2026-10-26_e1bd4d530e2135b0c7e0a0228c0ce531_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_e1bd4d530e2135b0c7e0a0228c0ce531_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat
Size 3.9MB
Sample261027-e7wxrsys8n
SHA256 3e35e49a0cdcb2fad0f60a6c93a360b36b895dd03e553386588f49a3cd792c0f
MD5 e1bd4d530e2135b0c7e0a0228c0ce531
SHA1 6a2a63633c34c5a17dbf8b57503fcdd9a148a7aa
SHA512 22c1f93dfdb17de36450a56d8f5ddbc8bb10ac02643105491ce3358dba47d51c10c4dd6f97b06f6f9c963fc211f8dbca07175448493c9aab88c3be878c45516b
SSDEEP 98304:Qn+pJq2myHluY4/Fn5tYCcMfeJlCCYx5qI5Noebmlx4:za2m4lur/Fn5tQIT3
TLSH
T13916AE217506C036E59201B19C6CAFBE849CAD351B7555C7B3D83F7E69B01E32B32A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_e1bd4d530e2135b0c7e0a0228c0ce531_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

File Explorer

2026-10-26_e1bd4d530e2135b0c7e0a0228c0ce531_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

.exe 3.9MB

2026-10-26_e1bd4d530e2135b0c7e0a0228c0ce531_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

IMPHASH eb9916fde6b8c6a525ac67eda243585e
SHA256 3e35e49a0cdcb2fad0f60a6c93a360b36b895dd03e553386588f49a3cd792c0f
MD5 e1bd4d530e2135b0c7e0a0228c0ce531
SHA1 6a2a63633c34c5a17dbf8b57503fcdd9a148a7aa
SHA512 22c1f93dfdb17de36450a56d8f5ddbc8bb10ac02643105491ce3358dba47d51c10c4dd6f97b06f6f9c963fc211f8dbca07175448493c9aab88c3be878c45516b
SSDEEP 98304:Qn+pJq2myHluY4/Fn5tYCcMfeJlCCYx5qI5Noebmlx4:za2m4lur/Fn5tQIT3
TLSH
T13916AE217506C036E59201B19C6CAFBE849CAD351B7555C7B3D83F7E69B01E32B32A2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2019507

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\apps\jenkins-slave\workspace\yeti-agent_yeti2-proxy\yeti2-proxy-global_devel_global\bin\Release\purpleonp.pdb

ws2_32

__WSAFDIsSet WSAIoctl getsockname connect ioctlsocket freeaddrinfo recv inet_ntoa recvfrom gethostname sendto select ntohs WSACleanup WSASend ntohl shutdown WSASetLastError WSAStringToAddressW WSASocketW WSAStartup getpeername WSAAddressToStringW WSARecv getsockopt htonl htons setsockopt accept bind closesocket listen getaddrinfo send socket WSAGetLastError

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

iphlpapi

GetAdaptersAddresses GetTcpTable2

shlwapi

PathFindFileNameA PathFileExistsW PathCanonicalizeW PathRemoveFileSpecW

nccrashreporter_win32

SetAppExtraData initializeWithCallback

wldap32

ord301 ord147 ord133 ord79 ord142 ord167 ord127 ord27 ord26 ord117 ord41 ord208 ord73 ord46 ord14 ord216 ord219 ord145

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertAddCertificateContextToStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

libeay32

ord1882 ord2925 ord4144 ord66 ord281 ord279 ord4372 ord2712 ord269 ord3315 ord400 ord283

