839cfe3d3b1b81155914c3813570593f0fbde8795d129a3792d4c4f7d5932005

Sharing

Copy URL Twitter E-mail

General

Target

839cfe3d3b1b81155914c3813570593f0fbde8795d129a3792d4c4f7d5932005
Size

8.2MB
MD5

eb660ed5cdd0280e385c8a5764c99203
SHA1

f60b21741ee2f31e5facb980172c5de69ed8ee86
SHA256

839cfe3d3b1b81155914c3813570593f0fbde8795d129a3792d4c4f7d5932005
SHA512

2c34f9f0d6620506c0c5d9b96d6dfa6fc26f2c8abdb9531fbc92d5c3ec7bb25bf8f8675f1afc6c2e7bbbb6f99d0803ced91ebeb6cc564a4dd62d9191993ea275
SSDEEP

196608:5HBNPKIMjC5X9ayoIrak79PSdku1K8prFsK7Y:5zPI0akraKUKImaY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
839cfe3d3b1b81155914c3813570593f0fbde8795d129a3792d4c4f7d5932005

Files

839cfe3d3b1b81155914c3813570593f0fbde8795d129a3792d4c4f7d5932005
.exe windows:6 windows x64

f143957448ed27a7943b99019b5caf9e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

qt5core

?constData@QString@@QEBAPEBVQChar@@XZ
??0QString@@QEAA@PEBD@Z
?toLocal8Bit@QString@@QEHAA?AVQByteArray@@XZ
?size@QString@@QEBAHXZ
?constData@QByteArray@@QEBAPEBDXZ
??1QByteArray@@QEAA@XZ
?qt_metacall@QObject@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?qt_metacast@QObject@@UEAAPEAXPEBD@Z
?dynamicMetaObject@QObjectData@@QEBAPEAUQMetaObject@@XZ
?staticMetaObject@QObject@@2UQMetaObject@@B
?writableLocation@QStandardPaths@@SA?AVQString@@W4StandardLocation@1@@Z
?remove@QFile@@SA_NAEBVQString@@@Z
?exists@QFile@@SA_NAEBVQString@@@Z
?toUInt@QString@@QEBAIPEA_NH@Z
?compare@QString@@QEBAHAEBV1@W4CaseSensitivity@Qt@@@Z
?split@QString@@QEBA?AVQStringList@@VQChar@@W4SplitBehavior@1@W4CaseSensitivity@Qt@@@Z
??4QString@@QEAAAEAV0@AEBV0@@Z
?rename@QDir@@QEAA_NAEBVQString@@0@Z
?exists@QDir@@QEBA_NXZ
?exists@QDir@@QEBA_NAEBVQString@@@Z
?rmpath@QDir@@QEBA_NAEBVQString@@@Z
?mkpath@QDir@@QEBA_NAEBVQString@@@Z
?entryInfoList@QDir@@QEBA?AV?$QList@VQFileInfo@@@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z
?setFilter@QDir@@QEAAXV?$QFlags@W4Filter@QDir@@@@@Z
?absolutePath@QDir@@QEBA?AVQString@@XZ
??1QDir@@QEAA@XZ
??0QDir@@QEAA@AEBVQString@@@Z
?setupChildProcess@QProcess@@MEAAXXZ
?startDetached@QProcess@@SA_NAEBVQString@@AEBVQStringList@@0PEA_J@Z
?isDir@QFileInfo@@QEBA_NXZ
?absoluteFilePath@QFileInfo@@QEBA?AVQString@@XZ
??1QString@@QEAA@XZ
??0QFileInfo@@QEAA@AEBV0@@Z
?tryLock@QLockFile@@QEAA_NH@Z
??1QLockFile@@QEAA@XZ
??0QLockFile@@QEAA@AEBVQString@@@Z
?applicationDirPath@QCoreApplication@@SA?AVQString@@XZ
?setApplicationName@QCoreApplication@@SAXAEBVQString@@@Z
??1QCoreApplication@@UEAA@XZ
??0QCoreApplication@@QEAA@AEAHPEAPEADH@Z
?detach@QListData@@QEAAPEAUData@1@H@Z
?end@QListData@@QEBAPEAPEAXXZ
?begin@QListData@@QEBAPEAPEAXXZ
