NEAS[.]db5462d7c54eab1c31c50aa26b126980[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.db5462d7c54eab1c31c50aa26b126980.exe
Size

5.0MB
MD5

db5462d7c54eab1c31c50aa26b126980
SHA1

d4d9bf3c27dc1cec5bf1606999434d1f48c0a84d
SHA256

51f254ae2be2fe4b38d788946a006ac95bfe8bc8756fead70b6f9772840b10d8
SHA512

223c5de7b09c0c2f695b04f8dc2d2e155bd24ffc962a902aa3c8549d726bc05ddc2301252db152495e029b4e3eabb7f59ca636abee7c7023b664468155f4dbe0
SSDEEP

98304:yvjpr5EwEbgUq1m7tXIbbEIrOnEYojXQi59+tqK6LGC/wE9yIInhRTDYOAWzwMGn:2/wE9yhhlYDE2mW6PT/+fyN+MheYef/

Score

1^/10

Malware Config

Signatures

Files

NEAS.db5462d7c54eab1c31c50aa26b126980.exe
.dll windows:6 windows x86

4e4b0d2bf4bf5220417826ef4b4d596a

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ab:4b:d7:46:83:ef:43:2f:81:dd:fd:3a:14:89:10:de:1e:38:9f:fb:87:61:f3:9e:1b:53:12:86:30:99:b4:9f
Signer

Actual PE Digest

ab:4b:d7:46:83:ef:43:2f:81:dd:fd:3a:14:89:10:de:1e:38:9f:fb:87:61:f3:9e:1b:53:12:86:30:99:b4:9f

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx
CLSIDFromString

oleaut32

QueryPathOfRegTypeLi
GetErrorInfo
SysFreeString

shell32

SHGetFolderPathW
SHCreateDirectoryExW

user32

CharUpperBuffW
CharLowerBuffW

msvcp140

?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Cnd_broadcast
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_wait
?_Syserror_map@std@@YAPBDH@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Cnd_signal
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1_Locinfo@std@@QAE@XZ
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??0_Locinfo@std@@QAE@PBD@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strxfrm
_Strcoll
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?is@?$ctype@D@std@@QBE_NFD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?bad@ios_base@std@@QBE_NXZ
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPAD_J@Z
?set_rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEGG@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?widen@?$ctype@G@std@@QBEGD@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Xout_of_range@std@@YAXPBD@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?flags@ios_base@std@@QBEHXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?_Xlength_error@std@@YAXPBD@Z
_Query_perf_counter
_Query_perf_frequency
?fail@ios_base@std@@QBE_NXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?width@ios_base@std@@QBE_JXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?good@ios_base@std@@QBE_NXZ
?uncaught_exception@std@@YA_NXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??Bid@locale@std@@QAEIXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$ctype@G@std@@QBEPBDPBD0PAG@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?setf@ios_base@std@@QAEHHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?_Xbad_alloc@std@@YAXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?width@ios_base@std@@QAE_J_J@Z

concrt140

?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ
?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z
?_GetNumberOfVirtualProcessors@_CurrentScheduler@details@Concurrency@@SAIXZ
??1_StructuredTaskCollection@details@Concurrency@@QAE@XZ
?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z
?Free@Concurrency@@YAXPAX@Z

mscoree

CLRCreateInstance

kernel32

SetHandleInformation
CompareStringEx
FindFirstFileExW
FindNextFileW
GetLocaleInfoA
IsValidCodePage
MultiByteToWideChar
LoadLibraryExW
GetThreadPreferredUILanguages
SizeofResource
LockResource
FindResourceExW
FindResourceW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetFullPathNameW
GetCurrentDirectoryW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
IsDebuggerPresent
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
FindResourceA
LoadResource
AllocConsole
GetCurrentProcess
VirtualQueryEx
GetSystemInfo
GetModuleHandleExW
DeleteCriticalSection
RaiseException
FreeLibrary
GetModuleFileNameW
LoadLibraryW
InitializeCriticalSectionEx
GetProcAddress
GetModuleHandleW
UnmapViewOfFile
VirtualFree
MapViewOfFileEx
WriteFile
SetFilePointerEx
VirtualAlloc
CreateFileMappingA
GetTempFileNameW
GetTempPathW
GetLastError
FormatMessageA
CreateFileA
SetConsoleMode
GetConsoleMode
GetStdHandle
GetFileAttributesA
GetFileAttributesW
SetFileTime
CloseHandle
SystemTimeToFileTime
GetSystemTime
CreateFileW
FindClose
GetEnvironmentVariableW

advapi32

RegEnumKeyExA
RegOpenKeyExA
RegCloseKey

vcruntime140

__std_exception_destroy
strstr
wcschr
wcsstr
memmove
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
strchr
_purecall
__std_type_info_destroy_list
memcpy
__CxxFrameHandler3
memset
memcmp
memchr
wcsrchr
__RTDynamicCast
__std_exception_copy
__std_terminate

