2026-10-22_39dee3283741a0e447bc7d1acd304059_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_39dee3283741a0e447bc7d1acd304059_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat
Size 3.9MB
Sample261024-tstanavydx
SHA256 e9f0b8e8fd414fd9f7d9872f2729d5f337b794c7dd00c6d5e26dd7ef2ed99bb6
MD5 39dee3283741a0e447bc7d1acd304059
SHA1 0d0c74229d4fab2c9b878d91dc245e23e9b5d2b8
SHA512 d1729bf3710e8581c0ee86023f4b46059d7b21be79a73a50db97810ee87a40e3a56c086e894d26b2773cc41dfe0f05c0f24b845c547bc7d22300eb8f1691bd79
SSDEEP 98304:uq+pJq2myHluY4/Fn5tYCcMfeJlCCYxOJTy:Ga2m4lur/Fn5tQxJ+
TLSH
T1ED16AF217606C036E59201B15C6CAFBE849CAD351B7555C7B3C83F7E69B01E32B36A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_39dee3283741a0e447bc7d1acd304059_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

File Explorer

2026-10-22_39dee3283741a0e447bc7d1acd304059_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

.exe 3.9MB

2026-10-22_39dee3283741a0e447bc7d1acd304059_amadey_darkgate_elex_glassworm_luca-stealer_lynx_magniber_medusalocker_njrat

IMPHASH eb9916fde6b8c6a525ac67eda243585e
SHA256 e9f0b8e8fd414fd9f7d9872f2729d5f337b794c7dd00c6d5e26dd7ef2ed99bb6
MD5 39dee3283741a0e447bc7d1acd304059
SHA1 0d0c74229d4fab2c9b878d91dc245e23e9b5d2b8
SHA512 d1729bf3710e8581c0ee86023f4b46059d7b21be79a73a50db97810ee87a40e3a56c086e894d26b2773cc41dfe0f05c0f24b845c547bc7d22300eb8f1691bd79
SSDEEP 98304:uq+pJq2myHluY4/Fn5tYCcMfeJlCCYxOJTy:Ga2m4lur/Fn5tQxJ+
TLSH
T1ED16AF217606C036E59201B15C6CAFBE849CAD351B7555C7B3C83F7E69B01E32B36A2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2019507

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\apps\jenkins-slave\workspace\yeti-agent_yeti2-proxy\yeti2-proxy-global_devel_global\bin\Release\purpleonp.pdb

ws2_32

__WSAFDIsSet WSAIoctl getsockname connect ioctlsocket freeaddrinfo recv inet_ntoa recvfrom gethostname sendto select ntohs WSACleanup WSASend ntohl shutdown WSASetLastError WSAStringToAddressW WSASocketW WSAStartup getpeername WSAAddressToStringW WSARecv getsockopt htonl htons setsockopt accept bind closesocket listen getaddrinfo send socket WSAGetLastError

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

iphlpapi

GetAdaptersAddresses GetTcpTable2

shlwapi

PathFindFileNameA PathFileExistsW PathCanonicalizeW PathRemoveFileSpecW

nccrashreporter_win32

SetAppExtraData initializeWithCallback

wldap32

ord301 ord147 ord133 ord79 ord142 ord167 ord127 ord27 ord26 ord117 ord41 ord208 ord73 ord46 ord14 ord216 ord219 ord145

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertAddCertificateContextToStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

libeay32

ord1882 ord2925 ord4144 ord66 ord281 ord279 ord4372 ord2712 ord269 ord3315 ord400 ord283

