2026-11-09_740c9b1b7decde18491f9e9d4b4efb8e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_740c9b1b7decde18491f9e9d4b4efb8e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 4.3MB
Sample261110-tgem5avyaz
SHA256 323b8917e4cef08a4110d4b3113f304442343ec1417640a68c58cb56ddbb9a21
MD5 740c9b1b7decde18491f9e9d4b4efb8e
SHA1 2e708b585c86bb2723df6f09849f9477e82c674f
SHA512 cdef0afec1728595477c6bd759394f209bcb16c1cc7f42c04682f694ab813521bafaf0b97e5ebcb2e9e00254ac3453133cfdf62692cd0e63131e144ee27b509f
SSDEEP 49152:Ll+s+BXMPJateq3qbqpHnhfWSsRyV2RRtPoLr7P+cansoSvThr3PAT82:oL3U23Ig2
TLSH
T15A264A0BA7F901F4D0BAD1798AA79517FA72785987319BDF0391465A0F23BE09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-09_740c9b1b7decde18491f9e9d4b4efb8e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 4.3MB

2026-11-09_740c9b1b7decde18491f9e9d4b4efb8e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 258b98d0595463ad6710d1df1b63a6b2
SHA256 323b8917e4cef08a4110d4b3113f304442343ec1417640a68c58cb56ddbb9a21
MD5 740c9b1b7decde18491f9e9d4b4efb8e
SHA1 2e708b585c86bb2723df6f09849f9477e82c674f
SHA512 cdef0afec1728595477c6bd759394f209bcb16c1cc7f42c04682f694ab813521bafaf0b97e5ebcb2e9e00254ac3453133cfdf62692cd0e63131e144ee27b509f
SSDEEP 49152:Ll+s+BXMPJateq3qbqpHnhfWSsRyV2RRtPoLr7P+cansoSvThr3PAT82:oL3U23Ig2
TLSH
T15A264A0BA7F901F4D0BAD1798AA79517FA72785987319BDF0391465A0F23BE09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

68:d2:df:ce:1d:be:50:b4:8a:3b:19:56:2b:1d:da:5c:67:c4:b6:40:cf:1c:95:ec:5f:38:98:f4:8e:6c:f7:a8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 6, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:02:02:7d:bc:9d:2a:9d:33:07:00:00:00:00:01:02

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 5, 2026 - Mar 3, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

276496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\dbs\el\odct\client\onedrive\Product\StandaloneUpdater\exe\obj\amd64\OneDriveStandaloneUpdater.pdb

