d3e1f974d9cd610465873c1d199a375030ca5047e91402b153bd54c94e1b6274

Sharing

Copy URL Twitter E-mail

General

Target

d3e1f974d9cd610465873c1d199a375030ca5047e91402b153bd54c94e1b6274
Size

4.0MB
MD5

2a2a3bef565aff8d95596bbd9d488834
SHA1

6f714e709af842cf8dd647a7035162f5b12fc5ed
SHA256

d3e1f974d9cd610465873c1d199a375030ca5047e91402b153bd54c94e1b6274
SHA512

b6dc0ffcf35654ec6b02e05c587916135c1e2d94ba0fefee9feb52569d05ca422bab09ccde6a29125f38565f80135f88be7f29c981dcf0516c675d359c047675
SSDEEP

49152:JLToppSidv9dJxQe1zG/VmOfryNnFjbvzRUXIYJvoZwsFsHF3OZMIRHtzIbjmcaI:1TkpjNQ4UpEYJkwksHF3OKIDzei7tiN

Score

N/A

Malware Config

Signatures

Files

d3e1f974d9cd610465873c1d199a375030ca5047e91402b153bd54c94e1b6274
.zip
1-Ԫ.url
.url
2-̳.url
.url
3-iPcFun.com.url
.url
License.txt
[˵].txt
lang/lang-1025.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1026.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1027.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1028.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1029.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1030.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1031.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1032.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1034.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1035.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1036.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1037.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1038.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1040.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1041.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1043.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1044.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1045.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1046.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1048.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1049.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1050.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1051.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1052.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1053.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1054.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1055.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1057.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1058.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1059.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1060.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1061.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1062.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1063.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1066.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1067.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1068.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1071.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-1079.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-2052.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-2074.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-3098.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-5146.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/lang-9999.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
portable.dat
recuva.exe
.exe windows x86

ac50b187d8a38d4f1979564a90c4e82e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4b:48:b2:7c:82:24:fe:37:b1:7a:6a:2e:d7:a8:1c:9f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/08/2015, 00:00

Not After

10/10/2018, 23:59

Subject

CN=Piriform Ltd,O=Piriform Ltd,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:48:b2:7c:82:24:fe:37:b1:7a:6a:2e:d7:a8:1c:9f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/08/2015, 00:00

Not After

10/10/2018, 23:59

Subject

CN=Piriform Ltd,O=Piriform Ltd,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:d0:f3:3d:77:41:b6:78:90:01:1e:fa:bb:a0:00:6f:5e:e9:f4:10:1a:e4:15:b7:47:ab:77:b5:1e:7e:26:c1
Signer

Actual PE Digest

42:d0:f3:3d:77:41:b6:78:90:01:1e:fa:bb:a0:00:6f:5e:e9:f4:10:1a:e4:15:b7:47:ab:77:b5:1e:7e:26:c1

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Piriform Ltd,O=Piriform Ltd,L=London,ST=London,C=GB

06/06/2016, 13:44
Valid: false

3f:7b:65:e5:03:c7:da:62:5e:c4:dc:7c:1e:88:c4:02:49:1c:92:f2
Signer

Actual PE Digest

3f:7b:65:e5:03:c7:da:62:5e:c4:dc:7c:1e:88:c4:02:49:1c:92:f2

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Piriform Ltd,O=Piriform Ltd,L=London,ST=London,C=GB

06/06/2016, 13:44
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

HttpQueryInfoW
InternetQueryDataAvailable
InternetCrackUrlW
InternetConnectW
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetCloseHandle

kernel32

RtlCaptureContext
SizeofResource
LockResource
LoadResource
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetLastError
GetCurrentThreadId
RaiseException
GetCurrentProcess
FlushInstructionCache
FreeLibrary
MulDiv
CloseHandle
WaitForSingleObject
CreateEventA
SetEvent
DuplicateHandle
CreateSemaphoreA
GetSystemTimeAsFileTime
GetTickCount
GetCurrentProcessId
GlobalReAlloc
GlobalAlloc
GetLogicalDrives
FindClose
GlobalFree
SetErrorMode
InterlockedDecrement
InterlockedIncrement
GetProcessHeap
GetLocalTime
GetCommandLineW
lstrlenA
InterlockedExchange
Sleep
HeapFree
InitializeCriticalSection
HeapAlloc
ReleaseSemaphore
WriteFile
WaitForMultipleObjects
ResetEvent
CompareFileTime
GlobalLock
GlobalUnlock
SystemTimeToFileTime
FileTimeToSystemTime
VirtualProtect
GetCurrentThread
LoadLibraryA
GetModuleHandleA
SetUnhandledExceptionFilter
VirtualQueryEx
TerminateThread
ResumeThread
CreateThread
GetSystemTime
LocalFree
GetSystemInfo
LocalAlloc
SetEnvironmentVariableA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetConsoleMode
GetConsoleCP
SetHandleCount
SetStdHandle
CreateFileA
GetFileType
GetOEMCP
GetACP
GetStdHandle
RtlUnwind
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
HeapSetInformation
HeapCreate
AreFileApisANSI
QueryPerformanceCounter
QueryPerformanceFrequency
FormatMessageA
CreateWaitableTimerA
InterlockedPopEntrySList
IsProcessorFeaturePresent
InterlockedPushEntrySList
HeapSize
HeapReAlloc
HeapDestroy
ExitProcess
FileTimeToDosDateTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
DebugBreak
WaitForMultipleObjectsEx
VirtualFree
VirtualAlloc
SetEndOfFile
SetFilePointerEx
OpenEventA
ExitThread
GetVolumePathNamesForVolumeNameW
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
DeviceIoControl
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
ReadFile
FlushFileBuffers
MoveFileExW
GetFileTime
GetFileSizeEx
GetLocaleInfoA
FileTimeToLocalFileTime
GlobalMemoryStatus
GetVersionExA
SetFileTime
SetFilePointer
GetFileSize
UnmapViewOfFile
MapViewOfFile
SleepEx
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
SetWaitableTimer
QueueUserAPC
InterlockedCompareExchange

user32

AdjustWindowRectEx
GetComboBoxInfo
GetMenu
RemoveMenu
SetCaretPos
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetScrollInfo
SetScrollRange
DragDetect
GetKeyState
SetScrollPos
DestroyCaret
CreateCaret
HideCaret
ShowCaret
CheckMenuRadioItem
SetMenuItemBitmaps
CheckMenuItem
CreatePopupMenu
SetMenuInfo
GetMenuInfo
DeleteMenu
GetMenuItemCount
GetUpdateRect
CheckDlgButton
IsIconic
FlashWindowEx
GetIconInfo
CreateIconFromResourceEx
LookupIconIdFromDirectoryEx
MonitorFromPoint
GetSubMenu
TrackPopupMenu
IsMenu
DrawFrameControl
InflateRect
SetWindowPlacement
PostQuitMessage
DrawEdge
GetMessagePos
OffsetRect
DestroyCursor
GetCursorPos
SetRectEmpty
UpdateWindow
CallNextHookEx
SetParent
SetTimer
KillTimer
MsgWaitForMultipleObjects
IsWindowEnabled
CopyIcon
GetSysColorBrush
IsDlgButtonChecked
DrawFocusRect
GetSysColor
MapDialogRect
DrawIconEx
SetCursor
PtInRect
ReleaseCapture
WindowFromPoint
ClientToScreen
SetCapture
GetCapture
EndPaint
BeginPaint
SetRect
FrameRect
TrackMouseEvent
TranslateMessage
DestroyWindow
MonitorFromWindow
MapWindowPoints
GetActiveWindow
GetFocus
UnhookWindowsHookEx
GetWindowThreadProcessId
FillRect
InvalidateRect
GetWindowPlacement
ShowWindow
ReleaseDC
GetWindowDC
GetWindow
IsWindow
DestroyMenu
SetFocus
MessageBeep
EnableMenuItem
DestroyIcon
EndDialog
CopyRect
ScreenToClient
SetWindowPos
GetDC
RedrawWindow
GetSystemMenu
CharLowerA
BringWindowToTop
CharLowerBuffA
ExitWindowsEx
CopyImage
UnregisterClassA
EnumWindows
IsWindowVisible
GetSystemMetrics
MoveWindow
GetWindowRect
GetClientRect
GetDlgCtrlID
EnumChildWindows
GetParent
GetDlgItem
GetMenuItemID

