2026-10-22_9730f48440085ca2191fecbe517e6627_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_9730f48440085ca2191fecbe517e6627_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat
Size 3.9MB
Sample261024-efejeahw5j
SHA256 b5f2f47ce67be8c0f7a3ae3e3c1a9a5c2061b9b1eee0a3874efca0bab20b085d
MD5 9730f48440085ca2191fecbe517e6627
SHA1 9d60157f6ae2b2047ebf06c678589354aa828eef
SHA512 154e52c551ed5de965e6b8a36b4275fe5e68a424ac4c7e24263b3b5ceabeb48bef92b7af84f392aa1c1f85a7579b6b1a2f0cdc901005526657aee5d386c858c5
SSDEEP 98304:u2+pJq2myHluY4/Fn5tYCcMfeJlCCYx80zaSG5W5yl:aa2m4lur/Fn5tQy35k
TLSH
T1BD16AF217506C036E59201B19C6CABBE849CAD351B7555C7B3D83F7E69B01E32B32B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_9730f48440085ca2191fecbe517e6627_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

File Explorer

2026-10-22_9730f48440085ca2191fecbe517e6627_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

.exe 3.9MB

2026-10-22_9730f48440085ca2191fecbe517e6627_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

IMPHASH eb9916fde6b8c6a525ac67eda243585e
SHA256 b5f2f47ce67be8c0f7a3ae3e3c1a9a5c2061b9b1eee0a3874efca0bab20b085d
MD5 9730f48440085ca2191fecbe517e6627
SHA1 9d60157f6ae2b2047ebf06c678589354aa828eef
SHA512 154e52c551ed5de965e6b8a36b4275fe5e68a424ac4c7e24263b3b5ceabeb48bef92b7af84f392aa1c1f85a7579b6b1a2f0cdc901005526657aee5d386c858c5
SSDEEP 98304:u2+pJq2myHluY4/Fn5tYCcMfeJlCCYx80zaSG5W5yl:aa2m4lur/Fn5tQy35k
TLSH
T1BD16AF217506C036E59201B19C6CABBE849CAD351B7555C7B3D83F7E69B01E32B32B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2019507

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\apps\jenkins-slave\workspace\yeti-agent_yeti2-proxy\yeti2-proxy-global_devel_global\bin\Release\purpleonp.pdb

ws2_32

__WSAFDIsSet WSAIoctl getsockname connect ioctlsocket freeaddrinfo recv inet_ntoa recvfrom gethostname sendto select ntohs WSACleanup WSASend ntohl shutdown WSASetLastError WSAStringToAddressW WSASocketW WSAStartup getpeername WSAAddressToStringW WSARecv getsockopt htonl htons setsockopt accept bind closesocket listen getaddrinfo send socket WSAGetLastError

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

iphlpapi

GetAdaptersAddresses GetTcpTable2

shlwapi

PathFindFileNameA PathFileExistsW PathCanonicalizeW PathRemoveFileSpecW

nccrashreporter_win32

SetAppExtraData initializeWithCallback

wldap32

ord301 ord147 ord133 ord79 ord142 ord167 ord127 ord27 ord26 ord117 ord41 ord208 ord73 ord46 ord14 ord216 ord219 ord145

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertAddCertificateContextToStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

libeay32

ord1882 ord2925 ord4144 ord66 ord281 ord279 ord4372 ord2712 ord269 ord3315 ord400 ord283

