u4[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

u4.exe
Size

56.2MB
MD5

0955869356904433415547865d79cc3a
SHA1

9f4fdf3944b595f91e4099e190be8fb01df83caf
SHA256

9c85440cd093e66e97abb3cd1fb798a5bc9b35d6a13fe00ff3676f51e54671b7
SHA512

ab7ef905fab5d5c04f4b78f3fa686ea7945dbf48cfe5a98de94de04b3b2459b2b312e47353f2b14d865c7fd63e7aabd3ad81e7718b04826016ba301163ebfbc9
SSDEEP

393216:RA2DsNGbelz0b5UCn3UB17mhHyDOXB0ijgGLRE1szouCURRLVqaj+KrV79kijrv/:y6co7Qqrv

Score

1^/10

Malware Config

Signatures

Files

u4.exe
.exe windows x64

e8d208a0791195312fa424d93b28a579

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

winmm

timeGetDevCaps
timeEndPeriod
timeBeginPeriod
timeGetTime

wininet

InternetOpenA
InternetCloseHandle
InternetTimeFromSystemTime
InternetTimeToSystemTime
InternetCrackUrlA
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetSetOptionA
InternetConnectA
InternetCreateUrlA

advapi32

SetEntriesInAclA
RegOpenKeyExW
RegSetKeyValueW
RegGetValueA
RegGetValueW
RegDeleteKeyExW
RegCreateKeyExW
RegCloseKey
FreeSid
SetNamedSecurityInfoA
RegQueryValueExW
AllocateAndInitializeSid
GetNamedSecurityInfoA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
GetUserNameA
CryptAcquireContextA
CryptCreateHash

gfsdk_aftermath_lib.x64

GFSDK_Aftermath_EnableGpuCrashDumps
GFSDK_Aftermath_DX12_Initialize
GFSDK_Aftermath_SetEventMarker
GFSDK_Aftermath_DX12_CreateContextHandle
GFSDK_Aftermath_DX12_RegisterResource
GFSDK_Aftermath_DX12_UnregisterResource
GFSDK_Aftermath_GetDeviceStatus
GFSDK_Aftermath_GetPageFaultInformation
GFSDK_Aftermath_GetData

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

imm32

ImmDisableIME

iggy_w64_final

IggyPlayerGetUserdata
IggyPlayerDestroy
IggyPlayerCallbackResultPath
IggyValueSetBooleanRS
IggyPlayerPause
IggyValueSetS32RS
IggyMakeEventMouseMove
IggyPlayerDispatchEventRS
IggyMakeEventMouseWheel
IggyPlayerReadyToTick
IggyPlayerTickRS
IggyPlayerInitializeAndTickRS
IggyPlayerDraw
IggyValueSetStringUTF8RS
IggySetWarningCallback
IggyDebugSetLeakResultCallback
IggyInit
IggyPlayerSetDisplaySize
IggyPlayerEnableMouseProcessing
IggyPlayerCallMethodRS
IggyConfigureBool
IggyPlayerCreateFastNameUTF8
IggyValuePathMakeNameRef
IggyValueGetTypeRS
IggyValueGetBooleanRS
IggyValueGetF64RS
IggyValueGetStringUTF8RS
IggyPlayerGarbageCollect
IggySetFontCachingCalculationBuffer
IggySetAssertCallback
IggyDiscardVertexBufferCallback
IggyGDrawSendWarning
IggySetValueRefLimit
IggyGDrawFree
IggyPlayerConfigureGCBehavior
IggyGDrawMallocAnnotated
IggyPlayerSetUserdata
IggyPlayerCreateFromMemory
IggyPlayerPlay
IggyPlayerSetBitmapFontCaching
IggyLibraryCreateFromMemory
IggySetAutoGeneratedInstancesIndex
IggyLibraryDestroy
IggyPlayerRootPath
IggyGetAutoGeneratedInstancesIndex
IggyValueSetValueRefRS
IggyValuePathSetArrayIndex
IggyValuePathMakeArrayRef
IggyValuePathFromRef
IggyValueRefCreateArray
IggyValueSetF64RS
IggyValueSetF32RS
IggyValueSetU32RS
IggyValueRefFree
IggyFontSetIndirectUTF8
IggyShutdown
IggySetGDraw
IggySetAS3ExternalProfileFunctionCallback
IggySetTextureSubstitutionCallbacksUTF8
IggyForceBitmapSmoothing
IggyFastTextFilterEffects
IggySetAS3ExternalFunctionCallbackUTF8
IggySetTraceCallbackUTF8