oleaut32

SysAllocString
VariantInit
VariantClear
VariantChangeType
VarBstrFromR8
SysAllocStringLen
SysAllocStringByteLen
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysFreeString
VarUI4FromStr

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 515KB - Virtual size: 514KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 121KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 279KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 219KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
recuva.ini
recuva64.exe
.exe windows x64

7e18b8b5a1ac812604c6a2df53eec6fd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4b:48:b2:7c:82:24:fe:37:b1:7a:6a:2e:d7:a8:1c:9f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/08/2015, 00:00

Not After

10/10/2018, 23:59

Subject

CN=Piriform Ltd,O=Piriform Ltd,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:48:b2:7c:82:24:fe:37:b1:7a:6a:2e:d7:a8:1c:9f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/08/2015, 00:00

Not After

10/10/2018, 23:59

Subject

CN=Piriform Ltd,O=Piriform Ltd,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

77:68:4b:5d:ec:80:b3:ac:13:16:b1:98:5a:fe:c4:1a:54:10:9c:53:f9:e3:7c:48:dd:91:42:d6:2e:16:51:44
Signer

Actual PE Digest

77:68:4b:5d:ec:80:b3:ac:13:16:b1:98:5a:fe:c4:1a:54:10:9c:53:f9:e3:7c:48:dd:91:42:d6:2e:16:51:44

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Piriform Ltd,O=Piriform Ltd,L=London,ST=London,C=GB

06/06/2016, 13:44
Valid: false

af:50:83:60:3f:e7:ea:a9:f1:fe:31:d3:13:82:53:ca:1c:98:39:34
Signer

Actual PE Digest

af:50:83:60:3f:e7:ea:a9:f1:fe:31:d3:13:82:53:ca:1c:98:39:34

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Piriform Ltd,O=Piriform Ltd,L=London,ST=London,C=GB

06/06/2016, 13:44
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

HttpOpenRequestW
InternetOpenUrlW
InternetOpenW
InternetCloseHandle
InternetReadFile
HttpAddRequestHeadersW
HttpSendRequestW
InternetConnectW
InternetCrackUrlW
InternetQueryDataAvailable
HttpQueryInfoW

