Resilio-Sync_x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Resilio-Sync_x64.exe
Size

34.0MB
MD5

a735215dc17e3c33b2f4b9e2a3aacd6e
SHA1

2d6db5bcfeb121676619f9ac50e01a44b23409fd
SHA256

dc9c72e709cc7a2ea74999ce3756e6f4879cd6eae50a888a1f8ca011a1d6efa3
SHA512

c6ad6d448b53b8f5416157dc57c246ea9398b2915c41534b66211dbe75350cf422ea53e296b65957ef594126379b1600559d3338fba8d8f34b30e51c8864f8f8
SSDEEP

786432:XqLLEDV9Gc/a7SgGNI/2kysBDZYkMW3p5TqWnUA8/EseedY1IrN3QIVKhps11zbA:XCselIrHgiV8hb

Score

1^/10

Malware Config

Signatures

Files

Resilio-Sync_x64.exe
.exe windows:6 windows x64 arch:x64

79acf4fe39f9503aace7993df3cab0c5

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

af:83:61:30:96:91:48:45:e7:85:e1:3b:9b:db:e3:1b
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

28/01/2022, 00:00

Not After

27/01/2025, 23:59

Subject

CN=Resilio\, Inc.,O=Resilio\, Inc.,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

30:9f:bc:1c:82:09:a2:e2:b4:bc:09:38:34:99:16:bc:87:97:1f:e1:44:24:ef:af:86:bd:4a:d1:dd:7b:c7:06
Signer

Actual PE Digest

30:9f:bc:1c:82:09:a2:e2:b4:bc:09:38:34:99:16:bc:87:97:1f:e1:44:24:ef:af:86:bd:4a:d1:dd:7b:c7:06

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\jenkins\workspace\build-sync-windows\build\Release\sync.pdb

