2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 3.9MB
Sample260820-nnapvsbl4t
SHA256 d0dccdc370135ec38d15c1114cf2115bcb49363140027364c76601558acfdea3
MD5 bc7b83c584c0da6ed0070978648c7655
SHA1 60b88b9b3b26c6b81e66e7455d26405e5bdc8753
SHA512 0f257f4970c5d7a765dcd5ad0540b3b6196d2841d623ef4f9043a553c8289b19c871bf41c690df4ff1afb99ddc0acdaa364dd3f39c382cb863d5c18d30000d48
SSDEEP 49152:Zi0BSWtOZvU0g8qptYgpADvbf2OQDSIGAauJc0GaTZbwfITQTqvR2TPod5:Rtb8qRFTauXr2Tc5
TLSH
T177167C06E6B940E4D0BBD13D8A979647FAB1385AC73197CB46A1875A1F237F09E3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 3.9MB

2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH d71b0d0219a07bb80107b0f4557c8983
SHA256 d0dccdc370135ec38d15c1114cf2115bcb49363140027364c76601558acfdea3
MD5 bc7b83c584c0da6ed0070978648c7655
SHA1 60b88b9b3b26c6b81e66e7455d26405e5bdc8753
SHA512 0f257f4970c5d7a765dcd5ad0540b3b6196d2841d623ef4f9043a553c8289b19c871bf41c690df4ff1afb99ddc0acdaa364dd3f39c382cb863d5c18d30000d48
SSDEEP 49152:Zi0BSWtOZvU0g8qptYgpADvbf2OQDSIGAauJc0GaTZbwfITQTqvR2TPod5:Rtb8qRFTauXr2Tc5
TLSH
T177167C06E6B940E4D0BBD13D8A979647FAB1385AC73197CB46A1875A1F237F09E3E340
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

744768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\dbs\sh\odct\0311_095523\client\onedrive\Product\ElevatedHelper\Server\exe\obj\amd64\FileSyncHelper.pdb

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider BCryptEncrypt BCryptGenerateSymmetricKey BCryptSetProperty BCryptDestroyKey

propsys

VariantGetElementCount InitVariantFromBuffer

rpcrt4

RpcStringFreeW UuidToStringW UuidCreate RpcBindingFree RpcBindingFromStringBindingW RpcBindingVectorFree RpcStringBindingComposeW RpcServerInqBindings RpcServerRegisterIfEx RpcServerUnregisterIf NdrServerCall2 NdrServerCallAll RpcServerInqCallAttributesW RpcEpUnregister RpcServerUseProtseqW RpcBindingSetAuthInfoExW RpcEpRegisterW

virtdisk

CreateVirtualDisk CompactVirtualDisk OpenVirtualDisk GetVirtualDiskPhysicalPath AttachVirtualDisk