kernel32

InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore GetVersionExW FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber QueryDepthSList ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue OutputDebugStringW LocalFree MoveFileExW GetCurrentDirectoryW UnregisterWaitEx RtlUnwind SetStdHandle GetConsoleMode ReadConsoleW GetConsoleCP ExitThread GetModuleHandleExW GetDriveTypeW SystemTimeToTzSpecificLocalTime DeleteTimerQueueTimer GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead ResetEvent GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo EncodePointer GetExitCodeThread SwitchToThread GetStringTypeW CreateHardLinkW AreFileApisANSI SetFilePointerEx SetEndOfFile GetFileInformationByHandle GetTickCount WaitForSingleObject CloseHandle CreateProcessW CreateDirectoryW FindFirstFileW GetFullPathNameW FindNextFileW RemoveDirectoryW GetTempPathW FindClose GetFileAttributesW SetFileAttributesW DeleteFileW lstrcmpW WriteConsoleW FormatMessageW GetLastError WideCharToMultiByte GetCommandLineW GetCurrentProcessId AllocConsole MoveFileW GetModuleHandleW GetSystemTimeAsFileTime HeapFree InitializeCriticalSectionEx HeapSize HeapReAlloc RaiseException HeapAlloc DecodePointer DeleteCriticalSection GetProcessHeap MultiByteToWideChar FormatMessageA Sleep GetThreadId SetWaitableTimer TlsSetValue SetLastError EnterCriticalSection CreateWaitableTimerW WaitForMultipleObjects InitializeCriticalSectionAndSpinCount LeaveCriticalSection GetQueuedCompletionStatus GetModuleHandleA PostQueuedCompletionStatus CreateEventW SetEvent TerminateThread TlsAlloc QueueUserAPC GetProcAddress VerSetConditionMask SleepEx VerifyVersionInfoW TlsGetValue TlsFree CreateIoCompletionPort GetModuleFileNameA QueryDosDeviceW GetCurrentProcess lstrlenW WriteFile TerminateProcess K32GetModuleFileNameExW SetFilePointer CreateFileW GetCurrentThreadId K32GetProcessImageFileNameW UnmapViewOfFile DuplicateHandle OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW K32EnumProcesses CreateFileMappingA CopyFileW CreateRemoteThread CreateProcessA MapViewOfFile IsWow64Process GetExitCodeProcess CreateThread GetModuleFileNameW CreateMutexW ReleaseMutex GetCommandLineA GetTickCount64 GetCurrentThread SetCurrentDirectoryW QueryPerformanceCounter QueryPerformanceFrequency GetThreadTimes GetDiskFreeSpaceExW InitializeCriticalSection GetSystemDirectoryW FreeLibrary LoadLibraryW WaitForSingleObjectEx ExpandEnvironmentStringsA GetStdHandle GetFileType ReadFile PeekNamedPipe GetFileSizeEx SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree VirtualQuery LoadLibraryExA LoadLibraryExW GetFileAttributesExW FindFirstFileExW TryEnterCriticalSection FileTimeToSystemTime ExitProcess SetEnvironmentVariableW FlushFileBuffers GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW FreeConsole lstrcpyW

user32

PostQuitMessage SetWindowLongW LoadCursorW TranslateMessage DispatchMessageW RegisterClassExW GetWindowThreadProcessId DefWindowProcW GetMessageW GetWindowLongW PostThreadMessageW PeekMessageW KillTimer FindWindowW SetTimer SendMessageW PostMessageW CreateWindowExW

advapi32

RegQueryValueExW RegSetValueExW RegCreateKeyExW RegCloseKey CryptReleaseContext CryptGenRandom CryptAcquireContextW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt RegOpenKeyExW