kernel32

GetCurrentThread
WritePrivateProfileStringW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
lstrlenW
GetModuleHandleW
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
DeleteFileW
GetModuleFileNameW
FindResourceExW
FindResourceW
LoadResource
FileTimeToSystemTime
SystemTimeToFileTime
GlobalUnlock
GlobalLock
SizeofResource
LockResource
CompareFileTime
ResetEvent
WaitForMultipleObjects
CreateEventW
LoadLibraryA
LocalAlloc
SetEnvironmentVariableA
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetConsoleMode
GetConsoleCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetHandleCount
SetStdHandle
CreateFileA
GetFileType
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetStdHandle
LCMapStringW
GetCPInfo
RtlUnwindEx
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
TerminateProcess
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
RtlPcToFileHeader
HeapCreate
GetVersion
HeapSetInformation
AreFileApisANSI
GetNumberFormatW
QueryPerformanceFrequency
FormatMessageA
CreateWaitableTimerA
DecodePointer
EncodePointer
GetStringTypeW
InterlockedPopEntrySList
InterlockedPushEntrySList
HeapSize
HeapReAlloc
HeapDestroy
ExitProcess
FileTimeToDosDateTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
DebugBreak
WaitForMultipleObjectsEx
VirtualProtect
VirtualFree
VirtualAlloc
SetEndOfFile
SetFilePointerEx
OpenEventA
ExitThread
GetVolumePathNamesForVolumeNameW
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
GetVolumeInformationW
DeviceIoControl
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
QueryDosDeviceW
ReadFile
FlushFileBuffers
MoveFileExW
GetFileTime
GetFileSizeEx
GetLocaleInfoA
GetWindowsDirectoryW
GetEnvironmentVariableW
FileTimeToLocalFileTime
GlobalMemoryStatus
GetVersionExA
GetDateFormatW
GetLocaleInfoW
RemoveDirectoryW
SetFileTime
SetFilePointer
GetFileSize
GetFileAttributesExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
SleepEx
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
SetWaitableTimer
QueueUserAPC
GetSystemInfo
LocalFree
FormatMessageW
GetSystemTime
CreateThread
ResumeThread
CreateSemaphoreW
TerminateThread
VirtualQueryEx
SetUnhandledExceptionFilter
RtlCaptureContext
WriteFile
ReleaseSemaphore
HeapAlloc
InitializeCriticalSection
CompareStringW
lstrcpyW
HeapFree
lstrcpynW
GetVersionExW
Sleep
GetFullPathNameW
CreateFileW
lstrlenA
GetCommandLineW
CreateProcessW
GetStartupInfoW
GetLocalTime
GetCurrentDirectoryW
GetProcessHeap
SetCurrentDirectoryW
LoadLibraryExW
lstrcmpiW
GetSystemDirectoryW
SetErrorMode
WideCharToMultiByte
GetDiskFreeSpaceExW
GlobalFree
FindClose
FindNextFileW
FindFirstFileW
GetLogicalDrives
GetDriveTypeW
CreateDirectoryW
GlobalAlloc
GlobalReAlloc
GetCurrentProcessId
MultiByteToWideChar
GetFileAttributesW
GetTickCount
GetSystemTimeAsFileTime
CreateSemaphoreA
QueryPerformanceCounter
DuplicateHandle
SetEvent
CreateEventA
WaitForSingleObject
CloseHandle
MulDiv
FreeLibrary
LoadLibraryW
FlushInstructionCache
GetCurrentProcess
RaiseException
GetCurrentThreadId
SetLastError
GetPrivateProfileStructW
WritePrivateProfileStructW
GetPrivateProfileStringW