kernel32

FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetTempPathW VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType SetStdHandle GetStringTypeW GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadFile ReadConsoleW CreateFileW WriteConsoleW FlsSetValue FlsGetValue FlsAlloc SetLastError InterlockedPushEntrySList RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader CompareFileTime FindClose FindNextFileW FindFirstFileW GetFileAttributesExW GetProcessIoCounters CreateSymbolicLinkW RemoveDirectoryW Process32NextW OpenProcess Process32FirstW CreateToolhelp32Snapshot LocalFree CompareStringOrdinal GetSystemFirmwareTable OpenMutexW GetCurrentProcess IsWow64Process CreateEventW SetEvent GetTickCount64 GetVolumePathNameW Sleep GetCommandLineW GetModuleHandleExW GetProcAddress FreeLibrary CloseHandle GetEnvironmentVariableW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive LeaveCriticalSection WriteFile DecodePointer RaiseException OutputDebugStringW IsDebuggerPresent GetPrivateProfileStringW WritePrivateProfileStringW SetDllDirectoryW ReplaceFileW RegisterApplicationRestart GetFileInformationByHandleEx OpenFileById GetProcessTimes GetExitCodeProcess CreateProcessW SetProcessShutdownParameters GetSystemTimes GetStdHandle GetModuleFileNameW ExitProcess IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext EncodePointer SetThreadInformation GetProductInfo DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError FreeLibraryAndExitThread ResumeThread ExitThread CreateThread RtlUnwind LoadLibraryExA VirtualQuery InitOnceExecuteOnce TryEnterCriticalSection InitializeCriticalSection HeapCreate GetDiskFreeSpaceW LockFile GetFullPathNameA SetEndOfFile UnmapViewOfFile HeapValidate GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA FlushViewOfFile CreateFileA LoadLibraryA DeleteFileA GetSystemInfo HeapCompact UnlockFile CreateFileMappingW MapViewOfFile GetSystemPowerStatus GetModuleFileNameA OutputDebugStringA CompareStringEx LCMapStringEx CreateHardLinkW CopyFile2 AreFileApisANSI CreateFile2 GetLocaleInfoEx AcquireSRWLockShared ReleaseSRWLockShared WakeConditionVariable GetExitCodeThread SwitchToThread WaitForSingleObjectEx TryAcquireSRWLockExclusive FormatMessageA GetSystemTimePreciseAsFileTime QueryPerformanceFrequency GetDllDirectoryW CreateEventExW WaitForMultipleObjectsEx ExpandEnvironmentStringsW ReadDirectoryChangesW ReadProcessMemory EnterCriticalSection FlsFree DeleteFileW GetSystemTime LocalAlloc CreateDirectoryW GetFullPathNameW GetTempFileNameW SetFileTime CopyFileW MoveFileExW SystemTimeToFileTime LockFileEx UnlockFileEx LoadLibraryW DeviceIoControl WerRegisterFile WerUnregisterFile GetTickCount K32GetModuleFileNameExW WaitForSingleObject GetFileAttributesW ResetEvent WaitForMultipleObjects QueueUserWorkItem CreateMutexW GlobalMemoryStatusEx GetVersionExW GetNativeSystemInfo MoveFileW LCIDToLocaleName GetUserGeoID GetUserDefaultLocaleName GetComputerNameW ReleaseMutex FindFirstVolumeW FindNextVolumeW FindVolumeClose GetDiskFreeSpaceExW GetFileInformationByHandle GetFileSize GetFinalPathNameByHandleW GetLongPathNameW SetFileAttributesW SetFileInformationByHandle SetFilePointer GetCompressedFileSizeW FindFirstFileNameW SetHandleInformation CreatePipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus ProcessIdToSessionId CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GlobalAlloc GlobalUnlock GlobalLock GlobalFree VerifyVersionInfoW

user32

RegisterPowerSettingNotification UnregisterPowerSettingNotification RegisterSuspendResumeNotification UnregisterSuspendResumeNotification RegisterClassW CreateWindowExW DestroyWindow ShowWindow OpenClipboard CloseClipboard SetClipboardData RegisterClipboardFormatW DispatchMessageW SendMessageTimeoutW PeekMessageW PostQuitMessage MsgWaitForMultipleObjectsEx SetCursor LoadCursorW PostThreadMessageW SystemParametersInfoW GetWindowThreadProcessId GetClassNameW PostMessageW TranslateMessage EmptyClipboard GetMessageW EnumWindows

oleaut32

SysAllocStringLen SysStringLen SysStringByteLen SysAllocStringByteLen VariantInit VariantClear SysAllocString VarBstrCmp LoadTypeLi LoadRegTypeLi GetRecordInfoFromTypeInfo SysFreeString GetErrorInfo SetErrorInfo VariantChangeType

shlwapi

SHDeleteKeyW SHRegGetUSValueW SHGetValueW SHGetValueA PathStripPathW PathFindFileNameW PathIsRelativeW SHCreateStreamOnFileEx SHSetValueW PathIsDirectoryW PathFileExistsW SHCreateStreamOnFileW SHRegGetValueW SHRegGetPathW SHRegGetBoolUSValueW AssocQueryStringW PathIsDirectoryEmptyW StrStrIW PathIsPrefixW PathRemoveFileSpecW ord219 SHDeleteValueW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