kernel32

InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore GetVersionExW FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber QueryDepthSList ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue OutputDebugStringW LocalFree MoveFileExW GetCurrentDirectoryW UnregisterWaitEx RtlUnwind SetStdHandle GetConsoleMode ReadConsoleW GetConsoleCP ExitThread GetModuleHandleExW GetDriveTypeW SystemTimeToTzSpecificLocalTime DeleteTimerQueueTimer GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead ResetEvent GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo EncodePointer GetExitCodeThread SwitchToThread GetStringTypeW CreateHardLinkW AreFileApisANSI SetFilePointerEx SetEndOfFile GetFileInformationByHandle GetTickCount WaitForSingleObject CloseHandle CreateProcessW CreateDirectoryW FindFirstFileW GetFullPathNameW FindNextFileW RemoveDirectoryW GetTempPathW FindClose GetFileAttributesW SetFileAttributesW DeleteFileW lstrcmpW WriteConsoleW FormatMessageW GetLastError WideCharToMultiByte GetCommandLineW GetCurrentProcessId AllocConsole MoveFileW GetModuleHandleW GetSystemTimeAsFileTime HeapFree InitializeCriticalSectionEx HeapSize HeapReAlloc RaiseException HeapAlloc DecodePointer DeleteCriticalSection GetProcessHeap MultiByteToWideChar FormatMessageA Sleep GetThreadId SetWaitableTimer TlsSetValue SetLastError EnterCriticalSection CreateWaitableTimerW WaitForMultipleObjects InitializeCriticalSectionAndSpinCount LeaveCriticalSection GetQueuedCompletionStatus GetModuleHandleA PostQueuedCompletionStatus CreateEventW SetEvent TerminateThread TlsAlloc QueueUserAPC GetProcAddress VerSetConditionMask SleepEx VerifyVersionInfoW TlsGetValue TlsFree CreateIoCompletionPort GetModuleFileNameA QueryDosDeviceW GetCurrentProcess lstrlenW WriteFile TerminateProcess K32GetModuleFileNameExW SetFilePointer CreateFileW GetCurrentThreadId K32GetProcessImageFileNameW UnmapViewOfFile DuplicateHandle OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW K32EnumProcesses CreateFileMappingA CopyFileW CreateRemoteThread CreateProcessA MapViewOfFile IsWow64Process GetExitCodeProcess CreateThread GetModuleFileNameW CreateMutexW ReleaseMutex GetCommandLineA GetTickCount64 GetCurrentThread SetCurrentDirectoryW QueryPerformanceCounter QueryPerformanceFrequency GetThreadTimes GetDiskFreeSpaceExW InitializeCriticalSection GetSystemDirectoryW FreeLibrary LoadLibraryW WaitForSingleObjectEx ExpandEnvironmentStringsA GetStdHandle GetFileType ReadFile PeekNamedPipe GetFileSizeEx SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree VirtualQuery LoadLibraryExA LoadLibraryExW GetFileAttributesExW FindFirstFileExW TryEnterCriticalSection FileTimeToSystemTime ExitProcess SetEnvironmentVariableW FlushFileBuffers GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW FreeConsole lstrcpyW

user32

PostQuitMessage SetWindowLongW LoadCursorW TranslateMessage DispatchMessageW RegisterClassExW GetWindowThreadProcessId DefWindowProcW GetMessageW GetWindowLongW PostThreadMessageW PeekMessageW KillTimer FindWindowW SetTimer SendMessageW PostMessageW CreateWindowExW

advapi32

RegQueryValueExW RegSetValueExW RegCreateKeyExW RegCloseKey CryptReleaseContext CryptGenRandom CryptAcquireContextW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt RegOpenKeyExW

