Edit tour

Windows Analysis Report
OneDriveUpdater.exe

Overview

General Information

Sample name:	OneDriveUpdater.exe
Analysis ID:	1467920
MD5:	792e95b64b9cf45ac8bc10d4d0f077c2
SHA1:	e50af7ee7e0a323d8aa60b6d9b3d39ab33b004f5
SHA256:	60e64dd2c6d2ac6fe9b498fadac81bc34a725de5d893e7df8b2728d8dc5b192d

Detection

Score:	15
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Uses ipconfig to lookup or modify the Windows network settings

Creates a process in suspended mode (likely to inject code)

PE file contains sections with non-standard names

Classification

Process Tree

System is w10x64_ra

OneDriveUpdater.exe (PID: 6264 cmdline: "C:\Users\user\Desktop\OneDriveUpdater.exe" MD5: 792E95B64B9CF45AC8BC10D4D0F077C2)

rundll32.exe (PID: 6496 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

cmd.exe (PID: 3928 cmdline: "C:\Windows\system32\cmd.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 6140 cmdline: ipconfig MD5: 62F170FB07FDBB79CEB7147101406EB8)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: OneDriveUpdater.exe

Static PE information: certificate valid

Source: OneDriveUpdater.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: classification engine

Classification label: clean15.winEXE@6/0@0/0

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Mutant created: \Sessions\1\BaseNamedObjects\FileSyncClientUpdaterNamedMutex

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

File created: C:\Users\user\AppData\Local\Temp\wct4511.tmp

Source: OneDriveUpdater.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Users\user\Desktop\OneDriveUpdater.exe "C:\Users\user\Desktop\OneDriveUpdater.exe"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig

Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: secur32.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: bitsproxy.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: wofutil.dll
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5CE34C0D-0DC9-4C1F-897C-DAA1B78CEE7C}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Office\ClickToRun\Configuration

Source: OneDriveUpdater.exe

Static PE information: certificate valid

Source: OneDriveUpdater.exe

Static PE information: More than 248 > 100 exports found

Source: OneDriveUpdater.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: OneDriveUpdater.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: OneDriveUpdater.exe

Static file information: File size 4200864 > 1048576

Source: OneDriveUpdater.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2e7a00

Source: OneDriveUpdater.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: OneDriveUpdater.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: OneDriveUpdater.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: OneDriveUpdater.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: OneDriveUpdater.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: OneDriveUpdater.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: OneDriveUpdater.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: OneDriveUpdater.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: OneDriveUpdater.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: OneDriveUpdater.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: OneDriveUpdater.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: OneDriveUpdater.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: OneDriveUpdater.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: OneDriveUpdater.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: OneDriveUpdater.exe	Static PE information: section name: .didat
Source: OneDriveUpdater.exe	Static PE information: section name: _RDATA

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig

Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Rundll32	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
OneDriveUpdater.exe	0%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467920
Start date and time:	2024-07-05 01:45:49 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	OneDriveUpdater.exe
Detection:	CLEAN
Classification:	clean15.winEXE@6/0@0/0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): oneclient.sfx.ms, g.live.com, fs.microsoft.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: OneDriveUpdater.exe

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.255702585045085
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	OneDriveUpdater.exe
File size:	4'200'864 bytes
MD5:	792e95b64b9cf45ac8bc10d4d0f077c2
SHA1:	e50af7ee7e0a323d8aa60b6d9b3d39ab33b004f5
SHA256:	60e64dd2c6d2ac6fe9b498fadac81bc34a725de5d893e7df8b2728d8dc5b192d
SHA512:	5064c1a64fa0bd5a31b205d8b34cb85cc3da7091dd2412421f6394d42b9a596430b67ea4d05129912ad942458198280a3a69409388d2413072c53d928de70e86
SSDEEP:	49152:3EenBpKLBz+dV0LWUEur5XVmy1rVaou58gZbkT3FjNVcXrkj6B+/T+k54Q1Wb:6VlH0MAQj8k5d18
TLSH:	3E165A4BA2B901E4D0BBD23D8A679617FAB1785587359BDF0690435A0F33BE09E3E710
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......6x.Sr.b.r.b.r.b..kg...b..pf.{.b..pg.I.b..lk.~.b. lf.a.b. la.z.b. lg...b..ka.\|.b..kf.m.b..kd.p.b..kc._.b.r.c...b..lg...b..lb.s.b

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140038ba0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x24CF8552 [Thu Jul 27 21:57:38 1989 UTC]
TLS Callbacks:	0x40167610, 0x1, 0x40167690, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	998485b035498bd8f4259c68101e6cc3

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	02/09/2021 20:25:38 01/09/2022 20:25:38
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	CCB19DD724F52810AD930629C1825FA3
Thumbprint SHA-1:	9251BD18AC5C69FDC0CB16B51D5133A84FE6BC2F
Thumbprint SHA-256:	E93FB5ABE1EF7797849E0B6B487C954EBDDABCB53DD16E4EF952524D51C30F9D
Serial:	330000042535216F36087CEB06000000000425