kernel32

WideCharToMultiByte LCMapStringW VerSetConditionMask GetProductInfo VerifyVersionInfoW SetLastError GetLongPathNameW ReleaseMutex CreateEventW Sleep WaitForMultipleObjects GetEnvironmentVariableW ExpandEnvironmentStringsW GetProcessTimes GetExitCodeProcess CreateProcessW SetProcessShutdownParameters GetSystemTimes SetThreadInformation FindFirstVolumeW FindNextVolumeW FindVolumeClose GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetVolumePathNameW ReadFile RemoveDirectoryW SetFileAttributesW SetFileInformationByHandle SetFilePointer GetCompressedFileSizeW FindFirstFileNameW IsDebuggerPresent SetHandleInformation CreatePipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus IsWow64Process LoadLibraryExW GlobalAlloc GlobalUnlock GlobalLock GlobalFree ReadDirectoryChangesW CreateSymbolicLinkW CompareStringOrdinal CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessIoCounters GetPrivateProfileStringW WritePrivateProfileStringW MoveFileExW ReplaceFileW GetComputerNameW RegisterApplicationRestart GetFileInformationByHandleEx OpenFileById GetModuleHandleW GetDllDirectoryW SetFilePointerEx GetDiskFreeSpaceW LockFile GetFullPathNameA UnlockFileEx UnmapViewOfFile HeapValidate GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA FlushViewOfFile CreateFileA LoadLibraryA DeleteFileA HeapCompact UnlockFile LockFileEx CreateFileMappingW MapViewOfFile GetTickCount GetSystemPowerStatus MultiByteToWideChar GetUserDefaultLocaleName GetUserDefaultLCID GetUserGeoID LCIDToLocaleName MoveFileW LocalAlloc GetVersionExW GetSystemTimeAsFileTime OpenProcess TerminateProcess GetCurrentProcess CreateMutexW WaitForSingleObject GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetModuleFileNameW GetTempPathW DeleteFileW CreateDirectoryW WerUnregisterFile WerRegisterFile GetCurrentThreadId GetCurrentProcessId SystemTimeToFileTime GetSystemTime WriteFile SetFileTime LoadLibraryW GetProcAddress FreeLibrary DeviceIoControl CloseHandle FindNextFileW FindFirstFileW FindClose CreateFileW CompareFileTime SetDllDirectoryW DeleteCriticalSection LocalFree DecodePointer GetLastError InitializeCriticalSectionEx GetCommandLineW HeapCreate InitializeCriticalSection WaitForMultipleObjectsEx AreFileApisANSI CreateHardLinkW EncodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce CreateEventExW SetEndOfFile GetFullPathNameW FindFirstFileExW GetCurrentDirectoryW GetLocaleInfoEx AcquireSRWLockShared ReleaseSRWLockShared QueryPerformanceFrequency QueryPerformanceCounter SleepConditionVariableSRW SleepConditionVariableCS GetModuleFileNameA WakeAllConditionVariable GetTickCount64 RtlUnwind LoadLibraryExA OutputDebugStringA WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW K32GetModuleFileNameExW GetCommandLineA WakeConditionVariable InitializeConditionVariable GetNativeSystemInfo GetExitCodeThread SwitchToThread WaitForSingleObjectEx TryEnterCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetStringTypeW FormatMessageA CopyFileW GetOEMCP GetACP IsValidCodePage ReadConsoleW SetStdHandle GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW GetTimeFormatW GetDateFormatW GetStdHandle ExitProcess VirtualQuery VirtualProtect GetSystemInfo FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext ResetEvent SetEvent InitializeCriticalSectionAndSpinCount GetCPInfo CompareStringEx OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection

user32

RegisterClipboardFormatW SetClipboardData CloseClipboard PostThreadMessageW PostQuitMessage PeekMessageW MsgWaitForMultipleObjectsEx SetCursor LoadCursorW OpenClipboard ShowWindow DestroyWindow EnumWindows CreateWindowExW RegisterClassW UnregisterPowerSettingNotification RegisterPowerSettingNotification DispatchMessageW TranslateMessage GetMessageW SendMessageTimeoutW SystemParametersInfoW GetWindowThreadProcessId GetClassNameW PostMessageW

advapi32

RegEnumKeyExW RegisterEventSourceW DeregisterEventSource CryptImportKey CryptSetHashParam CryptDestroyKey LookupAccountNameW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash OpenProcessToken AdjustTokenPrivileges CreateProcessWithTokenW GetUserNameW SetFileSecurityW ConvertSidToStringSidW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW QueryServiceStatusEx QueryServiceStatus EventWriteTransfer EventRegister RegGetValueA QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegDeleteTreeW RegUnLoadKeyW RegLoadKeyW RegEnumKeyW RegDeleteKeyExW RegCreateKeyTransactedW GetAclInformation FreeSid DuplicateTokenEx CreateWellKnownSid AllocateAndInitializeSid CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW RegGetValueW RegSetKeyValueW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCreateKeyExW RegCloseKey LookupPrivilegeValueW GetTokenInformation ReportEventW

shell32

SHSetKnownFolderPath SHCreateDirectoryExW SHGetFolderPathAndSubDirW SHGetKnownFolderPath SHFileOperationW SHGetSpecialFolderPathW SHChangeNotify SHParseDisplayName ShellExecuteExW SHCreateItemFromParsingName SHAssocEnumHandlers SHGetFolderPathW ord526 CommandLineToArgvW