Imports

credui

CredUnPackAuthenticationBufferW
CredUIPromptForWindowsCredentialsW

secur32

GetUserNameExW

kernel32

SystemTimeToFileTime
GetSystemTime
MultiByteToWideChar
TlsGetValue
TlsSetValue
IsNormalizedString
NormalizeString
HeapCompact
HeapWalk
HeapValidate
LocalAlloc
InitializeCriticalSection
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetNativeSystemInfo
GetLocalTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
GetDateFormatEx
GetTimeFormatEx
GetComputerNameW
GetVolumeNameForVolumeMountPointW
FormatMessageW
GlobalMemoryStatusEx
GetSystemTimes
GetProcessTimes
SetThreadAffinityMask
ResumeThread
GetLogicalProcessorInformation
VirtualFreeEx
GetNumaProcessorNode
GetCurrentProcessorNumber
VirtualAllocExNuma
QueryPerformanceCounter
QueryPerformanceFrequency
ReplaceFileW
GetCurrentDirectoryW
GetUserPreferredUILanguages
GetLocaleInfoEx
GetVolumeInformationA
SystemTimeToTzSpecificLocalTime
GetFullPathNameW
ProcessIdToSessionId
WaitNamedPipeW
GetSystemDirectoryW
VirtualAlloc
SetUnhandledExceptionFilter
SetConsoleScreenBufferSize
GetStdHandle
GetConsoleScreenBufferInfo
AllocConsole
TerminateProcess
PeekNamedPipe
CreatePipe
FreeLibrary
LoadLibraryW
OpenProcess
DuplicateHandle
GlobalUnlock
GlobalLock
FindResourceW
GetLogicalDriveStringsW
GlobalFree
MulDiv
FreeResource
SetEnvironmentVariableW
GetCommandLineA
SetCurrentDirectoryW
GlobalAlloc
GetACP
IsValidCodePage
GetConsoleCP
HeapQueryInformation
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
OutputDebugStringW
SetConsoleCtrlHandler
SetStdHandle
ExitThread
RtlUnwindEx
WaitForMultipleObjectsEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
SetProcessAffinityMask
VirtualFree
VirtualProtect
GetVersionExW
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
GetStringTypeW
EncodePointer
RtlPcToFileHeader
GetExitCodeThread
SwitchToThread
MapViewOfFile
CreateFileMappingW
FormatMessageA
LockFileEx
UnlockFile
HeapDestroy
GetSystemInfo
HeapReAlloc
DeleteFileA
CreateFileA
FlushViewOfFile
GetDiskFreeSpaceA
GetTempPathA
HeapSize
UnmapViewOfFile
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
HeapCreate
AreFileApisANSI
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
TlsFree
InitializeCriticalSectionAndSpinCount
GetModuleHandleExW
GetSystemDirectoryA
FreeConsole
WriteConsoleW
GetDateFormatW
SizeofResource
LockResource
LoadResource
FindResourceA
FindNextChangeNotification
FindFirstChangeNotificationW
FindCloseChangeNotification
OpenMutexW
OpenMutexA
GetShortPathNameW
WinExec
GetEnvironmentVariableW
ExitProcess
GetFileSize
GetFileInformationByHandle
GetFileType
WriteFileEx
ReadFileEx
SetFileTime
GetFileTime
GetLongPathNameW
FindFirstFileExW
GetFinalPathNameByHandleW
GetTempFileNameW
SetFileInformationByHandle
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesExW
SetFilePointer
GetVolumePathNameW
LoadLibraryA
GetFileAttributesA
SetFilePointerEx
GetFileSizeEx
RemoveDirectoryW
FlushFileBuffers
SetFileValidData
GetFileAttributesW
CancelIo
GetDiskFreeSpaceExW
GetVolumeInformationW
GetDriveTypeW
DeviceIoControl
ReadDirectoryChangesW
CancelIoEx
SleepEx
CreateEventA
WaitForSingleObjectEx
SetDllDirectoryW
GetCommandLineW
TlsAlloc
GlobalAddAtomW
RtlUnwind
SetErrorMode
WriteFile
SetNamedPipeHandleState
SetLastError
MoveFileExW
GetTickCount64
GetSystemTimeAsFileTime
CreateMutexW
GetCurrentProcess
GetModuleHandleA
ReleaseMutex
GetWindowsDirectoryW
RegisterApplicationRestart
GetModuleFileNameW
DecodePointer
GetProcAddress
GetModuleHandleW
DeleteCriticalSection
InitializeCriticalSectionEx
RaiseException
VerifyVersionInfoW
VerSetConditionMask
OpenEventW
CopyFileW
CreateDirectoryW
SetFileAttributesW
MoveFileW
DeleteFileW
GetTickCount
GetTempPathW
WideCharToMultiByte
AttachConsole
GetExitCodeProcess
DisconnectNamedPipe
ReadFile
GetOverlappedResult
ResetEvent
WaitForMultipleObjects
CreateProcessW
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
HeapFree
GetProcessHeap
HeapAlloc
InitializeProcThreadAttributeList
ConnectNamedPipe
CreateFileW
CreateNamedPipeW
LocalFree
SetEvent
CreateEventW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentThreadId
WaitForSingleObject
GetCurrentThread
SetThreadPriority
CloseHandle
CreateThread
GetCurrentProcessId
Sleep
GetLastError
RtlCaptureStackBackTrace
GetOEMCP