api-ms-win-crt-stdio-l1-1-0

fputc
_get_stream_buffer_pointers
fgetpos
fsetpos
setvbuf
__stdio_common_vfprintf_s
fgetc
__stdio_common_vfprintf
_wsopen_s
_get_osfhandle
_wfopen_s
putc
__stdio_common_vswprintf
_fread_nolock
__acrt_iob_func
ftell
fwrite
fputs
fread
fseek
fflush
__stdio_common_vsprintf
_fseeki64
_ftelli64
__stdio_common_vsscanf
_getcwd
_fileno
_isatty
getc
_wfsopen
freopen_s
__stdio_common_vswprintf_s
ungetc
ferror
fclose
fopen
_fsopen
_wfopen

api-ms-win-crt-string-l1-1-0

isalnum
strcpy_s
isspace
islower
isxdigit
strncmp
strncpy
isprint
wcscpy_s
wcsnlen
iswspace
tolower
isalpha
iscntrl
wcscat_s
_wcsicmp
wcsncmp
_strnicmp
_stricmp
isdigit
isupper
wmemcpy_s

api-ms-win-crt-convert-l1-1-0

strtol
strtoul
mbstowcs_s
_wtoi
wcstoul

api-ms-win-crt-heap-l1-1-0

malloc
realloc
free
_callnewh

api-ms-win-crt-runtime-l1-1-0

exit
_beginthreadex
signal
strerror
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_errno
_getpid
_invalid_parameter_noinfo
terminate

api-ms-win-crt-environment-l1-1-0

getenv_s
getenv

api-ms-win-crt-utility-l1-1-0

qsort
bsearch

api-ms-win-crt-time-l1-1-0

_time64
_ctime64
clock
_difftime64
asctime
_localtime64

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s
_lock_file
_waccess_s
_wstat64
_unlock_file
_stat64i32
_wremove
remove
_wchdir
_chdir
_fstat64i32
_findfirst64i32
_wstat64i32
_findnext64i32
_findclose

