ac2b061907aca26bf1bbccbdbc59fb13

Sharing

Copy URL

Twitter E-mail

General

Target

ac2b061907aca26bf1bbccbdbc59fb13
Size

1.7MB
MD5

ac2b061907aca26bf1bbccbdbc59fb13
SHA1

d7159fbeb41bd5fca71cc0247276d715bb724f40
SHA256

6e53ece82454c9449fd909ac0d5dbfa9e1bfcded07434de5cc31c347bbcd4ccb
SHA512

be5b141bc6e38d5b92ef0c1c7629315d7f5e98ce77f52f7da91c1363cb431a31292f964c8037f54bf173b8e65748bfc34d0ec0ce50530ad3b7b92a515fc8e859
SSDEEP

49152:Q1Jt5e7GvU202joZaQodGlnhloulNbUfl536:gKoU202kZhnPocbU9536

Score

3^/10

Malware Config

Signatures

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
ac2b061907aca26bf1bbccbdbc59fb13
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/CrashReport.exe
unpack001/FunPlayer.exe
unpack001/FunPlayerPlugin.dll
unpack001/GetMACAddress.dll
unpack001/WMVCORE.DLL

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

Files

ac2b061907aca26bf1bbccbdbc59fb13
.exe windows:4 windows x86 arch:x86

237a51742fed62d237b6f1b75452402f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
SetFileTime
ExitProcess
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
CloseHandle
lstrcmpiA
lstrcmpA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
MulDiv
FindNextFileA
FindFirstFileA
DeleteFileA
CopyFileA

user32

ExitWindowsEx
CharNextA
DialogBoxParamA
GetClassInfoA
SystemParametersInfoA
RegisterClassA
EndDialog
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
CreateDialogParamA
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
LoadImageA
GetDC
EnableWindow
InvalidateRect
CreateWindowExA
GetWindowLongA
DrawFocusRect
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
TrackPopupMenu
wsprintfA
SendMessageA
CallWindowProcA
MapWindowPoints
GetWindowRect
ScreenToClient
PtInRect
LoadCursorA
SetCursor
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SetWindowLongA

gdi32

SetBkColor
GetDeviceCaps
GetCurrentObject
GetObjectA
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegEnumKeyA
RegEnumValueA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegQueryValueExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 456KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstPath.ini
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

57354bdeea3dfae6e948101add87501a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
GetPrivateProfileIntA
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
MultiByteToWideChar
GlobalAlloc

user32

GetDlgCtrlID
GetClientRect
SetWindowRgn
MapWindowPoints
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
PtInRect
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
LoadIconA

gdi32

SetTextColor
GetObjectA
SelectObject
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
CreateCompatibleDC

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
SHGetMalloc
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 954B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NetType.ini
$PLUGINSDIR/StartMenu.dll
.dll windows:4 windows x86 arch:x86

7d85f9c30f9e87a65fff848de2c96ac1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpynA
GlobalAlloc
MulDiv
GetModuleHandleA
GlobalFree
FindClose
FindNextFileA
FindFirstFileA
lstrcmpiA
lstrcatA
lstrcpyA

user32

GetMessageA
IsDialogMessageA
PostMessageA
CallWindowProcA
TranslateMessage
CheckDlgButton
ShowWindow
LoadIconA
GetClientRect
MoveWindow
ScreenToClient
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextA
SendMessageA
GetWindowTextA
IsDlgButtonChecked
DispatchMessageA
DestroyWindow
GetDlgItem
CreateDialogParamA
SetWindowLongA
wsprintfA
GetWindowLongA

gdi32

GetTextMetricsA
SelectObject

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

Exports

Exports

Init
Select
Show

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
CrashReport.exe
.exe windows:4 windows x86 arch:x86