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FDAA4E123E4h
dec eax
add esp, 28h
jmp 00007FDAA4E11B9Fh
int3
int3
and dword ptr [003A4991h], 00000000h
ret
dec eax
mov dword ptr [esp+08h], ebx
push ebp
dec eax
lea ebp, dword ptr [esp-000004C0h]
dec eax
sub esp, 000005C0h
mov ebx, ecx
mov ecx, 00000017h
call dword ptr [002B096Ah]
test eax, eax
je 00007FDAA4E11D26h
mov ecx, ebx
int 29h
mov ecx, 00000003h
call 00007FDAA4E11CE9h
xor edx, edx
dec eax
lea ecx, dword ptr [ebp-10h]
inc ecx
mov eax, 000004D0h
call 00007FDAA4E13354h
dec eax
lea ecx, dword ptr [ebp-10h]
call dword ptr [002B123Dh]
dec eax
mov ebx, dword ptr [ebp+000000E8h]
dec eax
lea edx, dword ptr [ebp+000004D8h]
dec eax
mov ecx, ebx
inc ebp
xor eax, eax
call dword ptr [002B122Bh]
dec eax
test eax, eax
je 00007FDAA4E11D5Eh
dec eax
and dword ptr [esp+38h], 00000000h
dec eax
lea ecx, dword ptr [ebp+000004E0h]
dec eax
mov edx, dword ptr [ebp+000004D8h]
dec esp
mov ecx, eax
dec eax
mov dword ptr [esp+30h], ecx
dec esp
mov eax, ebx
dec eax
lea ecx, dword ptr [ebp+000004E8h]
dec eax
mov dword ptr [esp+28h], ecx
dec eax
lea ecx, dword ptr [ebp-10h]
dec eax
mov dword ptr [esp+20h], ecx
xor ecx, ecx
call dword ptr [002B11F2h]
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3b43e0	0x72cc	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3bb6ac	0x1cc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x402000	0xb60	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x3e3000	0x1ce6c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3ff400	0x25a0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x403000	0x528c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x362040	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x362100	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x35af90	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2e9000	0xef8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3b4250	0x60	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2e791c	0x2e7a00	a23d1340ce6770bd3e96322ec9b8471e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2e9000	0xd5a44	0xd5c00	3aa3851f60487a2dcdffab0194e0ef4f	False	0.31893046418128657	data	4.962151045168778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3bf000	0x23214	0x1e600	ba3d3cf5404aba214171beb85f132b1d	False	0.1951437114197531	data	4.8715384935366615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x3e3000	0x1ce6c	0x1d000	e4f42dd872058c005b33a5ecac3104d7	False	0.5015069369612069	data	6.283611176742107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x400000	0x48	0x200	bab7359b53959913b7a4cb69225e1e2e	False	0.076171875	data	0.5703483918359332	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x401000	0xfc	0x200	88f14c29479baa4dadcc14245a4175ba	False	0.318359375	data	2.458301158770647	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x402000	0xb60	0xc00	1e19c28ffefb2ba22f1cb67e37d3548c	False	0.3821614583333333	data	4.648152733517116	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x403000	0x528c	0x5400	2fe0dbcb762c4ef1986df34a76320f1a	False	0.2546968005952381	data	5.441211306199959	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
EDPENLIGHTENEDAPPINFOID	0x402b50	0x2	data	English	United States	5.0
EDPPERMISSIVEAPPINFOID	0x402b58	0x2	data	English	United States	5.0
RT_VERSION	0x402210	0x408	data	English	United States	0.42151162790697677
RT_MANIFEST	0x402618	0x533	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4320060105184072

Imports

DLL	Import
KERNEL32.dll	RtlPcToFileHeader, InterlockedPushEntrySList, SetLastError, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, ExitProcess, GetModuleFileNameW, GetStdHandle, WriteFile, GetCurrentThread, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, SetStdHandle, GetStringTypeW, GetTimeZoneInformation, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, ReadFile, RtlUnwindEx, WriteConsoleW, CompareFileTime, FindClose, FindNextFileW, FindFirstFileW, Process32NextW, OpenProcess, Process32FirstW, CreateToolhelp32Snapshot, CreateProcessW, GetProductInfo, VerifyVersionInfoW, VerSetConditionMask, LoadLibraryExW, MoveFileExW, IsWow64Process, ExpandEnvironmentStringsW, UnmapViewOfFile, MapViewOfFileEx, CreateFileMappingW, GetFileSize, CreateFileW, LocalFree, LocalAlloc, OpenMutexW, FileTimeToSystemTime, FileTimeToLocalFileTime, GetTickCount64, GetVolumePathNameW, Sleep, GetCommandLineW, GetModuleHandleExW, FreeLibrary, GetEnvironmentVariableW, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, TerminateProcess, GetCurrentProcess, IsProcessorFeaturePresent, GetStartupInfoW, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetProcAddress, GetModuleHandleW, CreateEventW, WaitForSingleObjectEx, ResetEvent, SetEvent, InitializeCriticalSectionAndSpinCount, CloseHandle, LeaveCriticalSection, EnterCriticalSection, OutputDebugStringW, IsDebuggerPresent, DeleteCriticalSection, InitializeCriticalSectionEx, GetProcessHeap, HeapSize, HeapFree, HeapReAlloc, HeapAlloc, HeapDestroy, GetLastError, SystemTimeToTzSpecificLocalTime, PeekNamedPipe, GetDriveTypeW, FreeLibraryAndExitThread, ExitThread, CreateThread, RtlUnwind, LoadLibraryExA, VirtualQuery, VirtualProtect, InitializeCriticalSection, HeapCreate, GetDiskFreeSpaceW, LockFile, GetFullPathNameA, HeapValidate, GetTempPathA, FormatMessageW, GetDiskFreeSpaceA, GetFileAttributesA, FlushViewOfFile, CreateFileA, LoadLibraryA, DeleteFileA, GetSystemInfo, HeapCompact, UnlockFile, MapViewOfFile, GetSystemPowerStatus, GetModuleFileNameA, OutputDebugStringA, CompareStringEx, LCMapStringEx, DecodePointer, InitOnceExecuteOnce, GetLocaleInfoEx, CreateHardLinkW, AreFileApisANSI, SetEndOfFile, GetCurrentDirectoryW, AcquireSRWLockShared, ReleaseSRWLockShared, SleepConditionVariableSRW, SleepConditionVariableCS, WakeAllConditionVariable, RaiseException, ReadConsoleW, DeleteFileW, GetSystemTime, CreateDirectoryW, GetFullPathNameW, GetTempFileNameW, RemoveDirectoryW, SetFileTime, GetTempPathW, CopyFileW, SystemTimeToFileTime, LockFileEx, UnlockFileEx, DeviceIoControl, LoadLibraryW, WerRegisterFile, WerUnregisterFile, GetTickCount, K32GetModuleFileNameExW, WaitForSingleObject, WaitForMultipleObjects, QueueUserWorkItem, CreateMutexW, GetVersionExW, MoveFileW, GetUserDefaultLocaleName, GetComputerNameW, FindFirstVolumeW, FindNextVolumeW, FindVolumeClose, GetDiskFreeSpaceExW, GetFileAttributesW, GetFileAttributesExW, GetFileInformationByHandle, GetFinalPathNameByHandleW, GetLongPathNameW, SetFileAttributesW, SetFileInformationByHandle, SetFilePointer, GetCompressedFileSizeW, FindFirstFileNameW, CreateIoCompletionPort, GetQueuedCompletionStatus, PostQueuedCompletionStatus, ReleaseMutex, GetProcessTimes, GetExitCodeProcess, GetSystemTimes, SetDllDirectoryW, ReplaceFileW, ReadDirectoryChangesW, RegisterApplicationRestart, GetFileInformationByHandleEx, OpenFileById, CreateSymbolicLinkW, CompareStringOrdinal, GetUserGeoID, GlobalFree, ReadProcessMemory, QueryPerformanceFrequency, FormatMessageA, InitializeSRWLock, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryEnterCriticalSection, SwitchToThread, GetExitCodeThread, GetNativeSystemInfo, InitializeConditionVariable, WakeConditionVariable
USER32.dll	PostThreadMessageW, SendMessageTimeoutW, ShowWindow, DestroyWindow, CreateWindowExW, RegisterClassW, DispatchMessageW, GetMessageW, SystemParametersInfoW, GetWindowThreadProcessId, GetClassNameW, EnumWindows, PostMessageW, PostQuitMessage, TranslateMessage