api-ms-win-crt-locale-l1-1-0

setlocale

api-ms-win-crt-math-l1-1-0

_fdopen
ceil

Exports

Exports

??0a_canonicalized_file_name@@QAE@$$T@Z
??0a_canonicalized_file_name@@QAE@ABU0@@Z
??0a_canonicalized_file_name@@QAE@PBD@Z
??0a_find_all_refs_operation@edge@@QAE@$$QAV01@@Z
??0a_find_all_refs_operation@edge@@QAE@PAUallocator@1@PBUintermediate_symbol@1@PAVtranslation_unit@1@W4find_all_refs_filter_mode_e@1@@Z
??0a_find_def_operation@edge@@QAE@PAUallocator@1@@Z
??0a_get_symbol_operation@edge@@QAE@PAUallocator@1@ABUfile_line_column@1@@Z
??0array_type@edge@@QAE@$$QAV01@@Z
??0array_type@edge@@QAE@ABV01@@Z
??0array_type@edge@@QAE@PAUa_type@@@Z
??0base_class@edge@@QAE@PAUa_base_class@@@Z
??0block_statement_entry@edge@@QAE@$$QAV01@@Z
??0block_statement_entry@edge@@QAE@ABV01@@Z
??0block_statement_entry@edge@@QAE@PAUa_statement@@@Z
??0braced_init_list_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0braced_init_list_expr_node_entry@edge@@QAE@ABV01@@Z
??0braced_init_list_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0branch_statement_entry@edge@@QAE@$$QAV01@@Z
??0branch_statement_entry@edge@@QAE@ABV01@@Z
??0branch_statement_entry@edge@@QAE@PAUa_statement@@@Z
??0builtin_operation_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0builtin_operation_expr_node_entry@edge@@QAE@ABV01@@Z
??0builtin_operation_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0call_operation_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0capt_var_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0capt_var_expr_node_entry@edge@@QAE@ABV01@@Z
??0capt_var_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0case_statement_entry@edge@@QAE@$$QAV01@@Z
??0case_statement_entry@edge@@QAE@ABV01@@Z
??0case_statement_entry@edge@@QAE@PAUa_statement@@@Z
??0class_struct_type@edge@@QAE@$$QAV01@@Z
??0class_struct_type@edge@@QAE@ABV01@@Z
??0class_struct_type@edge@@QAE@PAUa_type@@@Z
??0compound_req_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0compound_req_expr_node_entry@edge@@QAE@ABV01@@Z
??0compound_req_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0concept_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0concept_expr_node_entry@edge@@QAE@ABV01@@Z
??0concept_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0condition_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0condition_expr_node_entry@edge@@QAE@ABV01@@Z
??0condition_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0constant@edge@@QAE@PAUa_constant@@@Z
??0constant_entry@edge@@QAE@$$QAV01@@Z
??0constant_entry@edge@@QAE@ABV01@@Z
??0constant_entry@edge@@QAE@PAUa_constant@@@Z
??0constant_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0constant_expr_node_entry@edge@@QAE@ABV01@@Z
??0constant_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0decl_init_statement_entry@edge@@QAE@$$QAV01@@Z
??0decl_init_statement_entry@edge@@QAE@ABV01@@Z
??0decl_init_statement_entry@edge@@QAE@PAUa_statement@@@Z
??0decl_statement_entry@edge@@QAE@$$QAV01@@Z
??0decl_statement_entry@edge@@QAE@ABV01@@Z
??0decl_statement_entry@edge@@QAE@PAUa_statement@@@Z
??0derivation@edge@@QAE@PAUa_base_class_derivation@@@Z
??0enum_type@edge@@QAE@$$QAV01@@Z
??0enum_type@edge@@QAE@ABV01@@Z
??0enum_type@edge@@QAE@PAUa_type@@@Z
??0event_descr@edge@@QAE@PAUa_property_or_event_descr@@@Z
??0exception_specification@edge@@QAE@PAUan_exception_specification@@@Z
??0expr_node_entry@edge@@QAE@$$QAV01@@Z
??0expr_node_entry@edge@@QAE@ABV01@@Z
??0expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0expr_statement_entry@edge@@QAE@$$QAV01@@Z
??0expr_statement_entry@edge@@QAE@ABV01@@Z
??0expr_statement_entry@edge@@QAE@PAUa_statement@@@Z
??0field_entry@edge@@QAE@$$QAV01@@Z
??0field_entry@edge@@QAE@ABV01@@Z
??0field_entry@edge@@QAE@PAUa_field@@@Z
??0field_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0field_expr_node_entry@edge@@QAE@ABV01@@Z
??0field_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0file_buffer@edge@@IAE@$$QAV01@@Z
??0file_buffer@edge@@IAE@XZ
??0file_line_column@edge@@QAE@Ua_canonicalized_file_name@@U?$strong_typedef_t@Uline1_traits@msvc@@@msvc@@U?$strong_typedef_t@Ucolumn1_traits@msvc@@@4@@Z
??0file_line_column@edge@@QAE@XZ
??0file_position@edge@@QAE@Ua_canonicalized_file_name@@U?$strong_typedef_t@Uoffset_traits@msvc@@@msvc@@@Z
??0file_position@edge@@QAE@XZ
??0file_range@edge@@QAE@Ufile_position@1@0@Z
??0file_range@edge@@QAE@Ufile_position@1@H@Z
