2026-10-26_5744d282d0b05dc868fdbf809376dbad_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_5744d282d0b05dc868fdbf809376dbad_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat
Size 3.9MB
Sample261027-vf9ybaeb22
SHA256 80a2002d79d0eb5b0000a6fdc1256648a92cba70754bbc537b770fb8b406bb74
MD5 5744d282d0b05dc868fdbf809376dbad
SHA1 c499815184032c0f988570c86e0c1f1a94d09065
SHA512 2353a76631be433efb4e4cf0abc7f87db54f71cfe2e9e2759d8c609c271fe0f8ae8cae4e3640e3b4000f1267b54d573be41b9e7c64966400da8afb6f2f71f494
SSDEEP 98304:Qn+pJq2myHluY4/Fn5tYCcMfeJlCCYxcqI5Noebmlx4:za2m4lur/Fn5tQRT3
TLSH
T19E16AE217506C036E59201B19C6CAFBE849CAD351B7555C7B3D83F7E69B01E32B32A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_5744d282d0b05dc868fdbf809376dbad_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

File Explorer

2026-10-26_5744d282d0b05dc868fdbf809376dbad_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

.exe 3.9MB

2026-10-26_5744d282d0b05dc868fdbf809376dbad_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

IMPHASH eb9916fde6b8c6a525ac67eda243585e
SHA256 80a2002d79d0eb5b0000a6fdc1256648a92cba70754bbc537b770fb8b406bb74
MD5 5744d282d0b05dc868fdbf809376dbad
SHA1 c499815184032c0f988570c86e0c1f1a94d09065
SHA512 2353a76631be433efb4e4cf0abc7f87db54f71cfe2e9e2759d8c609c271fe0f8ae8cae4e3640e3b4000f1267b54d573be41b9e7c64966400da8afb6f2f71f494
SSDEEP 98304:Qn+pJq2myHluY4/Fn5tYCcMfeJlCCYxcqI5Noebmlx4:za2m4lur/Fn5tQRT3
TLSH
T19E16AE217506C036E59201B19C6CAFBE849CAD351B7555C7B3D83F7E69B01E32B32A2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2019507

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\apps\jenkins-slave\workspace\yeti-agent_yeti2-proxy\yeti2-proxy-global_devel_global\bin\Release\purpleonp.pdb

ws2_32

__WSAFDIsSet WSAIoctl getsockname connect ioctlsocket freeaddrinfo recv inet_ntoa recvfrom gethostname sendto select ntohs WSACleanup WSASend ntohl shutdown WSASetLastError WSAStringToAddressW WSASocketW WSAStartup getpeername WSAAddressToStringW WSARecv getsockopt htonl htons setsockopt accept bind closesocket listen getaddrinfo send socket WSAGetLastError

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

iphlpapi

GetAdaptersAddresses GetTcpTable2

shlwapi

PathFindFileNameA PathFileExistsW PathCanonicalizeW PathRemoveFileSpecW

nccrashreporter_win32

SetAppExtraData initializeWithCallback

wldap32

ord301 ord147 ord133 ord79 ord142 ord167 ord127 ord27 ord26 ord117 ord41 ord208 ord73 ord46 ord14 ord216 ord219 ord145

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertAddCertificateContextToStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

libeay32

ord1882 ord2925 ord4144 ord66 ord281 ord279 ord4372 ord2712 ord269 ord3315 ord400 ord283