cuesdk.x64_2017

CorsairRequestControl
CorsairReleaseControl
CorsairSetLedsColorsAsync
CorsairSubscribeForEvents
CorsairPerformProtocolHandshake
CorsairGetLedPositions
CorsairGetLastError
CorsairSetLayerPriority

bink2w64

BinkStartAsyncThread
BinkSetOSFileCallbacks
BinkSetSoundSystem
BinkCopyToBuffer
BinkOpenDirectSound
BinkSetFrameRate
BinkNextFrame
BinkWaitStopAsyncThread
BinkRequestStopAsyncThread
BinkClose
BinkDoFrameAsync
BinkGoto
BinkDoFrameAsyncWait
BinkWait
BinkOpen
BinkSetVolume
BinkGetSummary
BinkDoFrame
BinkShouldSkip

xinput1_4

ord3
ord2
ord4

bcrypt

BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptGetProperty
BCryptCreateHash
BCryptHashData

gfesdk

NVGSDK_Highlights_OpenGroupAsync
NVGSDK_Highlights_SetScreenshotHighlightAsync
NVGSDK_Highlights_ConfigureAsync
NVGSDK_RequestPermissionsAsync
NVGSDK_Create
NVGSDK_Highlights_SetVideoHighlightAsync
NVGSDK_Highlights_OpenSummaryAsync

amd_ags_x64

agsDeInitialize
agsInitialize

oo2core_9_win64

OodleCore_Plugins_SetAllocators
OodleLZ_Decompress
OodleLZDecoder_MemorySizeNeeded

steam_api64

SteamAPI_GetHSteamUser
SteamInternal_FindOrCreateUserInterface
SteamInternal_ContextInit
SteamAPI_Init
SteamAPI_Shutdown
SteamAPI_RunCallbacks
SteamAPI_UnregisterCallback
SteamAPI_RegisterCallback

ws2_32

inet_ntoa
getaddrinfo
freeaddrinfo
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
gethostbyaddr
socket
shutdown
setsockopt
sendto
send
select
recvfrom
WSAAsyncSelect
ntohs
ntohl
listen
inet_addr
htons
htonl
getsockopt
getpeername
ioctlsocket
connect
closesocket
bind
accept
__WSAFDIsSet
gethostname
recv