kernel32

InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore GetVersionExW FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber QueryDepthSList ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue OutputDebugStringW LocalFree MoveFileExW GetCurrentDirectoryW UnregisterWaitEx RtlUnwind SetStdHandle GetConsoleMode ReadConsoleW GetConsoleCP ExitThread GetModuleHandleExW GetDriveTypeW SystemTimeToTzSpecificLocalTime DeleteTimerQueueTimer GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead ResetEvent GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo EncodePointer GetExitCodeThread SwitchToThread GetStringTypeW CreateHardLinkW AreFileApisANSI SetFilePointerEx SetEndOfFile GetFileInformationByHandle GetTickCount WaitForSingleObject CloseHandle CreateProcessW CreateDirectoryW FindFirstFileW GetFullPathNameW FindNextFileW RemoveDirectoryW GetTempPathW FindClose GetFileAttributesW SetFileAttributesW DeleteFileW lstrcmpW WriteConsoleW FormatMessageW GetLastError WideCharToMultiByte GetCommandLineW GetCurrentProcessId AllocConsole MoveFileW GetModuleHandleW GetSystemTimeAsFileTime HeapFree InitializeCriticalSectionEx HeapSize HeapReAlloc RaiseException HeapAlloc DecodePointer DeleteCriticalSection GetProcessHeap MultiByteToWideChar FormatMessageA Sleep GetThreadId SetWaitableTimer TlsSetValue SetLastError EnterCriticalSection CreateWaitableTimerW WaitForMultipleObjects InitializeCriticalSectionAndSpinCount LeaveCriticalSection GetQueuedCompletionStatus GetModuleHandleA PostQueuedCompletionStatus CreateEventW SetEvent TerminateThread TlsAlloc QueueUserAPC GetProcAddress VerSetConditionMask SleepEx VerifyVersionInfoW TlsGetValue TlsFree CreateIoCompletionPort GetModuleFileNameA QueryDosDeviceW GetCurrentProcess lstrlenW WriteFile TerminateProcess K32GetModuleFileNameExW SetFilePointer CreateFileW GetCurrentThreadId K32GetProcessImageFileNameW UnmapViewOfFile DuplicateHandle OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW K32EnumProcesses CreateFileMappingA CopyFileW CreateRemoteThread CreateProcessA MapViewOfFile IsWow64Process GetExitCodeProcess CreateThread GetModuleFileNameW CreateMutexW ReleaseMutex GetCommandLineA GetTickCount64 GetCurrentThread SetCurrentDirectoryW QueryPerformanceCounter QueryPerformanceFrequency GetThreadTimes GetDiskFreeSpaceExW InitializeCriticalSection GetSystemDirectoryW FreeLibrary LoadLibraryW WaitForSingleObjectEx ExpandEnvironmentStringsA GetStdHandle GetFileType ReadFile PeekNamedPipe GetFileSizeEx SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree VirtualQuery LoadLibraryExA LoadLibraryExW GetFileAttributesExW FindFirstFileExW TryEnterCriticalSection FileTimeToSystemTime ExitProcess SetEnvironmentVariableW FlushFileBuffers GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW FreeConsole lstrcpyW

user32

PostQuitMessage SetWindowLongW LoadCursorW TranslateMessage DispatchMessageW RegisterClassExW GetWindowThreadProcessId DefWindowProcW GetMessageW GetWindowLongW PostThreadMessageW PeekMessageW KillTimer FindWindowW SetTimer SendMessageW PostMessageW CreateWindowExW

advapi32

RegQueryValueExW RegSetValueExW RegCreateKeyExW RegCloseKey CryptReleaseContext CryptGenRandom CryptAcquireContextW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt RegOpenKeyExW