kernel32

InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore GetVersionExW FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber QueryDepthSList ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue OutputDebugStringW LocalFree MoveFileExW GetCurrentDirectoryW UnregisterWaitEx RtlUnwind SetStdHandle GetConsoleMode ReadConsoleW GetConsoleCP ExitThread GetModuleHandleExW GetDriveTypeW SystemTimeToTzSpecificLocalTime DeleteTimerQueueTimer GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead ResetEvent GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo EncodePointer GetExitCodeThread SwitchToThread GetStringTypeW CreateHardLinkW AreFileApisANSI SetFilePointerEx SetEndOfFile GetFileInformationByHandle GetTickCount WaitForSingleObject CloseHandle CreateProcessW CreateDirectoryW FindFirstFileW GetFullPathNameW FindNextFileW RemoveDirectoryW GetTempPathW FindClose GetFileAttributesW SetFileAttributesW DeleteFileW lstrcmpW WriteConsoleW FormatMessageW GetLastError WideCharToMultiByte GetCommandLineW GetCurrentProcessId AllocConsole MoveFileW GetModuleHandleW GetSystemTimeAsFileTime HeapFree InitializeCriticalSectionEx HeapSize HeapReAlloc RaiseException HeapAlloc DecodePointer DeleteCriticalSection GetProcessHeap MultiByteToWideChar FormatMessageA Sleep GetThreadId SetWaitableTimer TlsSetValue SetLastError EnterCriticalSection CreateWaitableTimerW WaitForMultipleObjects InitializeCriticalSectionAndSpinCount LeaveCriticalSection GetQueuedCompletionStatus GetModuleHandleA PostQueuedCompletionStatus CreateEventW SetEvent TerminateThread TlsAlloc QueueUserAPC GetProcAddress VerSetConditionMask SleepEx VerifyVersionInfoW TlsGetValue TlsFree CreateIoCompletionPort GetModuleFileNameA QueryDosDeviceW GetCurrentProcess lstrlenW WriteFile TerminateProcess K32GetModuleFileNameExW SetFilePointer CreateFileW GetCurrentThreadId K32GetProcessImageFileNameW UnmapViewOfFile DuplicateHandle OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW K32EnumProcesses CreateFileMappingA CopyFileW CreateRemoteThread CreateProcessA MapViewOfFile IsWow64Process GetExitCodeProcess CreateThread GetModuleFileNameW CreateMutexW ReleaseMutex GetCommandLineA GetTickCount64 GetCurrentThread SetCurrentDirectoryW QueryPerformanceCounter QueryPerformanceFrequency GetThreadTimes GetDiskFreeSpaceExW InitializeCriticalSection GetSystemDirectoryW FreeLibrary LoadLibraryW WaitForSingleObjectEx ExpandEnvironmentStringsA GetStdHandle GetFileType ReadFile PeekNamedPipe GetFileSizeEx SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree VirtualQuery LoadLibraryExA LoadLibraryExW GetFileAttributesExW FindFirstFileExW TryEnterCriticalSection FileTimeToSystemTime ExitProcess SetEnvironmentVariableW FlushFileBuffers GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW FreeConsole lstrcpyW

user32

PostQuitMessage SetWindowLongW LoadCursorW TranslateMessage DispatchMessageW RegisterClassExW GetWindowThreadProcessId DefWindowProcW GetMessageW GetWindowLongW PostThreadMessageW PeekMessageW KillTimer FindWindowW SetTimer SendMessageW PostMessageW CreateWindowExW

advapi32

RegQueryValueExW RegSetValueExW RegCreateKeyExW RegCloseKey CryptReleaseContext CryptGenRandom CryptAcquireContextW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt RegOpenKeyExW