userenv

GetProfileType CreateEnvironmentBlock GetDefaultUserProfileDirectoryW

advapi32

RegSetKeyValueW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash AdjustTokenPrivileges AllocateAndInitializeSid FreeSid LookupPrivilegeValueW SetEntriesInAclW SetNamedSecurityInfoW ImpersonateLoggedOnUser RevertToSelf EqualSid RegDeleteValueW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW LookupAccountNameW CryptDestroyKey CryptSetHashParam CryptImportKey CreateWellKnownSid DuplicateTokenEx GetAclInformation IsWellKnownSid RegCreateKeyTransactedW RegDeleteKeyExW RegEnumKeyW RegLoadKeyW RegNotifyChangeKeyValue RegUnLoadKeyW RegDeleteTreeW ChangeServiceConfigW ChangeServiceConfig2W CloseServiceHandle ControlService CreateServiceW DeleteService OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceStatus QueryServiceStatusEx RegisterServiceCtrlHandlerW SetServiceStatus StartServiceCtrlDispatcherW StartServiceW GetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorW SetFileSecurityW CreateProcessWithTokenW CreateProcessAsUserW RegGetValueA EventUnregister ConvertSidToStringSidW GetTokenInformation OpenProcessToken RegSetValueExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegGetValueW RegOpenKeyExW GetUserNameW EventWriteTransfer EventRegister

shell32

SHGetFolderPathW SHCreateDirectoryExW ShellExecuteExW ord526 SHGetKnownFolderPath SHLoadNonloadedIconOverlayIdentifiers SHFileOperationW SHGetSpecialFolderPathW CommandLineToArgvW SHGetFolderPathAndSubDirW SHAssocEnumHandlers SHGetPropertyStoreFromParsingName SHCreateItemFromParsingName ShellExecuteW SHParseDisplayName SHChangeNotify SHSetKnownFolderPath

ole32

CoSetProxyBlanket CoCreateFreeThreadedMarshaler CoWaitForMultipleHandles CoInitialize CoTaskMemAlloc CreateBindCtx StringFromGUID2 CoTaskMemFree CoInitializeEx CoUninitialize CreateItemMoniker GetRunningObjectTable CLSIDFromString CoCreateInstance StringFromCLSID CoCreateGuid

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpSetStatusCallback WinHttpQueryOption WinHttpSetOption WinHttpAddRequestHeaders WinHttpSetCredentials WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser

ntdll

VerSetConditionMask

rstrtmgr

RmStartSession RmRegisterResources RmEndSession RmGetList

wintrust

WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrustEx

wtsapi32

WTSEnumerateSessionsW WTSQuerySessionInformationW WTSQueryUserToken WTSFreeMemory

bcrypt

BCryptCloseAlgorithmProvider BCryptSetProperty BCryptHash BCryptEncrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptGenRandom

crypt32

CryptBinaryToStringW CertFreeCertificateChain CertVerifyCertificateChainPolicy CertGetEnhancedKeyUsage CryptStringToBinaryW CertFindExtension

rpcrt4

RpcStringFreeW UuidToStringW RpcServerInqCallAttributesW RpcBindingFree UuidCreate RpcExceptionFilter RpcBindingFromStringBindingW RpcBindingVectorFree RpcStringBindingComposeW RpcServerInqBindings RpcServerRegisterIfEx RpcServerUnregisterIf RpcServerUseProtseqW RpcBindingSetAuthInfoExW RpcEpRegisterW RpcEpUnregister

secur32

GetUserNameExW

urlmon

URLOpenStreamW

wininet

InternetConnectA InternetCloseHandle InternetOpenW InternetCrackUrlA InternetCheckConnectionW InternetQueryOptionW InternetSetStatusCallbackW HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestW HttpQueryInfoA InternetReadFile

ws2_32

send closesocket bind htonl listen htons WSAGetLastError WSAStartup socket setsockopt accept