ole32

CoUninitialize CoInitialize

mswsock

GetAcceptExSockaddrs AcceptEx

??0?$DynArray@D$0BE@@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??0?$DynArray@PBD$09@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0CE@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0CE@@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0CM@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0CM@@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0DA@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0DA@@tinyxml2@@QAE@XZ ??0?$MemPoolT@$0DE@@tinyxml2@@QAE@ABV01@@Z ??0?$MemPoolT@$0DE@@tinyxml2@@QAE@XZ ??0MemPool@tinyxml2@@QAE@ABV01@@Z ??0MemPool@tinyxml2@@QAE@XZ ??0StrPair@tinyxml2@@QAE@XZ ??0XMLAttribute@tinyxml2@@AAE@XZ ??0XMLComment@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLConstHandle@tinyxml2@@QAE@ABV01@@Z ??0XMLConstHandle@tinyxml2@@QAE@ABVXMLNode@1@@Z ??0XMLConstHandle@tinyxml2@@QAE@PBVXMLNode@1@@Z ??0XMLDeclaration@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLDocument@tinyxml2@@QAE@_NW4Whitespace@1@@Z ??0XMLElement@tinyxml2@@AAE@PAVXMLDocument@1@@Z ??0XMLHandle@tinyxml2@@QAE@AAVXMLNode@1@@Z ??0XMLHandle@tinyxml2@@QAE@ABV01@@Z ??0XMLHandle@tinyxml2@@QAE@PAVXMLNode@1@@Z ??0XMLNode@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLPrinter@tinyxml2@@QAE@ABV01@@Z ??0XMLPrinter@tinyxml2@@QAE@PAU_iobuf@@_N@Z ??0XMLText@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLUnknown@tinyxml2@@IAE@PAVXMLDocument@1@@Z ??0XMLVisitor@tinyxml2@@QAE@ABV01@@Z ??0XMLVisitor@tinyxml2@@QAE@XZ ??1?$DynArray@D$0BE@@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAE@XZ ??1?$DynArray@PBD$09@tinyxml2@@QAE@XZ ??1?$MemPoolT@$0CE@@tinyxml2@@UAE@XZ ??1?$MemPoolT@$0CM@@tinyxml2@@UAE@XZ ??1?$MemPoolT@$0DA@@tinyxml2@@UAE@XZ ??1?$MemPoolT@$0DE@@tinyxml2@@UAE@XZ ??1MemPool@tinyxml2@@UAE@XZ ??1StrPair@tinyxml2@@QAE@XZ ??1XMLAttribute@tinyxml2@@EAE@XZ ??1XMLComment@tinyxml2@@MAE@XZ ??1XMLDeclaration@tinyxml2@@MAE@XZ ??1XMLDocument@tinyxml2@@UAE@XZ ??1XMLElement@tinyxml2@@EAE@XZ ??1XMLNode@tinyxml2@@MAE@XZ ??1XMLPrinter@tinyxml2@@UAE@XZ ??1XMLText@tinyxml2@@MAE@XZ ??1XMLUnknown@tinyxml2@@MAE@XZ ??1XMLVisitor@tinyxml2@@UAE@XZ ??4?$DynArray@D$0BE@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$DynArray@PBD$09@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0CE@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0CM@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0DA@@tinyxml2@@QAEAAV01@ABV01@@Z ??4?$MemPoolT@$0DE@@tinyxml2@@QAEAAV01@ABV01@@Z ??4MemPool@tinyxml2@@QAEAAV01@ABV01@@Z ??4StrPair@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLConstHandle@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLHandle@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLPrinter@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLUtil@tinyxml2@@QAEAAV01@$$QAV01@@Z ??4XMLUtil@tinyxml2@@QAEAAV01@ABV01@@Z ??4XMLVisitor@tinyxml2@@QAEAAV01@ABV01@@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0CE@@1@H@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0CM@@1@H@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0DA@@1@H@Z ??A?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAEAAPAUBlock@?$MemPoolT@$0DE@@1@H@Z ??_7?$MemPoolT@$0CE@@tinyxml2@@6B@ ??_7?$MemPoolT@$0CM@@tinyxml2@@6B@ ??_7?$MemPoolT@$0DA@@tinyxml2@@6B@ ??_7?$MemPoolT@$0DE@@tinyxml2@@6B@ ??