user32

AppendMenuW
TrackPopupMenu
DestroyMenu
GetSysColor
GetAsyncKeyState
GetSystemMetrics
UpdateWindow
GetParent
EnumChildWindows
IsDlgButtonChecked
CheckDlgButton
EnableWindow
GetScrollPos
GetScrollInfo
SetScrollInfo
ScrollWindow
BeginPaint
GetWindow
EndPaint
EqualRect
GetMessagePos
GetMessageTime
CallWindowProcW
LoadCursorA
RegisterClassExW
PostQuitMessage
GetWindowTextW
EnableMenuItem
GetUserObjectInformationW
GetProcessWindowStation
CloseClipboard
SetClipboardData
EmptyClipboard
OffsetRect
MapWindowPoints
GetDesktopWindow
CreatePopupMenu
GetSysColorBrush
DrawIcon
DrawEdge
LoadStringW
LoadBitmapW
DrawIconEx
LoadImageW
ShowWindowAsync
CreateIconIndirect
GetIconInfo
RegisterWindowMessageW
ReleaseCapture
FlashWindowEx
SwitchToThisWindow
SetDlgItemTextW
PeekMessageW
MsgWaitForMultipleObjects
PostThreadMessageW
KillTimer
SetTimer
RemovePropW
GetClassNameA
EndDeferWindowPos
DeferWindowPos
IsWindowVisible
BeginDeferWindowPos
CheckRadioButton
DrawFrameControl
DefWindowProcW
LoadIconA
LoadImageA
PtInRect
ScreenToClient
DispatchMessageW
TranslateMessage
WindowFromPoint
GetMessageW
SendMessageTimeoutA
SetCapture
SendMessageW
GetDlgItem
GetClientRect
GetWindowRect
DestroyWindow
ShowWindow
UnregisterClassW
SetFocus
GetFocus
SetMenu
PostMessageW
RegisterWindowMessageA
GetMenu
SetMenuInfo
DrawMenuBar
RegisterPowerSettingNotification
IsIconic
GetSystemMenu
EndDialog
InflateRect
ClientToScreen
OpenClipboard
InvalidateRect
FillRect
DrawTextW
DrawTextA
CopyRect
DestroyIcon
GetActiveWindow
SetPropA
CallNextHookEx
SetWindowTextW
GetPropA
GetMenuItemCount
GetMenuItemID
UnregisterPowerSettingNotification
ShutdownBlockReasonCreate
ShutdownBlockReasonDestroy
GetForegroundWindow
IsWindowEnabled
GetWindowLongW
GetWindowThreadProcessId
EnumWindows
FindWindowW
GetCursorPos
IntersectRect
SetForegroundWindow
AttachThreadInput
GetKeyState
SetWindowLongW
SetWindowPos
MoveWindow
CreateWindowExW
SendMessageTimeoutW
SetWindowLongPtrW
GetWindowLongPtrW
MessageBoxW
ReleaseDC
GetWindowPlacement
GetClassNameW
GetPropW
SetPropW
SetMenuItemInfoA
GetMenuItemInfoA
CreateMenu
GetKeyNameTextW
MapVirtualKeyA
SendDlgItemMessageW
CreateDialogIndirectParamW
DialogBoxIndirectParamW
SystemParametersInfoW
GetWindowTextLengthW
GetDlgCtrlID
SetWindowsHookExW
LoadIconW
UnhookWindowsHookEx
RemoveMenu
GetDC

gdi32

GetDeviceCaps
SelectObject
SetWindowOrgEx
CreateCompatibleDC
CreateCompatibleBitmap
GetTextExtentPoint32A
BitBlt
DeleteObject
CreateRectRgn
RectInRegion
OffsetRgn
SelectClipRgn
GetObjectA
CreateFontIndirectA
GetStockObject
CreateFontA
CreatePen
MoveToEx
LineTo
Polyline
ExcludeClipRect
Polygon
Ellipse
Pie
SetBkColor
CombineRgn
ExtTextOutW
GetPixel
SetPixel
SetBkMode
SetTextColor
TextOutW
GetTextMetricsA
CreateBitmap
CreatePatternBrush
GetObjectW
CreateDIBSection
PatBlt
StretchBlt
GetCurrentObject
GetDIBits
CreateFontIndirectW
CreateSolidBrush
DeleteDC

ws2_32

getnameinfo
send
inet_ntoa
freeaddrinfo
htonl
htons
bind
socket
closesocket
ntohl
WSAGetLastError
setsockopt
ntohs
sendto
recvfrom
WSAIoctl
recv
getpeername
getsockname
connect
accept
WSASetEvent
WSASetLastError
WSASend
WSARecv
getsockopt
WSASocketW
WSAWaitForMultipleEvents
WSAEventSelect
WSAEnumNetworkEvents
listen
WSASendTo
InetPtonW
WSAStartup
WSACleanup
ioctlsocket
inet_pton
inet_ntop
WSAStringToAddressW
gethostname
getservbyname
inet_addr
gethostbyname
getservbyport
gethostbyaddr
getaddrinfo

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

shell32

SHGetDataFromIDListW
SHGetFolderPathW
SHBrowseForFolderW
SHBindToParent
SHParseDisplayName
CommandLineToArgvW
SHGetSpecialFolderPathW
ShellExecuteW
Shell_NotifyIconW
SHAppBarMessage
SHFileOperationW
ShellExecuteExW
SHGetKnownFolderPath
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteA
DragQueryFileW
SHGetFileInfoW
SHChangeNotify
ord190
SHOpenFolderAndSelectItems
ord155

comctl32

ord410
ord413
ord412
ImageList_Destroy
ImageList_GetImageCount
ImageList_DrawEx
ord17
ord345
ImageList_GetIconSize
ImageList_GetIcon
ImageList_Replace
ImageList_SetImageCount
ImageList_Duplicate