user32

GetDlgItem
EnableWindow
SendMessageW
GetParent
SetWindowLongPtrW
EnumChildWindows
GetDlgCtrlID
SetWindowTextW
GetClientRect
GetWindowRect
MoveWindow
GetSystemMetrics
LoadImageW
GetWindowLongPtrW
IsWindowVisible
EnumWindows
GetSystemMenu
RedrawWindow
GetDC
SetWindowPos
DrawTextW
ScreenToClient
CopyRect
EndDialog
GetComboBoxInfo
AdjustWindowRectEx
GetMenu
RemoveMenu
GetWindowTextLengthW
GetWindowTextW
SetDlgItemTextW
SetCaretPos
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetScrollInfo
SetScrollRange
DragDetect
GetKeyState
SetScrollPos
DestroyCaret
CreateCaret
HideCaret
ShowCaret
GetClassLongPtrW
CheckMenuRadioItem
SetMenuItemBitmaps
CheckMenuItem
AppendMenuW
CreatePopupMenu
GetMenuStringW
InsertMenuW
SetMenuInfo
GetMenuInfo
DeleteMenu
GetMenuItemCount
GetMenuItemID
GetUpdateRect
CheckDlgButton
RegisterWindowMessageW
IsIconic
FlashWindowEx
GetIconInfo
CreateIconFromResourceEx
LookupIconIdFromDirectoryEx
MonitorFromPoint
GetSubMenu
LoadMenuW
SetMenuItemInfoW
TrackPopupMenu
IsMenu
DrawFrameControl
InflateRect
SetWindowPlacement
PostQuitMessage
IsDialogMessageW
DrawEdge
SystemParametersInfoW
GetMessagePos
OffsetRect
GetClassNameW
DestroyCursor
GetCursorPos
GetClassInfoExW
RegisterClassExW
SetRectEmpty
UpdateWindow
CallNextHookEx
SetParent
SetTimer
KillTimer
MsgWaitForMultipleObjects
PostMessageW
IsWindowEnabled
CopyIcon
GetSysColorBrush
IsDlgButtonChecked
DrawFocusRect
GetSysColor
MapDialogRect
DrawIconEx
GetTabbedTextExtentW
LoadCursorW
SetCursor
PtInRect
ReleaseCapture
WindowFromPoint
ClientToScreen
SetCapture
GetCapture
EndPaint
BeginPaint
SetRect
LoadBitmapW
FrameRect
TrackMouseEvent
CreateDialogParamW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
RegisterClassW
GetClassInfoW
MessageBoxW
CharNextW
CreateWindowExW
DestroyWindow
SetWindowLongW
DialogBoxIndirectParamW
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
GetActiveWindow
GetFocus
LoadIconW
UnhookWindowsHookEx
SetWindowsHookExW
GetWindowThreadProcessId
DialogBoxParamW
CallWindowProcW
DefWindowProcW
FillRect
InvalidateRect
GetWindowPlacement
ShowWindow
ReleaseDC
GetWindowDC
GetWindow
GetWindowLongW
IsWindow
DestroyMenu
SetFocus
MessageBeep
UnregisterClassW
CharLowerW
CharLowerA
BringWindowToTop
GetDlgItemTextW
IsClipboardFormatAvailable
GetClipboardData
CharLowerBuffA
ExitWindowsEx
CopyImage
UnregisterClassA
EnableMenuItem
DestroyIcon

gdi32

Polygon
CreatePatternBrush
CreateBitmap
PatBlt
TextOutW
LineTo
MoveToEx
CreatePen
GetDIBColorTable
StretchBlt
CreateDIBSection
ExtTextOutW
SetBkColor
SetTextColor
GetStockObject
GetDeviceCaps
Polyline
GetTextExtentPoint32W
SetBkMode
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SetViewportOrgEx
SelectObject
DeleteDC
CreateFontIndirectW
DeleteObject
GetObjectW
GetClipBox
ExcludeClipRect
CombineRgn
CreateRectRgnIndirect
TextOutA
RestoreDC
SetStretchBltMode
CreateDIBitmap
SetDIBits
GetTextMetricsW
SaveDC
CreateSolidBrush

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
FreeSid
AllocateAndInitializeSid
RegUnLoadKeyW
RegLoadKeyW
RegEnumKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegCreateKeyW
RegEnumKeyExW
RegQueryInfoKeyW

shell32

CommandLineToArgvW
SHGetFileInfoW
ord2
ord4
DoEnvironmentSubstW
ord25
SHGetDesktopFolder
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderLocation
ShellExecuteW

ole32

CoSetProxyBlanket
CoCreateGuid
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
FreePropVariantArray
CoInitialize
CoInitializeSecurity
CoUninitialize
StgOpenStorageOnILockBytes
CLSIDFromProgID
CoInitializeEx

oleaut32

LoadTypeLi
LoadRegTypeLi
SysStringLen
SysAllocStringLen
VarBstrFromR8
VariantChangeType
VariantClear
SysAllocStringByteLen
VariantInit
VarUI4FromStr
SysFreeString
SysAllocString

shlwapi

PathIsDirectoryEmptyW
PathGetDriveNumberW
PathCombineW
PathCanonicalizeW
StrCmpLogicalW
PathFindExtensionW
PathStripPathW
PathIsDirectoryW
PathMatchSpecW
PathFindFileNameA
PathAddBackslashW
PathCompactPathW
PathIsRootW
PathFindFileNameW
PathStripToRootW
PathRemoveExtensionW
PathAddExtensionW
PathAppendW
PathRemoveFileSpecW
PathFileExistsW