b38b3d986c69681edc8ddc4d444fb724

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
SetThreadLocale
GetThreadLocale
GetModuleHandleW
GetModuleFileNameW
GetSystemTime
DeleteFileW
CloseHandle
WriteFile
CreateFileW
WideCharToMultiByte
ReadFile
CreateFileA
SetEndOfFile
FreeLibrary
GetStringTypeA
LCMapStringW
LCMapStringA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetOEMCP
GetCPInfo
SetFilePointer
GetConsoleMode
GetConsoleCP
GetCurrentProcessId
SetLastError
lstrcmpiW
RaiseException
InterlockedDecrement
InterlockedIncrement
GetLastError
lstrlenW
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapDestroy
GetModuleFileNameA
GetStdHandle
EnterCriticalSection
GetStringTypeW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
Sleep
ExitProcess
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
GetProcAddress
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedExchange
GetACP
GetLocaleInfoA
GetVersionExA
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
GetStartupInfoW
GetSystemTimeAsFileTime
VirtualQuery
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapCreate

user32

ShowWindow
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
SetWindowLongW
DestroyWindow
SendMessageW
GetWindowLongW
GetDlgItem
IsDialogMessageW
CharNextW
LoadBitmapW
GetWindowTextLengthW
GetWindowTextW
PostQuitMessage
DefWindowProcW
GetSystemMetrics
LoadImageW
UnregisterClassA
CreateDialogParamW
GetParent
GetWindow
GetWindowRect
SystemParametersInfoW
GetClientRect
MapWindowPoints
SetWindowPos

gdi32

CreateFontW
DeleteObject
GetStockObject

advapi32

RegSetValueExW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey

shell32

ShellExecuteW

ole32

CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoInitialize
CoTaskMemAlloc

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

wininet

InternetConnectW
FtpSetCurrentDirectoryW
FtpPutFileW
InternetCloseHandle
InternetOpenW

Sections

.text
Size: 116KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
FunPlayer.exe
.exe windows:4 windows x86 arch:x86

d72609833358fe5b5bf81067b87ec5d4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\build1.1.0\src\ui2\Release\FunPlayer.pdb

Imports

shlwapi

PathFileExistsW

ws2_32

closesocket
recv
send
connect
ioctlsocket
htons
inet_addr
inet_ntoa
gethostbyname
gethostname
sendto
WSACleanup
WSAStartup
ntohl
getsockopt
htonl
ntohs
recvfrom
shutdown
select
WSAGetLastError
bind
setsockopt
listen
accept
socket
__WSAFDIsSet

wininet

InternetGetConnectedState
InternetConnectW
InternetOpenW
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
HttpQueryInfoA
InternetQueryDataAvailable
InternetReadFile
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetOpenA
InternetCloseHandle
InternetSetCookieW

kernel32

FindClose
FindNextFileW
DeleteFileW
RemoveDirectoryW
lstrcmpW
FindFirstFileW
MultiByteToWideChar
GetCurrentProcessId
lstrcmpiW
lstrcpynA
GlobalUnlock
GlobalLock
GlobalAlloc
Sleep
MulDiv
CompareStringW
GetLastError
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
InitializeCriticalSection
FreeLibrary
LoadLibraryW
GetModuleHandleW
GetProcAddress
GetFileSizeEx
CreateFileW
ExitProcess
CopyFileW
GetDriveTypeW
GetDiskFreeSpaceExW
SetFileAttributesW
GetSystemDirectoryA
TerminateThread
DeleteFileA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
LoadLibraryExW
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleFileNameA
SetUnhandledExceptionFilter
GetSystemTime
FindResourceA
FindResourceExA
CreateMutexA
WaitForSingleObject
ReleaseMutex
CreateSemaphoreA
ReleaseSemaphore
ExitThread
SetFilePointer
InterlockedExchange
GetVersion
GetEnvironmentVariableW
GetVersionExW
CompareStringA
GetStringTypeExW
GetStringTypeExA
lstrcmpiA
ResumeThread
SuspendThread
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetLocaleInfoA
GetACP
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SetEnvironmentVariableW
SetCurrentDirectoryW
GetStartupInfoW
VirtualProtect
GetModuleHandleA
GetSystemInfo
VirtualQuery
FlushFileBuffers
GetConsoleCP
GetConsoleMode
MoveFileW
GetComputerNameW
GlobalMemoryStatus
GetThreadLocale
lstrcatW
GetTickCount
GetSystemDirectoryW
SetThreadLocale
CreateDirectoryW
lstrlenA
WideCharToMultiByte
WriteFile
CreateFileA
CloseHandle
CreateDirectoryA
CreateThread
SetThreadPriority
GetModuleFileNameW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetCurrentDirectoryW
GetCurrentProcess
FlushInstructionCache
RaiseException
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
SetLastError
lstrcpynW
lstrlenW
FindResourceW
LoadResource
LockResource
SizeofResource
FindResourceExW
ReadFile
FindFirstFileA
FindNextFileA
GetFileAttributesA
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
GetOEMCP
lstrcpyW
HeapCreate
FatalAppExitA
GetTimeFormatA
GetDateFormatA
GetFullPathNameW
GetCurrentDirectoryA
SetCurrentDirectoryA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetConsoleCtrlHandler
GetLocaleInfoW
GetTimeZoneInformation
SetEndOfFile
GetDriveTypeA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetFullPathNameA
SetEnvironmentVariableA
LocalFree
GetEnvironmentVariableA
RtlUnwind