ole32

CoUninitialize CoInitialize

mswsock

GetAcceptExSockaddrs AcceptEx

??0?$DynArray@D$0BE@@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PBD$09@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0CE@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0CE@@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0CM@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0CM@@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0DA@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0DA@@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0DE@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0DE@@tinyxml2@@QAE@XZ ??0MemPool@tinyxml2@@QAE@ABV01@@Z ??0MemPool@tinyxml2@@QAE@XZ ??0StrPair@tinyxml2@@QAE@XZ ??0XMLAttribute@tinyxml2@@AAE@XZ ??0XMLComment@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLConstHandle@tinyxml2@@QAE@ABV01@@Z ??0XMLConstHandle@tinyxml2@@QAE@ABVXMLNode@1@@Z ??0XMLConstHandle@tinyxml2@@QAE@PBVXMLNode@1@@Z ??0XMLDeclaration@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLDocument@tinyxml2@@QAE@_NW4Whitespace@1@@Z ??0XMLElement@tinyxml2@@AAE@PAVXMLDocument@1@@Z ??0XMLHandle@tinyxml2@@QAE@AAVXMLNode@1@@Z ??0XMLHandle@tinyxml2@@QAE@ABV01@@Z ??0XMLHandle@tinyxml2@@QAE@PAVXMLNode@1@@Z ??0XMLNode@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLPrinter@tinyxml2@@QAE@ABV01@@Z ??0XMLPrinter@tinyxml2@@QAE@PAU_iobuf@@_N@Z ??0XMLText@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLUnknown@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLVisitor@tinyxml2@@QAE@ABV01@@Z ??0XMLVisitor@tinyxml2@@QAE@XZ ??1?$DynArray@D$0BE@@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PBD$09@tinyxml2@@QAE@XZ ??1?$MemPoolT@$0CE@@tinyxml2@@UAE@XZ ??1?$MemPoolT@$0CM@@tinyxml2@@UAE@XZ ??1?$MemPoolT@$0DA@@tinyxml2@@UAE@XZ ??1?$MemPoolT@$0DE@@tinyxml2@@UAE@XZ ??1MemPool@tinyxml2@@UAE@XZ ??1StrPair@tinyxml2@@QAE@XZ ??1XMLAttribute@tinyxml2@@EAE@XZ ??1XMLComment@tinyxml2@@MAE@XZ ??1XMLDeclaration@tinyxml2@@MAE@XZ ??1XMLDocument@tinyxml2@@UAE@XZ ??1XMLElement@tinyxml2@@EAE@XZ ??1XMLNode@tinyxml2@@MAE@XZ ??1XMLPrinter@tinyxml2@@UAE@XZ ??1XMLText@tinyxml2@@MAE@XZ ??1XMLUnknown@tinyxml2@@MAE@XZ ??1XMLVisitor@tinyxml2@@UAE@XZ ??4?$DynArray@D$0BE@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PBD$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0CE@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0CM@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0DA@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0DE@@tinyxml2@@QAEAAV01@ABV01@@Z ??4MemPool@tinyxml2@@QAEAAV01@ABV01@@Z ??4StrPair@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLConstHandle@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLHandle@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLPrinter@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLUtil@tinyxml2@@QAEAAV01@$$QAV01@@Z ??4XMLUtil@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLVisitor@tinyxml2@@QAEAAV01@ABV01@@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0CE@@1@H@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0CM@@1@H@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0DA@@1@H@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0DE@@1@H@Z ??_7?$MemPoolT@$0CE@@tinyxml2@@6B@ ??_7?$MemPoolT@$0CM@@tinyxml2@@6B@ ??_7?$MemPoolT@$0DA@@tinyxml2@@6B@ ??_7?$MemPoolT@$0DE@@tinyxml2@@6B@ ??_7MemPool@tinyxml2@@6B@ ??_7XMLAttribute@tinyxml2@@6B@ ??_7XMLComment@tinyxml2@@6B@ ??_7XMLDeclaration@tinyxml2@@6B@ ??_7XMLDocument@tinyxml2@@6B@ ??_7XMLElement@tinyxml2@@6B@ ??_7XMLNode@tinyxml2@@6B@ ??_7XMLPrinter@tinyxml2@@6B@ ??_7XMLText@tinyxml2@@6B@ ??_7XMLUnknown@tinyxml2@@6B@ ??_7XMLVisitor@tinyxml2@@6B@ ??_FXMLDocument@tinyxml2@@QAEXXZ ??_FXMLPrinter@tinyxml2@@QAEXXZ ?Accept@XMLComment@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLDeclaration@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLDocument@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLElement@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLText@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLUnknown@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Alloc@?