??0file_range@edge@@QAE@XZ
??0float_type@edge@@QAE@$$QAV01@@Z
??0float_type@edge@@QAE@ABV01@@Z
??0float_type@edge@@QAE@PAUa_type@@@Z
??0fold_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0fold_expr_node_entry@edge@@QAE@ABV01@@Z
??0fold_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0for_each_loop_statement_entry@edge@@QAE@$$QAV01@@Z
??0for_each_loop_statement_entry@edge@@QAE@ABV01@@Z
??0for_each_loop_statement_entry@edge@@QAE@PAUa_statement@@@Z
??0for_loop_statement_entry@edge@@QAE@$$QAV01@@Z
??0for_loop_statement_entry@edge@@QAE@ABV01@@Z
??0for_loop_statement_entry@edge@@QAE@PAUa_statement@@@Z
??0function_entry@edge@@QAE@$$QAV01@@Z
??0function_entry@edge@@QAE@ABV01@@Z
??0function_entry@edge@@QAE@PAUa_routine@@@Z
??0function_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0function_expr_node_entry@edge@@QAE@ABV01@@Z
??0function_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0function_type@edge@@QAE@$$QAV01@@Z
??0function_type@edge@@QAE@ABV01@@Z
??0function_type@edge@@QAE@PAUa_type@@@Z
??0handler_entry@edge@@QAE@$$QAV01@@Z
??0handler_entry@edge@@QAE@ABV01@@Z
??0handler_entry@edge@@QAE@PAUa_handler@@@Z
??0if_statement_entry@edge@@QAE@$$QAV01@@Z
??0if_statement_entry@edge@@QAE@ABV01@@Z
??0if_statement_entry@edge@@QAE@PAUa_statement@@@Z
??0il_entry@edge@@IAE@$$TW4il_entry_kind@1@@Z
??0il_entry@edge@@IAE@PAXW4il_entry_kind@1@@Z
??0il_entry@edge@@QAE@$$QAV01@@Z
??0il_entry@edge@@QAE@ABV01@@Z
??0integer_type@edge@@QAE@$$QAV01@@Z
??0integer_type@edge@@QAE@ABV01@@Z
??0integer_type@edge@@QAE@PAUa_type@@@Z
??0intellisense_operation@edge@@QAE@PAUallocator@1@PAVtranslation_unit@1@Usnapshot_session_t@snapshot@@ABUfile_position@1@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@U?$strong_typedef_t@Uoffset_traits@msvc@@@msvc@@_N@Z
??0intellisense_operation@edge@@QAE@PAUallocator@1@PAVtranslation_unit@1@Usnapshot_session_t@snapshot@@ABUfile_position@1@_N@Z
??0label_entry@edge@@QAE@$$QAV01@@Z
??0label_entry@edge@@QAE@ABV01@@Z
??0label_entry@edge@@QAE@PAUa_label@@@Z
??0label_statement_entry@edge@@QAE@$$QAV01@@Z
??0label_statement_entry@edge@@QAE@ABV01@@Z
??0label_statement_entry@edge@@QAE@PAUa_statement@@@Z
??0microsoft_try_statement_entry@edge@@QAE@$$QAV01@@Z
??0microsoft_try_statement_entry@edge@@QAE@ABV01@@Z
??0microsoft_try_statement_entry@edge@@QAE@PAUa_statement@@@Z
??0nested_req_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0nested_req_expr_node_entry@edge@@QAE@ABV01@@Z
??0nested_req_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0new_delete_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0new_delete_expr_node_entry@edge@@QAE@ABV01@@Z
??0new_delete_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0operation_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0operation_expr_node_entry@edge@@QAE@ABV01@@Z
??0operation_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0param_ref_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0param_ref_expr_node_entry@edge@@QAE@ABV01@@Z
??0param_ref_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0param_type_entry@edge@@QAE@$$QAV01@@Z
??0param_type_entry@edge@@QAE@ABV01@@Z
??0param_type_entry@edge@@QAE@PAUa_param_type@@@Z
??0pointer_to_member_type@edge@@QAE@$$QAV01@@Z
??0pointer_to_member_type@edge@@QAE@ABV01@@Z
??0pointer_to_member_type@edge@@QAE@PAUa_type@@@Z
??0pointer_type@edge@@QAE@$$QAV01@@Z
??0pointer_type@edge@@QAE@ABV01@@Z
??0pointer_type@edge@@QAE@PAUa_type@@@Z
??0property_descr@edge@@QAE@PAUa_property_or_event_descr@@@Z
??0property_or_event_descr@edge@@QAE@PAUa_property_or_event_descr@@@Z
??0query_action_data@edge@@QAE@$$QAV01@@Z
??0query_action_data@edge@@QAE@XZ
??0range_based_for_loop_statement_entry@edge@@QAE@$$QAV01@@Z
??0range_based_for_loop_statement_entry@edge@@QAE@ABV01@@Z
??0range_based_for_loop_statement_entry@edge@@QAE@PAUa_statement@@@Z
??0requires_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0requires_expr_node_entry@edge@@QAE@ABV01@@Z
??0requires_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0return_statement_entry@edge@@QAE@$$QAV01@@Z
??0return_statement_entry@edge@@QAE@ABV01@@Z
??0return_statement_entry@edge@@QAE@PAUa_statement@@@Z
??0scoped_query_manager@edge@@QAE@PAUallocator@1@PAVtranslation_unit@1@Usnapshot_session_t@snapshot@@ABUfile_position@1@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@_N@Z
??0scoped_query_manager@edge@@QAE@PAUallocator@1@PAVtranslation_unit@1@Usnapshot_session_t@snapshot@@_N@Z