?at@QListData@@QEBAPEAPEAXH@Z
?size@QListData@@QEBAHXZ
?dispose@QListData@@QEAAXXZ
??0QString@@QEAA@XZ
??0QString@@QEAA@AEBV0@@Z
?isEmpty@QString@@QEBA_NXZ
?fromUtf8@QString@@SA?AV1@PEBDH@Z
??YQString@@QEAAAEAV0@AEBV0@@Z
??0QString@@QEAA@$$QEAV0@@Z
??BQByteArray@@QEBAPEBDXZ
??0QChar@@QEAA@H@Z
?copy@QFile@@SA_NAEBVQString@@0@Z
?readData@QProcess@@MEAA_JPEAD_J@Z
?writeData@QProcess@@MEAA_JPEBD_J@Z
?cast@QMetaObject@@QEBAPEAVQObject@@PEAV2@@Z
??1Connection@QMetaObject@@QEAA@XZ
?pos@QIODevice@@UEBA_JXZ
?size@QIODevice@@UEBA_JXZ
?seek@QIODevice@@UEAA_N_J@Z
?dispose@QListData@@SAXPEAUData@1@@Z
?arguments@QCoreApplication@@SA?AVQStringList@@XZ
?exit@QCoreApplication@@SAXH@Z
??0QFileInfo@@QEAA@AEBVQString@@@Z
??1QFileInfo@@QEAA@XZ
?absolutePath@QFileInfo@@QEBA?AVQString@@XZ
?metaObject@QProcess@@UEBAPEBUQMetaObject@@XZ
?qt_metacast@QProcess@@UEAAPEAXPEBD@Z
?qt_metacall@QProcess@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
??0QProcess@@QEAA@PEAVQObject@@@Z
??1QProcess@@UEAA@XZ
?start@QProcess@@QEAAXAEBVQString@@AEBVQStringList@@V?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z
?open@QProcess@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z
?setWorkingDirectory@QProcess@@QEAAXAEBVQString@@@Z
?waitForReadyRead@QProcess@@UEAA_NH@Z
?waitForBytesWritten@QProcess@@UEAA_NH@Z
?readAllStandardOutput@QProcess@@QEAA?AVQByteArray@@XZ
?readAllStandardError@QProcess@@QEAA?AVQByteArray@@XZ
?bytesAvailable@QProcess@@UEBA_JXZ
?bytesToWrite@QProcess@@UEBA_JXZ
?isSequential@QProcess@@UEBA_NXZ
?canReadLine@QProcess@@UEBA_NXZ
?close@QProcess@@UEAAXXZ
?atEnd@QProcess@@UEBA_NXZ
?readyReadStandardOutput@QProcess@@QEAAXUQPrivateSignal@1@@Z
?filePath@QFileInfo@@QEBA?AVQString@@XZ
?readyReadStandardError@QProcess@@QEAAXUQPrivateSignal@1@@Z
?reset@QIODevice@@UEAA_NXZ
?readLineData@QIODevice@@MEAA_JPEAD_J@Z
?compare_helper@QString@@CAHPEBVQChar@@HPEBDHW4CaseSensitivity@Qt@@@Z
??0QObject@@QEAA@PEAV0@@Z
??1QObject@@UEAA@XZ
?event@QObject@@UEAA_NPEAVQEvent@@@Z
?eventFilter@QObject@@UEAA_NPEAV1@PEAVQEvent@@@Z
?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z
?deleteLater@QObject@@QEAAXXZ
?sender@QObject@@IEBAPEAV1@XZ
?timerEvent@QObject@@MEAAXPEAVQTimerEvent@@@Z
?childEvent@QObject@@MEAAXPEAVQChildEvent@@@Z
?customEvent@QObject@@MEAAXPEAVQEvent@@@Z
?connectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z
?disconnectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z
?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z
??0QDir@@QEAA@AEBVQString@@0V?$QFlags@W4SortFlag@QDir@@@@V?$QFlags@W4Filter@QDir@@@@@Z
?staticMetaObject@QProcess@@2UQMetaObject@@B