kernel32

CreateEventW
VerifyVersionInfoW
VerSetConditionMask
WaitForSingleObjectEx
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
GlobalAlloc
LoadLibraryExW
GetFullPathNameW
GetModuleHandleW
OutputDebugStringW
lstrcmpA
SetLastError
GetFileAttributesW
GetSystemDirectoryW
FlushFileBuffers
RemoveDirectoryA
SetFilePointerEx
GetFileInformationByHandle
SetEndOfFile
WriteFileEx
SleepEx
ReadFileEx
CancelIoEx
VirtualQuery
RtlCaptureContext
GetCurrentProcess
LoadLibraryW
TlsSetValue
CreateProcessW
ReleaseSemaphore
CreateSemaphoreW
TerminateThread
MoveFileExA
GetFileSizeEx
SetConsoleTextAttribute
SetConsoleMode
GetConsoleMode
SetConsoleWindowInfo
SetConsoleCursorInfo
SetConsoleScreenBufferSize
GetConsoleScreenBufferInfo
SetStdHandle
SetConsoleTitleA
GetModuleHandleExA
GetStdHandle
WriteConsoleA
FormatMessageW
TlsAlloc
TlsFree
InitializeCriticalSectionAndSpinCount
CreateSemaphoreA
RaiseException
AllocConsole
HeapAlloc
SetFilePointer
CreateDirectoryW
CreateFileW
SetFileTime
WriteFile
DeleteFileA
ReadFile
GetFileSize
GetFileTime
CreateFileA
HeapFree
GetProcessHeap
MoveFileA
FindNextFileW
FindFirstFileW
FindClose
FindNextFileA
FindFirstFileA
CreateDirectoryA
GetFileAttributesExA
GetFileAttributesExW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileAttributesA
LocalAlloc
FormatMessageA
LocalFree
GetNumberFormatA
GetUserDefaultLocaleName
SystemTimeToFileTime
CreateThread
GetCurrentThreadId
GetExitCodeThread
GetFullPathNameA
ReleaseMutex
CreateMutexA
GetModuleFileNameW
SetFileInformationByHandle
GetSystemTime
CreateEventExA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcessId
GetTempPathA
CreateProcessA
CreateEventA
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetLastError
OpenThread
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
FlsGetValue
FlsSetValue
FlsAlloc
FlsFree
VirtualFree
VirtualAlloc
SetThreadAffinityMask
ConvertThreadToFiber
CreateFiberEx
ConvertFiberToThread
DeleteFiber
SwitchToFiber
SetThreadDescription
GetThreadId
ResumeThread
LocalSize
ExitThread
WaitForMultipleObjects
SetEvent
ResetEvent
GetOverlappedResult
SuspendThread
GetDiskFreeSpaceA
GetSystemTimeAsFileTime
CreateWaitableTimerA
SetWaitableTimer
GetThreadPriority
MultiByteToWideChar
GetSystemInfo
LoadLibraryA
GetProcAddress
FreeLibrary
IsDebuggerPresent
OutputDebugStringA
GetTimeZoneInformation
GetModuleFileNameA
GlobalMemoryStatusEx
WideCharToMultiByte
TlsGetValue
GetModuleHandleA
GetConsoleWindow
CloseHandle
WaitForSingleObject
Sleep
SwitchToThread
GetCurrentThread
SetThreadPriority

user32

EnumDisplayDevicesA
GetSystemMetrics
GetCapture
SetCursorPos
ClientToScreen
ScreenToClient
GetCursorPos
DefWindowProcA
PostQuitMessage
SetForegroundWindow
ShowWindow
MoveWindow
SetWindowLongPtrA
EnumDisplayMonitors
MonitorFromWindow
SendMessageA
GetForegroundWindow
GetKeyboardState
DispatchMessageA
TranslateMessage
IsWindowVisible
PeekMessageA
ShowCursor
GetClientRect
GetWindowRect
CreateWindowExA
AdjustWindowRect
RegisterClassExA
LoadCursorA
MessageBoxA
GetMonitorInfoA
LoadIconA
GetKeyboardLayout
GetWindowDpiAwarenessContext
GetAwarenessFromDpiAwarenessContext
GetDpiForSystem
MessageBoxW
GetWindowThreadProcessId

shell32

SHCreateItemFromParsingName
SHGetKnownFolderPath

ole32

CoUninitialize
CoCreateGuid
PropVariantClear
StringFromGUID2
CoCreateInstance
CoInitializeEx
CoTaskMemFree

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness

msvcp140

??Bid@locale@std@@QEAA_KXZ
?_Xbad_alloc@std@@YAXXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_Getmonths@_Locinfo@std@@QEBAPEBDXZ
?_Getdays@_Locinfo@std@@QEBAPEBDXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
_Xtime_get_ticks
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_lock
_Mtx_destroy_in_situ
_Mtx_init_in_situ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?_Incref@facet@locale@std@@UEAAXXZ
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Xlength_error@std@@YAXPEBD@Z
?sync_with_stdio@ios_base@std@@SA_N_N@Z
?_Xbad_function_call@std@@YAXXZ
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
_Mbrtowc

