLoggingContext@OdLog@@YAXI@Z ?SetApplicationId@QoS@@YAXI@Z ?SetEventExpiration@TelemetryEvent@@QEAAXII@Z ?SetIsInEUDB@EUDBStatus@@SAX_N@Z ?SetScenarioAddedCallback@Detail@ScenarioTracking@@YAX$$QEAV?$function@$$A6AXAEBV?$shared_ptr@VIScenario@ScenarioTracking@@@std@@@Z@std@@@Z ?SetValueTranslation@TelemetryEvent@@SAXPEAU1@_KP6A?AV?$variant@Umonostate@std@@PEBDH@std@@AEBUStructuredEventParameter@@@Z@Z ?ShouldDelegateTelemetryToCallback@@YA_NXZ ?SizeUnknown@QoS@@YAIXZ ?StartScenario@ScenarioTracking@@YA?AV?$shared_ptr@VIScenario@ScenarioTracking@@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@@Z ?StripPrivateInfoFromString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEB_W@Z ?UnregisterSensitiveRootPath@@YAXPEB_W@Z ?UpdateExperimentalAriaRampAPI@@YAX_N@Z ?UpdateLogObfuscationAesRamp@@YAX_N@Z ?UpdateObfuscationEncryptionKey@@YAJAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z ?UpdateObfuscationKeyToGeneral@@YAJXZ ?UpdateOfficePrivacyRamp@@YAX_N@Z ?UpdateScopedLoggingSession@OdLog@@YAXIAEBUContextUpdateOptions@1@@Z ?WideStringToNarrowString@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEB_W@Z ?g_ODHasFatallyAsserted@@3_NA ?g_assertLogger@@3P6AXPEB_W000I0_N@ZEA ?g_catchAssertCallbackInvoked@@3HA ?g_pLoggingAPIWrapper@@3PEAVILoggingAPIWrapper@@EA ?initAssertLogger@@YAXP6AXPEB_W000I0_N@Z@Z InitLogging TestInitLogging TestInitLoggingEx TestUninitLogging UninitLogging

Sharing

General

Malware Config

Signatures

File Explorer

_996174e56b67ac70b4615569a7fa16f1abf9e7a75666490e4f090da17c2dbc50.dll

PE Signature issue

bcrypt

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

rpcrt4

secur32

shlwapi

version

wininet

ws2_32

wtsapi32

msvcp140

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

generic