kernel32

RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCommandLineW
LocalFree
WideCharToMultiByte
K32EnumProcessModules
K32EnumProcesses
K32GetModuleBaseNameA
CloseHandle
OpenProcess
TerminateProcess
RtlLookupFunctionEntry
FlsSetValue
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
FreeLibrary
TerminateProcess
GetCurrentProcess
GetSystemInfo
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
GetTickCount
GlobalFree
GetProcAddress
LocalAlloc
LocalFree
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?rdstate@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?setf@ios_base@std@@QEAAHHH@Z
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?uncaught_exception@std@@YA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

__CxxFrameHandler3
memcpy
__std_terminate
memmove
__C_specific_handler
__std_exception_copy
__std_exception_destroy
memset
_CxxThrowException
__std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

terminate
_initialize_narrow_environment
_configure_narrow_argv
_initterm
_set_app_type
_seh_filter_exe
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_initialize_onexit_table
_seh_filter_dll
_initterm_e
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
exit
_exit
_get_narrow_winmain_command_line

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-filesystem-l1-1-0

_chmod

shell32

CommandLineToArgvW

wtsapi32

WTSSendMessageW

user32

GetProcessWindowStation
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW

Exports

Exports

#��Sͣ�;T�T�?EA��1�4kY]��i��X+��T��O�R�Maat[�W��t�ʄ� yy��$�p򈯎�M�F��lt��zi/�H� �R��% S�,��6nwq�JU�q,`��7�,l��QN ��v��!�;�7�~%�LiT�id��}��u��^��ʷG��{�a�V�z7�-^�?�("�R��%4cԞ��$��Ui,P�܆��w��,)��|��ޒ��%��L��9+Mns]ը��7�O�E��m�P��J�xGo��_m8pɗ�5�H�?2W��#��)G��2�(��9I//}��n��sM�;��GX`Z��-�?kt6�iK��(�.�In��s��Z�r �3��!W�3i�5y��V�3K��M�8�~�T)؟��=�!� ��\��0�C1�0��m��L��E�_��>� "\��Y��c�In|�q��sv�Ǖ��$^�HƸ��C��⛩l� ]o*��1��^��4N[={��S�[%�/aH�s8C,剁.oz�+2�u/�(~�G~�I� �-&v��2�g�u�* 9��ft��n}��RU��P��ϣ;��p{�f�+q֗��!�7\t�X�0$k�.O�P�j¢H��P%ꆋY^A�s�|�p��K{�Y��P�Q^1�枹�o;��zk�� 8��)7�|��?Nj��ؕ��^��g]�~�0v�!:��s��!,@ �x_0�#0ޞWy�vC&!��AT��:>��5:0�u��|��\6�93ԍ��N�+@n4h�R��a�G;��P)x��?��C�@d/}�@��V{-@1�|�BZ��h�caS�w�ҧC��H�r��7i��(^��v��A�Fnz��5Om�y�ǯ0֛ �ah�1��@ǹ�~��I��8�ȗ��7-*;��D��, <g磰��h�F�m��X�v�Nb1%ryAe�g$s��C�T��x��'��7i�m�$�W��9�d �U6w껇p]�`� =A��Ϙʅ��h�6�@��h�N.Mh��O��r"��l�g��?LY��Ŵ5Uu+fx$�t:�g�r��H �U-4�G��]�c�Q�r�,��G��}<��R��1He� ��&�P�]2�&j�֢IX�Q�F ��$V�.�?