ole32

CoUninitialize CoInitialize

mswsock

GetAcceptExSockaddrs AcceptEx

??0?$DynArray@D$0BE@@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PBD$09@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0CE@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0CE@@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0CM@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0CM@@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0DA@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0DA@@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0DE@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0DE@@tinyxml2@@QAE@XZ ??0MemPool@tinyxml2@@QAE@ABV01@@Z ??0MemPool@tinyxml2@@QAE@XZ ??0StrPair@tinyxml2@@QAE@XZ ??0XMLAttribute@tinyxml2@@AAE@XZ ??0XMLComment@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLConstHandle@tinyxml2@@QAE@ABV01@@Z ??0XMLConstHandle@tinyxml2@@QAE@ABVXMLNode@1@@Z ??0XMLConstHandle@tinyxml2@@QAE@PBVXMLNode@1@@Z ??0XMLDeclaration@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLDocument@tinyxml2@@QAE@_NW4Whitespace@1@@Z ??0XMLElement@tinyxml2@@AAE@PAVXMLDocument@1@@Z ??0XMLHandle@tinyxml2@@QAE@AAVXMLNode@1@@Z ??0XMLHandle@tinyxml2@@QAE@ABV01@@Z ??0XMLHandle@tinyxml2@@QAE@PAVXMLNode@1@@Z ??0XMLNode@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLPrinter@tinyxml2@@QAE@ABV01@@Z ??0XMLPrinter@tinyxml2@@QAE@PAU_iobuf@@_N@Z ??0XMLText@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLUnknown@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLVisitor@tinyxml2@@QAE@ABV01@@Z ??0XMLVisitor@tinyxml2@@QAE@XZ ??1?$DynArray@D$0BE@@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PBD$09@tinyxml2@@QAE@XZ ??1?$MemPoolT@$0CE@@tinyxml2@@UAE@XZ ??1?$MemPoolT@$0CM@@tinyxml2@@UAE@XZ ??1?$MemPoolT@$0DA@@tinyxml2@@UAE@XZ ??1?$MemPoolT@$0DE@@tinyxml2@@UAE@XZ ??1MemPool@tinyxml2@@UAE@XZ ??1StrPair@tinyxml2@@QAE@XZ ??1XMLAttribute@tinyxml2@@EAE@XZ ??1XMLComment@tinyxml2@@MAE@XZ ??1XMLDeclaration@tinyxml2@@MAE@XZ ??1XMLDocument@tinyxml2@@UAE@XZ ??1XMLElement@tinyxml2@@EAE@XZ ??1XMLNode@tinyxml2@@MAE@XZ ??1XMLPrinter@tinyxml2@@UAE@XZ ??1XMLText@tinyxml2@@MAE@XZ ??1XMLUnknown@tinyxml2@@MAE@XZ ??1XMLVisitor@tinyxml2@@UAE@XZ ??4?$DynArray@D$0BE@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PBD$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0CE@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0CM@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0DA@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0DE@@tinyxml2@@QAEAAV01@ABV01@@Z ??4MemPool@tinyxml2@@QAEAAV01@ABV01@@Z ??4StrPair@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLConstHandle@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLHandle@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLPrinter@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLUtil@tinyxml2@@QAEAAV01@$$QAV01@@Z ??4XMLUtil@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLVisitor@tinyxml2@@QAEAAV01@ABV01@@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0CE@@1@H@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0CM@@1@H@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0DA@@1@H@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0DE@@1@H@Z ??_7?$MemPoolT@$0CE@@tinyxml2@@6B@ ??_7?$MemPoolT@$0CM@@tinyxml2@@6B@ ??_7?$MemPoolT@$0DA@@tinyxml2@@6B@ ??_7?$MemPoolT@$0DE@@tinyxml2@@6B@ ??_7MemPool@tinyxml2@@6B@ ??_7XMLAttribute@tinyxml2@@6B@ ??_7XMLComment@tinyxml2@@6B@ ??_7XMLDeclaration@tinyxml2@@6B@ ??_7XMLDocument@tinyxml2@@6B@ ??_7XMLElement@tinyxml2@@6B@ ??_7XMLNode@tinyxml2@@6B@ ??_7XMLPrinter@tinyxml2@@6B@ ??_7XMLText@tinyxml2@@6B@ ??_7XMLUnknown@tinyxml2@@6B@ ??_7XMLVisitor@tinyxml2@@6B@ ??_FXMLDocument@tinyxml2@@QAEXXZ ??_FXMLPrinter@tinyxml2@@QAEXXZ ?Accept@XMLComment@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLDeclaration@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLDocument@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLElement@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLText@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLUnknown@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Alloc@?