OLEAUT32.dll	VariantChangeType, VarBstrCmp, VariantClear, SysStringByteLen, LoadTypeLib, LoadRegTypeLib, SysFreeString, SysStringLen, SetErrorInfo, GetErrorInfo, GetRecordInfoFromTypeInfo, SysAllocStringLen, VariantInit, SysAllocString, SysAllocStringByteLen
ntdll.dll	RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind
SHLWAPI.dll	StrStrIW, SHRegGetBoolUSValueW, SHRegGetValueW, PathStripToRootW, PathStripPathW, PathIsDirectoryW, PathRemoveFileSpecW, PathFileExistsW, SHSetValueW, SHCreateStreamOnFileEx, PathIsRelativeW, PathFindFileNameW, SHDeleteKeyW, SHDeleteValueW, SHGetValueW, PathIsPrefixW, SHCreateStreamOnFileW
VERSION.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
USERENV.dll	GetDefaultUserProfileDirectoryW, CreateEnvironmentBlock, GetProfileType
ADVAPI32.dll	RegGetValueA, EventUnregister, CryptAcquireContextW, CryptReleaseContext, CryptGetHashParam, CryptCreateHash, EventWriteTransfer, GetUserNameW, RegOpenKeyExW, OpenProcessToken, GetTokenInformation, MapGenericMask, IsValidAcl, DuplicateToken, AccessCheck, OpenThreadToken, ConvertStringSecurityDescriptorToSecurityDescriptorW, GetNamedSecurityInfoW, StartServiceW, StartServiceCtrlDispatcherW, SetServiceStatus, RegisterServiceCtrlHandlerW, QueryServiceStatusEx, QueryServiceStatus, QueryServiceConfigW, DeleteService, CreateServiceW, ControlService, ChangeServiceConfig2W, CryptHashData, CryptDestroyHash, AdjustTokenPrivileges, AllocateAndInitializeSid, FreeSid, LookupPrivilegeValueW, SetEntriesInAclW, SetNamedSecurityInfoW, ImpersonateLoggedOnUser, RevertToSelf, CopySid, GetLengthSid, IsValidSid, RegDeleteValueW, RegEnumKeyExW, RegEnumValueW, RegQueryInfoKeyW, RegSetKeyValueW, RegGetValueW, LookupAccountNameW, CryptDestroyKey, CryptSetHashParam, CryptImportKey, CreateProcessAsUserW, CreateWellKnownSid, DuplicateTokenEx, GetAclInformation, SetFileSecurityW, RegCreateKeyTransactedW, RegDeleteKeyExW, RegEnumKeyW, RegLoadKeyW, RegUnLoadKeyW, RegDeleteTreeW, ChangeServiceConfigW, OpenSCManagerW, ConvertSidToStringSidW, RegSetValueExW, RegCreateKeyExW, RegCloseKey, RegQueryValueExW, CloseServiceHandle, OpenServiceW, EventRegister
SHELL32.dll	SHLoadNonloadedIconOverlayIdentifiers, SHChangeNotify, SHParseDisplayName, SHCreateItemFromParsingName, SHGetFolderPathAndSubDirW, SHSetKnownFolderPath, CommandLineToArgvW, SHGetSpecialFolderPathW, SHCreateDirectoryExW, SHGetFolderPathW, ShellExecuteExW, SHGetKnownFolderPath, SHFileOperationW
ole32.dll	CoSetProxyBlanket, CoInitialize, CreateBindCtx, StringFromCLSID, CoTaskMemAlloc, StringFromGUID2, CoCreateInstance, CoTaskMemFree, GetRunningObjectTable, CreateItemMoniker, CoCreateGuid, CoUninitialize, CoInitializeEx, CLSIDFromString, CoCreateFreeThreadedMarshaler
WINHTTP.dll	WinHttpGetProxyForUrl, WinHttpSetCredentials, WinHttpSetOption, WinHttpCloseHandle, WinHttpOpen, WinHttpGetIEProxyConfigForCurrentUser
RstrtMgr.DLL	RmGetList, RmRegisterResources, RmEndSession, RmStartSession
WINTRUST.dll	WTHelperGetProvSignerFromChain, WTHelperProvDataFromStateData, WinVerifyTrustEx
WTSAPI32.dll	WTSFreeMemory, WTSQuerySessionInformationW, WTSEnumerateSessionsW, WTSQueryUserToken
bcrypt.dll	BCryptEncrypt, BCryptGenerateSymmetricKey, BCryptCloseAlgorithmProvider, BCryptDestroyKey, BCryptOpenAlgorithmProvider, BCryptGenRandom, BCryptSetProperty
CRYPT32.dll	CertVerifyCertificateChainPolicy, CertFreeCertificateChain, CryptBinaryToStringW, CryptStringToBinaryW
RPCRT4.dll	UuidToStringW, RpcBindingFree, RpcBindingFromStringBindingW, RpcBindingVectorFree, RpcBindingSetAuthInfoExW, RpcEpRegisterW, RpcEpUnregister, RpcServerInqCallAttributesW, RpcStringFreeW, RpcStringBindingComposeW, RpcServerInqBindings, RpcServerRegisterIfEx, RpcServerUnregisterIf, RpcServerUseProtseqW, RpcExceptionFilter
Secur32.dll	GetUserNameExW
urlmon.dll	URLOpenStreamW
WININET.dll	InternetCheckConnectionW, InternetCrackUrlA, InternetOpenW, InternetConnectA, InternetReadFile, InternetQueryOptionW, InternetSetStatusCallbackW, HttpOpenRequestA, InternetCloseHandle, HttpSendRequestW, HttpQueryInfoA, HttpAddRequestHeadersA
WS2_32.dll	bind, closesocket, htonl, accept, listen, send, setsockopt, socket, WSAStartup, WSAGetLastError, htons
IPHLPAPI.DLL	GetAdaptersInfo