ole32

CoUninitialize CoInitialize

mswsock

GetAcceptExSockaddrs AcceptEx

??0?$DynArray@D$0BE@@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PBD$09@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0CE@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0CE@@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0CM@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0CM@@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0DA@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0DA@@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0DE@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0DE@@tinyxml2@@QAE@XZ ??0MemPool@tinyxml2@@QAE@ABV01@@Z ??0MemPool@tinyxml2@@QAE@XZ ??0StrPair@tinyxml2@@QAE@XZ ??0XMLAttribute@tinyxml2@@AAE@XZ ??0XMLComment@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLConstHandle@tinyxml2@@QAE@ABV01@@Z ??0XMLConstHandle@tinyxml2@@QAE@ABVXMLNode@1@@Z ??0XMLConstHandle@tinyxml2@@QAE@PBVXMLNode@1@@Z ??0XMLDeclaration@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLDocument@tinyxml2@@QAE@_NW4Whitespace@1@@Z ??0XMLElement@tinyxml2@@AAE@PAVXMLDocument@1@@Z ??0XMLHandle@tinyxml2@@QAE@AAVXMLNode@1@@Z ??0XMLHandle@tinyxml2@@QAE@ABV01@@Z ??0XMLHandle@tinyxml2@@QAE@PAVXMLNode@1@@Z ??0XMLNode@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLPrinter@tinyxml2@@QAE@ABV01@@Z ??0XMLPrinter@tinyxml2@@QAE@PAU_iobuf@@_N@Z ??0XMLText@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLUnknown@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLVisitor@tinyxml2@@QAE@ABV01@@Z ??0XMLVisitor@tinyxml2@@QAE@XZ ??1?$DynArray@D$0BE@@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PBD$09@tinyxml2@@QAE@XZ ??1?$MemPoolT@$0CE@@tinyxml2@@UAE@XZ ??1?$MemPoolT@$0CM@@tinyxml2@@UAE@XZ ??1?$MemPoolT@$0DA@@tinyxml2@@UAE@XZ ??1?$MemPoolT@$0DE@@tinyxml2@@UAE@XZ ??1MemPool@tinyxml2@@UAE@XZ ??1StrPair@tinyxml2@@QAE@XZ ??1XMLAttribute@tinyxml2@@EAE@XZ ??1XMLComment@tinyxml2@@MAE@XZ ??1XMLDeclaration@tinyxml2@@MAE@XZ ??1XMLDocument@tinyxml2@@UAE@XZ ??1XMLElement@tinyxml2@@EAE@XZ ??1XMLNode@tinyxml2@@MAE@XZ ??1XMLPrinter@tinyxml2@@UAE@XZ ??1XMLText@tinyxml2@@MAE@XZ ??1XMLUnknown@tinyxml2@@MAE@XZ ??1XMLVisitor@tinyxml2@@UAE@XZ ??4?$DynArray@D$0BE@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PBD$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0CE@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0CM@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0DA@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0DE@@tinyxml2@@QAEAAV01@ABV01@@Z ??4MemPool@tinyxml2@@QAEAAV01@ABV01@@Z ??4StrPair@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLConstHandle@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLHandle@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLPrinter@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLUtil@tinyxml2@@QAEAAV01@$$QAV01@@Z ??4XMLUtil@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLVisitor@tinyxml2@@QAEAAV01@ABV01@@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0CE@@1@H@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0CM@@1@H@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0DA@@1@H@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0DE@@1@H@Z ??_7?$MemPoolT@$0CE@@tinyxml2@@6B@ ??_7?$MemPoolT@$0CM@@tinyxml2@@6B@ ??_7?$MemPoolT@$0DA@@tinyxml2@@6B@ ??_7?$MemPoolT@$0DE@@tinyxml2@@6B@ ??_7MemPool@tinyxml2@@6B@ ??_7XMLAttribute@tinyxml2@@6B@ ??_7XMLComment@tinyxml2@@6B@ ??_7XMLDeclaration@tinyxml2@@6B@ ??_7XMLDocument@tinyxml2@@6B@ ??_7XMLElement@tinyxml2@@6B@ ??_7XMLNode@tinyxml2@@6B@ ??_7XMLPrinter@tinyxml2@@6B@ ??_7XMLText@tinyxml2@@6B@ ??_7XMLUnknown@tinyxml2@@6B@ ??_7XMLVisitor@tinyxml2@@6B@ ??_FXMLDocument@tinyxml2@@QAEXXZ ??_FXMLPrinter@tinyxml2@@QAEXXZ ?Accept@XMLComment@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLDeclaration@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLDocument@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLElement@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLText@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLUnknown@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Alloc@?