2026-10-01_c6fd4bd8747ecfe6575e3bbb3478b613_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_c6fd4bd8747ecfe6575e3bbb3478b613_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat
Size 3.9MB
Sample261003-xt332avgqe
SHA256 118af437d819df89e5f06dca28c4a67938d84f4160523e4c9234af6696578b2a
MD5 c6fd4bd8747ecfe6575e3bbb3478b613
SHA1 ff4c385a88d259f4507ee03b91cfa5ad807b0229
SHA512 7c6419c336bb8f52f42e1998dd13d48cc9f20a1199fd219173f5a904592a998260b41fd35788a84643510f050eb438d96dc743fd318da7d11ab3d479dd53e03f
SSDEEP 98304:gF5wYakje0mkvFH4tiSfHmh5SpmqI5Noebmlx4:Lka0FvFH4tMT3
TLSH
T15B16AE217606C036E59201B19C7DABAE945CED391B3554CBB3D83F3E59701E32A36B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_c6fd4bd8747ecfe6575e3bbb3478b613_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

File Explorer

2026-10-01_c6fd4bd8747ecfe6575e3bbb3478b613_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

.exe 3.9MB

2026-10-01_c6fd4bd8747ecfe6575e3bbb3478b613_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

IMPHASH 08344e7cf428c4ad834f77f04ab16aa3
SHA256 118af437d819df89e5f06dca28c4a67938d84f4160523e4c9234af6696578b2a
MD5 c6fd4bd8747ecfe6575e3bbb3478b613
SHA1 ff4c385a88d259f4507ee03b91cfa5ad807b0229
SHA512 7c6419c336bb8f52f42e1998dd13d48cc9f20a1199fd219173f5a904592a998260b41fd35788a84643510f050eb438d96dc743fd318da7d11ab3d479dd53e03f
SSDEEP 98304:gF5wYakje0mkvFH4tiSfHmh5SpmqI5Noebmlx4:Lka0FvFH4tMT3
TLSH
T15B16AE217606C036E59201B19C7DABAE945CED391B3554CBB3D83F3E59701E32A36B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2009633

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\apps\jenkins-slave\workspace\yeti-agent_yeti2-proxy\yeti2-proxy-global_devel_global\bin\Release\purpleonp.pdb

ws2_32

__WSAFDIsSet WSAIoctl getsockname connect ioctlsocket freeaddrinfo recv inet_ntoa recvfrom gethostname sendto select ntohs WSACleanup WSASend ntohl shutdown WSASetLastError WSAStringToAddressW WSASocketW WSAStartup getpeername WSAAddressToStringW WSARecv getsockopt htonl htons setsockopt accept bind closesocket listen getaddrinfo send socket WSAGetLastError

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

iphlpapi

GetAdaptersAddresses GetTcpTable2

shlwapi

PathFileExistsW PathFindFileNameA PathCanonicalizeW PathRemoveFileSpecW

nccrashreporter_win32

initializeWithCallback SetAppExtraData

wldap32

ord301 ord147 ord133 ord79 ord142 ord167 ord127 ord27 ord26 ord117 ord41 ord208 ord73 ord46 ord14 ord216 ord219 ord145

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertAddCertificateContextToStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