Exports

Name	Ordinal	Address
?$TSS0@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ@4HA	1	0x1403e1660
??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	2	0x14016a1c0
??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@XZ	3	0x14016a1c0
??0DebugEventListener@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	4	0x14016a1d0
??0DebugEventListener@Events@Applications@Microsoft@@QEAA@XZ	5	0x14016a1d0
??0DebugEventSource@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z	6	0x14016a1e0
??0DebugEventSource@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	7	0x14016a2a0
??0DebugEventSource@Events@Applications@Microsoft@@QEAA@XZ	8	0x1400a69f0
??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	9	0x140171af0
??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	10	0x140171b40
??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@5@@Z	11	0x140171b70
??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@E@Z	12	0x140171bc0
??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@5@@Z	13	0x140171cc0
??0EventProperties@Events@Applications@Microsoft@@QEAA@XZ	14	0x140171d20
??0EventProperty@Events@Applications@Microsoft@@QEAA@$$QEAU0123@@Z	15	0x140176d70
??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@NV?$allocator@N@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z	16	0x140176dc0
??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z	17	0x140176e30
??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z	18	0x140176ea0
??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@_JV?$allocator@_J@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z	19	0x140176f10
??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z	20	0x140176d70
??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z	21	0x140176f80
??0EventProperty@Events@Applications@Microsoft@@QEAA@CW4PiiKind@123@W4DataCategory@123@@Z	22	0x140177000
??0EventProperty@Events@Applications@Microsoft@@QEAA@EW4PiiKind@123@W4DataCategory@123@@Z	23	0x140177030
??0EventProperty@Events@Applications@Microsoft@@QEAA@FW4PiiKind@123@W4DataCategory@123@@Z	24	0x140177060
??0EventProperty@Events@Applications@Microsoft@@QEAA@GW4PiiKind@123@W4DataCategory@123@@Z	25	0x140177090
??0EventProperty@Events@Applications@Microsoft@@QEAA@HW4PiiKind@123@W4DataCategory@123@@Z	26	0x1401770c0
??0EventProperty@Events@Applications@Microsoft@@QEAA@IW4PiiKind@123@W4DataCategory@123@@Z	27	0x1401770f0
??0EventProperty@Events@Applications@Microsoft@@QEAA@JW4PiiKind@123@W4DataCategory@123@@Z	28	0x1401770c0
??0EventProperty@Events@Applications@Microsoft@@QEAA@NW4PiiKind@123@W4DataCategory@123@@Z	29	0x140177120
??0EventProperty@Events@Applications@Microsoft@@QEAA@PEBDW4PiiKind@123@W4DataCategory@123@@Z	30	0x140177150
??0EventProperty@Events@Applications@Microsoft@@QEAA@UGUID_t@123@W4PiiKind@123@W4DataCategory@123@@Z	31	0x1401771e0
??0EventProperty@Events@Applications@Microsoft@@QEAA@Utime_ticks_t@123@W4PiiKind@123@W4DataCategory@123@@Z	32	0x140177220
??0EventProperty@Events@Applications@Microsoft@@QEAA@XZ	33	0x140177250
??0EventProperty@Events@Applications@Microsoft@@QEAA@_JW4PiiKind@123@W4DataCategory@123@@Z	34	0x1401772c0
??0EventProperty@Events@Applications@Microsoft@@QEAA@_KW4PiiKind@123@W4DataCategory@123@@Z	35	0x1401772c0
??0EventProperty@Events@Applications@Microsoft@@QEAA@_NW4PiiKind@123@W4DataCategory@123@@Z	36	0x1401772f0
??0GUID_t@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z	37	0x140177310
??0GUID_t@Events@Applications@Microsoft@@QEAA@HHHAEBV?$initializer_list@E@std@@@Z	38	0x140177350
??0GUID_t@Events@Applications@Microsoft@@QEAA@PEBD@Z	39	0x140177390
??0GUID_t@Events@Applications@Microsoft@@QEAA@QEBE_N@Z	40	0x140177470
??0GUID_t@Events@Applications@Microsoft@@QEAA@U_GUID@@@Z	41	0x140177550
??0GUID_t@Events@Applications@Microsoft@@QEAA@XZ	42	0x1401775c0
??0IAuthTokensController@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	43	0x14016a310
??0IAuthTokensController@Events@Applications@Microsoft@@QEAA@XZ	44	0x14016a310
??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z	45	0x14016a320
??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	46	0x14016a3c0
??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@AEBV?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@std@@@Z	47	0x1401748c0
??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@XZ	48	0x1400a6a80
??0ILogController@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z	49	0x14016a410
??0ILogController@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	50	0x14016a410
??0ILogController@Events@Applications@Microsoft@@QEAA@XZ	51	0x14016a410
??0ILogManager@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	52	0x14016a420
??0ILogManager@Events@Applications@Microsoft@@QEAA@XZ	53	0x14016a420
??0ILogger@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	54	0x14016a450
??0ILogger@Events@Applications@Microsoft@@QEAA@XZ	55	0x14016a450
??0IModule@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	56	0x14016a460
??0IModule@Events@Applications@Microsoft@@QEAA@XZ	57	0x14016a460
??0ISemanticContext@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	58	0x14016a470
??0ISemanticContext@Events@Applications@Microsoft@@QEAA@XZ	59	0x14016a470
??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@$$QEAU0123@@Z	60	0x14016a480
??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@AEBU0123@@Z	61	0x14016a580
??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@XZ	62	0x14016a640
??0time_ticks_t@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z	63	0x14016b060
??0time_ticks_t@Events@Applications@Microsoft@@QEAA@PEB_J@Z	64	0x1401775d0