iphlpapi

GetAdaptersInfo

?$TSS0@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ@4HA ??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@XZ ??0DebugEventListener@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0DebugEventListener@Events@Applications@Microsoft@@QEAA@XZ ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@XZ ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@5@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@E@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@5@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@XZ ??0EventProperty@Events@Applications@Microsoft@@QEAA@$$QEAU0123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@NV?$allocator@N@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@_JV?$allocator@_J@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@CW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@EW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@FW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@GW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@HW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@IW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@JW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@NW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@PEBDW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@UGUID_t@123@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@Utime_ticks_t@123@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@XZ ??0EventProperty@Events@Applications@Microsoft@@QEAA@_JW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@_KW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@_NW4PiiKind@123@W4DataCategory@123@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@HHHAEBV?$initializer_list@E@std@@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@PEBD@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@QEBE_N@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@U_GUID@@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@XZ ??0IAuthTokensController@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0IAuthTokensController@Events@Applications@Microsoft@@QEAA@XZ ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@AEBV?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@std@@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@XZ ??0ILogController@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z ??0ILogController@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogController@Events@Applications@Microsoft@@QEAA@XZ ??0ILogManager@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogManager@Events@Applications@Microsoft@@QEAA@XZ ??0ILogger@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogger@Events@Applications@Microsoft@@QEAA@XZ ??0IModule@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0IModule@Events@Applications@Microsoft@@QEAA@XZ ??0ISemanticContext@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ISemanticContext@Events@Applications@Microsoft@@QEAA@XZ ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@$$QEAU0123@@Z ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@XZ ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@PEB_J@Z ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@XZ ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@_K@Z ??1DebugEventDispatcher@Events@Applications@Microsoft@@UEAA@XZ ??1DebugEventListener@Events@Applications@Microsoft@@UEAA@XZ ??1DebugEventSource@Events@Applications@Microsoft@@UEAA@XZ ??1EventProperties@Events@Applications@Microsoft@@UEAA@XZ ??1EventProperty@Events@Applications@Microsoft@@UEAA@XZ ??1IAuthTokensController@Events@Applications@Microsoft@@UEAA@XZ ??1ILogConfiguration@Events@Applications@Microsoft@@QEAA@XZ ??1ILogManager@Events@Applications@Microsoft@@UEAA@XZ ??1ILogger@Events@Applications@Microsoft@@UEAA@XZ ??1IModule@Events@Applications@Microsoft@@UEAA@XZ ??1ISemanticContext@Events@Applications@Microsoft@@UEAA@XZ ??1LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@XZ ??4DebugEventDispatcher@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4DebugEventListener@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4DebugEventSource@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4DebugEventSource@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@NV?$allocator@N@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@_JV?$allocator@_J@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@C@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@E@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@F@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@G@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@H@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@I@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@J@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@N@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@PEBD@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@UGUID_t@123@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@Utime_ticks_t@123@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_J@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_K@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_N@Z ??4GUID_t@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??4IAuthTokensController@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogController@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4ILogController@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogManager@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogger@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4IModule@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ISemanticContext@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4LogConfiguration@Telemetry@Applications@Microsoft@@QEAAAEAU0123@$$QEAU0123@@Z ??4LogConfiguration@Telemetry@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??4LogManagerProvider@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4LogManagerProvider@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4time_ticks_t@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??8EventProperty@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z ??8GUID_t@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z ??AILogConfiguration@Events@Applications@Microsoft@@QEAAAEAVVariant@123@PEBD@Z ??DILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@2@@std@@XZ ??MGUID_t@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z ??YEventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z ??_7DebugEventDispatcher@Events@Applications@Microsoft@@6B@ ??_7DebugEventListener@Events@Applications@Microsoft@@6B@ ??_7DebugEventSource@Events@Applications@Microsoft@@6B@ ??_7EventProperties@Events@Applications@Microsoft@@6B@ ??_7EventProperty@Events@Applications@Microsoft@@6B@ ??_7IAuthTokensController@Events@Applications@Microsoft@@6B@ ??_7ILogController@Events@Applications@Microsoft@@6B@ ??_7ILogManager@Events@Applications@Microsoft@@6BDebugEventDispatcher@123@@ ??_7ILogManager@Events@Applications@Microsoft@@6BIContextProvider@123@@ ??_7ILogManager@Events@Applications@Microsoft@@6BILogController@123@@ ??_7ILogger@Events@Applications@Microsoft@@6B@ ??_7IModule@Events@Applications@Microsoft@@6B@ ??_7ISemanticContext@Events@Applications@Microsoft@@6B@ ?AddEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z ?AddModule@ILogConfiguration@Events@Applications@Microsoft@@QEAAXPEBDAEBV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@@Z ?AttachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z ?ClearExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXXZ ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@AEAVILogConfiguration@234@AEAW4status_t@234@@Z ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@PEBDAEAW4status_t@234@_K@Z ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@PEBD_NAEAVILogConfiguration@234@AEAW4status_t@234@_K@Z ?DecrementActiveHydrationsCount@QoS@@YAXXZ ?DestroyLogManager@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PEBD@Z ?DetachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z ?DispatchEvent@DebugEventSource@Events@Applications@Microsoft@@UEAA_NVDebugEvent@234@@Z ?DispatchEventBroadcast@ILogManager@Events@Applications@Microsoft@@SA_NVDebugEvent@234@@Z ?FromJSON@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@PEBD@Z ?FromLogConfiguration@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@AEAULogConfiguration@Telemetry@23@@Z ?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPEAVILogManager@234@AEAVILogConfiguration@234@AEAW4status_t@234@@Z ?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPEAVILogManager@234@PEBDAEAW4status_t@234@@Z ?GetActiveHydrationsCount@QoS@@YAIXZ ?GetApplicationPropertyId@QoS@@YA?AW4Id@PropertyId@TelemetryConstants@@XZ ?GetDefaultConfiguration@Events@Applications@Microsoft@@YAAEBVILogConfiguration@123@XZ ?GetErrorType@QoS@@YA?AW4Type@ErrorType@TelemetryConstants@@JI@Z ?GetErrorType@QoS@@YA?AW4Type@ErrorType@TelemetryConstants@@JIAEBV?$set@IU?$less@I@std@@V?$allocator@I@2@@std@@@Z ?GetInstance@Telemetry@@CAPEAV1@XZ ?GetLatency@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventLatency@234@XZ ?GetLogObfuscationKeyManger@@YAJPEAPEAVILogObfuscationKeyManager@@@Z ?GetLogObfuscatorAes@@YAJPEAPEAVILogObfuscatorAes@@@Z ?GetModule@ILogConfiguration@Events@Applications@Microsoft@@QEAA?AV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@PEBD@Z ?GetModules@ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@@std@@@2@@std@@XZ ?GetName@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?GetPersistence@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventPersistence@234@XZ ?GetPiiProperties@EventProperties@Events@Applications@Microsoft@@QEBA?BV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Applications@Microsoft@@@2@@std@@@2@@std@@W4DataCategory@234@@Z ?GetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QEBA_KXZ ?GetPopSample@EventProperties@Events@Applications@Microsoft@@QEBANXZ ?GetPriority@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventPriority@234@XZ ?GetProperties@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@W4DataCategory@234@@Z ?GetResultType@QoS@@YAPEB_WJI@Z ?GetResultType@QoS@@YAPEB_WW4Type@ErrorType@TelemetryConstants@@@Z ?GetTimestamp@EventProperties@Events@Applications@Microsoft@@QEBA_JXZ ?GetType@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?HasConfig@ILogConfiguration@Events@Applications@Microsoft@@QEAA_NPEBD@Z ?Hash@GUID_t@Events@Applications@Microsoft@@QEBA_KXZ ?IncrementActiveHydrationsCount@QoS@@YAXXZ ?Initialize@IModule@Events@Applications@Microsoft@@UEAAXPEAVILogManager@234@@Z ?InsertIntoIrmEnabledLibrarySet@QoS@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?IsAnyLibraryIrmEnabled@QoS@@YA_NXZ ?