kernel32

InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore GetVersionExW FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber QueryDepthSList ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue OutputDebugStringW LocalFree MoveFileExW GetCurrentDirectoryW UnregisterWaitEx RtlUnwind SetStdHandle GetConsoleMode ReadConsoleW GetConsoleCP ExitThread GetModuleHandleExW GetDriveTypeW SystemTimeToTzSpecificLocalTime DeleteTimerQueueTimer GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead ResetEvent GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo EncodePointer GetExitCodeThread SwitchToThread GetStringTypeW CreateHardLinkW AreFileApisANSI SetFilePointerEx GetTickCount WaitForSingleObject CloseHandle CreateProcessW CreateDirectoryW FindFirstFileW GetFullPathNameW FindNextFileW RemoveDirectoryW GetTempPathW FindClose GetFileAttributesW SetFileAttributesW DeleteFileW lstrcmpW WriteConsoleW FormatMessageW GetLastError WideCharToMultiByte FreeConsole GetCurrentProcessId GetCommandLineW MoveFileW GetModuleHandleW GetSystemTimeAsFileTime HeapFree InitializeCriticalSectionEx HeapSize HeapReAlloc RaiseException HeapAlloc DecodePointer DeleteCriticalSection GetProcessHeap MultiByteToWideChar FormatMessageA Sleep GetThreadId SetWaitableTimer TlsSetValue SetLastError EnterCriticalSection CreateWaitableTimerW WaitForMultipleObjects InitializeCriticalSectionAndSpinCount LeaveCriticalSection GetQueuedCompletionStatus GetModuleHandleA PostQueuedCompletionStatus CreateEventW SetEvent TerminateThread TlsAlloc QueueUserAPC GetProcAddress VerSetConditionMask SleepEx VerifyVersionInfoW TlsGetValue TlsFree CreateIoCompletionPort GetModuleFileNameA QueryDosDeviceW GetCurrentProcess lstrlenW WriteFile TerminateProcess K32GetModuleFileNameExW SetFilePointer CreateFileW GetCurrentThreadId K32GetProcessImageFileNameW UnmapViewOfFile DuplicateHandle OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW K32EnumProcesses CreateFileMappingA CopyFileW lstrcpyW CreateProcessA MapViewOfFile IsWow64Process GetExitCodeProcess CreateThread GetModuleFileNameW CreateMutexW ReleaseMutex GetCommandLineA GetTickCount64 GetCurrentThread SetCurrentDirectoryW QueryPerformanceCounter QueryPerformanceFrequency GetThreadTimes GetDiskFreeSpaceExW InitializeCriticalSection GetSystemDirectoryW FreeLibrary LoadLibraryW WaitForSingleObjectEx ExpandEnvironmentStringsA GetStdHandle GetFileType ReadFile PeekNamedPipe GetFileSizeEx SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree VirtualQuery LoadLibraryExA LoadLibraryExW SetEndOfFile GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW TryEnterCriticalSection FileTimeToSystemTime ExitProcess SetEnvironmentVariableW FlushFileBuffers GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW AllocConsole CreateRemoteThread

user32

PostQuitMessage GetWindowThreadProcessId TranslateMessage LoadCursorW DispatchMessageW RegisterClassExW CreateWindowExW DefWindowProcW GetMessageW GetWindowLongW PostThreadMessageW PeekMessageW KillTimer FindWindowW SetTimer SendMessageW PostMessageW SetWindowLongW

advapi32

RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey CryptReleaseContext CryptGenRandom CryptAcquireContextW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt RegQueryValueExW

