2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 4.4MB
Sample260922-rtpmravwfs
SHA256 90c0c3077c8a1174b97f404fb39e8519a678e104d3cd79b3653de0169b3b7c74
MD5 256cd09ed8fd748fbf5887aa78fd4f56
SHA1 84ee16b918948a1e38efe2a0f2c2b858794de37a
SHA512 afd1d5fb3181277b45a38ca082cfc15c7e7caffbe3fa3b55612c9be00b9d000e0d29faf59721d918e6152d39148d44f49c3946df067920d558bd9ee9370ef87f
SSDEEP 49152:8wlhO9jlOb9hP65baFY3Xemz1joiEq0bOySQIxcB8Q/sASaQeNTlGSaXN/j2U4FH:nc9bES/+zbij2jF
TLSH
T124267B1BE2B941F4C0B6D1798A979617FAB27819973297CB0291475B1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 4.4MB

2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH ff61c36166951bbe342da0e22797c465
SHA256 90c0c3077c8a1174b97f404fb39e8519a678e104d3cd79b3653de0169b3b7c74
MD5 256cd09ed8fd748fbf5887aa78fd4f56
SHA1 84ee16b918948a1e38efe2a0f2c2b858794de37a
SHA512 afd1d5fb3181277b45a38ca082cfc15c7e7caffbe3fa3b55612c9be00b9d000e0d29faf59721d918e6152d39148d44f49c3946df067920d558bd9ee9370ef87f
SSDEEP 49152:8wlhO9jlOb9hP65baFY3Xemz1joiEq0bOySQIxcB8Q/sASaQeNTlGSaXN/j2U4FH:nc9bES/+zbij2jF
TLSH
T124267B1BE2B941F4C0B6D1798A979617FAB27819973297CB0291475B1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

991984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\dbs\sh\odct\0909_211519\client\onedrive\Product\UpdaterService\exe\obj\amd64\OneDriveUpdaterService.pdb

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptHash BCryptEncrypt BCryptDestroyKey BCryptGenRandom BCryptOpenAlgorithmProvider

rpcrt4

RpcServerUnregisterIf RpcStringFreeW RpcServerInqBindings RpcServerRegisterIfEx RpcServerInqCallAttributesW RpcBindingFree RpcBindingFromStringBindingW RpcBindingVectorFree RpcStringBindingComposeW NdrServerCallAll NdrServerCall2 RpcEpUnregister RpcEpRegisterW RpcBindingSetAuthInfoExW RpcServerUseProtseqW UuidToStringW UuidCreate