_7MemPool@tinyxml2@@6B@ ??_7XMLAttribute@tinyxml2@@6B@ ??_7XMLComment@tinyxml2@@6B@ ??_7XMLDeclaration@tinyxml2@@6B@ ??_7XMLDocument@tinyxml2@@6B@ ??_7XMLElement@tinyxml2@@6B@ ??_7XMLNode@tinyxml2@@6B@ ??_7XMLPrinter@tinyxml2@@6B@ ??_7XMLText@tinyxml2@@6B@ ??_7XMLUnknown@tinyxml2@@6B@ ??_7XMLVisitor@tinyxml2@@6B@ ??_FXMLDocument@tinyxml2@@QAEXXZ ??_FXMLPrinter@tinyxml2@@QAEXXZ ?Accept@XMLComment@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLDeclaration@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLDocument@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLElement@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLText@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Accept@XMLUnknown@tinyxml2@@UBE_NPAVXMLVisitor@2@@Z ?Alloc@?$MemPoolT@$0CE@@tinyxml2@@UAEPAXXZ ?Alloc@?$MemPoolT@$0CM@@tinyxml2@@UAEPAXXZ ?Alloc@?$MemPoolT@$0DA@@tinyxml2@@UAEPAXXZ ?Alloc@?$MemPoolT@$0DE@@tinyxml2@@UAEPAXXZ ?Attribute@XMLElement@tinyxml2@@QBEPBDPBD0@Z ?BoolAttribute@XMLElement@tinyxml2@@QBE_NPBD@Z ?BoolValue@XMLAttribute@tinyxml2@@QBE_NXZ ?CData@XMLText@tinyxml2@@QBE_NXZ ?CStr@XMLPrinter@tinyxml2@@QBEPBDXZ ?CStrSize@XMLPrinter@tinyxml2@@QBEHXZ ?CloseElement@XMLPrinter@tinyxml2@@QAEXXZ ?ClosingType@XMLElement@tinyxml2@@QBEHXZ ?CollapseWhitespace@StrPair@tinyxml2@@AAEXXZ ?ConvertUTF32ToUTF8@XMLUtil@tinyxml2@@SAXKPADPAH@Z ?DeleteAttribute@XMLElement@tinyxml2@@QAEXPBD@Z ?DeleteChild@XMLNode@tinyxml2@@QAEXPAV12@@Z ?DeleteChildren@XMLNode@tinyxml2@@QAEXXZ ?DeleteNode@XMLDocument@tinyxml2@@QAEXPAVXMLNode@2@@Z ?DoubleAttribute@XMLElement@tinyxml2@@QBENPBD@Z ?DoubleValue@XMLAttribute@tinyxml2@@QBENXZ ?Empty@StrPair@tinyxml2@@QBE_NXZ ?EnsureCapacity@?$DynArray@D$0BE@@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@AAEXH@Z ?EnsureCapacity@?$DynArray@PBD$09@tinyxml2@@AAEXH@Z ?Error@XMLDocument@tinyxml2@@QBE_NXZ ?ErrorID@XMLDocument@tinyxml2@@QBE?AW4XMLError@2@XZ ?FindAttribute@XMLElement@tinyxml2@@AAEPAVXMLAttribute@2@PBD@Z ?FindAttribute@XMLElement@tinyxml2@@QBEPBVXMLAttribute@2@PBD@Z ?FindOrCreateAttribute@XMLElement@tinyxml2@@AAEPAVXMLAttribute@2@PBD@Z ?FirstAttribute@XMLElement@tinyxml2@@QBEPBVXMLAttribute@2@XZ ?FirstChild@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?FirstChild@XMLHandle@tinyxml2@@QAE?AV12@XZ ?FirstChild@XMLNode@tinyxml2@@QAEPAV12@XZ ?FirstChild@XMLNode@tinyxml2@@QBEPBV12@XZ ?FirstChildElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?FirstChildElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?FirstChildElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?FirstChildElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?FloatAttribute@XMLElement@tinyxml2@@QBEMPBD@Z ?FloatValue@XMLAttribute@tinyxml2@@QBEMXZ ?Free@?$MemPoolT@$0CE@@tinyxml2@@UAEXPAX@Z ?Free@?$MemPoolT@$0CM@@tinyxml2@@UAEXPAX@Z ?Free@?$MemPoolT@$0DA@@tinyxml2@@UAEXPAX@Z ?Free@?