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@AEAVILogConfiguration@234@@Z ?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PEBD@Z ?RemoveEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z ?RemoveFromIrmEnabledLibrarySet@QoS@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?SetAppEnv@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentETag@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentImpressionId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppLanguage@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppName@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppVersion@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetApplicationId@QoS@@YAXI@Z ?SetCommercialId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetCommonField@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUEventProperty@234@@Z ?SetCustomField@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUEventProperty@234@@Z ?SetDeviceClass@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceMake@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceModel@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceOrgId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetEventExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z ?SetLatency@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventLatency@234@@Z ?SetLevel@EventProperties@Events@Applications@Microsoft@@QEAAXE@Z ?SetName@EventProperties@Events@Applications@Microsoft@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetNetworkCost@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4NetworkCost@234@@Z ?SetNetworkProvider@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetNetworkType@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4NetworkType@234@@Z ?SetOsBuild@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetOsName@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetOsVersion@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetPersistence@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventPersistence@234@@Z ?SetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QEAAX_K@Z ?SetPopsample@EventProperties@Events@Applications@Microsoft@@QEAAXN@Z ?SetPriority@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventPriority@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@NV?$allocator@N@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@_JV?$allocator@_J@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@EW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@FW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@GW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@NW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UGUID_t@234@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Utime_ticks_t@234@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_JW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_KW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_NW4PiiKind@234@W4DataCategory@234@@Z ?SetTicket@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4TicketType@234@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetTimestamp@EventProperties@Events@Applications@Microsoft@@QEAAX_J@Z ?SetType@EventProperties@Events@Applications@Microsoft@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserANID@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserAdvertisingId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@234@@Z ?SetUserLanguage@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserMsaId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserTimeZone@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SizeUnknown@QoS@@YAIXZ ?Teardown@IModule@Events@Applications@Microsoft@@UEAAXXZ ?TryGetLevel@EventProperties@Events@Applications@Microsoft@@QEBA?AV?$tuple@_NE@std@@XZ ?clear@EventProperty@Events@Applications@Microsoft@@QEAAXXZ ?convertUintVectorToGUID@GUID_t@Events@Applications@Microsoft@@SA?AU_GUID@@AEBV?$vector@EV?$allocator@E@std@@@std@@@Z ?copydata@EventProperty@Events@Applications@Microsoft@@AEAAXPEBU1234@@Z ?empty@EventProperty@Events@Applications@Microsoft@@QEAA_NXZ ?erase@EventProperties@Events@Applications@Microsoft@@QEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4DataCategory@234@@Z ?lock@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ@4V67@A ?pack@EventProperties@Events@Applications@Microsoft@@QEAAPEAUevt_prop@@XZ ?stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ ?to_bytes@GUID_t@Events@Applications@Microsoft@@QEBAXAEAY0BA@E@Z ?to_string@EventProperty@Events@Applications@Microsoft@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?to_string@GUID_t@Events@Applications@Microsoft@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?type_name@EventProperty@Events@Applications@Microsoft@@SAPEBDI@Z ?unpack@EventProperties@Events@Applications@Microsoft@@QEAA_NPEAUevt_prop@@_K@Z evt_api_call_default

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

976KB

Virtual Size

975KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

125KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_740c9b1b7decde18491f9e9d4b4efb8e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

kernel32

user32

oleaut32

shlwapi

version

userenv

advapi32

shell32

ole32

winhttp

ntdll

rstrtmgr

wintrust

wtsapi32

bcrypt

crypt32

rpcrt4

secur32

urlmon

wininet

ws2_32

iphlpapi

generic