kernel32

SetHandleInformation CreatePipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus SetEvent OpenMutexW CreateEventW ProcessIdToSessionId CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait IsWow64Process LoadLibraryExW GlobalAlloc GlobalUnlock GlobalLock GlobalFree ReadDirectoryChangesW CreateSymbolicLinkW CompareStringOrdinal WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW VerSetConditionMask GetProductInfo VerifyVersionInfoW SetLastError ReleaseMutex Sleep WaitForMultipleObjects ExpandEnvironmentStringsW GetProcessTimes GetExitCodeProcess CreateProcessW SetProcessShutdownParameters GetSystemTimes SetThreadInformation K32GetProcessMemoryInfo GetProcessIoCounters GetPrivateProfileStringW WritePrivateProfileStringW SetDllDirectoryW CopyFileW ReplaceFileW GetComputerNameW RegisterApplicationRestart GetFileInformationByHandleEx OpenFileById GetModuleHandleW GetDllDirectoryW MultiByteToWideChar RaiseException EnterCriticalSection LeaveCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive GetFileSize GetFileInformationByHandle GetFileAttributesExW GetDiskFreeSpaceExW FindVolumeClose FindNextVolumeW FindFirstVolumeW CreateDirectoryW LCMapStringW IsDebuggerPresent K32GetModuleFileNameExW GetSystemFirmwareTable CreateEventExW WaitForMultipleObjectsEx InitOnceExecuteOnce TryEnterCriticalSection InitializeCriticalSection HeapCreate GetUserDefaultLocaleName GetUserDefaultLCID GetUserGeoID LCIDToLocaleName MoveFileW LocalFree LocalAlloc GetModuleHandleExW GetNativeSystemInfo GetVersionExW GetSystemTimeAsFileTime GlobalMemoryStatusEx OpenProcess TerminateProcess GetCurrentProcess CreateMutexW WaitForSingleObject GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetModuleFileNameW GetTempPathW GetCommandLineW WerUnregisterFile WerRegisterFile SystemTimeToFileTime GetSystemTime DeviceIoControl SetFileTime GetCurrentThreadId GetCurrentProcessId LoadLibraryW GetProcAddress FreeLibrary FindNextFileW FindFirstFileW FindClose CompareFileTime GetEnvironmentVariableW MoveFileExW WriteFile ReadFile GetFileSizeEx GetFileAttributesW DeleteFileW CreateFileW DeleteCriticalSection DecodePointer CloseHandle GetLastError SetProcessMitigationPolicy InitializeCriticalSectionEx TryAcquireSRWLockExclusive ReleaseSRWLockShared GetCompressedFileSizeW FindFirstFileNameW SetFilePointer SetFileInformationByHandle SetFileAttributesW RemoveDirectoryW GetVolumePathNameW GetLongPathNameW GetFinalPathNameByHandleW GetDiskFreeSpaceW LockFile GetFullPathNameA UnmapViewOfFile HeapValidate GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA FlushViewOfFile CreateFileA LoadLibraryA DeleteFileA HeapCompact UnlockFile CreateFileMappingW MapViewOfFile GetTickCount GetSystemPowerStatus GetModuleFileNameA OutputDebugStringA QueueUserWorkItem ResetEvent UnlockFileEx LockFileEx GetTempFileNameW SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW AcquireSRWLockShared SleepConditionVariableSRW GetTickCount64 FreeEnvironmentStringsW FormatMessageA LoadLibraryExA RtlUnwind GetLocaleInfoEx GetStringTypeW GetFileType GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetStdHandle ExitProcess VirtualQuery VirtualProtect GetSystemInfo IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext FreeLibraryAndExitThread ResumeThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc InterlockedPushEntrySList RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter LCMapStringEx GetCPInfo CompareStringEx EncodePointer CreateHardLinkW CopyFile2 AreFileApisANSI CreateFile2 GetFullPathNameW FindFirstFileExW RtlPcToFileHeader WakeAllConditionVariable WakeConditionVariable GetExitCodeThread SwitchToThread WaitForSingleObjectEx GetSystemTimePreciseAsFileTime QueryPerformanceFrequency QueryPerformanceCounter OutputDebugStringW

user32

RegisterClipboardFormatW EmptyClipboard LoadCursorW DestroyWindow CreateWindowExW RegisterClassW UnregisterSuspendResumeNotification CloseClipboard UnregisterPowerSettingNotification RegisterPowerSettingNotification DispatchMessageW TranslateMessage GetMessageW SystemParametersInfoW SendMessageTimeoutW GetWindowThreadProcessId SetClipboardData RegisterSuspendResumeNotification GetClassNameW SetCursor MsgWaitForMultipleObjectsEx EnumWindows PostMessageW ShowWindow PostThreadMessageW OpenClipboard PeekMessageW PostQuitMessage

advapi32

CryptDestroyHash RegisterEventSourceW DeregisterEventSource CryptImportKey CryptSetHashParam CryptDestroyKey CreateProcessWithTokenW GetUserNameW SetFileSecurityW CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW LookupAccountNameW EventWriteTransfer EventRegister RegGetValueA RevertToSelf ImpersonateLoggedOnUser CryptAcquireContextW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegDeleteTreeW RegUnLoadKeyW RegNotifyChangeKeyValue RegLoadKeyW RegEnumKeyW RegDeleteKeyExW RegCreateKeyTransactedW IsWellKnownSid GetAclInformation FreeSid DuplicateTokenEx CreateWellKnownSid AllocateAndInitializeSid RegGetValueW RegSetKeyValueW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey LookupPrivilegeValueW GetTokenInformation EqualSid AdjustTokenPrivileges OpenProcessToken CryptReleaseContext CryptHashData CryptCreateHash CryptGetHashParam ReportEventW

shell32

ShellExecuteExW ShellExecuteW SHCreateItemFromParsingName SHGetPropertyStoreFromParsingName SHLoadNonloadedIconOverlayIdentifiers SHAssocEnumHandlers SHGetFolderPathW SHSetKnownFolderPath SHParseDisplayName SHChangeNotify SHGetSpecialFolderPathW SHFileOperationW CommandLineToArgvW SHGetKnownFolderPath SHCreateDirectoryExW SHGetFolderPathAndSubDirW ord526

ole32

GetRunningObjectTable CoWaitForMultipleHandles CoCreateFreeThreadedMarshaler CoInitialize CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance CreateBindCtx CLSIDFromString CoUninitialize StringFromCLSID CoSetProxyBlanket CoCreateGuid CreateItemMoniker CoInitializeEx

oleaut32

SysStringLen SysFreeString GetRecordInfoFromTypeInfo LoadRegTypeLi LoadTypeLi SetErrorInfo VariantChangeType SysAllocString SysAllocStringLen VariantInit VariantClear VarBstrCmp GetErrorInfo

crypt32

CryptImportPublicKeyInfoEx2 CertCreateCertificateContext CertFreeCertificateChain CertVerifyCertificateChainPolicy CertGetEnhancedKeyUsage CertGetCertificateChain CertFreeCertificateContext CryptStringToBinaryW CryptBinaryToStringW CertFindExtension

secur32

GetUserNameExW

shlwapi

ord219 PathFileExistsW SHCreateStreamOnFileEx PathIsRelativeW PathIsDirectoryW PathFindFileNameW SHGetValueW SHRegGetUSValueW PathStripPathW SHDeleteKeyW SHDeleteValueW SHGetValueA SHSetValueW SHRegGetValueW SHRegGetPathW SHRegGetBoolUSValueW AssocQueryStringW SHCreateStreamOnFileW PathRemoveFileSpecW StrStrIW PathIsPrefixW PathIsDirectoryEmptyW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wininet

HttpAddRequestHeadersA HttpSendRequestW HttpQueryInfoA InternetCrackUrlA InternetCloseHandle InternetConnectA InternetCheckConnectionW InternetReadFile InternetQueryOptionW InternetSetStatusCallbackW HttpOpenRequestA InternetOpenW

ws2_32

WSAStartup WSAGetLastError socket bind accept setsockopt send listen htons htonl closesocket

wtsapi32

WTSQuerySessionInformationW WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

userenv

GetDefaultUserProfileDirectoryW CreateEnvironmentBlock

rstrtmgr

RmStartSession RmEndSession RmRegisterResources RmGetList

wer

WerReportSubmit WerReportCloseHandle WerReportSetParameter WerReportCreate

winhttp

WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpOpen WinHttpReadData WinHttpSetOption WinHttpAddRequestHeaders WinHttpSetCredentials WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpCrackUrl WinHttpConnect WinHttpQueryDataAvailable WinHttpQueryOption WinHttpCloseHandle WinHttpSetStatusCallback

wintrust

WinVerifyTrustEx WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData

urlmon

URLOpenStreamW

iphlpapi

GetAdaptersInfo

cryptxml

CryptXmlGetReference CryptXmlGetSignature CryptXmlGetDocContext CryptXmlVerifySignature CryptXmlOpenToDecode CryptXmlClose CryptXmlGetStatus

?$TSS0@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ@4HA ??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@XZ ??0DebugEventListener@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0DebugEventListener@Events@Applications@Microsoft@@QEAA@XZ ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@XZ ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@5@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@E@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@5@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@XZ ??0EventProperty@Events@Applications@Microsoft@@QEAA@$$QEAU0123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@NV?$allocator@N@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@_JV?$allocator@_J@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@CW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@EW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@FW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@GW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@HW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@IW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@JW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@NW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@PEBDW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@UGUID_t@123@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@Utime_ticks_t@123@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@XZ ??0EventProperty@Events@Applications@Microsoft@@QEAA@_JW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@_KW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@_NW4PiiKind@123@W4DataCategory@123@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@HHHAEBV?$initializer_list@E@std@@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@PEBD@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@QEBE_N@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@U_GUID@@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@XZ ??0IAuthTokensController@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0IAuthTokensController@Events@Applications@Microsoft@@QEAA@XZ ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@AEBV?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@std@@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@XZ ??0ILogController@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z ??0ILogController@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogController@Events@Applications@Microsoft@@QEAA@XZ ??0ILogManager@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogManager@Events@Applications@Microsoft@@QEAA@XZ ??0ILogger@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogger@Events@Applications@Microsoft@@QEAA@XZ ??0IModule@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0IModule@Events@Applications@Microsoft@@QEAA@XZ ??0ISemanticContext@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ISemanticContext@Events@Applications@Microsoft@@QEAA@XZ ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@$$QEAU0123@@Z ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@XZ ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@PEB_J@Z ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@XZ ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@_K@Z ??1DebugEventDispatcher@Events@Applications@Microsoft@@UEAA@XZ ??1DebugEventListener@Events@Applications@Microsoft@@UEAA@XZ ??1DebugEventSource@Events@Applications@Microsoft@@UEAA@XZ ??1EventProperties@Events@Applications@Microsoft@@UEAA@XZ ??1EventProperty@Events@Applications@Microsoft@@UEAA@XZ ??1IAuthTokensController@Events@Applications@Microsoft@@UEAA@XZ ??1ILogConfiguration@Events@Applications@Microsoft@@QEAA@XZ ??1ILogManager@Events@Applications@Microsoft@@UEAA@XZ ??1ILogger@Events@Applications@Microsoft@@UEAA@XZ ??1IModule@Events@Applications@Microsoft@@UEAA@XZ ??1ISemanticContext@Events@Applications@Microsoft@@UEAA@XZ ??1LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@XZ ??4DebugEventDispatcher@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4DebugEventListener@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4DebugEventSource@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4DebugEventSource@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@NV?$allocator@N@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@_JV?$allocator@_J@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@C@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@E@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@F@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@G@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@H@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@I@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@J@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@N@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@PEBD@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@UGUID_t@123@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@Utime_ticks_t@123@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_J@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_K@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_N@Z ??4GUID_t@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??4IAuthTokensController@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogController@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4ILogController@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogManager@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogger@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4IModule@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ISemanticContext@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4LogConfiguration@Telemetry@Applications@Microsoft@@QEAAAEAU0123@$$QEAU0123@@Z ??4LogConfiguration@Telemetry@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??4LogManagerProvider@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4LogManagerProvider@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4time_ticks_t@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??8EventProperty@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z ??8GUID_t@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z ??AILogConfiguration@Events@Applications@Microsoft@@QEAAAEAVVariant@123@PEBD@Z ??DILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@2@@std@@XZ ??MGUID_t@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z ??YEventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z ??_7DebugEventDispatcher@Events@Applications@Microsoft@@6B@ ??_7DebugEventListener@Events@Applications@Microsoft@@6B@ ??_7DebugEventSource@Events@Applications@Microsoft@@6B@ ??_7EventProperties@Events@Applications@Microsoft@@6B@ ??_7EventProperty@Events@Applications@Microsoft@@6B@ ??_7IAuthTokensController@Events@Applications@Microsoft@@6B@ ??_7ILogController@Events@Applications@Microsoft@@6B@ ??_7ILogManager@Events@Applications@Microsoft@@6BDebugEventDispatcher@123@@ ??_7ILogManager@Events@Applications@Microsoft@@6BIContextProvider@123@@ ??_7ILogManager@Events@Applications@Microsoft@@6BILogController@123@@ ??_7ILogger@Events@Applications@Microsoft@@6B@ ??_7IModule@Events@Applications@Microsoft@@6B@ ??_7ISemanticContext@Events@Applications@Microsoft@@6B@ ?AddEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z ?AddModule@ILogConfiguration@Events@Applications@Microsoft@@QEAAXPEBDAEBV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@@Z ?AttachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z ?ClearExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXXZ ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@AEAVILogConfiguration@234@AEAW4status_t@234@@Z ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@PEBDAEAW4status_t@234@_K@Z ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@PEBD_NAEAVILogConfiguration@234@AEAW4status_t@234@_K@Z ?DecrementActiveHydrationsCount@QoS@@YAXXZ ?DestroyLogManager@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PEBD@Z ?DetachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z ?DispatchEvent@DebugEventSource@Events@Applications@Microsoft@@UEAA_NVDebugEvent@234@@Z ?DispatchEventBroadcast@ILogManager@Events@Applications@Microsoft@@SA_NVDebugEvent@234@@Z ?FromJSON@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@PEBD@Z ?FromLogConfiguration@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@AEAULogConfiguration@Telemetry@23@@Z ?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPEAVILogManager@234@AEAVILogConfiguration@234@AEAW4status_t@234@@Z ?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPEAVILogManager@234@PEBDAEAW4status_t@234@@Z ?GetActiveHydrationsCount@QoS@@YAIXZ ?GetApplicationPropertyId@QoS@@YA?AW4Id@PropertyId@TelemetryConstants@@XZ ?GetDefaultConfiguration@Events@Applications@Microsoft@@YAAEBVILogConfiguration@123@XZ ?GetErrorType@QoS@@YA?AW4Type@ErrorType@TelemetryConstants@@JI@Z ?GetErrorType@QoS@@YA?AW4Type@ErrorType@TelemetryConstants@@JIAEBV?$set@IU?$less@I@std@@V?$allocator@I@2@@std@@@Z ?GetInstance@Telemetry@@CAPEAV1@XZ ?GetLatency@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventLatency@234@XZ ?GetLogObfuscationKeyManger@@YAJPEAPEAVILogObfuscationKeyManager@@@Z ?GetLogObfuscatorAes@@YAJPEAPEAVILogObfuscatorAes@@@Z ?GetModule@ILogConfiguration@Events@Applications@Microsoft@@QEAA?AV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@PEBD@Z ?GetModules@ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@@std@@@2@@std@@XZ ?GetName@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?GetPersistence@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventPersistence@234@XZ ?GetPiiProperties@EventProperties@Events@Applications@Microsoft@@QEBA?BV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Applications@Microsoft@@@2@@std@@@2@@std@@W4DataCategory@234@@Z ?GetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QEBA_KXZ ?GetPopSample@EventProperties@Events@Applications@Microsoft@@QEBANXZ ?GetPriority@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventPriority@234@XZ ?GetProperties@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@W4DataCategory@234@@Z ?GetResultType@QoS@@YAPEB_WJI@Z ?GetResultType@QoS@@YAPEB_WW4Type@ErrorType@TelemetryConstants@@@Z ?GetTimestamp@EventProperties@Events@Applications@Microsoft@@QEBA_JXZ ?GetType@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?HasConfig@ILogConfiguration@Events@Applications@Microsoft@@QEAA_NPEBD@Z ?Hash@GUID_t@Events@Applications@Microsoft@@QEBA_KXZ ?IncrementActiveHydrationsCount@QoS@@YAXXZ ?Initialize@IModule@Events@Applications@Microsoft@@UEAAXPEAVILogManager@234@@Z ?InsertIntoIrmEnabledLibrarySet@QoS@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?IsAnyLibraryIrmEnabled@QoS@@YA_NXZ ?