comctl32

InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_Create
ImageList_Destroy
ImageList_GetIcon
ImageList_Add
ImageList_GetImageCount
PropertySheetW
_TrackMouseEvent
CreatePropertySheetPageW
ImageList_GetIconSize
ImageList_Draw
ImageList_LoadImageW
DestroyPropertySheetPage

msimg32

TransparentBlt
AlphaBlend

ws2_32

WSAStartup
WSACleanup

crypt32

CertGetNameStringW
CertFreeCertificateContext
CryptMsgClose
CertCloseStore
CryptMsgGetParam
CryptQueryObject
CertFindCertificateInStore

wintrust

WinVerifyTrust

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 137KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 288KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ԫ΢Źں.png
.png

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 28KB - Virtual size: 27KB

.reloc Size: 512B - Virtual size: 8B

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 30KB - Virtual size: 30KB

.reloc Size: 512B - Virtual size: 8B

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 34KB - Virtual size: 34KB

.reloc Size: 512B - Virtual size: 8B

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 13KB - Virtual size: 13KB

.reloc Size: 512B - Virtual size: 8B

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 30KB - Virtual size: 30KB

.reloc Size: 512B - Virtual size: 8B

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 30KB - Virtual size: 30KB

.reloc Size: 512B - Virtual size: 8B

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 32KB - Virtual size: 32KB

.reloc Size: 512B - Virtual size: 8B

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 36KB - Virtual size: 35KB

.reloc Size: 4KB - Virtual size: 8B

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 36KB - Virtual size: 35KB

.reloc Size: 4KB - Virtual size: 8B

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 31KB - Virtual size: 31KB

.reloc Size: 512B - Virtual size: 8B

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 36KB - Virtual size: 35KB

.reloc Size: 4KB - Virtual size: 8B

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 25KB - Virtual size: 24KB

.reloc Size: 512B - Virtual size: 8B

Headers

DLL Characteristics

File Characteristics

.rsrc
Size: 28KB - Virtual size: 27KB

.reloc
Size: 512B - Virtual size: 8B

.rsrc
Size: 30KB - Virtual size: 30KB

.reloc
Size: 512B - Virtual size: 8B

.rsrc
Size: 34KB - Virtual size: 34KB

.reloc
Size: 512B - Virtual size: 8B

.rsrc
Size: 13KB - Virtual size: 13KB

.reloc
Size: 512B - Virtual size: 8B

.rsrc
Size: 30KB - Virtual size: 30KB

.reloc
Size: 512B - Virtual size: 8B

.rsrc
Size: 30KB - Virtual size: 30KB

.reloc
Size: 512B - Virtual size: 8B

.rsrc
Size: 32KB - Virtual size: 32KB

.reloc
Size: 512B - Virtual size: 8B

.rsrc
Size: 36KB - Virtual size: 35KB

.reloc
Size: 4KB - Virtual size: 8B

.rsrc
Size: 36KB - Virtual size: 35KB

.reloc
Size: 4KB - Virtual size: 8B

.rsrc
Size: 31KB - Virtual size: 31KB

.reloc
Size: 512B - Virtual size: 8B

.rsrc
Size: 36KB - Virtual size: 35KB

.reloc
Size: 4KB - Virtual size: 8B

.rsrc
Size: 25KB - Virtual size: 24KB

.reloc
Size: 512B - Virtual size: 8B

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 512B - Virtual size: 8B

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 512B - Virtual size: 8B

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 512B - Virtual size: 8B

.rsrc
Size: 36KB - Virtual size: 35KB

.reloc
Size: 4KB - Virtual size: 8B

.rsrc
Size: 30KB - Virtual size: 29KB

.reloc
Size: 512B - Virtual size: 8B

.rsrc
Size: 33KB - Virtual size: 32KB

.reloc
Size: 512B - Virtual size: 8B

.rsrc
Size: 32KB - Virtual size: 32KB

.reloc
Size: 512B - Virtual size: 8B

.rsrc
Size: 30KB - Virtual size: 30KB

.reloc
Size: 512B - Virtual size: 8B