ole32

CoInitialize CoCreateFreeThreadedMarshaler CoWaitForMultipleHandles GetRunningObjectTable CreateItemMoniker CoSetProxyBlanket CoInitializeEx CoUninitialize CLSIDFromString CreateBindCtx StringFromGUID2 CoCreateInstance CoCreateGuid CoTaskMemFree StringFromCLSID

oleaut32

SafeArrayUnaccessData SafeArrayAccessData VariantCopy VariantChangeType VariantClear VariantInit SysAllocString SysFreeString GetRecordInfoFromTypeInfo LoadRegTypeLi LoadTypeLi SetErrorInfo GetErrorInfo SysStringLen

crypt32

CertFindExtension CryptStringToBinaryW CryptBinaryToStringW CertGetEnhancedKeyUsage CryptProtectMemory CryptUnprotectMemory CertFreeCertificateChain CertVerifyCertificateChainPolicy

secur32

GetUserNameExW

shlwapi

PathIsRelativeW PathFileExistsW PathIsDirectoryW PathFindFileNameW SHGetValueW SHRegGetUSValueW ord219 PathStripPathW PathStripToRootW StrStrIW PathRemoveFileSpecW SHDeleteKeyW SHDeleteValueW SHGetValueA SHSetValueW SHRegGetValueW SHRegGetPathW SHRegGetBoolUSValueW AssocQueryStringW SHCreateStreamOnFileW PathIsDirectoryEmptyW PathIsPrefixW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wininet

HttpAddRequestHeadersA HttpOpenRequestA InternetSetStatusCallbackW InternetCrackUrlA InternetOpenW InternetCloseHandle InternetConnectA InternetReadFile InternetCheckConnectionW HttpQueryInfoA HttpSendRequestW InternetQueryOptionW

ws2_32

accept bind closesocket htonl htons listen send setsockopt WSAGetLastError WSAStartup socket

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSEnumerateSessionsW WTSQueryUserToken