$MemPoolT@$0CE@@tinyxml2@@UAEPAXXZ ?Alloc@?$MemPoolT@$0CM@@tinyxml2@@UAEPAXXZ ?Alloc@?$MemPoolT@$0DA@@tinyxml2@@UAEPAXXZ ?Alloc@?$MemPoolT@$0DE@@tinyxml2@@UAEPAXXZ ?Attribute@XMLElement@tinyxml2@@QBEPBDPBD0@Z ?BoolAttribute@XMLElement@tinyxml2@@QBE_NPBD@Z ?BoolValue@XMLAttribute@tinyxml2@@QBE_NXZ ?CData@XMLText@tinyxml2@@QBE_NXZ ?CStr@XMLPrinter@tinyxml2@@QBEPBDXZ ?CStrSize@XMLPrinter@tinyxml2@@QBEHXZ ?CloseElement@XMLPrinter@tinyxml2@@QAEXXZ ?ClosingType@XMLElement@tinyxml2@@QBEHXZ ?CollapseWhitespace@StrPair@tinyxml2@@AAEXXZ ?ConvertUTF32ToUTF8@XMLUtil@tinyxml2@@SAXKPADPAH@Z ?DeleteAttribute@XMLElement@tinyxml2@@QAEXPBD@Z ?DeleteChild@XMLNode@tinyxml2@@QAEXPAV12@@Z ?DeleteChildren@XMLNode@tinyxml2@@QAEXXZ ?DeleteNode@XMLDocument@tinyxml2@@QAEXPAVXMLNode@2@@Z ?DoubleAttribute@XMLElement@tinyxml2@@QBENPBD@Z ?DoubleValue@XMLAttribute@tinyxml2@@QBENXZ ?Empty@StrPair@tinyxml2@@QBE_NXZ ?EnsureCapacity@?$DynArray@D$0BE@@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PBD$09@tinyxml2@@AAEXH@Z ?Error@XMLDocument@tinyxml2@@QBE_NXZ ?ErrorID@XMLDocument@tinyxml2@@QBE?AW4XMLError@2@XZ ?FindAttribute@XMLElement@tinyxml2@@AAEPAVXMLAttribute@2@PBD@Z ?FindAttribute@XMLElement@tinyxml2@@QBEPBVXMLAttribute@2@PBD@Z ?FindOrCreateAttribute@XMLElement@tinyxml2@@AAEPAVXMLAttribute@2@PBD@Z ?FirstAttribute@XMLElement@tinyxml2@@QBEPBVXMLAttribute@2@XZ ?FirstChild@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?FirstChild@XMLHandle@tinyxml2@@QAE?AV12@XZ ?FirstChild@XMLNode@tinyxml2@@QAEPAV12@XZ ?FirstChild@XMLNode@tinyxml2@@QBEPBV12@XZ ?FirstChildElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?FirstChildElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?FirstChildElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?FirstChildElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?FloatAttribute@XMLElement@tinyxml2@@QBEMPBD@Z ?FloatValue@XMLAttribute@tinyxml2@@QBEMXZ ?Free@?$MemPoolT@$0CE@@tinyxml2@@UAEXPAX@Z ?Free@?$MemPoolT@$0CM@@tinyxml2@@UAEXPAX@Z ?Free@?$MemPoolT@$0DA@@tinyxml2@@UAEXPAX@Z ?Free@?$MemPoolT@$0DE@@tinyxml2@@UAEXPAX@Z ?GetCharacterRef@XMLUtil@tinyxml2@@SAPBDPBDPADPAH@Z ?GetDocument@XMLNode@tinyxml2@@QAEPAVXMLDocument@2@XZ ?GetDocument@XMLNode@tinyxml2@@QBEPBVXMLDocument@2@XZ ?GetErrorStr1@XMLDocument@tinyxml2@@QBEPBDXZ ?GetErrorStr2@XMLDocument@tinyxml2@@QBEPBDXZ ?GetStr@StrPair@tinyxml2@@QAEPBDXZ ?GetText@XMLElement@tinyxml2@@QBEPBDXZ ?HasBOM@XMLDocument@tinyxml2@@QBE_NXZ ?Identify@XMLDocument@tinyxml2@@QAEPADPADPAPAVXMLNode@2@@Z ?InitDocument@XMLDocument@tinyxml2@@AAEXXZ ?InsertAfterChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@0@Z ?InsertEndChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@@Z ?InsertFirstChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@@Z ?IntAttribute@XMLElement@tinyxml2@@QBEHPBD@Z ?IntValue@XMLAttribute@tinyxml2@@QBEHXZ ?IsAlpha@XMLUtil@tinyxml2@@SAHE@Z ?IsAlphaNum@XMLUtil@tinyxml2@@SAHE@Z ?IsUTF8Continuation@XMLUtil@tinyxml2@@SAHD@Z ?IsWhiteSpace@XMLUtil@tinyxml2@@SA_ND@Z ?ItemSize@?$MemPoolT@$0CE@@tinyxml2@@UBEHXZ ?ItemSize@?$MemPoolT@$0CM@@tinyxml2@@UBEHXZ ?ItemSize@?$MemPoolT@$0DA@@tinyxml2@@UBEHXZ ?ItemSize@?$MemPoolT@$0DE@@tinyxml2@@UBEHXZ ?LastChild@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?LastChild@XMLHandle@tinyxml2@@QAE?AV12@XZ ?LastChild@XMLNode@tinyxml2@@QAEPAV12@XZ ?LastChild@XMLNode@tinyxml2@@QBEPBV12@XZ ?LastChildElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?LastChildElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?LastChildElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?LastChildElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?LinkEndChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@@Z ?LoadFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PAU_iobuf@@@Z ?LoadFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PBD@Z ?Mem@?