??0time_ticks_t@Events@Applications@Microsoft@@QEAA@XZ	65	0x1401775f0
??0time_ticks_t@Events@Applications@Microsoft@@QEAA@_K@Z	66	0x140177600
??1DebugEventDispatcher@Events@Applications@Microsoft@@UEAA@XZ	67	0x1400299a0
??1DebugEventListener@Events@Applications@Microsoft@@UEAA@XZ	68	0x1400299a0
??1DebugEventSource@Events@Applications@Microsoft@@UEAA@XZ	69	0x1400a7770
??1EventProperties@Events@Applications@Microsoft@@UEAA@XZ	70	0x140171fe0
??1EventProperty@Events@Applications@Microsoft@@UEAA@XZ	71	0x140177640
??1IAuthTokensController@Events@Applications@Microsoft@@UEAA@XZ	72	0x14016a9e0
??1ILogConfiguration@Events@Applications@Microsoft@@QEAA@XZ	73	0x1400b7ba0
??1ILogManager@Events@Applications@Microsoft@@UEAA@XZ	74	0x14016a9f0
??1ILogger@Events@Applications@Microsoft@@UEAA@XZ	75	0x14016aa20
??1IModule@Events@Applications@Microsoft@@UEAA@XZ	76	0x1400299a0
??1ISemanticContext@Events@Applications@Microsoft@@UEAA@XZ	77	0x14016aa30
??1LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@XZ	78	0x14016aa40
??4DebugEventDispatcher@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	79	0x140019ae0
??4DebugEventListener@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	80	0x140019ae0
??4DebugEventSource@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z	81	0x14016acf0
??4DebugEventSource@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	82	0x14016ada0
??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	83	0x140172110
??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z	84	0x140172130
??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@std@@@Z	85	0x140172170
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z	86	0x140177650
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	87	0x140177690
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@NV?$allocator@N@std@@@std@@@Z	88	0x140177710
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@@Z	89	0x140177770
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z	90	0x1401777d0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@_JV?$allocator@_J@std@@@std@@@Z	91	0x140177830
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@C@Z	92	0x140177890
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@E@Z	93	0x1401778a0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@F@Z	94	0x1401778b0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@G@Z	95	0x1401778c0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@H@Z	96	0x1401778d0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@I@Z	97	0x1401778e0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@J@Z	98	0x1401778d0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@N@Z	99	0x1401778f0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@PEBD@Z	100	0x140177920
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@UGUID_t@123@@Z	101	0x140177980
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@Utime_ticks_t@123@@Z	102	0x1401779c0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_J@Z	103	0x140177a00
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_K@Z	104	0x140177a30
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_N@Z	105	0x140177a40
??4GUID_t@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z	106	0x14016ae30
??4IAuthTokensController@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	107	0x140019ae0
??4ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z	108	0x14016ae40
??4ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	109	0x14016aed0
??4ILogController@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z	110	0x140019ae0
??4ILogController@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	111	0x140019ae0
??4ILogManager@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	112	0x140019ae0
??4ILogger@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	113	0x140019ae0
??4IModule@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	114	0x140019ae0
??4ISemanticContext@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	115	0x140019ae0
??4LogConfiguration@Telemetry@Applications@Microsoft@@QEAAAEAU0123@$$QEAU0123@@Z	116	0x14016af40
??4LogConfiguration@Telemetry@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z	117	0x14016afd0
??4LogManagerProvider@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z	118	0x140019ae0
??4LogManagerProvider@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	119	0x140019ae0
??4time_ticks_t@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z	120	0x14016b060
??8EventProperty@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z	121	0x140177a70
??8GUID_t@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z	122	0x140177f90
??AILogConfiguration@Events@Applications@Microsoft@@QEAAAEAVVariant@123@PEBD@Z	123	0x140174970
??DILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@2@@std@@XZ	124	0x140019ae0
??MGUID_t@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z	125	0x140177fe0
??YEventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z	126	0x140172350
??_7DebugEventDispatcher@Events@Applications@Microsoft@@6B@	127	0x1402fea30
??_7DebugEventListener@Events@Applications@Microsoft@@6B@	128	0x140300898
??_7DebugEventSource@Events@Applications@Microsoft@@6B@	129	0x1402fea48
??_7EventProperties@Events@Applications@Microsoft@@6B@	130	0x14032eb28
??_7EventProperty@Events@Applications@Microsoft@@6B@	131	0x14032f220
??_7IAuthTokensController@Events@Applications@Microsoft@@6B@	132	0x14032e280
??_7ILogController@Events@Applications@Microsoft@@6B@	133	0x14032e2c8
??_7ILogManager@Events@Applications@Microsoft@@6BDebugEventDispatcher@123@@	134	0x14032e4a8
??_7ILogManager@Events@Applications@Microsoft@@6BIContextProvider@123@@	135	0x14032e490