userenv

CreateEnvironmentBlock GetDefaultUserProfileDirectoryW

iphlpapi

GetAdaptersInfo

wintrust

WTHelperGetProvSignerFromChain WinVerifyTrustEx WTHelperProvDataFromStateData

?$TSS0@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ@4HA ??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@XZ ??0DebugEventListener@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0DebugEventListener@Events@Applications@Microsoft@@QEAA@XZ ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@XZ ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@5@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@E@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@5@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@XZ ??0EventProperty@Events@Applications@Microsoft@@QEAA@$$QEAU0123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@NV?$allocator@N@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@_JV?$allocator@_J@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@CW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@EW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@FW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@GW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@HW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@IW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@JW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@NW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@PEBDW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@UGUID_t@123@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@Utime_ticks_t@123@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@XZ ??0EventProperty@Events@Applications@Microsoft@@QEAA@_JW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@_KW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@_NW4PiiKind@123@W4DataCategory@123@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@HHHAEBV?$initializer_list@E@std@@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@PEBD@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@QEBE_N@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@U_GUID@@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@XZ ??0IAuthTokensController@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0IAuthTokensController@Events@Applications@Microsoft@@QEAA@XZ ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@AEBV?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@std@@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@XZ ??0ILogController@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z ??0ILogController@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogController@Events@Applications@Microsoft@@QEAA@XZ ??0ILogManager@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogManager@Events@Applications@Microsoft@@QEAA@XZ ??0ILogger@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogger@Events@Applications@Microsoft@@QEAA@XZ ??0IModule@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0IModule@Events@Applications@Microsoft@@QEAA@XZ ??0ISemanticContext@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ISemanticContext@Events@Applications@Microsoft@@QEAA@XZ ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@$$QEAU0123@@Z ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@XZ ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@PEB_J@Z ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@XZ ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@_K@Z ??1DebugEventDispatcher@Events@Applications@Microsoft@@UEAA@XZ ??1DebugEventListener@Events@Applications@Microsoft@@UEAA@XZ ??1DebugEventSource@Events@Applications@Microsoft@@UEAA@XZ ??1EventProperties@Events@Applications@Microsoft@@UEAA@XZ ??1EventProperty@Events@Applications@Microsoft@@UEAA@XZ ??1IAuthTokensController@Events@Applications@Microsoft@@UEAA@XZ ??1ILogConfiguration@Events@Applications@Microsoft@@QEAA@XZ ??1ILogManager@Events@Applications@Microsoft@@UEAA@XZ ??1ILogger@Events@Applications@Microsoft@@UEAA@XZ ??1IModule@Events@Applications@Microsoft@@UEAA@XZ ??1ISemanticContext@Events@Applications@Microsoft@@UEAA@XZ ??1LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@XZ ??4DebugEventDispatcher@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4DebugEventListener@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4DebugEventSource@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4DebugEventSource@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@NV?$allocator@N@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@_JV?$allocator@_J@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@C@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@E@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@F@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@G@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@H@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@I@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@J@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@N@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@PEBD@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@UGUID_t@123@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@Utime_ticks_t@123@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_J@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_K@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_N@Z ??4GUID_t@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??4IAuthTokensController@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogController@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4ILogController@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogManager@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogger@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4IModule@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ISemanticContext@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4LogConfiguration@Telemetry@Applications@Microsoft@@QEAAAEAU0123@$$QEAU0123@@Z ??4LogConfiguration@Telemetry@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??4LogManagerProvider@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4LogManagerProvider@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4time_ticks_t@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??8EventProperty@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z ??8GUID_t@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z ??AILogConfiguration@Events@Applications@Microsoft@@QEAAAEAVVariant@123@PEBD@Z ??DILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@2@@std@@XZ ??MGUID_t@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z ??YEventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z ??_7DebugEventDispatcher@Events@Applications@Microsoft@@6B@ ??_7DebugEventListener@Events@Applications@Microsoft@@6B@ ??_7DebugEventSource@Events@Applications@Microsoft@@6B@ ??_7EventProperties@Events@Applications@Microsoft@@6B@ ??_7EventProperty@Events@Applications@Microsoft@@6B@ ??_7IAuthTokensController@Events@Applications@Microsoft@@6B@ ??_7ILogController@Events@Applications@Microsoft@@6B@ ??_7ILogManager@Events@Applications@Microsoft@@6BDebugEventDispatcher@123@@ ??_7ILogManager@Events@Applications@Microsoft@@6BIContextProvider@123@@ ??_7ILogManager@Events@Applications@Microsoft@@6BILogController@123@@ ??_7ILogger@Events@Applications@Microsoft@@6B@ ??_7IModule@Events@Applications@Microsoft@@6B@ ??