$MemPoolT@$0CE@@tinyxml2@@UAEPAXXZ ?Alloc@?$MemPoolT@$0CM@@tinyxml2@@UAEPAXXZ ?Alloc@?$MemPoolT@$0DA@@tinyxml2@@UAEPAXXZ ?Alloc@?$MemPoolT@$0DE@@tinyxml2@@UAEPAXXZ ?Attribute@XMLElement@tinyxml2@@QBEPBDPBD0@Z ?BoolAttribute@XMLElement@tinyxml2@@QBE_NPBD@Z ?BoolValue@XMLAttribute@tinyxml2@@QBE_NXZ ?CData@XMLText@tinyxml2@@QBE_NXZ ?CStr@XMLPrinter@tinyxml2@@QBEPBDXZ ?CStrSize@XMLPrinter@tinyxml2@@QBEHXZ ?CloseElement@XMLPrinter@tinyxml2@@QAEXXZ ?ClosingType@XMLElement@tinyxml2@@QBEHXZ ?CollapseWhitespace@StrPair@tinyxml2@@AAEXXZ ?ConvertUTF32ToUTF8@XMLUtil@tinyxml2@@SAXKPADPAH@Z ?DeleteAttribute@XMLElement@tinyxml2@@QAEXPBD@Z ?DeleteChild@XMLNode@tinyxml2@@QAEXPAV12@@Z ?DeleteChildren@XMLNode@tinyxml2@@QAEXXZ ?DeleteNode@XMLDocument@tinyxml2@@QAEXPAVXMLNode@2@@Z ?DoubleAttribute@XMLElement@tinyxml2@@QBENPBD@Z ?DoubleValue@XMLAttribute@tinyxml2@@QBENXZ ?Empty@StrPair@tinyxml2@@QBE_NXZ ?EnsureCapacity@?$DynArray@D$0BE@@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PBD$09@tinyxml2@@AAEXH@Z ?Error@XMLDocument@tinyxml2@@QBE_NXZ ?ErrorID@XMLDocument@tinyxml2@@QBE?AW4XMLError@2@XZ ?FindAttribute@XMLElement@tinyxml2@@AAEPAVXMLAttribute@2@PBD@Z ?FindAttribute@XMLElement@tinyxml2@@QBEPBVXMLAttribute@2@PBD@Z ?FindOrCreateAttribute@XMLElement@tinyxml2@@AAEPAVXMLAttribute@2@PBD@Z ?FirstAttribute@XMLElement@tinyxml2@@QBEPBVXMLAttribute@2@XZ ?FirstChild@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?FirstChild@XMLHandle@tinyxml2@@QAE?AV12@XZ ?FirstChild@XMLNode@tinyxml2@@QAEPAV12@XZ ?FirstChild@XMLNode@tinyxml2@@QBEPBV12@XZ ?FirstChildElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?FirstChildElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?FirstChildElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?FirstChildElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?FloatAttribute@XMLElement@tinyxml2@@QBEMPBD@Z ?FloatValue@XMLAttribute@tinyxml2@@QBEMXZ ?Free@?$MemPoolT@$0CE@@tinyxml2@@UAEXPAX@Z ?Free@?$MemPoolT@$0CM@@tinyxml2@@UAEXPAX@Z ?Free@?$MemPoolT@$0DA@@tinyxml2@@UAEXPAX@Z ?Free@?$MemPoolT@$0DE@@tinyxml2@@UAEXPAX@Z ?GetCharacterRef@XMLUtil@tinyxml2@@SAPBDPBDPADPAH@Z ?GetDocument@XMLNode@tinyxml2@@QAEPAVXMLDocument@2@XZ ?GetDocument@XMLNode@tinyxml2@@QBEPBVXMLDocument@2@XZ ?GetErrorStr1@XMLDocument@tinyxml2@@QBEPBDXZ ?GetErrorStr2@XMLDocument@tinyxml2@@QBEPBDXZ ?GetStr@StrPair@tinyxml2@@QAEPBDXZ ?GetText@XMLElement@tinyxml2@@QBEPBDXZ ?HasBOM@XMLDocument@tinyxml2@@QBE_NXZ ?Identify@XMLDocument@tinyxml2@@QAEPADPADPAPAVXMLNode@2@@Z ?InitDocument@XMLDocument@tinyxml2@@AAEXXZ ?InsertAfterChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@0@Z ?InsertEndChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@@Z ?InsertFirstChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@@Z ?IntAttribute@XMLElement@tinyxml2@@QBEHPBD@Z ?IntValue@XMLAttribute@tinyxml2@@QBEHXZ ?IsAlpha@XMLUtil@tinyxml2@@SAHE@Z ?IsAlphaNum@XMLUtil@tinyxml2@@SAHE@Z ?IsUTF8Continuation@XMLUtil@tinyxml2@@SAHD@Z ?IsWhiteSpace@XMLUtil@tinyxml2@@SA_ND@Z ?ItemSize@?$MemPoolT@$0CE@@tinyxml2@@UBEHXZ ?ItemSize@?$MemPoolT@$0CM@@tinyxml2@@UBEHXZ ?ItemSize@?$MemPoolT@$0DA@@tinyxml2@@UBEHXZ ?ItemSize@?$MemPoolT@$0DE@@tinyxml2@@UBEHXZ ?LastChild@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?LastChild@XMLHandle@tinyxml2@@QAE?AV12@XZ ?LastChild@XMLNode@tinyxml2@@QAEPAV12@XZ ?LastChild@XMLNode@tinyxml2@@QBEPBV12@XZ ?LastChildElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?LastChildElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?LastChildElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?LastChildElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?LinkEndChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@@Z ?LoadFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PAU_iobuf@@@Z ?LoadFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PBD@Z ?Mem@?