??0sizeof_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0sizeof_expr_node_entry@edge@@QAE@ABV01@@Z
??0sizeof_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0source_file@edge@@QAE@PAUa_source_file@@@Z
??0source_file_entry@edge@@QAE@$$QAV01@@Z
??0source_file_entry@edge@@QAE@ABV01@@Z
??0source_file_entry@edge@@QAE@PAUa_source_file@@@Z
??0source_position@edge@@QAE@ABUa_source_position@@@Z
??0statement_entry@edge@@QAE@$$QAV01@@Z
??0statement_entry@edge@@QAE@ABV01@@Z
??0statement_entry@edge@@QAE@PAUa_statement@@@Z
??0switch_statement_entry@edge@@QAE@$$QAV01@@Z
??0switch_statement_entry@edge@@QAE@ABV01@@Z
??0switch_statement_entry@edge@@QAE@PAUa_statement@@@Z
??0temp_init_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0temp_init_expr_node_entry@edge@@QAE@ABV01@@Z
??0temp_init_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0template_parameter@edge@@QAE@PAUa_template_param@@PAUa_template_parameter@@@Z
??0template_parameter_type@edge@@QAE@$$QAV01@@Z
??0template_parameter_type@edge@@QAE@ABV01@@Z
??0template_parameter_type@edge@@QAE@PAUa_type@@@Z
??0throw_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0throw_expr_node_entry@edge@@QAE@ABV01@@Z
??0throw_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0translation_unit@edge@@QAE@XZ
??0tree_query_result_builder@edge@@QAE@$$QAV01@@Z
??0tree_query_result_builder@edge@@QAE@ABV01@@Z
??0tree_query_result_builder@edge@@QAE@XZ
??0try_statement_entry@edge@@QAE@$$QAV01@@Z
??0try_statement_entry@edge@@QAE@ABV01@@Z
??0try_statement_entry@edge@@QAE@PAUa_statement@@@Z
??0type@edge@@QAE@$$QAV01@@Z
??0type@edge@@QAE@ABV01@@Z
??0type@edge@@QAE@PAUa_type@@@Z
??0type_entry@edge@@QAE@$$QAV01@@Z
??0type_entry@edge@@QAE@ABV01@@Z
??0type_entry@edge@@QAE@PAUa_type@@@Z
??0type_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0type_expr_node_entry@edge@@QAE@ABV01@@Z
??0type_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0typeid_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0typeid_expr_node_entry@edge@@QAE@ABV01@@Z
??0typeid_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0typeref_type@edge@@QAE@$$QAV01@@Z
??0typeref_type@edge@@QAE@ABV01@@Z
??0typeref_type@edge@@QAE@PAUa_type@@@Z
??0union_type@edge@@QAE@$$QAV01@@Z
??0union_type@edge@@QAE@ABV01@@Z
??0union_type@edge@@QAE@PAUa_type@@@Z
??0unknown_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0unknown_expr_node_entry@edge@@QAE@ABV01@@Z
??0unknown_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0variable_entry@edge@@QAE@$$QAV01@@Z
??0variable_entry@edge@@QAE@ABV01@@Z
??0variable_entry@edge@@QAE@PAUa_variable@@@Z
??0variable_expr_node_entry@edge@@IAE@Uderived_tag@01@PAUan_expr_node@@@Z
??0variable_expr_node_entry@edge@@QAE@$$QAV01@@Z
??0variable_expr_node_entry@edge@@QAE@ABV01@@Z
??0variable_expr_node_entry@edge@@QAE@PAUan_expr_node@@@Z
??0vector_type@edge@@QAE@$$QAV01@@Z
??0vector_type@edge@@QAE@ABV01@@Z
??0vector_type@edge@@QAE@PAUa_type@@@Z
??0while_statement_entry@edge@@QAE@$$QAV01@@Z
??0while_statement_entry@edge@@QAE@ABV01@@Z
??0while_statement_entry@edge@@QAE@PAUa_statement@@@Z
??1a_find_all_refs_operation@edge@@QAE@XZ
??1a_find_def_operation@edge@@QAE@XZ
??1a_get_symbol_operation@edge@@QAE@XZ
??1file_buffer@edge@@MAE@XZ
??1intellisense_operation@edge@@QAE@XZ
??1query_action_data@edge@@QAE@XZ
??1scoped_query_manager@edge@@QAE@XZ
??1translation_unit@edge@@QAE@XZ
??4a_canonicalized_file_name@@QAEAAU0@ABU0@@Z
??4a_find_def_operation@edge@@QAEAAV01@ABV01@@Z
??4array_type@edge@@QAEAAV01@$$QAV01@@Z
??4array_type@edge@@QAEAAV01@ABV01@@Z
??4base_class@edge@@QAEAAV01@$$QAV01@@Z
??4base_class@edge@@QAEAAV01@ABV01@@Z
??4block_statement_entry@edge@@QAEAAV01@$$QAV01@@Z
??4block_statement_entry@edge@@QAEAAV01@ABV01@@Z
??4braced_init_list_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4braced_init_list_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4branch_statement_entry@edge@@QAEAAV01@$$QAV01@@Z
??4branch_statement_entry@edge@@QAEAAV01@ABV01@@Z
??4builtin_operation_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4builtin_operation_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4capt_var_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4capt_var_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4case_statement_entry@edge@@QAEAAV01@$$QAV01@@Z
??4case_statement_entry@edge@@QAEAAV01@ABV01@@Z