_7ISemanticContext@Events@Applications@Microsoft@@6B@ ?AddEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z ?AddModule@ILogConfiguration@Events@Applications@Microsoft@@QEAAXPEBDAEBV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@@Z ?AttachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z ?ClearExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXXZ ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@AEAVILogConfiguration@234@AEAW4status_t@234@@Z ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@PEBDAEAW4status_t@234@_K@Z ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@PEBD_NAEAVILogConfiguration@234@AEAW4status_t@234@_K@Z ?DestroyLogManager@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PEBD@Z ?DetachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z ?DispatchEvent@DebugEventSource@Events@Applications@Microsoft@@UEAA_NVDebugEvent@234@@Z ?DispatchEventBroadcast@ILogManager@Events@Applications@Microsoft@@SA_NVDebugEvent@234@@Z ?FromJSON@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@PEBD@Z ?FromLogConfiguration@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@AEAULogConfiguration@Telemetry@23@@Z ?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPEAVILogManager@234@AEAVILogConfiguration@234@AEAW4status_t@234@@Z ?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPEAVILogManager@234@PEBDAEAW4status_t@234@@Z ?GetDefaultConfiguration@Events@Applications@Microsoft@@YAAEBVILogConfiguration@123@XZ ?GetLatency@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventLatency@234@XZ ?GetLogObfuscationKeyManger@@YAJPEAPEAVILogObfuscationKeyManager@@@Z ?GetLogObfuscatorAes@@YAJPEAPEAVILogObfuscatorAes@@@Z ?GetModule@ILogConfiguration@Events@Applications@Microsoft@@QEAA?AV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@PEBD@Z ?GetModules@ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@@std@@@2@@std@@XZ ?GetName@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?GetPersistence@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventPersistence@234@XZ ?GetPiiProperties@EventProperties@Events@Applications@Microsoft@@QEBA?BV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Applications@Microsoft@@@2@@std@@@2@@std@@W4DataCategory@234@@Z ?GetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QEBA_KXZ ?GetPopSample@EventProperties@Events@Applications@Microsoft@@QEBANXZ ?GetPriority@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventPriority@234@XZ ?GetProperties@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@W4DataCategory@234@@Z ?GetTimestamp@EventProperties@Events@Applications@Microsoft@@QEBA_JXZ ?GetType@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?HasConfig@ILogConfiguration@Events@Applications@Microsoft@@QEAA_NPEBD@Z ?Hash@GUID_t@Events@Applications@Microsoft@@QEBA_KXZ ?Initialize@IModule@Events@Applications@Microsoft@@UEAAXPEAVILogManager@234@@Z ?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@AEAVILogConfiguration@234@@Z ?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PEBD@Z ?RemoveEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z ?SetAppEnv@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentETag@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentImpressionId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppLanguage@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppName@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppVersion@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetCommercialId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetCommonField@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUEventProperty@234@@Z ?SetCustomField@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUEventProperty@234@@Z ?SetDeviceClass@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceMake@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceModel@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceOrgId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetEventExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z ?SetLatency@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventLatency@234@@Z ?SetLevel@EventProperties@Events@Applications@Microsoft@@QEAAXE@Z ?SetName@EventProperties@Events@Applications@Microsoft@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetNetworkCost@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4NetworkCost@234@@Z ?SetNetworkProvider@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetNetworkType@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4NetworkType@234@@Z ?SetOsBuild@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetOsName@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetOsVersion@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetPersistence@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventPersistence@234@@Z ?SetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QEAAX_K@Z ?SetPopsample@EventProperties@Events@Applications@Microsoft@@QEAAXN@Z ?SetPriority@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventPriority@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@NV?$allocator@N@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@_JV?$allocator@_J@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@EW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@FW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@GW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@NW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UGUID_t@234@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Utime_ticks_t@234@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_JW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_KW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_NW4PiiKind@234@W4DataCategory@234@@Z ?SetTicket@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4TicketType@234@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetTimestamp@EventProperties@Events@Applications@Microsoft@@QEAAX_J@Z ?SetType@EventProperties@Events@Applications@Microsoft@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserANID@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserAdvertisingId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@234@@Z ?SetUserLanguage@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserMsaId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserTimeZone@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?Teardown@IModule@Events@Applications@Microsoft@@UEAAXXZ ?TryGetLevel@EventProperties@Events@Applications@Microsoft@@QEBA?AV?$tuple@_NE@std@@XZ ?clear@EventProperty@Events@Applications@Microsoft@@QEAAXXZ ?convertUintVectorToGUID@GUID_t@Events@Applications@Microsoft@@SA?AU_GUID@@AEBV?$vector@EV?$allocator@E@std@@@std@@@Z ?copydata@EventProperty@Events@Applications@Microsoft@@AEAAXPEBU1234@@Z ?empty@EventProperty@Events@Applications@Microsoft@@QEAA_NXZ ?erase@EventProperties@Events@Applications@Microsoft@@QEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4DataCategory@234@@Z ?lock@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ@4V67@A ?pack@EventProperties@Events@Applications@Microsoft@@QEAAPEAUevt_prop@@XZ ?stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ ?to_bytes@GUID_t@Events@Applications@Microsoft@@QEBAXAEAY0BA@E@Z ?to_string@EventProperty@Events@Applications@Microsoft@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?to_string@GUID_t@Events@Applications@Microsoft@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?type_name@EventProperty@Events@Applications@Microsoft@@SAPEBDI@Z ?unpack@EventProperties@Events@Applications@Microsoft@@QEAA_NPEAUevt_prop@@_K@Z OnLoadTelemetryExtensions evt_api_call_default

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

686KB

Virtual Size

685KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

99KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

584KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_bc7b83c584c0da6ed0070978648c7655_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

bcrypt

propsys

rpcrt4

virtdisk

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

secur32

shlwapi

version

wininet

ws2_32

wtsapi32

userenv

iphlpapi

wintrust

generic