user32

SendMessageA
PostMessageA
CharUpperA
CharUpperW
CharLowerA
MessageBoxA
ScrollWindow
GetMessageW
TranslateMessage
DispatchMessageW
DdeInitializeW
DdeCreateStringHandleW
DdeConnect
DdeNameService
DdeGetData
GetDlgItemInt
SetDlgItemInt
MessageBoxW
GetMenuItemID
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SetDlgItemTextW
CopyRect
GetDCEx
DrawStateW
InvalidateRgn
CreateAcceleratorTableW
GetDesktopWindow
RedrawWindow
IsChild
SetRect
DrawFocusRect
GetDlgCtrlID
CallNextHookEx
IsMenu
DrawEdge
GetWindowDC
PeekMessageW
TrackPopupMenuEx
CreatePopupMenu
AppendMenuW
DestroyAcceleratorTable
OffsetRect
GetClassNameW
SetCursor
GetMenu
GetClassInfoExW
RegisterClassExW
RegisterWindowMessageW
GetMessagePos
WindowFromPoint
GetSysColorBrush
FrameRect
DrawTextW
GetWindowThreadProcessId
CharNextW
CharLowerW
GetMenuItemCount
GetMenuItemInfoW
SetMenuItemInfoW
IsWindowEnabled
GetFocus
MessageBeep
SetWindowsHookExW
InflateRect
GetSysColor
FillRect
LoadStringA
PostQuitMessage
wsprintfW
CreateDialogParamW
SetFocus
SetCapture
GetCapture
ReleaseCapture
ScreenToClient
UpdateWindow
IsWindow
IsCharAlphaW
IsCharAlphaNumericW
GetWindowTextLengthW
GetWindowTextW
LoadCursorW
CreateWindowExW
DefWindowProcW
SetRectEmpty
CallWindowProcW
LoadStringW
ExitWindowsEx
RemoveMenu
FlashWindow
PtInRect
SetMenu
ClientToScreen
CheckMenuItem
EnableWindow
InvalidateRect
GetMenuState
CheckMenuRadioItem
FindWindowW
LoadMenuW
GetKeyState
PostMessageW
TranslateAcceleratorW
DestroyWindow
DestroyMenu
SetWindowLongW
DialogBoxParamW
MoveWindow
EndPaint
BeginPaint
LoadIconW
DrawIcon
GetWindowLongW
GetWindow
SystemParametersInfoW
MapWindowPoints
GetDlgItem
SetWindowTextW
GetParent
EndDialog
GetActiveWindow
SetWindowPos
SetWindowRgn
GetWindowRect
GetClientRect
LoadBitmapW
ReleaseDC
GetDC
SetTimer
KillTimer
GetSubMenu
ModifyMenuW
GetCursorPos
EnableMenuItem
TrackPopupMenu
IsWindowVisible
ShowWindow
IsIconic
SendMessageW
SetForegroundWindow
GetSystemMetrics
LoadImageW
DestroyIcon
UnregisterClassA
UnhookWindowsHookEx