advapi32

CryptSetHashParam
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetUserNameW
FreeSid
AllocateAndInitializeSid
RevertToSelf
AccessCheck
MapGenericMask
OpenThreadToken
ImpersonateSelf
GetFileSecurityW
RegDeleteKeyW
RegDeleteKeyExW
CryptGenRandom
CryptReleaseContext
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegQueryInfoKeyW
EqualSid
GetAce
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
SetNamedSecurityInfoW
SetSecurityInfo
ConvertStringSidToSidW
ConvertSidToStringSidW
ConvertSecurityDescriptorToStringSecurityDescriptorW
DeleteAce
GetSecurityInfo
OpenSCManagerW
OpenServiceW
LookupAccountNameW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptAcquireContextW
CryptDestroyKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
LookupAccountSidW
DuplicateToken
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
QueryServiceStatus
StartServiceW
DeleteService
ControlService
ChangeServiceConfig2W
CloseServiceHandle
CreateServiceW
LsaClose
LsaAddAccountRights
LsaOpenPolicy
LogonUserW

psapi

GetProcessMemoryInfo

iphlpapi

NotifyIpInterfaceChange
CancelMibChangeNotify2
GetAdaptersAddresses

gdiplus

GdipDrawImageI
GdipGetImageGraphicsContext
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipCreateBitmapFromStreamICM
GdipDisposeImage
GdipAlloc
GdipFree
GdipDeleteGraphics
GdipDrawImageRectI
GdipCreateBitmapFromStream
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0

shlwapi

PathIsUNCW
PathFileExistsW
PathIsDirectoryEmptyW

winmm

timeEndPeriod
timeBeginPeriod

wininet

InternetOpenUrlW
HttpQueryInfoW
InternetCloseHandle
InternetOpenW

mpr

WNetGetUniversalNameW

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken
WTSRegisterSessionNotification

ncrypt

BCryptGenRandom

ntdll

NtCreateFile
NtClose
RtlVirtualUnwind
RtlInitUnicodeString

ole32

CoCreateInstance
OleInitialize
StgCreateDocfile
OleCreate
OleSetContainedObject
OleUninitialize
CreateStreamOnHGlobal
CoTaskMemFree

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

crypt32

CertOpenStore
CertCloseStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertFindCertificateInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext

Sections

.text
Size: 12.7MB - Virtual size: 12.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 218KB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 706KB - Virtual size: 706KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16.7MB - Virtual size: 16.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

79acf4fe39f9503aace7993df3cab0c5

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

af:83:61:30:96:91:48:45:e7:85:e1:3b:9b:db:e3:1bCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

30:9f:bc:1c:82:09:a2:e2:b4:bc:09:38:34:99:16:bc:87:97:1f:e1:44:24:ef:af:86:bd:4a:d1:dd:7b:c7:06Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

credui

secur32

kernel32

user32

gdi32

ws2_32

comdlg32

shell32

comctl32

advapi32

psapi

iphlpapi

gdiplus

shlwapi

winmm

wininet

mpr

wtsapi32

ncrypt

ntdll

ole32

oleaut32

crypt32

Sections

.text Size: 12.7MB - Virtual size: 12.7MB

.rdata Size: 3.5MB - Virtual size: 3.5MB

.data Size: 218KB - Virtual size: 3.9MB

.pdata Size: 706KB - Virtual size: 706KB

.rsrc Size: 16.7MB - Virtual size: 16.7MB

.reloc Size: 80KB - Virtual size: 79KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

af:83:61:30:96:91:48:45:e7:85:e1:3b:9b:db:e3:1b
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

30:9f:bc:1c:82:09:a2:e2:b4:bc:09:38:34:99:16:bc:87:97:1f:e1:44:24:ef:af:86:bd:4a:d1:dd:7b:c7:06
Signer

.text
Size: 12.7MB - Virtual size: 12.7MB

.rdata
Size: 3.5MB - Virtual size: 3.5MB

.data
Size: 218KB - Virtual size: 3.9MB

.pdata
Size: 706KB - Virtual size: 706KB

.rsrc
Size: 16.7MB - Virtual size: 16.7MB

.reloc
Size: 80KB - Virtual size: 79KB