d3d12

ord101
D3D12SerializeRootSignature
D3D12SerializeVersionedRootSignature
ord102

dxgi

CreateDXGIFactory2
DXGIGetDebugInterface1

dbghelp

SymSetOptions
SymGetSearchPath
SymInitialize
SymSetParentWindow
SymRegisterCallback64
SymSetSearchPath
SymGetLineFromAddr64
SymGetSymFromAddr64
SymGetModuleBase64
StackWalk64
SymGetOptions
SymFunctionTableAccess64

shlwapi

PathFileExistsW

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo

crypt32

CertGetNameStringW
CryptVerifyMessageSignature
CertFreeCertificateContext

wintrust

WinVerifyTrust

imagehlp

ImageGetCertificateHeader
ImageEnumerateCertificates
ImageGetCertificateData

vcruntime140

__std_terminate
_purecall
strrchr
strstr
strchr
__std_exception_destroy
__std_exception_copy
memset
wcsstr
memcpy
wcsrchr
memcmp
_CxxThrowException
memmove
__C_specific_handler
__std_type_info_destroy_list
__RTDynamicCast
__CxxFrameHandler3

api-ms-win-crt-heap-l1-1-0

_aligned_malloc
realloc
free
malloc
_set_new_mode
_aligned_free
calloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s
fseek
fwrite
__stdio_common_vfprintf_s
clearerr
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf
ungetc
ferror
_fseeki64
_ftelli64
fopen_s
ftell
fopen
feof
fgetc
fclose
__stdio_common_vswscanf
fgets
_set_fmode
__p__commode
__stdio_common_vswprintf
fread
_wfsopen
putc
_wfopen_s
__stdio_common_vsscanf
__stdio_common_vsprintf_s
setvbuf
fflush
fputs
_open_osfhandle

api-ms-win-crt-string-l1-1-0

strncat
isxdigit
strcmp
isspace
wcscpy_s
strpbrk
tolower
wcstok
wcsncpy_s
strncpy_s
strcpy_s
_strnicmp
wcsncpy
isdigit
strcat_s
isalpha
_wcsnicmp
strtok
strncmp
_wcsicmp
_stricmp
strncpy
wcscat_s
_wcsdup
isgraph
wcscmp
_wcslwr
strtok_s
toupper
isprint
strnlen
wcsncmp
isalnum
iswspace

api-ms-win-crt-runtime-l1-1-0

strerror
__p___argc
__p___argv
_endthreadex
_errno
_register_thread_local_exe_atexit_callback
_c_exit
strerror_s
_exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
_invalid_parameter_noinfo
exit
_beginthread
_beginthreadex
_invalid_parameter_noinfo_noreturn
abort
_endthread
_set_invalid_parameter_handler

api-ms-win-crt-convert-l1-1-0

strtoull
wcstombs_s
wcstombs
atoi
strtol
mbstowcs
atol
_strtoi64
wcstod
strtod
atof
strtoul
_atoi64

api-ms-win-crt-utility-l1-1-0

bsearch
rand
qsort

api-ms-win-crt-filesystem-l1-1-0

_waccess
_wremove
remove
_mkdir
rename

api-ms-win-crt-time-l1-1-0

_gmtime64
_localtime64
_localtime64_s
_mktime64
_time64
_gmtime64_s
_mkgmtime64
_ctime64
strftime

api-ms-win-crt-math-l1-1-0

atan2f
modff
powf
copysignf
_fdopen
tanf
frexp
acosf
asinf
log10f
expf
cosf
ldexp
_fdtest
log10
exp2f
fmod
log2f
truncf
round
sinf
lroundf
floorf
roundf
sqrt
atanf
sin
sinhf
cos
fmodf
pow
floor
atan2
sqrtf
ceilf
logf
__setusermatherr

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv

hid

HidP_GetCaps
HidD_GetAttributes
HidD_GetHidGuid
HidD_GetPreparsedData
HidD_FreePreparsedData
HidD_GetFeature
HidD_SetFeature
HidD_GetManufacturerString
HidD_GetProductString
HidD_GetSerialNumberString
HidP_GetValueCaps