$MemPoolT@$0DE@@tinyxml2@@UAEXPAX@Z ?GetCharacterRef@XMLUtil@tinyxml2@@SAPBDPBDPADPAH@Z ?GetDocument@XMLNode@tinyxml2@@QAEPAVXMLDocument@2@XZ ?GetDocument@XMLNode@tinyxml2@@QBEPBVXMLDocument@2@XZ ?GetErrorStr1@XMLDocument@tinyxml2@@QBEPBDXZ ?GetErrorStr2@XMLDocument@tinyxml2@@QBEPBDXZ ?GetStr@StrPair@tinyxml2@@QAEPBDXZ ?GetText@XMLElement@tinyxml2@@QBEPBDXZ ?HasBOM@XMLDocument@tinyxml2@@QBE_NXZ ?Identify@XMLDocument@tinyxml2@@QAEPADPADPAPAVXMLNode@2@@Z ?InitDocument@XMLDocument@tinyxml2@@AAEXXZ ?InsertAfterChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@0@Z ?InsertEndChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@@Z ?InsertFirstChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@@Z ?IntAttribute@XMLElement@tinyxml2@@QBEHPBD@Z ?IntValue@XMLAttribute@tinyxml2@@QBEHXZ ?IsAlpha@XMLUtil@tinyxml2@@SAHE@Z ?IsAlphaNum@XMLUtil@tinyxml2@@SAHE@Z ?IsUTF8Continuation@XMLUtil@tinyxml2@@SAHD@Z ?IsWhiteSpace@XMLUtil@tinyxml2@@SA_ND@Z ?ItemSize@?$MemPoolT@$0CE@@tinyxml2@@UBEHXZ ?ItemSize@?$MemPoolT@$0CM@@tinyxml2@@UBEHXZ ?ItemSize@?$MemPoolT@$0DA@@tinyxml2@@UBEHXZ ?ItemSize@?$MemPoolT@$0DE@@tinyxml2@@UBEHXZ ?LastChild@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?LastChild@XMLHandle@tinyxml2@@QAE?AV12@XZ ?LastChild@XMLNode@tinyxml2@@QAEPAV12@XZ ?LastChild@XMLNode@tinyxml2@@QBEPBV12@XZ ?LastChildElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?LastChildElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?LastChildElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?LastChildElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?LinkEndChild@XMLNode@tinyxml2@@QAEPAV12@PAV12@@Z ?LoadFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PAU_iobuf@@@Z ?LoadFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PBD@Z ?Mem@?$DynArray@D$0BE@@tinyxml2@@QBEPBDXZ ?Name@XMLAttribute@tinyxml2@@QBEPBDXZ ?Name@XMLElement@tinyxml2@@QBEPBDXZ ?NewComment@XMLDocument@tinyxml2@@QAEPAVXMLComment@2@PBD@Z ?NewDeclaration@XMLDocument@tinyxml2@@QAEPAVXMLDeclaration@2@PBD@Z ?NewElement@XMLDocument@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?NewText@XMLDocument@tinyxml2@@QAEPAVXMLText@2@PBD@Z ?NewUnknown@XMLDocument@tinyxml2@@QAEPAVXMLUnknown@2@PBD@Z ?Next@XMLAttribute@tinyxml2@@QBEPBV12@XZ ?NextSibling@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?NextSibling@XMLHandle@tinyxml2@@QAE?AV12@XZ ?NextSibling@XMLNode@tinyxml2@@QAEPAV12@XZ ?NextSibling@XMLNode@tinyxml2@@QBEPBV12@XZ ?NextSiblingElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?NextSiblingElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?NextSiblingElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?NextSiblingElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?NoChildren@XMLNode@tinyxml2@@QBE_NXZ ?OpenElement@XMLPrinter@tinyxml2@@QAEXPBD@Z ?Parent@XMLNode@tinyxml2@@QAEPAV12@XZ ?Parent@XMLNode@tinyxml2@@QBEPBV12@XZ ?Parse@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PBDI@Z ?ParseAttributes@XMLElement@tinyxml2@@AAEPADPAD@Z ?ParseDeep@XMLAttribute@tinyxml2@@AAEPADPAD_N@Z ?ParseDeep@XMLComment@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLDeclaration@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLElement@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLNode@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLText@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseDeep@XMLUnknown@tinyxml2@@UAEPADPADPAVStrPair@2@@Z ?ParseName@StrPair@tinyxml2@@QAEPADPAD@Z ?ParseText@StrPair@tinyxml2@@QAEPADPADPBDH@Z ?Pop@?