gdi32

CreatePatternBrush
CreateBitmap
LineTo
CreateSolidBrush
CreatePen
Rectangle
SetBkColor
ExtTextOutW
SetTextColor
GetStockObject
GetTextMetricsW
GetDeviceCaps
DPtoLP
CreateFontIndirectW
GetTextExtentPoint32W
DeleteDC
SetBkMode
StretchBlt
BitBlt
CreateRectRgn
GetPixel
CombineRgn
PatBlt
CreateCompatibleBitmap
Polygon
SetBrushOrgEx
GetTextColor
CreateRoundRectRgn
GetBitmapBits
GetDCOrgEx
GetObjectW
TextOutW
SelectObject
MoveToEx
CreateCompatibleDC
DeleteObject
OffsetRgn
RoundRect

comdlg32

GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError

advapi32

LookupPrivilegeValueW
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyW
RegOpenKeyW
RegEnumKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
AdjustTokenPrivileges
OpenProcessToken
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW

shell32

SHGetMalloc
SHChangeNotify
SHBrowseForFolderW
SHGetPathFromIDListW
Shell_NotifyIconW
ShellExecuteW
DragQueryFileW

ole32

CLSIDFromString
StringFromGUID2
CoUninitialize
CLSIDFromProgID
CoTaskMemFree
CoTaskMemRealloc
CoGetClassObject
OleInitialize
CreateStreamOnHGlobal
CoInitialize
OleUninitialize
OleLockRunning
CoCreateInstance
CoTaskMemAlloc

oleaut32

GetErrorInfo
SetErrorInfo
CreateErrorInfo
VarUI4FromStr
OleCreateFontIndirect
SysFreeString
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
SafeArrayCreate
VariantChangeType
VariantInit
SysStringLen
SysAllocStringLen
DispCallFunc
SafeArrayGetUBound
SafeArrayGetLBound
SysStringByteLen
LoadRegTypeLi
LoadTypeLi

comctl32

InitCommonControlsEx
ImageList_LoadImageW
ImageList_Draw
ImageList_DrawEx
ImageList_GetIconSize
ImageList_GetIcon
ImageList_GetImageCount
ImageList_Destroy
CreateStatusWindowW
ImageList_Create
ImageList_AddMasked
_TrackMouseEvent
ImageList_GetImageInfo

msimg32

TransparentBlt

iphlpapi

GetBestRoute
GetBestInterface
GetIpAddrTable
GetIfTable

dbghelp

MiniDumpWriteDump

Exports

Exports

??$void_cast_register@$$CBVtaskpersist_065_1@@$$CBVfilespersist@@@serialization@boost@@YAABVvoid_caster@void_cast_detail@01@PBVtaskpersist_065_1@@PBVfilespersist@@@Z
?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@V?$list@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@VCFpTaskFactory@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@Vfilepersist@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@Vfilespersist@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@Vtaskpersist_061@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@Vtaskpersist_065_1@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?save_object_data@?$oserializer@Vxml_woarchive@archive@boost@@V?$list@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vxml_woarchive@archive@boost@@VCFpTaskFactory@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vxml_woarchive@archive@boost@@Vfilepersist@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vxml_woarchive@archive@boost@@Vfilespersist@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vxml_woarchive@archive@boost@@Vtaskpersist_061@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vxml_woarchive@archive@boost@@Vtaskpersist_065_1@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 328KB - Virtual size: 325KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
FunPlayerPlugin.dll
.dll windows:4 windows x86 arch:x86