??4class_struct_type@edge@@QAEAAV01@$$QAV01@@Z
??4class_struct_type@edge@@QAEAAV01@ABV01@@Z
??4compound_req_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4compound_req_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4concept_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4concept_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4condition_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4condition_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4constant@edge@@QAEAAV01@$$QAV01@@Z
??4constant@edge@@QAEAAV01@ABV01@@Z
??4constant_entry@edge@@QAEAAV01@$$QAV01@@Z
??4constant_entry@edge@@QAEAAV01@ABV01@@Z
??4constant_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4constant_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4decl_init_statement_entry@edge@@QAEAAV01@$$QAV01@@Z
??4decl_init_statement_entry@edge@@QAEAAV01@ABV01@@Z
??4decl_statement_entry@edge@@QAEAAV01@$$QAV01@@Z
??4decl_statement_entry@edge@@QAEAAV01@ABV01@@Z
??4derivation@edge@@QAEAAV01@$$QAV01@@Z
??4derivation@edge@@QAEAAV01@ABV01@@Z
??4enum_type@edge@@QAEAAV01@$$QAV01@@Z
??4enum_type@edge@@QAEAAV01@ABV01@@Z
??4event_descr@edge@@QAEAAV01@$$QAV01@@Z
??4event_descr@edge@@QAEAAV01@ABV01@@Z
??4exception_specification@edge@@QAEAAV01@$$QAV01@@Z
??4exception_specification@edge@@QAEAAV01@ABV01@@Z
??4expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4expr_statement_entry@edge@@QAEAAV01@$$QAV01@@Z
??4expr_statement_entry@edge@@QAEAAV01@ABV01@@Z
??4field_entry@edge@@QAEAAV01@$$QAV01@@Z
??4field_entry@edge@@QAEAAV01@ABV01@@Z
??4field_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4field_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4file_buffer@edge@@IAEAAV01@$$QAV01@@Z
??4file_line_column@edge@@QAEAAU01@$$QAU01@@Z
??4file_line_column@edge@@QAEAAU01@ABU01@@Z
??4file_position@edge@@QAEAAU01@$$QAU01@@Z
??4file_position@edge@@QAEAAU01@ABU01@@Z
??4file_range@edge@@QAEAAU01@$$QAU01@@Z
??4file_range@edge@@QAEAAU01@ABU01@@Z
??4float_type@edge@@QAEAAV01@$$QAV01@@Z
??4float_type@edge@@QAEAAV01@ABV01@@Z
??4fold_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4fold_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4for_each_loop_statement_entry@edge@@QAEAAV01@$$QAV01@@Z
??4for_each_loop_statement_entry@edge@@QAEAAV01@ABV01@@Z
??4for_loop_statement_entry@edge@@QAEAAV01@$$QAV01@@Z
??4for_loop_statement_entry@edge@@QAEAAV01@ABV01@@Z
??4function_entry@edge@@QAEAAV01@$$QAV01@@Z
??4function_entry@edge@@QAEAAV01@ABV01@@Z
??4function_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4function_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4function_type@edge@@QAEAAV01@$$QAV01@@Z
??4function_type@edge@@QAEAAV01@ABV01@@Z
??4handler_entry@edge@@QAEAAV01@$$QAV01@@Z
??4handler_entry@edge@@QAEAAV01@ABV01@@Z
??4if_statement_entry@edge@@QAEAAV01@$$QAV01@@Z
??4if_statement_entry@edge@@QAEAAV01@ABV01@@Z
??4il_entry@edge@@QAEAAV01@$$QAV01@@Z
??4il_entry@edge@@QAEAAV01@ABV01@@Z
??4integer_type@edge@@QAEAAV01@$$QAV01@@Z
??4integer_type@edge@@QAEAAV01@ABV01@@Z
??4label_entry@edge@@QAEAAV01@$$QAV01@@Z
??4label_entry@edge@@QAEAAV01@ABV01@@Z
??4label_statement_entry@edge@@QAEAAV01@$$QAV01@@Z
??4label_statement_entry@edge@@QAEAAV01@ABV01@@Z
??4microsoft_try_statement_entry@edge@@QAEAAV01@$$QAV01@@Z
??4microsoft_try_statement_entry@edge@@QAEAAV01@ABV01@@Z
??4nested_req_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4nested_req_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4new_delete_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4new_delete_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4operation_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4operation_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4param_ref_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4param_ref_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4param_type_entry@edge@@QAEAAV01@$$QAV01@@Z
??4param_type_entry@edge@@QAEAAV01@ABV01@@Z
??4pointer_to_member_type@edge@@QAEAAV01@$$QAV01@@Z
??4pointer_to_member_type@edge@@QAEAAV01@ABV01@@Z
??4pointer_type@edge@@QAEAAV01@$$QAV01@@Z
??4pointer_type@edge@@QAEAAV01@ABV01@@Z
??4property_descr@edge@@QAEAAV01@$$QAV01@@Z
??4property_descr@edge@@QAEAAV01@ABV01@@Z
??4property_or_event_descr@edge@@QAEAAV01@$$QAV01@@Z
??4property_or_event_descr@edge@@QAEAAV01@ABV01@@Z
??4range_based_for_loop_statement_entry@edge@@QAEAAV01@$$QAV01@@Z
??4range_based_for_loop_statement_entry@edge@@QAEAAV01@ABV01@@Z