ole32

CoUninitialize CoInitialize

mswsock

AcceptEx GetAcceptExSockaddrs

??0?$DynArray@D$0BE@@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PBD$09@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0CE@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0CE@@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0CM@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0CM@@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0DA@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0DA@@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0DE@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0DE@@tinyxml2@@QAE@XZ ??0MemPool@tinyxml2@@QAE@ABV01@@Z ??0MemPool@tinyxml2@@QAE@XZ ??0StrPair@tinyxml2@@QAE@XZ ??0XMLAttribute@tinyxml2@@AAE@XZ ??0XMLComment@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLConstHandle@tinyxml2@@QAE@ABV01@@Z ??0XMLConstHandle@tinyxml2@@QAE@ABVXMLNode@1@@Z ??0XMLConstHandle@tinyxml2@@QAE@PBVXMLNode@1@@Z ??0XMLDeclaration@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLDocument@tinyxml2@@QAE@_NW4Whitespace@1@@Z ??0XMLElement@tinyxml2@@AAE@PAVXMLDocument@1@@Z ??0XMLHandle@tinyxml2@@QAE@AAVXMLNode@1@@Z ??0XMLHandle@tinyxml2@@QAE@ABV01@@Z ??0XMLHandle@tinyxml2@@QAE@PAVXMLNode@1@@Z ??0XMLNode@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLPrinter@tinyxml2@@QAE@ABV01@@Z ??0XMLPrinter@tinyxml2@@QAE@PAU_iobuf@@_N@Z ??0XMLText@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLUnknown@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLVisitor@tinyxml2@@QAE@ABV01@@Z ??0XMLVisitor@tinyxml2@@QAE@XZ ??1?$DynArray@D$0BE@@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PBD$09@tinyxml2@@QAE@XZ ??1?$MemPoolT@$0CE@@tinyxml2@@UAE@XZ ??1?$MemPoolT@$0CM@@tinyxml2@@UAE@XZ ??1?$MemPoolT@$0DA@@tinyxml2@@UAE@XZ ??1?$MemPoolT@$0DE@@tinyxml2@@UAE@XZ ??1MemPool@tinyxml2@@UAE@XZ ??1StrPair@tinyxml2@@QAE@XZ ??1XMLAttribute@tinyxml2@@EAE@XZ ??1XMLComment@tinyxml2@@MAE@XZ ??1XMLDeclaration@tinyxml2@@MAE@XZ ??1XMLDocument@tinyxml2@@UAE@XZ ??1XMLElement@tinyxml2@@EAE@XZ ??1XMLNode@tinyxml2@@MAE@XZ ??1XMLPrinter@tinyxml2@@UAE@XZ ??1XMLText@tinyxml2@@MAE@XZ ??1XMLUnknown@tinyxml2@@MAE@XZ ??1XMLVisitor@tinyxml2@@UAE@XZ ??4?$DynArray@D$0BE@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PBD$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0CE@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0CM@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0DA@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0DE@@tinyxml2@@QAEAAV01@ABV01@@Z ??4MemPool@tinyxml2@@QAEAAV01@ABV01@@Z ??4StrPair@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLConstHandle@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLHandle@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLPrinter@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLUtil@tinyxml2@@QAEAAV01@$$QAV01@@Z ??4XMLUtil@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLVisitor@tinyxml2@@QAEAAV01@ABV01@@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0CE@@1@H@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0CM@@1@H@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0DA@@1@H@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0DE@@1@H@Z ??_7?$MemPoolT@$0CE@@tinyxml2@@6B@ ??_7?$MemPoolT@$0CM@@tinyxml2@@6B@ ??_7?$MemPoolT@$0DA@@tinyxml2@@6B@ ??_7?$MemPoolT@$0DE@@tinyxml2@@6B@ ??_7MemPool@tinyxml2@@6B@ ??_7XMLAttribute@tinyxml2@@6B@ ??_7XMLComment@tinyxml2@@6B@ ??_7XMLDeclaration@tinyxml2@@6B@ ??_7XMLDocument@tinyxml2@@6B@ ??_7XMLElement@tinyxml2@@6B@ ??_7XMLNode@tinyxml2@@6B@ ??_7XMLPrinter@tinyxml2@@6B@ ??_7XMLText@tinyxml2@@6B@ ??_7XMLUnknown@tinyxml2@@6B@ ??_7XMLVisitor@tinyxml2@@6B@ ??_FXMLDocument@tinyxml2@@QAEXXZ ??_FXMLPrinter@tinyxml2@@QAEXXZ ?Accept@XMLComment@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLDeclaration@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLDocument@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLElement@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLText@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLUnknown@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Alloc@?