??_7ILogManager@Events@Applications@Microsoft@@6BILogController@123@@	136	0x14032e330
??_7ILogger@Events@Applications@Microsoft@@6B@	137	0x14032e128
??_7IModule@Events@Applications@Microsoft@@6B@	138	0x14032ddd8
??_7ISemanticContext@Events@Applications@Microsoft@@6B@	139	0x14032de08
?AddEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z	140	0x1401707d0
?AddModule@ILogConfiguration@Events@Applications@Microsoft@@QEAAXPEBDAEBV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@@Z	141	0x140174a20
?AttachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z	142	0x140170880
?ClearExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXXZ	143	0x1400299a0
?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@AEAVILogConfiguration@234@AEAW4status_t@234@@Z	144	0x14016b6b0
?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@PEBDAEAW4status_t@234@_K@Z	145	0x14016b6c0
?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@PEBD_NAEAVILogConfiguration@234@AEAW4status_t@234@_K@Z	146	0x14016b6d0
?DestroyLogManager@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PEBD@Z	147	0x14016b7e0
?DetachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z	148	0x140170920
?DispatchEvent@DebugEventSource@Events@Applications@Microsoft@@UEAA_NVDebugEvent@234@@Z	149	0x1401709a0
?DispatchEventBroadcast@ILogManager@Events@Applications@Microsoft@@SA_NVDebugEvent@234@@Z	150	0x14018c9f0
?FromJSON@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@PEBD@Z	151	0x140183cb0
?FromLogConfiguration@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@AEAULogConfiguration@Telemetry@23@@Z	152	0x140183e70
?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPEAVILogManager@234@AEAVILogConfiguration@234@AEAW4status_t@234@@Z	153	0x1401750c0
?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPEAVILogManager@234@PEBDAEAW4status_t@234@@Z	154	0x140175100
?GetDefaultConfiguration@Events@Applications@Microsoft@@YAAEBVILogConfiguration@123@XZ	155	0x140184260
?GetLatency@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventLatency@234@XZ	156	0x140172530
?GetLogObfuscationKeyManger@@YAJPEAPEAVILogObfuscationKeyManager@@@Z	157	0x1400bb050
?GetLogObfuscatorAes@@YAJPEAPEAVILogObfuscatorAes@@@Z	158	0x1400b8a30
?GetModule@ILogConfiguration@Events@Applications@Microsoft@@QEAA?AV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@PEBD@Z	159	0x140174af0
?GetModules@ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@@std@@@2@@std@@XZ	160	0x140174d40
?GetName@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ	161	0x1400855e0
?GetPersistence@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventPersistence@234@XZ	162	0x140172540
?GetPiiProperties@EventProperties@Events@Applications@Microsoft@@QEBA?BV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Application	163	0x140172550
?GetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QEBA_KXZ	164	0x1401727c0
?GetPopSample@EventProperties@Events@Applications@Microsoft@@QEBANXZ	165	0x1401727d0
?GetPriority@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventPriority@234@XZ	166	0x140172530
?GetProperties@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@W4DataCategory@234@@Z	167	0x1401727e0
?GetTimestamp@EventProperties@Events@Applications@Microsoft@@QEBA_JXZ	168	0x140172800
?GetType@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ	169	0x140172810
?HasConfig@ILogConfiguration@Events@Applications@Microsoft@@QEAA_NPEBD@Z	170	0x140174d50
?Hash@GUID_t@Events@Applications@Microsoft@@QEBA_KXZ	171	0x1401781c0
?Initialize@IModule@Events@Applications@Microsoft@@UEAAXPEAVILogManager@234@@Z	172	0x1400299a0
?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@AEAVILogConfiguration@234@@Z	173	0x1401751c0
?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PEBD@Z	174	0x1401751f0
?RemoveEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z	175	0x140170b60
?SetAppEnv@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	176	0x14016b7f0
?SetAppExperimentETag@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	177	0x14016b8e0
?SetAppExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	178	0x14016b9e0
?SetAppExperimentImpressionId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	179	0x14016bad0
?SetAppId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	180	0x14016bbc0
?SetAppLanguage@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	181	0x14016bcb0
?SetAppName@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	182	0x14016bda0
?SetAppVersion@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	183	0x14016be90
?SetCommercialId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	184	0x14016bf80
?SetCommonField@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUEventProperty@234@@Z	185	0x1400299a0
?SetCustomField@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUEventProperty@234@@Z	186	0x1400299a0
?SetDeviceClass@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	187	0x14016c070
?SetDeviceId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	188	0x14016c160
?SetDeviceMake@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	189	0x14016c250
?SetDeviceModel@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	190	0x14016c340
?SetDeviceOrgId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	191	0x14016c430
?SetEventExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z	192	0x1400299a0
?SetLatency@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventLatency@234@@Z	193	0x140172820
?SetLevel@EventProperties@Events@Applications@Microsoft@@QEAAXE@Z	194	0x14016c520