e1a11f507f3b3c1f4d6b3c5799efca29

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

dsound

ord1

wmvcore

WMCreateReaderPriv

kernel32

LocalFree
LocalAlloc
GetModuleHandleW
DeviceIoControl
GetLocalTime
QueryPerformanceCounter
GlobalMemoryStatus
GetDiskFreeSpaceA
GetComputerNameA
VirtualAlloc
DuplicateHandle
VirtualFree
GetSystemInfo
ReleaseSemaphore
CreateSemaphoreA
GetCurrentThread
SetThreadPriority
UnmapViewOfFile
CreateFileA
CreateFileMappingA
GetFileSize
MapViewOfFile
GetModuleHandleA
GetFullPathNameA
GetStringTypeExA
CompareStringW
CompareStringA
lstrcmpiA
GetVersion
RaiseException
GetModuleFileNameA
FreeLibrary
VirtualProtect
LoadLibraryA
GetProcAddress
InterlockedIncrement
GetDriveTypeA
FindFirstFileA
FindClose
GetUserDefaultLCID
GetSystemDirectoryA
GetPrivateProfileIntA
CreateEventA
GetTickCount
TerminateThread
InterlockedDecrement
SetUnhandledExceptionFilter
GetModuleFileNameW
CreateFileW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
ExitProcess
Sleep
WideCharToMultiByte
lstrlenA
FindResourceA
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
MulDiv
CreateThread
GetLastError
WaitForMultipleObjects
CloseHandle
ResetEvent
WaitForSingleObject
SetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetEnvironmentVariableA
GetLocaleInfoW
IsBadCodePtr
GetTimeZoneInformation
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetStdHandle
SetHandleCount
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsBadWritePtr
HeapCreate
HeapDestroy
HeapSize
GetFileType
SetStdHandle
TerminateProcess
ExitThread
HeapReAlloc
GetCommandLineA
IsBadReadPtr
GetSystemTimeAsFileTime
VirtualQuery
HeapAlloc
HeapFree
FindNextFileA
GetVolumeInformationA
IsDBCSLeadByteEx
GetTempPathA
GetTempFileNameA
DebugBreak
lstrcpynA
FormatMessageA
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
SetLastError
lstrcmpA
lstrcmpW
lstrcatA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
DeleteFileA
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
lstrcpyA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesA
GetFileTime
ResumeThread
SuspendThread
GetCurrentDirectoryA
EnumResourceLanguagesA
ConvertDefaultLocale
WritePrivateProfileStringA
GetPrivateProfileStringA
GlobalReAlloc
GlobalHandle
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
GlobalFlags
GetCPInfo
GetOEMCP
RtlUnwind

user32

RegisterClassA
GetClassInfoA
GetParent
AdjustWindowRectEx
GetSysColor
GetMenu
SetForegroundWindow
GetKeyState
LoadIconA
GetMessagePos
GetMessageTime
UnhookWindowsHookEx
DestroyWindow
GetTopWindow
GetDlgItem
GetLastActivePopup
GetForegroundWindow
GetWindowTextA
GetFocus
RemovePropA
GetPropA
SetPropA
GetClassNameA
GetClassInfoExA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
CreateWindowExA
GetCapture
WinHelpA
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
ClientToScreen
BeginPaint
EndPaint
ValidateRect
GetCursorPos
GetActiveWindow
GetDlgCtrlID
GetMessageA
LoadBitmapA
GetMenuCheckMarkDimensions
CheckMenuItem
EnableMenuItem
ModifyMenuA
SetMenuItemBitmaps
SetWindowTextA
MoveWindow
ShowWindow
IsWindowEnabled
DeleteMenu
SetCursor
GetSysColorBrush
InsertMenuA
DefWindowProcA
CallWindowProcA
LoadCursorA
IsWindow
GetWindow
GetClientRect
MapWindowPoints
IsWindowVisible
GetWindowLongA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
PtInRect
GetMenuState
GetMenuStringA
GetMenuItemID
PostMessageA
SetRect
CopyRect
IsRectEmpty
GetMenuItemCount
GetSubMenu
InflateRect
CharLowerBuffA
MessageBoxA
GetDC
ReleaseDC
IntersectRect
MonitorFromWindow
GetWindowRect
SetRectEmpty
EqualRect
OffsetRect
UnionRect
FillRect
SendMessageA
PostThreadMessageA
PostQuitMessage
EnableWindow
TranslateMessage
DispatchMessageA
RegisterWindowMessageA
wsprintfA
PeekMessageA
UnregisterClassA
CharUpperA
CreateAcceleratorTableA
DestroyAcceleratorTable
MessageBeep
DestroyMenu

gdi32

CloseFigure
EndPath
GetPath
AbortPath
BeginPath
AddFontResourceA
GetDeviceCaps
TranslateCharsetInfo
GetClipBox
ExtTextOutA
CreateBitmap
SaveDC
RestoreDC
DeleteDC
CreateCompatibleDC
SetBkMode
SetMapMode
GetTextExtentPoint32W
TextOutW
SelectObject
GetTextMetricsA
GetStockObject
SetBkColor
SetTextColor
TextOutA
CreateRectRgn
GetRegionData
DeleteObject
PtVisible
RectVisible
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
CreateFontIndirectA