$DynArray@PBD$09@tinyxml2@@QAEPBDXZ ?PreviousSibling@XMLConstHandle@tinyxml2@@QBE?BV12@XZ ?PreviousSibling@XMLHandle@tinyxml2@@QAE?AV12@XZ ?PreviousSibling@XMLNode@tinyxml2@@QAEPAV12@XZ ?PreviousSibling@XMLNode@tinyxml2@@QBEPBV12@XZ ?PreviousSiblingElement@XMLConstHandle@tinyxml2@@QBE?BV12@PBD@Z ?PreviousSiblingElement@XMLHandle@tinyxml2@@QAE?AV12@PBD@Z ?PreviousSiblingElement@XMLNode@tinyxml2@@QAEPAVXMLElement@2@PBD@Z ?PreviousSiblingElement@XMLNode@tinyxml2@@QBEPBVXMLElement@2@PBD@Z ?Print@XMLDocument@tinyxml2@@QAEXPAVXMLPrinter@2@@Z ?Print@XMLPrinter@tinyxml2@@AAAXPBDZZ ?PrintError@XMLDocument@tinyxml2@@QBEXXZ ?PrintSpace@XMLPrinter@tinyxml2@@AAEXH@Z ?PrintString@XMLPrinter@tinyxml2@@AAEXPBD_N@Z ?ProcessEntities@XMLDocument@tinyxml2@@QBE_NXZ ?Push@?$DynArray@D$0BE@@tinyxml2@@QAEXD@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0CE@@2@@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0CM@@2@@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0DA@@2@@Z ?Push@?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QAEXPAUBlock@?$MemPoolT@$0DE@@2@@Z ?Push@?$DynArray@PBD$09@tinyxml2@@QAEXPBD@Z ?PushArr@?$DynArray@D$0BE@@tinyxml2@@QAEPADH@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBD0@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBDH@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBDI@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBDN@Z ?PushAttribute@XMLPrinter@tinyxml2@@QAEXPBD_N@Z ?PushComment@XMLPrinter@tinyxml2@@QAEXPBD@Z ?PushDeclaration@XMLPrinter@tinyxml2@@QAEXPBD@Z ?PushHeader@XMLPrinter@tinyxml2@@QAEX_N0@Z ?PushText@XMLPrinter@tinyxml2@@QAEXH@Z ?PushText@XMLPrinter@tinyxml2@@QAEXI@Z ?PushText@XMLPrinter@tinyxml2@@QAEXM@Z ?PushText@XMLPrinter@tinyxml2@@QAEXN@Z ?PushText@XMLPrinter@tinyxml2@@QAEXPBD_N@Z ?PushText@XMLPrinter@tinyxml2@@QAEX_N@Z ?PushUnknown@XMLPrinter@tinyxml2@@QAEXPBD@Z ?QueryBoolAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPA_N@Z ?QueryBoolText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PA_N@Z ?QueryBoolValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PA_N@Z ?QueryDoubleAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAN@Z ?QueryDoubleText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAN@Z ?QueryDoubleValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAN@Z ?QueryFloatAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAM@Z ?QueryFloatText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAM@Z ?QueryFloatValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAM@Z ?QueryIntAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAH@Z ?QueryIntText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAH@Z ?QueryIntValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAH@Z ?QueryUnsignedAttribute@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PBDPAI@Z ?QueryUnsignedText@XMLElement@tinyxml2@@QBE?AW4XMLError@2@PAI@Z ?QueryUnsignedValue@XMLAttribute@tinyxml2@@QBE?AW4XMLError@2@PAI@Z ?ReadBOM@XMLUtil@tinyxml2@@SAPBDPBDPA_N@Z ?Reset@StrPair@tinyxml2@@AAEXXZ ?RootElement@XMLDocument@tinyxml2@@QAEPAVXMLElement@2@XZ ?RootElement@XMLDocument@tinyxml2@@QBEPBVXMLElement@2@XZ ?SaveFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PAU_iobuf@@_N@Z ?SaveFile@XMLDocument@tinyxml2@@QAE?AW4XMLError@2@PBD_N@Z ?SealElement@XMLPrinter@tinyxml2@@AAEXXZ ?Set@StrPair@tinyxml2@@QAEXPAD0H@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXH@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXI@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXM@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXN@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEXPBD@Z ?SetAttribute@XMLAttribute@tinyxml2@@QAEX_N@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBD0@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBDH@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBDI@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBDN@Z ?SetAttribute@XMLElement@tinyxml2@@QAEXPBD_N@Z ?SetBOM@XMLDocument@tinyxml2@@QAEX_N@Z ?SetCData@XMLText@tinyxml2@@QAEX_N@Z ?SetError@XMLDocument@tinyxml2@@QAEXW4XMLError@2@PBD1@Z ?SetInternedStr@StrPair@tinyxml2@@QAEXPBD@Z ?SetName@XMLAttribute@tinyxml2@@AAEXPBD@Z ?SetName@XMLElement@tinyxml2@@QAEXPBD_N@Z ?SetStr@StrPair@tinyxml2@@QAEXPBDH@Z ?SetTracked@?$MemPoolT@$0CE@@tinyxml2@@UAEXXZ ?SetTracked@?$MemPoolT@$0CM@@tinyxml2@@UAEXXZ ?SetTracked@?$MemPoolT@$0DA@@tinyxml2@@UAEXXZ ?SetTracked@?$MemPoolT@$0DE@@tinyxml2@@UAEXXZ ?SetValue@XMLNode@tinyxml2@@QAEXPBD_N@Z ?ShallowClone@XMLComment@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLDeclaration@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLDocument@tinyxml2@@UBEPAVXMLNode@2@PAV12@@Z ?ShallowClone@XMLElement@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLText@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowClone@XMLUnknown@tinyxml2@@UBEPAVXMLNode@2@PAVXMLDocument@2@@Z ?ShallowEqual@XMLComment@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLDeclaration@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLDocument@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLElement@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLText@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?ShallowEqual@XMLUnknown@tinyxml2@@UBE_NPBVXMLNode@2@@Z ?Size@?$DynArray@D$0BE@@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0CE@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0CM@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0DA@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?Size@?$DynArray@PAUBlock@?$MemPoolT@$0DE@@tinyxml2@@$09@tinyxml2@@QBEHXZ ?SkipWhiteSpace@XMLUtil@tinyxml2@@SAPADPAD@Z ?SkipWhiteSpace@XMLUtil@tinyxml2@@SAPBDPBD@Z ?StringEqual@XMLUtil@tinyxml2@@SA_NPBD0H@Z ?ToBool@XMLUtil@tinyxml2@@SA_NPBDPA_N@Z ?ToComment@XMLComment@tinyxml2@@UAEPAV12@XZ ?ToComment@XMLComment@tinyxml2@@UBEPBV12@XZ ?ToComment@XMLNode@tinyxml2@@UAEPAVXMLComment@2@XZ ?ToComment@XMLNode@tinyxml2@@UBEPBVXMLComment@2@XZ ?ToDeclaration@XMLConstHandle@tinyxml2@@QBEPBVXMLDeclaration@2@XZ ?ToDeclaration@XMLDeclaration@tinyxml2@@UAEPAV12@XZ ?ToDeclaration@XMLDeclaration@tinyxml2@@UBEPBV12@XZ ?ToDeclaration@XMLHandle@tinyxml2@@QAEPAVXMLDeclaration@2@XZ ?ToDeclaration@XMLNode@tinyxml2@@UAEPAVXMLDeclaration@2@XZ ?ToDeclaration@XMLNode@tinyxml2@@UBEPBVXMLDeclaration@2@XZ ?ToDocument@XMLDocument@tinyxml2@@UAEPAV12@XZ ?ToDocument@XMLDocument@tinyxml2@@UBEPBV12@XZ ?ToDocument@XMLNode@tinyxml2@@UAEPAVXMLDocument@2@XZ ?ToDocument@XMLNode@tinyxml2@@UBEPBVXMLDocument@2@XZ ?ToDouble@XMLUtil@tinyxml2@@SA_NPBDPAN@Z ?ToElement@XMLConstHandle@tinyxml2@@QBEPBVXMLElement@2@XZ ?ToElement@XMLElement@tinyxml2@@UAEPAV12@XZ ?ToElement@XMLElement@tinyxml2@@UBEPBV12@XZ ?ToElement@XMLHandle@tinyxml2@@QAEPAVXMLElement@2@XZ ?ToElement@XMLNode@tinyxml2@@UAEPAVXMLElement@2@XZ ?ToElement@XMLNode@tinyxml2@@UBEPBVXMLElement@2@XZ ?ToFloat@XMLUtil@tinyxml2@@SA_NPBDPAM@Z ?ToInt@XMLUtil@tinyxml2@@SA_NPBDPAH@Z ?ToNode@XMLConstHandle@tinyxml2@@QBEPBVXMLNode@2@XZ ?ToNode@XMLHandle@tinyxml2@@QAEPAVXMLNode@2@XZ ?ToStr@XMLUtil@tinyxml2@@SAXHPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAXIPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAXMPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAXNPADH@Z ?ToStr@XMLUtil@tinyxml2@@SAX_NPADH@Z ?ToText@XMLConstHandle@tinyxml2@@QBEPBVXMLText@2@XZ ?ToText@XMLHandle@tinyxml2@@QAEPAVXMLText@2@XZ ?ToText@XMLNode@tinyxml2@@UAEPAVXMLText@2@XZ ?ToText@XMLNode@tinyxml2@@UBEPBVXMLText@2@XZ ?ToText@XMLText@tinyxml2@@UAEPAV12@XZ ?ToText@XMLText@tinyxml2@@UBEPBV12@XZ ?ToUnknown@XMLConstHandle@tinyxml2@@QBEPBVXMLUnknown@2@XZ ?ToUnknown@XMLHandle@tinyxml2@@QAEPAVXMLUnknown@2@XZ ?ToUnknown@XMLNode@tinyxml2@@UAEPAVXMLUnknown@2@XZ ?ToUnknown@XMLNode@tinyxml2@@UBEPBVXMLUnknown@2@XZ ?ToUnknown@XMLUnknown@tinyxml2@@UAEPAV12@XZ ?ToUnknown@XMLUnknown@tinyxml2@@UBEPBV12@XZ ?ToUnsigned@XMLUtil@tinyxml2@@SA_NPBDPAI@Z ?Unlink@XMLNode@tinyxml2@@AAEXPAV12@@Z ?UnsignedAttribute@XMLElement@tinyxml2@@QBEIPBD@Z ?UnsignedValue@XMLAttribute@tinyxml2@@QBEIXZ ?Value@XMLAttribute@tinyxml2@@QBEPBDXZ ?Value@XMLNode@tinyxml2@@QBEPBDXZ ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLComment@2@@Z ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLDeclaration@2@@Z ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLText@2@@Z ?Visit@XMLPrinter@tinyxml2@@UAE_NABVXMLUnknown@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLComment@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLDeclaration@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLText@2@@Z ?Visit@XMLVisitor@tinyxml2@@UAE_NABVXMLUnknown@2@@Z ?VisitEnter@XMLPrinter@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitEnter@XMLPrinter@tinyxml2@@UAE_NABVXMLElement@2@PBVXMLAttribute@2@@Z ?VisitEnter@XMLVisitor@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitEnter@XMLVisitor@tinyxml2@@UAE_NABVXMLElement@2@PBVXMLAttribute@2@@Z ?VisitExit@XMLPrinter@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitExit@XMLPrinter@tinyxml2@@UAE_NABVXMLElement@2@@Z ?VisitExit@XMLVisitor@tinyxml2@@UAE_NABVXMLDocument@2@@Z ?VisitExit@XMLVisitor@tinyxml2@@UAE_NABVXMLElement@2@@Z ?WhitespaceMode@XMLDocument@tinyxml2@@QBE?AW4Whitespace@2@XZ

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

474KB

Virtual Size

474KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

61KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

154KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

876KB

Virtual Size

880KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=26, id=259, version=25711,

count=216, id=261, version=25711,

count=6, id=261, productName=VS2017 v15.7.4 build 26431, version=26431,

count=6, id=199, version=41118,

count=26, id=259, version=26706,

count=137, id=261, version=26706,

count=38, id=260, version=26706,

count=28, id=260, version=25711,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=104, id=260, version=27034,

count=2, id=257, version=27044,

count=3, productName=Unmarked objects (old),

count=72, id=261, version=27031,

count=25, id=257, version=25711,

count=361, id=1, productName=Unmarked objects,

count=83, id=265, version=27027,

count=1, id=256, productName=VS2017 v15.9.7 build 27027, version=27027,

count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,

count=1, id=151,

count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,