?SetName@EventProperties@Events@Applications@Microsoft@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	195	0x140172830
?SetNetworkCost@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4NetworkCost@234@@Z	196	0x14016c5e0
?SetNetworkProvider@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	197	0x14016c710
?SetNetworkType@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4NetworkType@234@@Z	198	0x14016c800
?SetOsBuild@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	199	0x14016c930
?SetOsName@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	200	0x14016ca20
?SetOsVersion@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	201	0x14016cb10
?SetPersistence@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventPersistence@234@@Z	202	0x140172970
?SetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QEAAX_K@Z	203	0x140172980
?SetPopsample@EventProperties@Events@Applications@Microsoft@@QEAAXN@Z	204	0x140172990
?SetPriority@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventPriority@234@@Z	205	0x1401729a0
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4PiiKind@234@W4DataCategory@234@@Z	206	0x1401729e0
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@NV?$allocator@N@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z	207	0x140172a30
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z	208	0x140172a80
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@6@W4PiiKind@234@W4DataCategory@234@@Z	209	0x140172ad0
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@_JV?$allocator@_J@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z	210	0x140172b20
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CW4PiiKind@234@W4DataCategory@234@@Z	211	0x14016cc00
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@EW4PiiKind@234@W4DataCategory@234@@Z	212	0x14016cc10
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@FW4PiiKind@234@W4DataCategory@234@@Z	213	0x14016cc20
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@GW4PiiKind@234@W4DataCategory@234@@Z	214	0x14016cc30
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HW4PiiKind@234@W4DataCategory@234@@Z	215	0x14016cc40
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IW4PiiKind@234@W4DataCategory@234@@Z	216	0x14016cc50
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@NW4PiiKind@234@W4DataCategory@234@@Z	217	0x140172b70
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDW4PiiKind@234@W4DataCategory@234@@Z	218	0x140172bc0
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@234@@Z	219	0x140172c10
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UGUID_t@234@W4PiiKind@234@W4DataCategory@234@@Z	220	0x140172d10
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Utime_ticks_t@234@W4PiiKind@234@W4DataCategory@234@@Z	221	0x140172d60
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_JW4PiiKind@234@W4DataCategory@234@@Z	222	0x140172dc0
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_KW4PiiKind@234@W4DataCategory@234@@Z	223	0x14016cc60
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_NW4PiiKind@234@W4DataCategory@234@@Z	224	0x140172e10
?SetTicket@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4TicketType@234@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	225	0x1400299a0
?SetTimestamp@EventProperties@Events@Applications@Microsoft@@QEAAX_J@Z	226	0x140172e60
?SetType@EventProperties@Events@Applications@Microsoft@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	227	0x140172e70
?SetUserANID@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	228	0x14016cc70
?SetUserAdvertisingId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	229	0x14016cd60
?SetUserId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@234@@Z	230	0x14016ce50
?SetUserLanguage@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	231	0x14016cf30
?SetUserMsaId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	232	0x14016d020
?SetUserTimeZone@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	233	0x14016d110
?Teardown@IModule@Events@Applications@Microsoft@@UEAAXXZ	234	0x1400299a0
?TryGetLevel@EventProperties@Events@Applications@Microsoft@@QEBA?AV?$tuple@_NE@std@@XZ	235	0x140173010
?clear@EventProperty@Events@Applications@Microsoft@@QEAAXXZ	236	0x140178380
?convertUintVectorToGUID@GUID_t@Events@Applications@Microsoft@@SA?AU_GUID@@AEBV?$vector@EV?$allocator@E@std@@@std@@@Z	237	0x140178430
?copydata@EventProperty@Events@Applications@Microsoft@@AEAAXPEBU1234@@Z	238	0x140178490
?empty@EventProperty@Events@Applications@Microsoft@@QEAA_NXZ	239	0x140178620
?erase@EventProperties@Events@Applications@Microsoft@@QEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4DataCategory@234@@Z	240	0x1401733f0
?lock@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ@4V67@A	241	0x1403e1610
?pack@EventProperties@Events@Applications@Microsoft@@QEAAPEAUevt_prop@@XZ	242	0x140173410
?stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ	243	0x14016fbc0
?to_bytes@GUID_t@Events@Applications@Microsoft@@QEBAXAEAY0BA@E@Z	244	0x140178650
?to_string@EventProperty@Events@Applications@Microsoft@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ	245	0x1401786a0
?to_string@GUID_t@Events@Applications@Microsoft@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ	246	0x140178f50
?type_name@EventProperty@Events@Applications@Microsoft@@SAPEBDI@Z	247	0x140178f70
?unpack@EventProperties@Events@Applications@Microsoft@@QEAA_NPEAUevt_prop@@_K@Z	248	0x1401736e0
evt_api_call_default	249	0x140167850

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report OneDriveUpdater.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Windows Analysis Report
OneDriveUpdater.exe