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@AEAVILogConfiguration@234@@Z ?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PEBD@Z ?RemoveEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z ?RemoveFromIrmEnabledLibrarySet@QoS@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?SetAppEnv@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentETag@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentImpressionId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppLanguage@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppName@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppVersion@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetApplicationId@QoS@@YAXI@Z ?SetCommercialId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetCommonField@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUEventProperty@234@@Z ?SetCustomField@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUEventProperty@234@@Z ?SetDeviceClass@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceMake@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceModel@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceOrgId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetEventExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z ?SetLatency@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventLatency@234@@Z ?SetLevel@EventProperties@Events@Applications@Microsoft@@QEAAXE@Z ?SetName@EventProperties@Events@Applications@Microsoft@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetNetworkCost@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4NetworkCost@234@@Z ?SetNetworkProvider@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetNetworkType@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4NetworkType@234@@Z ?SetOsBuild@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetOsName@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetOsVersion@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetPersistence@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventPersistence@234@@Z ?SetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QEAAX_K@Z ?SetPopsample@EventProperties@Events@Applications@Microsoft@@QEAAXN@Z ?SetPriority@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventPriority@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@NV?$allocator@N@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@_JV?$allocator@_J@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@EW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@FW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@GW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@NW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UGUID_t@234@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Utime_ticks_t@234@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_JW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_KW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_NW4PiiKind@234@W4DataCategory@234@@Z ?SetTicket@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4TicketType@234@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetTimestamp@EventProperties@Events@Applications@Microsoft@@QEAAX_J@Z ?SetType@EventProperties@Events@Applications@Microsoft@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserANID@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserAdvertisingId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@234@@Z ?SetUserLanguage@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserMsaId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserTimeZone@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SizeUnknown@QoS@@YAIXZ ?Teardown@IModule@Events@Applications@Microsoft@@UEAAXXZ ?TryGetLevel@EventProperties@Events@Applications@Microsoft@@QEBA?AV?$tuple@_NE@std@@XZ ?clear@EventProperty@Events@Applications@Microsoft@@QEAAXXZ ?convertUintVectorToGUID@GUID_t@Events@Applications@Microsoft@@SA?AU_GUID@@AEBV?$vector@EV?$allocator@E@std@@@std@@@Z ?copydata@EventProperty@Events@Applications@Microsoft@@AEAAXPEBU1234@@Z ?empty@EventProperty@Events@Applications@Microsoft@@QEAA_NXZ ?erase@EventProperties@Events@Applications@Microsoft@@QEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4DataCategory@234@@Z ?lock@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ@4V67@A ?pack@EventProperties@Events@Applications@Microsoft@@QEAAPEAUevt_prop@@XZ ?stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ ?to_bytes@GUID_t@Events@Applications@Microsoft@@QEBAXAEAY0BA@E@Z ?to_string@EventProperty@Events@Applications@Microsoft@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?to_string@GUID_t@Events@Applications@Microsoft@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?type_name@EventProperty@Events@Applications@Microsoft@@SAPEBDI@Z ?unpack@EventProperties@Events@Applications@Microsoft@@QEAA_NPEAUevt_prop@@_K@Z OnLoadTelemetryExtensions evt_api_call_default

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

843KB

Virtual Size

842KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

118KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

588KB

Virtual Size

592KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

bcrypt

rpcrt4

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

secur32

shlwapi

version

wininet

ws2_32

wtsapi32

userenv

rstrtmgr

wer

winhttp

wintrust

urlmon

iphlpapi

cryptxml

generic