$DynArray@D$0BE@@tinyxml2@@QBEPBDXZ ?Name@XMLAttribute@tinyxml2@@QBEPBDXZ ?Name@XMLElement@tinyxml2@@QBEPBDXZ ?NewComment@XMLDocument@tinyxml2@@QAEPAVXMLComment@2@PBD@Z ?NewDeclaration@XMLDocument@tinyxml2@@QAEPAVXMLDeclaration@2@PBD@Z ?NewElement@XMLDocument@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?NewText@XMLDocument@tinyxml2@@QAEPAVXMLText@2@PBD@Z ?NewUnknown@XMLDocument@tinyxml2@@QAEPAVXMLUnknown@2@PBD@Z ?Next@XMLAttribute@tinyxml2@@QBEPBV12@XZ ?NextSibling@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?NextSibling@XMLHandle@tinyxml2@@QAE?AV12@XZ ?NextSibling@XMLNode@tinyxml2@@QAEPAV12@XZ ?NextSibling@XMLNode@tinyxml2@@QBEPBV12@XZ ?NextSiblingElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?NextSiblingElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?NextSiblingElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?NextSiblingElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?NoChildren@XMLNode@tinyxml2@@QBE_NXZ ?OpenElement@XMLPrinter@tinyxml2@@QAEXPBD@Z ?Parent@XMLNode@tinyxml2@@QAEPAV12@XZ ?Parent@XMLNode@tinyxml2@@QBEPBV12@XZ ?Parse@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PBDI@Z ?ParseAttributes@XMLElement@tinyxml2@@AAEPADPAD@Z ?ParseDeep@XMLAttribute@tinyxml2@@AAEPADPAD_N@Z ?ParseDeep@XMLComment@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLDeclaration@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLElement@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLNode@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLText@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLUnknown@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseName@StrPair@tinyxml2@@QAEPADPAD@Z ?ParseText@StrPair@tinyxml2@@QAEPADPADPBDH@Z ?Pop@?$DynArray@PBD$09@tinyxml2@@QAEPBDXZ ?PreviousSibling@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?PreviousSibling@XMLHandle@tinyxml2@@QAE?AV12@XZ ?PreviousSibling@XMLNode@tinyxml2@@QAEPAV12@XZ ?PreviousSibling@XMLNode@tinyxml2@@QBEPBV12@XZ ?PreviousSiblingElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?PreviousSiblingElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?PreviousSiblingElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?PreviousSiblingElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?Print@XMLDocument@tinyxml2@@QAEXPAVXMLPrinter@2@@Z ?Print@XMLPrinter@tinyxml2@@AAAXPBDZZ ?PrintError@XMLDocument@tinyxml2@@QBEXXZ ?PrintSpace@XMLPrinter@tinyxml2@@AAEXH@Z ?PrintString@XMLPrinter@tinyxml2@@AAEXPBD_N@Z ?ProcessEntities@XMLDocument@tinyxml2@@QBE_NXZ ?Push@?$DynArray@D$0BE@@tinyxml2@@QAEXD@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0CE@@2@@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0CM@@2@@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0DA@@2@@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0DE@@2@@Z ?Push@?$DynArray@PBD$09@tinyxml2@@QAEXPBD@Z ?PushArr@?$DynArray@D$0BE@@tinyxml2@@QAEPADH@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBD0@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBDH@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBDI@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBDN@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBD_N@Z ?PushComment@XMLPrinter@tinyxml2@@QAEXPBD@Z ?PushDeclaration@XMLPrinter@tinyxml2@@QAEXPBD@Z ?PushHeader@XMLPrinter@tinyxml2@@QAEX_N0@Z ?PushText@XMLPrinter@tinyxml2@@QAEXH@Z ?PushText@XMLPrinter@tinyxml2@@QAEXI@Z ?PushText@XMLPrinter@tinyxml2@@QAEXM@Z ?PushText@XMLPrinter@tinyxml2@@QAEXN@Z ?PushText@XMLPrinter@tinyxml2@@QAEXPBD_N@Z ?PushText@XMLPrinter@tinyxml2@@QAEX_N@Z ?PushUnknown@XMLPrinter@tinyxml2@@QAEXPBD@Z ?QueryBoolAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPA_N@Z ?QueryBoolText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PA_N@Z ?QueryBoolValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PA_N@Z ?QueryDoubleAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAN@Z ?QueryDoubleText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAN@Z ?QueryDoubleValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAN@Z ?QueryFloatAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAM@Z ?QueryFloatText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAM@Z ?QueryFloatValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAM@Z ?QueryIntAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAH@Z ?QueryIntText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAH@Z ?QueryIntValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAH@Z ?QueryUnsignedAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAI@Z ?QueryUnsignedText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAI@Z ?QueryUnsignedValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAI@Z ?ReadBOM@XMLUtil@tinyxml2@@SAPBDPBDPA_N@Z ?Reset@StrPair@tinyxml2@@AAEXXZ ?RootElement@XMLDocument@tinyxml2@@QAEPAVXMLElement@2@XZ ?RootElement@XMLDocument@tinyxml2@@QBEPBVXMLElement@2@XZ ?SaveFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PAU_iobuf@@_N@Z ?SaveFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PBD_N@Z ?SealElement@XMLPrinter@tinyxml2@@AAEXXZ ?Set@StrPair@tinyxml2@@QAEXPAD0H@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXH@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXI@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXM@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXN@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXPBD@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEX_N@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBD0@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBDH@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBDI@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBDN@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBD_N@Z ?SetBOM@XMLDocument@tinyxml2@@QAEX_N@Z ?SetCData@XMLText@tinyxml2@@QAEX_N@Z ?SetError@XMLDocument@tinyxml2@@QAEXW4XMLError@2@PBD1@Z ?SetInternedStr@StrPair@tinyxml2@@QAEXPBD@Z ?SetName@XMLAttribute@tinyxml2@@AAEXPBD@Z ?SetName@XMLElement@tinyxml2@@QAEXPBD_N@Z ?SetStr@StrPair@tinyxml2@@QAEXPBDH@Z ?SetTracked@?$MemPoolT@$0CE@@tinyxml2@@UAEXXZ ?SetTracked@?$MemPoolT@$0CM@@tinyxml2@@UAEXXZ ?SetTracked@?$MemPoolT@$0DA@@tinyxml2@@UAEXXZ ?SetTracked@?$MemPoolT@$0DE@@tinyxml2@@UAEXXZ ?SetValue@XMLNode@tinyxml2@@QAEXPBD_N@Z ?ShallowClone@XMLComment@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLDeclaration@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLDocument@tinyxml2@@UBEPAVXMLNode@2@PAV12@@Z ?ShallowClone@XMLElement@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLText@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLUnknown@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowEqual@XMLComment@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLDeclaration@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLDocument@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLElement@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLText@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLUnknown@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?Size@?$DynArray@D$0BE@@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?SkipWhiteSpace@XMLUtil@tinyxml2@@SAPADPAD@Z ?SkipWhiteSpace@XMLUtil@tinyxml2@@SAPBDPBD@Z ?StringEqual@XMLUtil@tinyxml2@@SA_NPBD0H@Z ?ToBool@XMLUtil@tinyxml2@@SA_NPBDPA_N@Z ?ToComment@XMLComment@tinyxml2@@UAEPAV12@XZ ?ToComment@XMLComment@tinyxml2@@UBEPBV12@XZ ?ToComment@XMLNode@tinyxml2@@UAEPAVXMLComment@2@XZ ?ToComment@XMLNode@tinyxml2@@UBEPBVXMLComment@2@XZ ?ToDeclaration@XMLConstHandle@tinyxml2@@QBEPBVXMLDeclaration@2@XZ ?ToDeclaration@XMLDeclaration@tinyxml2@@UAEPAV12@XZ ?ToDeclaration@XMLDeclaration@tinyxml2@@UBEPBV12@XZ ?ToDeclaration@XMLHandle@tinyxml2@@QAEPAVXMLDeclaration@2@XZ ?ToDeclaration@XMLNode@tinyxml2@@UAEPAVXMLDeclaration@2@XZ ?ToDeclaration@XMLNode@tinyxml2@@UBEPBVXMLDeclaration@2@XZ ?ToDocument@XMLDocument@tinyxml2@@UAEPAV12@XZ ?ToDocument@XMLDocument@tinyxml2@@UBEPBV12@XZ ?ToDocument@XMLNode@tinyxml2@@UAEPAVXMLDocument@2@XZ ?ToDocument@XMLNode@tinyxml2@@UBEPBVXMLDocument@2@XZ ?ToDouble@XMLUtil@tinyxml2@@SA_NPBDPAN@Z ?ToElement@XMLConstHandle@tinyxml2@@QBEPBVXMLElement@2@XZ ?ToElement@XMLElement@tinyxml2@@UAEPAV12@XZ ?ToElement@XMLElement@tinyxml2@@UBEPBV12@XZ ?ToElement@XMLHandle@tinyxml2@@QAEPAVXMLElement@2@XZ ?ToElement@XMLNode@tinyxml2@@UAEPAVXMLElement@2@XZ ?ToElement@XMLNode@tinyxml2@@UBEPBVXMLElement@2@XZ ?ToFloat@XMLUtil@tinyxml2@@SA_NPBDPAM@Z ?ToInt@XMLUtil@tinyxml2@@SA_NPBDPAH@Z ?ToNode@XMLConstHandle@tinyxml2@@QBEPBVXMLNode@2@XZ ?ToNode@XMLHandle@tinyxml2@@QAEPAVXMLNode@2@XZ ?ToStr@XMLUtil@tinyxml2@@SAXHPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAXIPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAXMPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAXNPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAX_NPADH@Z ?ToText@XMLConstHandle@tinyxml2@@QBEPBVXMLText@2@XZ ?ToText@XMLHandle@tinyxml2@@QAEPAVXMLText@2@XZ ?ToText@XMLNode@tinyxml2@@UAEPAVXMLText@2@XZ ?ToText@XMLNode@tinyxml2@@UBEPBVXMLText@2@XZ ?ToText@XMLText@tinyxml2@@UAEPAV12@XZ ?ToText@XMLText@tinyxml2@@UBEPBV12@XZ ?ToUnknown@XMLConstHandle@tinyxml2@@QBEPBVXMLUnknown@2@XZ ?ToUnknown@XMLHandle@tinyxml2@@QAEPAVXMLUnknown@2@XZ ?ToUnknown@XMLNode@tinyxml2@@UAEPAVXMLUnknown@2@XZ ?ToUnknown@XMLNode@tinyxml2@@UBEPBVXMLUnknown@2@XZ ?ToUnknown@XMLUnknown@tinyxml2@@UAEPAV12@XZ ?ToUnknown@XMLUnknown@tinyxml2@@UBEPBV12@XZ ?ToUnsigned@XMLUtil@tinyxml2@@SA_NPBDPAI@Z ?Unlink@XMLNode@tinyxml2@@AAEXPAV12@@Z ?UnsignedAttribute@XMLElement@tinyxml2@@QBEIPBD@Z ?UnsignedValue@XMLAttribute@tinyxml2@@QBEIXZ ?Value@XMLAttribute@tinyxml2@@QBEPBDXZ ?Value@XMLNode@tinyxml2@@QBEPBDXZ ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLComment@2@@Z ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLDeclaration@2@@Z ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLText@2@@Z ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLUnknown@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLComment@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLDeclaration@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLText@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLUnknown@2@@Z ?VisitEnter@XMLPrinter@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitEnter@XMLPrinter@tinyxml2@@UAE_NABVXMLElement@2@PBVXMLAttribute@2@@Z ?VisitEnter@XMLVisitor@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitEnter@XMLVisitor@tinyxml2@@UAE_NABVXMLElement@2@PBVXMLAttribute@2@@Z ?VisitExit@XMLPrinter@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitExit@XMLPrinter@tinyxml2@@UAE_NABVXMLElement@2@@Z ?VisitExit@XMLVisitor@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitExit@XMLVisitor@tinyxml2@@UAE_NABVXMLElement@2@@Z ?WhitespaceMode@XMLDocument@tinyxml2@@QBE?AW4Whitespace@2@XZ

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

474KB

Virtual Size

474KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

61KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

154KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

881KB

Virtual Size

884KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=26, id=259, version=25711,

count=216, id=261, version=25711,

count=6, id=261, productName=VS2017 v15.7.4 build 26431, version=26431,

count=6, id=199, version=41118,

count=26, id=259, version=26706,

count=137, id=261, version=26706,

count=38, id=260, version=26706,

count=28, id=260, version=25711,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=104, id=260, version=27034,

count=2, id=257, version=27044,

count=3, productName=Unmarked objects (old),

count=72, id=261, version=27031,

count=25, id=257, version=25711,

count=361, id=1, productName=Unmarked objects,

count=83, id=265, version=27027,

count=1, id=256, productName=VS2017 v15.9.7 build 27027, version=27027,

count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,

count=1, id=151,

count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,