$DynArray@D$0BE@@tinyxml2@@QBEPBDXZ ?Name@XMLAttribute@tinyxml2@@QBEPBDXZ ?Name@XMLElement@tinyxml2@@QBEPBDXZ ?NewComment@XMLDocument@tinyxml2@@QAEPAVXMLComment@2@PBD@Z ?NewDeclaration@XMLDocument@tinyxml2@@QAEPAVXMLDeclaration@2@PBD@Z ?NewElement@XMLDocument@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?NewText@XMLDocument@tinyxml2@@QAEPAVXMLText@2@PBD@Z ?NewUnknown@XMLDocument@tinyxml2@@QAEPAVXMLUnknown@2@PBD@Z ?Next@XMLAttribute@tinyxml2@@QBEPBV12@XZ ?NextSibling@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?NextSibling@XMLHandle@tinyxml2@@QAE?AV12@XZ ?NextSibling@XMLNode@tinyxml2@@QAEPAV12@XZ ?NextSibling@XMLNode@tinyxml2@@QBEPBV12@XZ ?NextSiblingElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?NextSiblingElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?NextSiblingElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?NextSiblingElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?NoChildren@XMLNode@tinyxml2@@QBE_NXZ ?OpenElement@XMLPrinter@tinyxml2@@QAEXPBD@Z ?Parent@XMLNode@tinyxml2@@QAEPAV12@XZ ?Parent@XMLNode@tinyxml2@@QBEPBV12@XZ ?Parse@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PBDI@Z ?ParseAttributes@XMLElement@tinyxml2@@AAEPADPAD@Z ?ParseDeep@XMLAttribute@tinyxml2@@AAEPADPAD_N@Z ?ParseDeep@XMLComment@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLDeclaration@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLElement@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLNode@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLText@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLUnknown@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseName@StrPair@tinyxml2@@QAEPADPAD@Z ?ParseText@StrPair@tinyxml2@@QAEPADPADPBDH@Z ?Pop@?$DynArray@PBD$09@tinyxml2@@QAEPBDXZ ?PreviousSibling@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?PreviousSibling@XMLHandle@tinyxml2@@QAE?AV12@XZ ?PreviousSibling@XMLNode@tinyxml2@@QAEPAV12@XZ ?PreviousSibling@XMLNode@tinyxml2@@QBEPBV12@XZ ?PreviousSiblingElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?PreviousSiblingElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?PreviousSiblingElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?PreviousSiblingElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?Print@XMLDocument@tinyxml2@@QAEXPAVXMLPrinter@2@@Z ?Print@XMLPrinter@tinyxml2@@AAAXPBDZZ ?PrintError@XMLDocument@tinyxml2@@QBEXXZ ?PrintSpace@XMLPrinter@tinyxml2@@AAEXH@Z ?PrintString@XMLPrinter@tinyxml2@@AAEXPBD_N@Z ?ProcessEntities@XMLDocument@tinyxml2@@QBE_NXZ ?Push@?$DynArray@D$0BE@@tinyxml2@@QAEXD@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0CE@@2@@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0CM@@2@@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0DA@@2@@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0DE@@2@@Z ?Push@?$DynArray@PBD$09@tinyxml2@@QAEXPBD@Z ?PushArr@?$DynArray@D$0BE@@tinyxml2@@QAEPADH@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBD0@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBDH@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBDI@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBDN@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBD_N@Z ?PushComment@XMLPrinter@tinyxml2@@QAEXPBD@Z ?PushDeclaration@XMLPrinter@tinyxml2@@QAEXPBD@Z ?PushHeader@XMLPrinter@tinyxml2@@QAEX_N0@Z ?PushText@XMLPrinter@tinyxml2@@QAEXH@Z ?PushText@XMLPrinter@tinyxml2@@QAEXI@Z ?PushText@XMLPrinter@tinyxml2@@QAEXM@Z ?PushText@XMLPrinter@tinyxml2@@QAEXN@Z ?PushText@XMLPrinter@tinyxml2@@QAEXPBD_N@Z ?PushText@XMLPrinter@tinyxml2@@QAEX_N@Z ?PushUnknown@XMLPrinter@tinyxml2@@QAEXPBD@Z ?QueryBoolAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPA_N@Z ?QueryBoolText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PA_N@Z ?QueryBoolValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PA_N@Z ?QueryDoubleAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAN@Z ?QueryDoubleText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAN@Z ?QueryDoubleValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAN@Z ?QueryFloatAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAM@Z ?QueryFloatText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAM@Z ?QueryFloatValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAM@Z ?QueryIntAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAH@Z ?QueryIntText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAH@Z ?QueryIntValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAH@Z ?QueryUnsignedAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAI@Z ?QueryUnsignedText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAI@Z ?QueryUnsignedValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAI@Z ?ReadBOM@XMLUtil@tinyxml2@@SAPBDPBDPA_N@Z ?Reset@StrPair@tinyxml2@@AAEXXZ ?RootElement@XMLDocument@tinyxml2@@QAEPAVXMLElement@2@XZ ?RootElement@XMLDocument@tinyxml2@@QBEPBVXMLElement@2@XZ ?SaveFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PAU_iobuf@@_N@Z ?SaveFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PBD_N@Z ?SealElement@XMLPrinter@tinyxml2@@AAEXXZ ?Set@StrPair@tinyxml2@@QAEXPAD0H@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXH@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXI@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXM@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXN@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXPBD@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEX_N@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBD0@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBDH@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBDI@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBDN@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBD_N@Z ?SetBOM@XMLDocument@tinyxml2@@QAEX_N@Z ?SetCData@XMLText@tinyxml2@@QAEX_N@Z ?SetError@XMLDocument@tinyxml2@@QAEXW4XMLError@2@PBD1@Z ?SetInternedStr@StrPair@tinyxml2@@QAEXPBD@Z ?SetName@XMLAttribute@tinyxml2@@AAEXPBD@Z ?SetName@XMLElement@tinyxml2@@QAEXPBD_N@Z ?SetStr@StrPair@tinyxml2@@QAEXPBDH@Z ?SetTracked@?$MemPoolT@$0CE@@tinyxml2@@UAEXXZ ?SetTracked@?$MemPoolT@$0CM@@tinyxml2@@UAEXXZ ?SetTracked@?$MemPoolT@$0DA@@tinyxml2@@UAEXXZ ?SetTracked@?$MemPoolT@$0DE@@tinyxml2@@UAEXXZ ?SetValue@XMLNode@tinyxml2@@QAEXPBD_N@Z ?ShallowClone@XMLComment@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLDeclaration@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLDocument@tinyxml2@@UBEPAVXMLNode@2@PAV12@@Z ?ShallowClone@XMLElement@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLText@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLUnknown@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowEqual@XMLComment@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLDeclaration@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLDocument@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLElement@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLText@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLUnknown@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?Size@?$DynArray@D$0BE@@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?SkipWhiteSpace@XMLUtil@tinyxml2@@SAPADPAD@Z ?SkipWhiteSpace@XMLUtil@tinyxml2@@SAPBDPBD@Z ?StringEqual@XMLUtil@tinyxml2@@SA_NPBD0H@Z ?ToBool@XMLUtil@tinyxml2@@SA_NPBDPA_N@Z ?ToComment@XMLComment@tinyxml2@@UAEPAV12@XZ ?ToComment@XMLComment@tinyxml2@@UBEPBV12@XZ ?ToComment@XMLNode@tinyxml2@@UAEPAVXMLComment@2@XZ ?ToComment@XMLNode@tinyxml2@@UBEPBVXMLComment@2@XZ ?ToDeclaration@XMLConstHandle@tinyxml2@@QBEPBVXMLDeclaration@2@XZ ?ToDeclaration@XMLDeclaration@tinyxml2@@UAEPAV12@XZ ?ToDeclaration@XMLDeclaration@tinyxml2@@UBEPBV12@XZ ?ToDeclaration@XMLHandle@tinyxml2@@QAEPAVXMLDeclaration@2@XZ ?ToDeclaration@XMLNode@tinyxml2@@UAEPAVXMLDeclaration@2@XZ ?ToDeclaration@XMLNode@tinyxml2@@UBEPBVXMLDeclaration@2@XZ ?ToDocument@XMLDocument@tinyxml2@@UAEPAV12@XZ ?ToDocument@XMLDocument@tinyxml2@@UBEPBV12@XZ ?ToDocument@XMLNode@tinyxml2@@UAEPAVXMLDocument@2@XZ ?ToDocument@XMLNode@tinyxml2@@UBEPBVXMLDocument@2@XZ ?ToDouble@XMLUtil@tinyxml2@@SA_NPBDPAN@Z ?ToElement@XMLConstHandle@tinyxml2@@QBEPBVXMLElement@2@XZ ?ToElement@XMLElement@tinyxml2@@UAEPAV12@XZ ?ToElement@XMLElement@tinyxml2@@UBEPBV12@XZ ?ToElement@XMLHandle@tinyxml2@@QAEPAVXMLElement@2@XZ ?ToElement@XMLNode@tinyxml2@@UAEPAVXMLElement@2@XZ ?ToElement@XMLNode@tinyxml2@@UBEPBVXMLElement@2@XZ ?ToFloat@XMLUtil@tinyxml2@@SA_NPBDPAM@Z ?ToInt@XMLUtil@tinyxml2@@SA_NPBDPAH@Z ?ToNode@XMLConstHandle@tinyxml2@@QBEPBVXMLNode@2@XZ ?ToNode@XMLHandle@tinyxml2@@QAEPAVXMLNode@2@XZ ?ToStr@XMLUtil@tinyxml2@@SAXHPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAXIPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAXMPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAXNPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAX_NPADH@Z ?ToText@XMLConstHandle@tinyxml2@@QBEPBVXMLText@2@XZ ?ToText@XMLHandle@tinyxml2@@QAEPAVXMLText@2@XZ ?ToText@XMLNode@tinyxml2@@UAEPAVXMLText@2@XZ ?ToText@XMLNode@tinyxml2@@UBEPBVXMLText@2@XZ ?ToText@XMLText@tinyxml2@@UAEPAV12@XZ ?ToText@XMLText@tinyxml2@@UBEPBV12@XZ ?ToUnknown@XMLConstHandle@tinyxml2@@QBEPBVXMLUnknown@2@XZ ?ToUnknown@XMLHandle@tinyxml2@@QAEPAVXMLUnknown@2@XZ ?ToUnknown@XMLNode@tinyxml2@@UAEPAVXMLUnknown@2@XZ ?ToUnknown@XMLNode@tinyxml2@@UBEPBVXMLUnknown@2@XZ ?ToUnknown@XMLUnknown@tinyxml2@@UAEPAV12@XZ ?ToUnknown@XMLUnknown@tinyxml2@@UBEPBV12@XZ ?ToUnsigned@XMLUtil@tinyxml2@@SA_NPBDPAI@Z ?Unlink@XMLNode@tinyxml2@@AAEXPAV12@@Z ?UnsignedAttribute@XMLElement@tinyxml2@@QBEIPBD@Z ?UnsignedValue@XMLAttribute@tinyxml2@@QBEIXZ ?Value@XMLAttribute@tinyxml2@@QBEPBDXZ ?Value@XMLNode@tinyxml2@@QBEPBDXZ ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLComment@2@@Z ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLDeclaration@2@@Z ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLText@2@@Z ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLUnknown@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLComment@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLDeclaration@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLText@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLUnknown@2@@Z ?VisitEnter@XMLPrinter@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitEnter@XMLPrinter@tinyxml2@@UAE_NABVXMLElement@2@PBVXMLAttribute@2@@Z ?VisitEnter@XMLVisitor@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitEnter@XMLVisitor@tinyxml2@@UAE_NABVXMLElement@2@PBVXMLAttribute@2@@Z ?VisitExit@XMLPrinter@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitExit@XMLPrinter@tinyxml2@@UAE_NABVXMLElement@2@@Z ?VisitExit@XMLVisitor@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitExit@XMLVisitor@tinyxml2@@UAE_NABVXMLElement@2@@Z ?WhitespaceMode@XMLDocument@tinyxml2@@QBE?AW4Whitespace@2@XZ

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

474KB

Virtual Size

474KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

61KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

154KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

881KB

Virtual Size

884KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=26, id=259, version=25711,

count=216, id=261, version=25711,

count=6, id=261, productName=VS2017 v15.7.4 build 26431, version=26431,

count=6, id=199, version=41118,

count=26, id=259, version=26706,

count=137, id=261, version=26706,

count=38, id=260, version=26706,

count=28, id=260, version=25711,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=104, id=260, version=27034,

count=2, id=257, version=27044,

count=3, productName=Unmarked objects (old),

count=72, id=261, version=27031,

count=25, id=257, version=25711,

count=361, id=1, productName=Unmarked objects,

count=83, id=265, version=27027,

count=1, id=256, productName=VS2017 v15.9.7 build 27027, version=27027,

count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,

count=1, id=151,

count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,