??4requires_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4requires_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4return_statement_entry@edge@@QAEAAV01@$$QAV01@@Z
??4return_statement_entry@edge@@QAEAAV01@ABV01@@Z
??4sizeof_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4sizeof_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4source_file@edge@@QAEAAU01@$$QAU01@@Z
??4source_file@edge@@QAEAAU01@ABU01@@Z
??4source_file_entry@edge@@QAEAAV01@$$QAV01@@Z
??4source_file_entry@edge@@QAEAAV01@ABV01@@Z
??4source_position@edge@@QAEAAV01@$$QAV01@@Z
??4source_position@edge@@QAEAAV01@ABV01@@Z
??4statement_entry@edge@@QAEAAV01@$$QAV01@@Z
??4statement_entry@edge@@QAEAAV01@ABV01@@Z
??4switch_statement_entry@edge@@QAEAAV01@$$QAV01@@Z
??4switch_statement_entry@edge@@QAEAAV01@ABV01@@Z
??4temp_init_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4temp_init_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4template_parameter@edge@@QAEAAV01@$$QAV01@@Z
??4template_parameter@edge@@QAEAAV01@ABV01@@Z
??4template_parameter_type@edge@@QAEAAV01@$$QAV01@@Z
??4template_parameter_type@edge@@QAEAAV01@ABV01@@Z
??4test@translation_unit@edge@@QAEAAU012@$$QAU012@@Z
??4test@translation_unit@edge@@QAEAAU012@ABU012@@Z
??4throw_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4throw_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4tree_query_result_builder@edge@@QAEAAV01@$$QAV01@@Z
??4tree_query_result_builder@edge@@QAEAAV01@ABV01@@Z
??4try_statement_entry@edge@@QAEAAV01@$$QAV01@@Z
??4try_statement_entry@edge@@QAEAAV01@ABV01@@Z
??4type@edge@@QAEAAV01@$$QAV01@@Z
??4type@edge@@QAEAAV01@ABV01@@Z
??4type_entry@edge@@QAEAAV01@$$QAV01@@Z
??4type_entry@edge@@QAEAAV01@ABV01@@Z
??4type_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4type_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4typeid_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4typeid_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4typeref_type@edge@@QAEAAV01@$$QAV01@@Z
??4typeref_type@edge@@QAEAAV01@ABV01@@Z
??4union_type@edge@@QAEAAV01@$$QAV01@@Z
??4union_type@edge@@QAEAAV01@ABV01@@Z
??4unknown_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4unknown_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4variable_entry@edge@@QAEAAV01@$$QAV01@@Z
??4variable_entry@edge@@QAEAAV01@ABV01@@Z
??4variable_expr_node_entry@edge@@QAEAAV01@$$QAV01@@Z
??4variable_expr_node_entry@edge@@QAEAAV01@ABV01@@Z
??4vector_type@edge@@QAEAAV01@$$QAV01@@Z
??4vector_type@edge@@QAEAAV01@ABV01@@Z
??4while_statement_entry@edge@@QAEAAV01@$$QAV01@@Z
??4while_statement_entry@edge@@QAEAAV01@ABV01@@Z
??8edge@@YA_NABUfile_position@0@0@Z
??9edge@@YA_NABUfile_position@0@0@Z
??Ba_canonicalized_file_name@@QAEPBDXZ
??_7array_type@edge@@6B@
??_7block_statement_entry@edge@@6B@
??_7braced_init_list_expr_node_entry@edge@@6B@
??_7branch_statement_entry@edge@@6B@
??_7builtin_operation_expr_node_entry@edge@@6B@
??_7capt_var_expr_node_entry@edge@@6B@
??_7case_statement_entry@edge@@6B@
??_7class_struct_type@edge@@6B@
??_7compound_req_expr_node_entry@edge@@6B@
??_7concept_expr_node_entry@edge@@6B@
??_7condition_expr_node_entry@edge@@6B@
??_7constant_entry@edge@@6B@
??_7constant_expr_node_entry@edge@@6B@
??_7decl_init_statement_entry@edge@@6B@
??_7decl_statement_entry@edge@@6B@
??_7enum_type@edge@@6B@
??_7expr_node_entry@edge@@6B@
??_7expr_statement_entry@edge@@6B@
??_7field_entry@edge@@6B@
??_7field_expr_node_entry@edge@@6B@
??_7file_buffer@edge@@6B@
??_7float_type@edge@@6B@
??_7fold_expr_node_entry@edge@@6B@
??_7for_each_loop_statement_entry@edge@@6B@
??_7for_loop_statement_entry@edge@@6B@
??_7function_entry@edge@@6B@
??_7function_expr_node_entry@edge@@6B@
??_7function_type@edge@@6B@
??_7handler_entry@edge@@6B@
??_7if_statement_entry@edge@@6B@
??_7il_entry@edge@@6B@
??_7integer_type@edge@@6B@
??_7label_entry@edge@@6B@
??_7label_statement_entry@edge@@6B@
??_7microsoft_try_statement_entry@edge@@6B@
??_7nested_req_expr_node_entry@edge@@6B@
??_7new_delete_expr_node_entry@edge@@6B@
??_7operation_expr_node_entry@edge@@6B@
??_7param_ref_expr_node_entry@edge@@6B@
??_7param_type_entry@edge@@6B@
??_7pointer_to_member_type@edge@@6B@
??_7pointer_type@edge@@6B@
??_7range_based_for_loop_statement_entry@edge@@6B@
??_7requires_expr_node_entry@edge@@6B@
??_7return_statement_entry@edge@@6B@
??_7sizeof_expr_node_entry@edge@@6B@
??_7source_file_entry@edge@@6B@
??_7statement_entry@edge@@6B@
??_7switch_statement_entry@edge@@6B@
??_7temp_init_expr_node_entry@edge@@6B@
??_7template_parameter_type@edge@@6B@
??_7throw_expr_node_entry@edge@@6B@
??_7tree_query_result_builder@edge@@6B@
??_7try_statement_entry@edge@@6B@
??_7type@edge@@6B@
??_7type_entry@edge@@6B@
??_7type_expr_node_entry@edge@@6B@
??_7typeid_expr_node_entry@edge@@6B@
??_7typeref_type@edge@@6B@
??_7union_type@edge@@6B@
??_7unknown_expr_node_entry@edge@@6B@
??_7variable_entry@edge@@6B@
??_7variable_expr_node_entry@edge@@6B@
??_7vector_type@edge@@6B@
??_7while_statement_entry@edge@@6B@
?access@derivation@edge@@QBE?AW4access_specifier_e@2@XZ
?activate@file_buffer@edge@@QAEXXZ
?antlr_parse@@YA_NHPAPBDPBDW4parse_lang_e@edge@@AAVa_scout_parser_interface@@@Z
?append_primary@tree_query_result_builder@edge@@UAEXPAVil_entry@2@@Z
?append_primary@tree_query_result_builder@edge@@UAEXPAVil_entry@2@ABUfile_position@2@1@Z
?arg_list_for_call_site@intellisense_operation@edge@@QAE_NPAU?$strong_typedef_t@Uoffset_traits@msvc@@@msvc@@0@Z
?arg_list_kind@argument_list_entry@edge@@QBE?AW4arg_list_entry_kind@2@XZ
?arity@operation_expr_node_entry@edge@@QBE?AW4operator_arity@2@XZ
?as_file_position@file_line_column@edge@@QBE?AUfile_position@2@XZ
?base_class@base_class_entry@edge@@QBEPAV02@XZ
?batch_preprocess_file@@YAXV?$span_t@V?$basic_string_view@DU?$char_traits@D@std@@@std@@@msvc@@0V?$basic_string_view@DU?$char_traits@D@std@@@std@@AAUbatch_preprocess_events@@Usnapshot_session_t@snapshot@@@Z
?batch_restore_macro@@YAXV?$basic_string_view@DU?$char_traits@D@std@@@std@@0@Z
?batch_restore_pragma_once@@YAXPBD@Z
?body@for_each_loop_statement_entry@edge@@QBEPAVstatement_entry@2@XZ
?body@for_loop_statement_entry@edge@@QBEPAVstatement_entry@2@XZ
?body@function_entry@edge@@QBEPAVstatement_entry@2@XZ
?body@function_scope_entry@edge@@QBEPAVstatement_entry@2@XZ
?body@handler_entry@edge@@QBEPAVstatement_entry@2@XZ
?body@microsoft_try_statement_entry@edge@@QBEPAVstatement_entry@2@XZ
?body@range_based_for_loop_statement_entry@edge@@QBEPAVstatement_entry@2@XZ
?body@switch_statement_entry@edge@@QBEPAVstatement_entry@2@XZ
?body@try_statement_entry@edge@@QBEPAVstatement_entry@2@XZ
?body@while_statement_entry@edge@@QBEPAVstatement_entry@2@XZ
?call_sites_in_enclosing_function_scope@intellisense_operation@edge@@QAEXPAU?$list@Ucall_site@edge@@@2@@Z
?calling_convention@function_type@edge@@QBE?AW4calling_convention_kind@2@XZ
?canonicalize@edge@@YA?AUa_canonicalized_file_name@@PBD@Z
?canonicalize@edge@@YA?AUa_canonicalized_file_name@@PBG@Z
?check_and_compile@scoped_query_manager@edge@@AAEXABUfile_position@2@00_N11@Z
?check_and_compile@scoped_query_manager@edge@@AAEXABUfile_position@2@_N11@Z
?check_and_compile_for_file_scope@scoped_query_manager@edge@@AAEXABUfile_position@2@@Z
?class_type@pointer_to_member_type@edge@@QBEPAVclass_struct_type@2@XZ
?cleanup@microsoft_try_statement_entry@edge@@QBEPAVstatement_entry@2@XZ
?clear_canonicalizer_cache@edge@@YAXXZ
?close@file_buffer@edge@@QAEXXZ
?collection@for_each_loop_statement_entry@edge@@QBEPAVexpr_node_entry@2@XZ
?compare_name@type@edge@@QBEHV?$basic_string_view@DU?$char_traits@D@std@@@std@@@Z
?concept_@concept_expr_node_entry@edge@@QBEPAVtemplate_entry@2@XZ

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 215KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 230KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e4b0d2bf4bf5220417826ef4b4d596a

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4eCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

ab:4b:d7:46:83:ef:43:2f:81:dd:fd:3a:14:89:10:de:1e:38:9f:fb:87:61:f3:9e:1b:53:12:86:30:99:b4:9fSigner

Headers

DLL Characteristics

File Characteristics

Imports

ole32

oleaut32

shell32

user32

msvcp140

concrt140

mscoree

kernel32

advapi32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 4.5MB - Virtual size: 4.5MB

.data Size: 215KB - Virtual size: 1.5MB

.idata Size: 17KB - Virtual size: 16KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 230KB - Virtual size: 229KB

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

ab:4b:d7:46:83:ef:43:2f:81:dd:fd:3a:14:89:10:de:1e:38:9f:fb:87:61:f3:9e:1b:53:12:86:30:99:b4:9f
Signer

.text
Size: 4.5MB - Virtual size: 4.5MB

.data
Size: 215KB - Virtual size: 1.5MB

.idata
Size: 17KB - Virtual size: 16KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 230KB - Virtual size: 229KB