$MemPoolT@$0CE@@tinyxml2@@UAEPAXXZ ?Alloc@?$MemPoolT@$0CM@@tinyxml2@@UAEPAXXZ ?Alloc@?$MemPoolT@$0DA@@tinyxml2@@UAEPAXXZ ?Alloc@?$MemPoolT@$0DE@@tinyxml2@@UAEPAXXZ ?Attribute@XMLElement@tinyxml2@@QBEPBDPBD0@Z ?BoolAttribute@XMLElement@tinyxml2@@QBE_NPBD@Z ?BoolValue@XMLAttribute@tinyxml2@@QBE_NXZ ?CData@XMLText@tinyxml2@@QBE_NXZ ?CStr@XMLPrinter@tinyxml2@@QBEPBDXZ ?CStrSize@XMLPrinter@tinyxml2@@QBEHXZ ?CloseElement@XMLPrinter@tinyxml2@@QAEXXZ ?ClosingType@XMLElement@tinyxml2@@QBEHXZ ?CollapseWhitespace@StrPair@tinyxml2@@AAEXXZ ?ConvertUTF32ToUTF8@XMLUtil@tinyxml2@@SAXKPADPAH@Z ?DeleteAttribute@XMLElement@tinyxml2@@QAEXPBD@Z ?DeleteChild@XMLNode@tinyxml2@@QAEXPAV12@@Z ?DeleteChildren@XMLNode@tinyxml2@@QAEXXZ ?DeleteNode@XMLDocument@tinyxml2@@QAEXPAVXMLNode@2@@Z ?DoubleAttribute@XMLElement@tinyxml2@@QBENPBD@Z ?DoubleValue@XMLAttribute@tinyxml2@@QBENXZ ?Empty@StrPair@tinyxml2@@QBE_NXZ ?EnsureCapacity@?$DynArray@D$0BE@@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PBD$09@tinyxml2@@AAEXH@Z ?Error@XMLDocument@tinyxml2@@QBE_NXZ ?ErrorID@XMLDocument@tinyxml2@@QBE?AW4XMLError@2@XZ ?FindAttribute@XMLElement@tinyxml2@@AAEPAVXMLAttribute@2@PBD@Z ?FindAttribute@XMLElement@tinyxml2@@QBEPBVXMLAttribute@2@PBD@Z ?FindOrCreateAttribute@XMLElement@tinyxml2@@AAEPAVXMLAttribute@2@PBD@Z ?FirstAttribute@XMLElement@tinyxml2@@QBEPBVXMLAttribute@2@XZ ?FirstChild@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?FirstChild@XMLHandle@tinyxml2@@QAE?AV12@XZ ?FirstChild@XMLNode@tinyxml2@@QAEPAV12@XZ ?FirstChild@XMLNode@tinyxml2@@QBEPBV12@XZ ?FirstChildElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?FirstChildElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?FirstChildElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?FirstChildElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?FloatAttribute@XMLElement@tinyxml2@@QBEMPBD@Z ?FloatValue@XMLAttribute@tinyxml2@@QBEMXZ ?Free@?$MemPoolT@$0CE@@tinyxml2@@UAEXPAX@Z ?Free@?$MemPoolT@$0CM@@tinyxml2@@UAEXPAX@Z ?Free@?$MemPoolT@$0DA@@tinyxml2@@UAEXPAX@Z ?Free@?$MemPoolT@$0DE@@tinyxml2@@UAEXPAX@Z ?GetCharacterRef@XMLUtil@tinyxml2@@SAPBDPBDPADPAH@Z ?GetDocument@XMLNode@tinyxml2@@QAEPAVXMLDocument@2@XZ ?GetDocument@XMLNode@tinyxml2@@QBEPBVXMLDocument@2@XZ ?GetErrorStr1@XMLDocument@tinyxml2@@QBEPBDXZ ?GetErrorStr2@XMLDocument@tinyxml2@@QBEPBDXZ ?GetStr@StrPair@tinyxml2@@QAEPBDXZ ?GetText@XMLElement@tinyxml2@@QBEPBDXZ ?HasBOM@XMLDocument@tinyxml2@@QBE_NXZ ?Identify@XMLDocument@tinyxml2@@QAEPADPADPAPAVXMLNode@2@@Z ?InitDocument@XMLDocument@tinyxml2@@AAEXXZ ?InsertAfterChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@0@Z ?InsertEndChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@@Z ?InsertFirstChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@@Z ?IntAttribute@XMLElement@tinyxml2@@QBEHPBD@Z ?IntValue@XMLAttribute@tinyxml2@@QBEHXZ ?IsAlpha@XMLUtil@tinyxml2@@SAHE@Z ?IsAlphaNum@XMLUtil@tinyxml2@@SAHE@Z ?IsUTF8Continuation@XMLUtil@tinyxml2@@SAHD@Z ?IsWhiteSpace@XMLUtil@tinyxml2@@SA_ND@Z ?ItemSize@?$MemPoolT@$0CE@@tinyxml2@@UBEHXZ ?ItemSize@?$MemPoolT@$0CM@@tinyxml2@@UBEHXZ ?ItemSize@?$MemPoolT@$0DA@@tinyxml2@@UBEHXZ ?ItemSize@?$MemPoolT@$0DE@@tinyxml2@@UBEHXZ ?LastChild@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?LastChild@XMLHandle@tinyxml2@@QAE?AV12@XZ ?LastChild@XMLNode@tinyxml2@@QAEPAV12@XZ ?LastChild@XMLNode@tinyxml2@@QBEPBV12@XZ ?LastChildElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?LastChildElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?LastChildElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?LastChildElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?LinkEndChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@@Z ?LoadFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PAU_iobuf@@@Z ?LoadFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PBD@Z ?Mem@?