$MemPoolT@$0CE@@tinyxml2@@UAEPAXXZ ?Alloc@?$MemPoolT@$0CM@@tinyxml2@@UAEPAXXZ ?Alloc@?$MemPoolT@$0DA@@tinyxml2@@UAEPAXXZ ?Alloc@?$MemPoolT@$0DE@@tinyxml2@@UAEPAXXZ ?Attribute@XMLElement@tinyxml2@@QBEPBDPBD0@Z ?BoolAttribute@XMLElement@tinyxml2@@QBE_NPBD@Z ?BoolValue@XMLAttribute@tinyxml2@@QBE_NXZ ?CData@XMLText@tinyxml2@@QBE_NXZ ?CStr@XMLPrinter@tinyxml2@@QBEPBDXZ ?CStrSize@XMLPrinter@tinyxml2@@QBEHXZ ?CloseElement@XMLPrinter@tinyxml2@@QAEXXZ ?ClosingType@XMLElement@tinyxml2@@QBEHXZ ?CollapseWhitespace@StrPair@tinyxml2@@AAEXXZ ?ConvertUTF32ToUTF8@XMLUtil@tinyxml2@@SAXKPADPAH@Z ?DeleteAttribute@XMLElement@tinyxml2@@QAEXPBD@Z ?DeleteChild@XMLNode@tinyxml2@@QAEXPAV12@@Z ?DeleteChildren@XMLNode@tinyxml2@@QAEXXZ ?DeleteNode@XMLDocument@tinyxml2@@QAEXPAVXMLNode@2@@Z ?DoubleAttribute@XMLElement@tinyxml2@@QBENPBD@Z ?DoubleValue@XMLAttribute@tinyxml2@@QBENXZ ?Empty@StrPair@tinyxml2@@QBE_NXZ ?EnsureCapacity@?$DynArray@D$0BE@@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PBD$09@tinyxml2@@AAEXH@Z ?Error@XMLDocument@tinyxml2@@QBE_NXZ ?ErrorID@XMLDocument@tinyxml2@@QBE?AW4XMLError@2@XZ ?FindAttribute@XMLElement@tinyxml2@@AAEPAVXMLAttribute@2@PBD@Z ?FindAttribute@XMLElement@tinyxml2@@QBEPBVXMLAttribute@2@PBD@Z ?FindOrCreateAttribute@XMLElement@tinyxml2@@AAEPAVXMLAttribute@2@PBD@Z ?FirstAttribute@XMLElement@tinyxml2@@QBEPBVXMLAttribute@2@XZ ?FirstChild@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?FirstChild@XMLHandle@tinyxml2@@QAE?AV12@XZ ?FirstChild@XMLNode@tinyxml2@@QAEPAV12@XZ ?FirstChild@XMLNode@tinyxml2@@QBEPBV12@XZ ?FirstChildElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?FirstChildElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?FirstChildElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?FirstChildElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?FloatAttribute@XMLElement@tinyxml2@@QBEMPBD@Z ?FloatValue@XMLAttribute@tinyxml2@@QBEMXZ ?Free@?$MemPoolT@$0CE@@tinyxml2@@UAEXPAX@Z ?Free@?$MemPoolT@$0CM@@tinyxml2@@UAEXPAX@Z ?Free@?$MemPoolT@$0DA@@tinyxml2@@UAEXPAX@Z ?Free@?$MemPoolT@$0DE@@tinyxml2@@UAEXPAX@Z ?GetCharacterRef@XMLUtil@tinyxml2@@SAPBDPBDPADPAH@Z ?GetDocument@XMLNode@tinyxml2@@QAEPAVXMLDocument@2@XZ ?GetDocument@XMLNode@tinyxml2@@QBEPBVXMLDocument@2@XZ ?GetErrorStr1@XMLDocument@tinyxml2@@QBEPBDXZ ?GetErrorStr2@XMLDocument@tinyxml2@@QBEPBDXZ ?GetStr@StrPair@tinyxml2@@QAEPBDXZ ?GetText@XMLElement@tinyxml2@@QBEPBDXZ ?HasBOM@XMLDocument@tinyxml2@@QBE_NXZ ?Identify@XMLDocument@tinyxml2@@QAEPADPADPAPAVXMLNode@2@@Z ?InitDocument@XMLDocument@tinyxml2@@AAEXXZ ?InsertAfterChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@0@Z ?InsertEndChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@@Z ?InsertFirstChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@@Z ?IntAttribute@XMLElement@tinyxml2@@QBEHPBD@Z ?IntValue@XMLAttribute@tinyxml2@@QBEHXZ ?IsAlpha@XMLUtil@tinyxml2@@SAHE@Z ?IsAlphaNum@XMLUtil@tinyxml2@@SAHE@Z ?IsUTF8Continuation@XMLUtil@tinyxml2@@SAHD@Z ?IsWhiteSpace@XMLUtil@tinyxml2@@SA_ND@Z ?ItemSize@?$MemPoolT@$0CE@@tinyxml2@@UBEHXZ ?ItemSize@?$MemPoolT@$0CM@@tinyxml2@@UBEHXZ ?ItemSize@?$MemPoolT@$0DA@@tinyxml2@@UBEHXZ ?ItemSize@?$MemPoolT@$0DE@@tinyxml2@@UBEHXZ ?LastChild@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?LastChild@XMLHandle@tinyxml2@@QAE?AV12@XZ ?LastChild@XMLNode@tinyxml2@@QAEPAV12@XZ ?LastChild@XMLNode@tinyxml2@@QBEPBV12@XZ ?LastChildElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?LastChildElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?LastChildElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?LastChildElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?LinkEndChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@@Z ?LoadFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PAU_iobuf@@@Z ?LoadFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PBD@Z ?Mem@?