Exports

Exports

NVSDK_NGX_D3D12_AllocateParameters
NVSDK_NGX_D3D12_CreateFeature
NVSDK_NGX_D3D12_DestroyParameters
NVSDK_NGX_D3D12_EvaluateFeature
NVSDK_NGX_D3D12_EvaluateFeature_C
NVSDK_NGX_D3D12_GetCapabilityParameters
NVSDK_NGX_D3D12_GetParameters
NVSDK_NGX_D3D12_GetScratchBufferSize
NVSDK_NGX_D3D12_ReleaseFeature
NVSDK_NGX_D3D12_Shutdown
NVSDK_NGX_D3D12_Shutdown1
NVSDK_NGX_Parameter_GetD
NVSDK_NGX_Parameter_GetD3d11Resource
NVSDK_NGX_Parameter_GetD3d12Resource
NVSDK_NGX_Parameter_GetF
NVSDK_NGX_Parameter_GetI
NVSDK_NGX_Parameter_GetUI
NVSDK_NGX_Parameter_GetULL
NVSDK_NGX_Parameter_GetVoidPointer
NVSDK_NGX_Parameter_SetD
NVSDK_NGX_Parameter_SetD3d11Resource
NVSDK_NGX_Parameter_SetD3d12Resource
NVSDK_NGX_Parameter_SetF
NVSDK_NGX_Parameter_SetI
NVSDK_NGX_Parameter_SetUI
NVSDK_NGX_Parameter_SetULL
NVSDK_NGX_Parameter_SetVoidPointer
ffxFsr2ContextCreate
ffxFsr2ContextDestroy
ffxFsr2ContextDispatch
ffxFsr2ContextGenerateReactiveMask
ffxFsr2GetInterfaceDX12
ffxFsr2GetJitterOffset
ffxFsr2GetJitterPhaseCount
ffxFsr2GetRenderResolutionFromQualityMode
ffxFsr2GetScratchMemorySizeDX12
ffxFsr2GetUpscaleRatioFromQualityMode
ffxFsr2ResourceIsNull
ffxGetCommandListDX12
ffxGetDX12ResourcePtr
ffxGetDeviceDX12
ffxGetResourceDX12

Sections

.text
Size: 36.6MB - Virtual size: 36.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9.9MB - Virtual size: 9.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7.4MB - Virtual size: 61.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 53KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 606KB - Virtual size: 608KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 307KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e8d208a0791195312fa424d93b28a579

Headers

DLL Characteristics

File Characteristics

Imports

winmm

wininet

advapi32

gfsdk_aftermath_lib.x64

version

imm32

iggy_w64_final

cuesdk.x64_2017

bink2w64

xinput1_4

bcrypt

gfesdk

amd_ags_x64

oo2core_9_win64

steam_api64

ws2_32

kernel32

user32

shell32

ole32

api-ms-win-shcore-scaling-l1-1-1

msvcp140

d3d12

dxgi

dbghelp

shlwapi

setupapi

crypt32

wintrust

imagehlp

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

hid

Exports

Exports

Sections

.text Size: 36.6MB - Virtual size: 36.6MB

.rdata Size: 9.9MB - Virtual size: 9.9MB

.data Size: 7.4MB - Virtual size: 61.3MB

.pdata Size: 1.4MB - Virtual size: 1.4MB

_RDATA Size: 53KB - Virtual size: 56KB

.rsrc Size: 606KB - Virtual size: 608KB

.reloc Size: 307KB - Virtual size: 308KB

.text
Size: 36.6MB - Virtual size: 36.6MB

.rdata
Size: 9.9MB - Virtual size: 9.9MB

.data
Size: 7.4MB - Virtual size: 61.3MB

.pdata
Size: 1.4MB - Virtual size: 1.4MB

_RDATA
Size: 53KB - Virtual size: 56KB

.rsrc
Size: 606KB - Virtual size: 608KB

.reloc
Size: 307KB - Virtual size: 308KB