$DynArray@D$0BE@@tinyxml2@@QBEPBDXZ ?Name@XMLAttribute@tinyxml2@@QBEPBDXZ ?Name@XMLElement@tinyxml2@@QBEPBDXZ ?NewComment@XMLDocument@tinyxml2@@QAEPAVXMLComment@2@PBD@Z ?NewDeclaration@XMLDocument@tinyxml2@@QAEPAVXMLDeclaration@2@PBD@Z ?NewElement@XMLDocument@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?NewText@XMLDocument@tinyxml2@@QAEPAVXMLText@2@PBD@Z ?NewUnknown@XMLDocument@tinyxml2@@QAEPAVXMLUnknown@2@PBD@Z ?Next@XMLAttribute@tinyxml2@@QBEPBV12@XZ ?NextSibling@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?NextSibling@XMLHandle@tinyxml2@@QAE?AV12@XZ ?NextSibling@XMLNode@tinyxml2@@QAEPAV12@XZ ?NextSibling@XMLNode@tinyxml2@@QBEPBV12@XZ ?NextSiblingElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?NextSiblingElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?NextSiblingElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?NextSiblingElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?NoChildren@XMLNode@tinyxml2@@QBE_NXZ ?OpenElement@XMLPrinter@tinyxml2@@QAEXPBD@Z ?Parent@XMLNode@tinyxml2@@QAEPAV12@XZ ?Parent@XMLNode@tinyxml2@@QBEPBV12@XZ ?Parse@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PBDI@Z ?ParseAttributes@XMLElement@tinyxml2@@AAEPADPAD@Z ?ParseDeep@XMLAttribute@tinyxml2@@AAEPADPAD_N@Z ?ParseDeep@XMLComment@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLDeclaration@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLElement@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLNode@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLText@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLUnknown@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseName@StrPair@tinyxml2@@QAEPADPAD@Z ?ParseText@StrPair@tinyxml2@@QAEPADPADPBDH@Z ?Pop@?$DynArray@PBD$09@tinyxml2@@QAEPBDXZ ?PreviousSibling@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?PreviousSibling@XMLHandle@tinyxml2@@QAE?AV12@XZ ?PreviousSibling@XMLNode@tinyxml2@@QAEPAV12@XZ ?PreviousSibling@XMLNode@tinyxml2@@QBEPBV12@XZ ?PreviousSiblingElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?PreviousSiblingElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?PreviousSiblingElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?PreviousSiblingElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?Print@XMLDocument@tinyxml2@@QAEXPAVXMLPrinter@2@@Z ?Print@XMLPrinter@tinyxml2@@AAAXPBDZZ ?PrintError@XMLDocument@tinyxml2@@QBEXXZ ?PrintSpace@XMLPrinter@tinyxml2@@AAEXH@Z ?PrintString@XMLPrinter@tinyxml2@@AAEXPBD_N@Z ?ProcessEntities@XMLDocument@tinyxml2@@QBE_NXZ ?Push@?$DynArray@D$0BE@@tinyxml2@@QAEXD@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0CE@@2@@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0CM@@2@@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0DA@@2@@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0DE@@2@@Z ?Push@?$DynArray@PBD$09@tinyxml2@@QAEXPBD@Z ?PushArr@?$DynArray@D$0BE@@tinyxml2@@QAEPADH@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBD0@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBDH@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBDI@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBDN@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBD_N@Z ?PushComment@XMLPrinter@tinyxml2@@QAEXPBD@Z ?PushDeclaration@XMLPrinter@tinyxml2@@QAEXPBD@Z ?PushHeader@XMLPrinter@tinyxml2@@QAEX_N0@Z ?PushText@XMLPrinter@tinyxml2@@QAEXH@Z ?PushText@XMLPrinter@tinyxml2@@QAEXI@Z ?PushText@XMLPrinter@tinyxml2@@QAEXM@Z ?PushText@XMLPrinter@tinyxml2@@QAEXN@Z ?PushText@XMLPrinter@tinyxml2@@QAEXPBD_N@Z ?PushText@XMLPrinter@tinyxml2@@QAEX_N@Z ?PushUnknown@XMLPrinter@tinyxml2@@QAEXPBD@Z ?QueryBoolAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPA_N@Z ?QueryBoolText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PA_N@Z ?QueryBoolValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PA_N@Z ?QueryDoubleAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAN@Z ?QueryDoubleText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAN@Z ?QueryDoubleValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAN@Z ?QueryFloatAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAM@Z ?QueryFloatText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAM@Z ?QueryFloatValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAM@Z ?QueryIntAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAH@Z ?QueryIntText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAH@Z ?QueryIntValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAH@Z ?QueryUnsignedAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAI@Z ?QueryUnsignedText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAI@Z ?QueryUnsignedValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAI@Z ?ReadBOM@XMLUtil@tinyxml2@@SAPBDPBDPA_N@Z ?Reset@StrPair@tinyxml2@@AAEXXZ ?RootElement@XMLDocument@tinyxml2@@QAEPAVXMLElement@2@XZ ?RootElement@XMLDocument@tinyxml2@@QBEPBVXMLElement@2@XZ ?SaveFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PAU_iobuf@@_N@Z ?SaveFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PBD_N@Z ?SealElement@XMLPrinter@tinyxml2@@AAEXXZ ?Set@StrPair@tinyxml2@@QAEXPAD0H@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXH@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXI@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXM@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXN@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXPBD@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEX_N@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBD0@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBDH@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBDI@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBDN@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBD_N@Z ?SetBOM@XMLDocument@tinyxml2@@QAEX_N@Z ?SetCData@XMLText@tinyxml2@@QAEX_N@Z ?SetError@XMLDocument@tinyxml2@@QAEXW4XMLError@2@PBD1@Z ?SetInternedStr@StrPair@tinyxml2@@QAEXPBD@Z ?SetName@XMLAttribute@tinyxml2@@AAEXPBD@Z ?SetName@XMLElement@tinyxml2@@QAEXPBD_N@Z ?SetStr@StrPair@tinyxml2@@QAEXPBDH@Z ?SetTracked@?$MemPoolT@$0CE@@tinyxml2@@UAEXXZ ?SetTracked@?$MemPoolT@$0CM@@tinyxml2@@UAEXXZ ?SetTracked@?$MemPoolT@$0DA@@tinyxml2@@UAEXXZ ?SetTracked@?$MemPoolT@$0DE@@tinyxml2@@UAEXXZ ?SetValue@XMLNode@tinyxml2@@QAEXPBD_N@Z ?ShallowClone@XMLComment@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLDeclaration@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLDocument@tinyxml2@@UBEPAVXMLNode@2@PAV12@@Z ?ShallowClone@XMLElement@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLText@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLUnknown@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowEqual@XMLComment@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLDeclaration@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLDocument@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLElement@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLText@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLUnknown@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?Size@?$DynArray@D$0BE@@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?SkipWhiteSpace@XMLUtil@tinyxml2@@SAPADPAD@Z ?SkipWhiteSpace@XMLUtil@tinyxml2@@SAPBDPBD@Z ?StringEqual@XMLUtil@tinyxml2@@SA_NPBD0H@Z ?ToBool@XMLUtil@tinyxml2@@SA_NPBDPA_N@Z ?ToComment@XMLComment@tinyxml2@@UAEPAV12@XZ ?ToComment@XMLComment@tinyxml2@@UBEPBV12@XZ ?ToComment@XMLNode@tinyxml2@@UAEPAVXMLComment@2@XZ ?ToComment@XMLNode@tinyxml2@@UBEPBVXMLComment@2@XZ ?ToDeclaration@XMLConstHandle@tinyxml2@@QBEPBVXMLDeclaration@2@XZ ?ToDeclaration@XMLDeclaration@tinyxml2@@UAEPAV12@XZ ?ToDeclaration@XMLDeclaration@tinyxml2@@UBEPBV12@XZ ?ToDeclaration@XMLHandle@tinyxml2@@QAEPAVXMLDeclaration@2@XZ ?ToDeclaration@XMLNode@tinyxml2@@UAEPAVXMLDeclaration@2@XZ ?ToDeclaration@XMLNode@tinyxml2@@UBEPBVXMLDeclaration@2@XZ ?ToDocument@XMLDocument@tinyxml2@@UAEPAV12@XZ ?ToDocument@XMLDocument@tinyxml2@@UBEPBV12@XZ ?ToDocument@XMLNode@tinyxml2@@UAEPAVXMLDocument@2@XZ ?ToDocument@XMLNode@tinyxml2@@UBEPBVXMLDocument@2@XZ ?ToDouble@XMLUtil@tinyxml2@@SA_NPBDPAN@Z ?ToElement@XMLConstHandle@tinyxml2@@QBEPBVXMLElement@2@XZ ?ToElement@XMLElement@tinyxml2@@UAEPAV12@XZ ?ToElement@XMLElement@tinyxml2@@UBEPBV12@XZ ?ToElement@XMLHandle@tinyxml2@@QAEPAVXMLElement@2@XZ ?ToElement@XMLNode@tinyxml2@@UAEPAVXMLElement@2@XZ ?ToElement@XMLNode@tinyxml2@@UBEPBVXMLElement@2@XZ ?ToFloat@XMLUtil@tinyxml2@@SA_NPBDPAM@Z ?ToInt@XMLUtil@tinyxml2@@SA_NPBDPAH@Z ?ToNode@XMLConstHandle@tinyxml2@@QBEPBVXMLNode@2@XZ ?ToNode@XMLHandle@tinyxml2@@QAEPAVXMLNode@2@XZ ?ToStr@XMLUtil@tinyxml2@@SAXHPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAXIPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAXMPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAXNPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAX_NPADH@Z ?ToText@XMLConstHandle@tinyxml2@@QBEPBVXMLText@2@XZ ?ToText@XMLHandle@tinyxml2@@QAEPAVXMLText@2@XZ ?ToText@XMLNode@tinyxml2@@UAEPAVXMLText@2@XZ ?ToText@XMLNode@tinyxml2@@UBEPBVXMLText@2@XZ ?ToText@XMLText@tinyxml2@@UAEPAV12@XZ ?ToText@XMLText@tinyxml2@@UBEPBV12@XZ ?ToUnknown@XMLConstHandle@tinyxml2@@QBEPBVXMLUnknown@2@XZ ?ToUnknown@XMLHandle@tinyxml2@@QAEPAVXMLUnknown@2@XZ ?ToUnknown@XMLNode@tinyxml2@@UAEPAVXMLUnknown@2@XZ ?ToUnknown@XMLNode@tinyxml2@@UBEPBVXMLUnknown@2@XZ ?ToUnknown@XMLUnknown@tinyxml2@@UAEPAV12@XZ ?ToUnknown@XMLUnknown@tinyxml2@@UBEPBV12@XZ ?ToUnsigned@XMLUtil@tinyxml2@@SA_NPBDPAI@Z ?Unlink@XMLNode@tinyxml2@@AAEXPAV12@@Z ?UnsignedAttribute@XMLElement@tinyxml2@@QBEIPBD@Z ?UnsignedValue@XMLAttribute@tinyxml2@@QBEIXZ ?Value@XMLAttribute@tinyxml2@@QBEPBDXZ ?Value@XMLNode@tinyxml2@@QBEPBDXZ ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLComment@2@@Z ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLDeclaration@2@@Z ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLText@2@@Z ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLUnknown@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLComment@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLDeclaration@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLText@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLUnknown@2@@Z ?VisitEnter@XMLPrinter@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitEnter@XMLPrinter@tinyxml2@@UAE_NABVXMLElement@2@PBVXMLAttribute@2@@Z ?VisitEnter@XMLVisitor@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitEnter@XMLVisitor@tinyxml2@@UAE_NABVXMLElement@2@PBVXMLAttribute@2@@Z ?VisitExit@XMLPrinter@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitExit@XMLPrinter@tinyxml2@@UAE_NABVXMLElement@2@@Z ?VisitExit@XMLVisitor@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitExit@XMLVisitor@tinyxml2@@UAE_NABVXMLElement@2@@Z ?WhitespaceMode@XMLDocument@tinyxml2@@QBE?AW4Whitespace@2@XZ

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

465KB

Virtual Size

464KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

61KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

154KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

880KB

Virtual Size

884KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=26, id=259, version=25711,

count=216, id=261, version=25711,

count=6, id=261, productName=VS2017 v15.7.4 build 26431, version=26431,

count=6, id=199, version=41118,

count=26, id=259, version=26706,

count=137, id=261, version=26706,

count=38, id=260, version=26706,

count=28, id=260, version=25711,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=104, id=260, version=27034,

count=2, id=257, version=27044,

count=3, productName=Unmarked objects (old),

count=72, id=261, version=27031,

count=25, id=257, version=25711,

count=359, id=1, productName=Unmarked objects,

count=83, id=265, version=27027,

count=1, id=256, productName=VS2017 v15.9.7 build 27027, version=27027,

count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,

count=1, id=151,

count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,