$DynArray@D$0BE@@tinyxml2@@QBEPBDXZ ?Name@XMLAttribute@tinyxml2@@QBEPBDXZ ?Name@XMLElement@tinyxml2@@QBEPBDXZ ?NewComment@XMLDocument@tinyxml2@@QAEPAVXMLComment@2@PBD@Z ?NewDeclaration@XMLDocument@tinyxml2@@QAEPAVXMLDeclaration@2@PBD@Z ?NewElement@XMLDocument@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?NewText@XMLDocument@tinyxml2@@QAEPAVXMLText@2@PBD@Z ?NewUnknown@XMLDocument@tinyxml2@@QAEPAVXMLUnknown@2@PBD@Z ?Next@XMLAttribute@tinyxml2@@QBEPBV12@XZ ?NextSibling@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?NextSibling@XMLHandle@tinyxml2@@QAE?AV12@XZ ?NextSibling@XMLNode@tinyxml2@@QAEPAV12@XZ ?NextSibling@XMLNode@tinyxml2@@QBEPBV12@XZ ?NextSiblingElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?NextSiblingElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?NextSiblingElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?NextSiblingElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?NoChildren@XMLNode@tinyxml2@@QBE_NXZ ?OpenElement@XMLPrinter@tinyxml2@@QAEXPBD@Z ?Parent@XMLNode@tinyxml2@@QAEPAV12@XZ ?Parent@XMLNode@tinyxml2@@QBEPBV12@XZ ?Parse@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PBDI@Z ?ParseAttributes@XMLElement@tinyxml2@@AAEPADPAD@Z ?ParseDeep@XMLAttribute@tinyxml2@@AAEPADPAD_N@Z ?ParseDeep@XMLComment@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLDeclaration@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLElement@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLNode@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLText@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLUnknown@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseName@StrPair@tinyxml2@@QAEPADPAD@Z ?ParseText@StrPair@tinyxml2@@QAEPADPADPBDH@Z ?Pop@?$DynArray@PBD$09@tinyxml2@@QAEPBDXZ ?PreviousSibling@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?PreviousSibling@XMLHandle@tinyxml2@@QAE?AV12@XZ ?PreviousSibling@XMLNode@tinyxml2@@QAEPAV12@XZ ?PreviousSibling@XMLNode@tinyxml2@@QBEPBV12@XZ ?PreviousSiblingElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?PreviousSiblingElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?PreviousSiblingElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?PreviousSiblingElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?Print@XMLDocument@tinyxml2@@QAEXPAVXMLPrinter@2@@Z ?Print@XMLPrinter@tinyxml2@@AAAXPBDZZ ?PrintError@XMLDocument@tinyxml2@@QBEXXZ ?PrintSpace@XMLPrinter@tinyxml2@@AAEXH@Z ?PrintString@XMLPrinter@tinyxml2@@AAEXPBD_N@Z ?ProcessEntities@XMLDocument@tinyxml2@@QBE_NXZ ?Push@?$DynArray@D$0BE@@tinyxml2@@QAEXD@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0CE@@2@@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0CM@@2@@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0DA@@2@@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0DE@@2@@Z ?Push@?$DynArray@PBD$09@tinyxml2@@QAEXPBD@Z ?PushArr@?$DynArray@D$0BE@@tinyxml2@@QAEPADH@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBD0@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBDH@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBDI@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBDN@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBD_N@Z ?PushComment@XMLPrinter@tinyxml2@@QAEXPBD@Z ?PushDeclaration@XMLPrinter@tinyxml2@@QAEXPBD@Z ?PushHeader@XMLPrinter@tinyxml2@@QAEX_N0@Z ?PushText@XMLPrinter@tinyxml2@@QAEXH@Z ?PushText@XMLPrinter@tinyxml2@@QAEXI@Z ?PushText@XMLPrinter@tinyxml2@@QAEXM@Z ?PushText@XMLPrinter@tinyxml2@@QAEXN@Z ?PushText@XMLPrinter@tinyxml2@@QAEXPBD_N@Z ?PushText@XMLPrinter@tinyxml2@@QAEX_N@Z ?PushUnknown@XMLPrinter@tinyxml2@@QAEXPBD@Z ?QueryBoolAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPA_N@Z ?QueryBoolText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PA_N@Z ?QueryBoolValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PA_N@Z ?QueryDoubleAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAN@Z ?QueryDoubleText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAN@Z ?QueryDoubleValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAN@Z ?QueryFloatAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAM@Z ?QueryFloatText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAM@Z ?QueryFloatValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAM@Z ?QueryIntAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAH@Z ?QueryIntText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAH@Z ?QueryIntValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAH@Z ?QueryUnsignedAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAI@Z ?QueryUnsignedText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAI@Z ?QueryUnsignedValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAI@Z ?ReadBOM@XMLUtil@tinyxml2@@SAPBDPBDPA_N@Z ?Reset@StrPair@tinyxml2@@AAEXXZ ?RootElement@XMLDocument@tinyxml2@@QAEPAVXMLElement@2@XZ ?RootElement@XMLDocument@tinyxml2@@QBEPBVXMLElement@2@XZ ?SaveFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PAU_iobuf@@_N@Z ?SaveFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PBD_N@Z ?SealElement@XMLPrinter@tinyxml2@@AAEXXZ ?Set@StrPair@tinyxml2@@QAEXPAD0H@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXH@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXI@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXM@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXN@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXPBD@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEX_N@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBD0@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBDH@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBDI@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBDN@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBD_N@Z ?SetBOM@XMLDocument@tinyxml2@@QAEX_N@Z ?SetCData@XMLText@tinyxml2@@QAEX_N@Z ?SetError@XMLDocument@tinyxml2@@QAEXW4XMLError@2@PBD1@Z ?SetInternedStr@StrPair@tinyxml2@@QAEXPBD@Z ?SetName@XMLAttribute@tinyxml2@@AAEXPBD@Z ?SetName@XMLElement@tinyxml2@@QAEXPBD_N@Z ?SetStr@StrPair@tinyxml2@@QAEXPBDH@Z ?SetTracked@?$MemPoolT@$0CE@@tinyxml2@@UAEXXZ ?SetTracked@?$MemPoolT@$0CM@@tinyxml2@@UAEXXZ ?SetTracked@?$MemPoolT@$0DA@@tinyxml2@@UAEXXZ ?SetTracked@?$MemPoolT@$0DE@@tinyxml2@@UAEXXZ ?SetValue@XMLNode@tinyxml2@@QAEXPBD_N@Z ?ShallowClone@XMLComment@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLDeclaration@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLDocument@tinyxml2@@UBEPAVXMLNode@2@PAV12@@Z ?ShallowClone@XMLElement@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLText@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLUnknown@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowEqual@XMLComment@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLDeclaration@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLDocument@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLElement@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLText@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLUnknown@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?Size@?$DynArray@D$0BE@@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?SkipWhiteSpace@XMLUtil@tinyxml2@@SAPADPAD@Z ?SkipWhiteSpace@XMLUtil@tinyxml2@@SAPBDPBD@Z ?StringEqual@XMLUtil@tinyxml2@@SA_NPBD0H@Z ?ToBool@XMLUtil@tinyxml2@@SA_NPBDPA_N@Z ?ToComment@XMLComment@tinyxml2@@UAEPAV12@XZ ?ToComment@XMLComment@tinyxml2@@UBEPBV12@XZ ?ToComment@XMLNode@tinyxml2@@UAEPAVXMLComment@2@XZ ?ToComment@XMLNode@tinyxml2@@UBEPBVXMLComment@2@XZ ?ToDeclaration@XMLConstHandle@tinyxml2@@QBEPBVXMLDeclaration@2@XZ ?ToDeclaration@XMLDeclaration@tinyxml2@@UAEPAV12@XZ ?ToDeclaration@XMLDeclaration@tinyxml2@@UBEPBV12@XZ ?ToDeclaration@XMLHandle@tinyxml2@@QAEPAVXMLDeclaration@2@XZ ?ToDeclaration@XMLNode@tinyxml2@@UAEPAVXMLDeclaration@2@XZ ?ToDeclaration@XMLNode@tinyxml2@@UBEPBVXMLDeclaration@2@XZ ?ToDocument@XMLDocument@tinyxml2@@UAEPAV12@XZ ?ToDocument@XMLDocument@tinyxml2@@UBEPBV12@XZ ?ToDocument@XMLNode@tinyxml2@@UAEPAVXMLDocument@2@XZ ?ToDocument@XMLNode@tinyxml2@@UBEPBVXMLDocument@2@XZ ?ToDouble@XMLUtil@tinyxml2@@SA_NPBDPAN@Z ?ToElement@XMLConstHandle@tinyxml2@@QBEPBVXMLElement@2@XZ ?ToElement@XMLElement@tinyxml2@@UAEPAV12@XZ ?ToElement@XMLElement@tinyxml2@@UBEPBV12@XZ ?ToElement@XMLHandle@tinyxml2@@QAEPAVXMLElement@2@XZ ?ToElement@XMLNode@tinyxml2@@UAEPAVXMLElement@2@XZ ?ToElement@XMLNode@tinyxml2@@UBEPBVXMLElement@2@XZ ?ToFloat@XMLUtil@tinyxml2@@SA_NPBDPAM@Z ?ToInt@XMLUtil@tinyxml2@@SA_NPBDPAH@Z ?ToNode@XMLConstHandle@tinyxml2@@QBEPBVXMLNode@2@XZ ?ToNode@XMLHandle@tinyxml2@@QAEPAVXMLNode@2@XZ ?ToStr@XMLUtil@tinyxml2@@SAXHPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAXIPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAXMPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAXNPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAX_NPADH@Z ?ToText@XMLConstHandle@tinyxml2@@QBEPBVXMLText@2@XZ ?ToText@XMLHandle@tinyxml2@@QAEPAVXMLText@2@XZ ?ToText@XMLNode@tinyxml2@@UAEPAVXMLText@2@XZ ?ToText@XMLNode@tinyxml2@@UBEPBVXMLText@2@XZ ?ToText@XMLText@tinyxml2@@UAEPAV12@XZ ?ToText@XMLText@tinyxml2@@UBEPBV12@XZ ?ToUnknown@XMLConstHandle@tinyxml2@@QBEPBVXMLUnknown@2@XZ ?ToUnknown@XMLHandle@tinyxml2@@QAEPAVXMLUnknown@2@XZ ?ToUnknown@XMLNode@tinyxml2@@UAEPAVXMLUnknown@2@XZ ?ToUnknown@XMLNode@tinyxml2@@UBEPBVXMLUnknown@2@XZ ?ToUnknown@XMLUnknown@tinyxml2@@UAEPAV12@XZ ?ToUnknown@XMLUnknown@tinyxml2@@UBEPBV12@XZ ?ToUnsigned@XMLUtil@tinyxml2@@SA_NPBDPAI@Z ?Unlink@XMLNode@tinyxml2@@AAEXPAV12@@Z ?UnsignedAttribute@XMLElement@tinyxml2@@QBEIPBD@Z ?UnsignedValue@XMLAttribute@tinyxml2@@QBEIXZ ?Value@XMLAttribute@tinyxml2@@QBEPBDXZ ?Value@XMLNode@tinyxml2@@QBEPBDXZ ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLComment@2@@Z ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLDeclaration@2@@Z ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLText@2@@Z ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLUnknown@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLComment@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLDeclaration@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLText@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLUnknown@2@@Z ?VisitEnter@XMLPrinter@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitEnter@XMLPrinter@tinyxml2@@UAE_NABVXMLElement@2@PBVXMLAttribute@2@@Z ?VisitEnter@XMLVisitor@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitEnter@XMLVisitor@tinyxml2@@UAE_NABVXMLElement@2@PBVXMLAttribute@2@@Z ?VisitExit@XMLPrinter@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitExit@XMLPrinter@tinyxml2@@UAE_NABVXMLElement@2@@Z ?VisitExit@XMLVisitor@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitExit@XMLVisitor@tinyxml2@@UAE_NABVXMLElement@2@@Z ?WhitespaceMode@XMLDocument@tinyxml2@@QBE?AW4Whitespace@2@XZ

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

474KB

Virtual Size

474KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

61KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

154KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

876KB

Virtual Size

880KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=26, id=259, version=25711,

count=216, id=261, version=25711,

count=6, id=261, productName=VS2017 v15.7.4 build 26431, version=26431,

count=6, id=199, version=41118,

count=26, id=259, version=26706,

count=137, id=261, version=26706,

count=38, id=260, version=26706,

count=28, id=260, version=25711,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=104, id=260, version=27034,

count=2, id=257, version=27044,

count=3, productName=Unmarked objects (old),

count=72, id=261, version=27031,

count=25, id=257, version=25711,

count=361, id=1, productName=Unmarked objects,

count=83, id=265, version=27027,

count=1, id=256, productName=VS2017 v15.9.7 build 27027, version=27027,

count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,

count=1, id=151,

count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,