�Z^4�bg�+k��N�ư~�>�S�KySY��t��{��bˣ1�#eЎ��|x��(3�z3k-#�U��u�Ֆv��=Әa��'!_��G�Q��$rHD#�k!Ԯ��A�Y��M��q�ѩ*v=�E1W,y}��Q��_Rʜ'@��nn��CB'��-RÐ?�gE��Ñ��x�!Ph�G�"��"��]"�rqʗ�;�$�o�ߖ��i�uP, 0��,��H�-�/L:#��b��T�k"�j/56��Y��9�>��K�7��s��R52u�'7�Ê)��5��^��#/�B�e�fI��lH��J��H�r8�Xu��wM%0B��kF��p��%��Ƈs|)��M��ܒ��֟0� ��}\�Z�T �P.4]��cϰCSQ��I׆�yPά\~�dS� ��Aq�nL�r��S��Bލ+)ѷR��H��aI�M��=�wOl'}��&r,�)��s5f.K��] + >��@��q|0��P��7�ד�� }T�@��f� AKk|#L/�PnAwc](��7�@��ß��c��"v�{+08�W`��F:H!��yx�*��zШ��09�#�g��3�.$8z ��]/N��q��$㗖��B!�Ul��,!y��U},��jc��p��x��5'�b$V��@&�|'Uǧ��J(d�Xힽ 0_]7��O�Q_c�� O_m�w{��Y�U(��]Z��%�仂�7�|+V�h�$�@Sw��J8��ۈ�!�ۻ��x�Bҭj��U��T�g#S��жMzM��,X��V�vΞ��8��O�>��C,G�/P��Fvuk��Q�`�<��'�Lh&� �#v(��&F�&&U,��q5E�ߕ,�̞��z��g8�蹃��>8!��َ56�h��y��[0� �Y���{j}K�غ�'о��}��e}o'��^~uI0|JޝM�q�f��m9�\��nKm��ێ��yv��L.��|IKwݱ��(��m��ۡ �R��E��9滤L��lV��_e�Q��MOƄ��_Y��[ú�L��;0I��<t�`��[��w��p;=zu=�2�nd''l2��ZD�lD5�8/��"n��V��Q{�T~Z��)��3!��ޫ��ٝ��)��1�t�x��7À��@C3��i_��QǬ߁�H"��f�[��ľ-��{q�?�r��f�LB��U.�"=��H|�9�in�4;_��i� ��=�%'��|a+&ץ��r�nh�"��|,1��d�0�5#p��M�Ew1�q� �Ĕ�Ud�%��ﭴ��z��57��u�6WO��I��b5�/L�ki{��Q^�p��M_CP��u�C��5XR�T�_�MVv��p<�,��3�Ypt�8��oh��A� �R��C3�y��*��lsz�~PNo�Ud8j�3P<(��x�Ń��y��F��Z��2)�m��rE�r�eB@Ă�;ǝ�t%6��k.d�[ a��\9g��\xv�i]��\��E��˭ک�2 _[��p�]�S}j��3DP;��ɯ�SSߦ�>,�T]�-�Ҳ#�t4�E��H�w3V1,X��u��hʀ��óV\t�\�

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dji0
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.dji1
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f143957448ed27a7943b99019b5caf9e

Headers

DLL Characteristics

File Characteristics

Imports

qt5core

kernel32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

shell32

wtsapi32

user32

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 24KB - Virtual size: 24KB

.data Size: 4KB - Virtual size: 4KB

.pdata Size: 4KB - Virtual size: 4KB

.gfids Size: 4KB - Virtual size: 4KB

.dji0 Size: 3.2MB - Virtual size: 3.2MB

.dji1 Size: 4.8MB - Virtual size: 4.8MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 101KB - Virtual size: 101KB

.l1 Size: 20KB - Virtual size: 20KB

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 24KB - Virtual size: 24KB

.data
Size: 4KB - Virtual size: 4KB

.pdata
Size: 4KB - Virtual size: 4KB

.gfids
Size: 4KB - Virtual size: 4KB

.dji0
Size: 3.2MB - Virtual size: 3.2MB

.dji1
Size: 4.8MB - Virtual size: 4.8MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 101KB - Virtual size: 101KB

.l1
Size: 20KB - Virtual size: 20KB