advapi32

RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegQueryValueA
RegEnumKeyA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegDeleteKeyA
GetUserNameA

shell32

ShellExecuteW

ole32

CoFreeLibrary
CoLoadLibrary
GetRunningObjectTable
CreateItemMoniker
CoFreeUnusedLibraries
CreateBindCtx
MkParseDisplayName
CLSIDFromString
StringFromGUID2
CoUninitialize
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance

oleaut32

SysAllocStringByteLen
VarBstrCmp
SysStringLen
VariantClear
SysAllocString
SysAllocStringLen
SysFreeString
VariantInit
VariantChangeType
SafeArrayUnaccessData
SafeArrayAccessData

ddraw

DirectDrawCreateEx

comctl32

ord17

shlwapi

PathRemoveFileSpecA
PathCanonicalizeA
PathStripToRootA
PathAddBackslashA
PathFindFileNameA
UrlUnescapeA
PathFileExistsA
PathIsUNCA
PathFindExtensionA

dbghelp

MiniDumpWriteDump

wininet

InternetOpenUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetQueryOptionA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
InternetQueryDataAvailable

oleacc

LresultFromObject
CreateStdAccessibleObject

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

comdlg32

GetFileTitleA

Exports

Exports

FilterDllMsg
FunPlayerPluginExports
ProcessDllIdle

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_TEXT64
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
GetMACAddress.dll
.dll windows:4 windows x86 arch:x86

ef6a036c99754e52d571ec048bfab146

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord4486
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord3953
ord2982
ord6375
ord2554
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord4274
ord825
ord815
ord823
ord3147
ord3259
ord561
ord600
ord826
ord1575
ord1168
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1116
ord1176
ord269
ord6467
ord1578
ord1255

msvcrt

__CxxFrameHandler
sprintf
_EH_prolog
??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit

kernel32

LocalAlloc
LocalFree

iphlpapi

GetIfTable

Exports

Exports

GetMACAddress

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 430B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WMVCORE.DLL
.dll regsvr32 windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllRegisterServer
WMCheckURLExtension
WMCheckURLScheme
WMCreateBackupRestorer
WMCreateBackupRestorerPrivate
WMCreateEditor
WMCreateIndexer
WMCreateLicenseRevocationAgentPrivate
WMCreateProfileManager
WMCreateReader
WMCreateReaderPriv
WMCreateSyncReader
WMCreateSyncReaderPriv
WMCreateWriter
WMCreateWriterFileSink
WMCreateWriterNetworkSink
WMCreateWriterPriv
WMCreateWriterPushSink
WMIsAvailableOffline
WMIsContentProtected
WMValidateData

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_DATA
Size: 4KB - Virtual size: 368B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 312KB - Virtual size: 310KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

237a51742fed62d237b6f1b75452402f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 25KB - Virtual size: 25KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 3KB - Virtual size: 290KB

.ndata Size: - Virtual size: 456KB

.rsrc Size: 30KB - Virtual size: 32KB

57354bdeea3dfae6e948101add87501a

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 954B

7d85f9c30f9e87a65fff848de2c96ac1

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 5KB

.rsrc Size: 512B - Virtual size: 296B

.reloc Size: 512B - Virtual size: 460B

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 92B

.reloc Size: 512B - Virtual size: 494B

b38b3d986c69681edc8ddc4d444fb724

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 290KB

.ndata
Size: - Virtual size: 456KB

.rsrc
Size: 30KB - Virtual size: 32KB

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 954B

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 296B

.reloc
Size: 512B - Virtual size: 460B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 92B

.reloc
Size: 512B - Virtual size: 494B

.text
Size: 116KB - Virtual size: 112KB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 8KB - Virtual size: 13KB

.rsrc
Size: 36KB - Virtual size: 32KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 328KB - Virtual size: 325KB

.data
Size: 60KB - Virtual size: 69KB

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

.text
Size: 1.1MB - Virtual size: 1.1MB

_TEXT64
Size: 4KB - Virtual size: 1KB

.rdata
Size: 232KB - Virtual size: 231KB

.data
Size: 72KB - Virtual size: 112KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 96KB - Virtual size: 93KB