HookValo_Spoofer[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

HookValo_Spoofer.rar
Size

13.6MB
MD5

42b0951f5139d2bff78f0ef539ff66bb
SHA1

8864be9c5e5117d8e7b21a6f5c3b944c1deb297f
SHA256

e2e4eea3d18e5766c65fb331455591a22f5ad85fdcf8d1c7b45ef473c5447b4f
SHA512

733a77418aa70f052c46e53e06214d391e355ffbe5d5c1ece09734f211411bc7bbd3769ef7fcdafbc9f543e5f9586aabc2bf7e356095772a6df890ab5f5f075c
SSDEEP

393216:UXvZdNyAexVjq9ZhlK1DFgFS9RPAqwTUAvq3f6L:oXuxELPYpce1nw6yL

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/HookValo Spoofer/Cleaner Pack/Cleaner.exe
unpack001/HookValo Spoofer/Cleaner Pack/Cleaner2.exe
unpack001/HookValo Spoofer/Guna.UI2.dll
unpack001/HookValo Spoofer/Ultra Spoofer Mac Changer.exe
unpack001/HookValo Spoofer/Ultra Spoofer.exe
unpack001/HookValo Spoofer/injector.exe
unpack001/HookValo Spoofer/vroom.dll

Files

HookValo_Spoofer.rar
.rar
HookValo Spoofer/Cleaner Pack/Cleaner.exe
.exe windows:6 windows x64 arch:x64

4f18d8f5190b7c0f5a4164ca3c2d888a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VerifyVersionInfoA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

FindWindowA
CharUpperBuffW

msvcp140

?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A

normaliz

IdnToAscii

wldap32

ord79

crypt32

CertFreeCertificateContext

ws2_32

WSASetLastError

rpcrt4

UuidToStringA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

__sys_nerr

api-ms-win-crt-filesystem-l1-1-0

_stat64

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-stdio-l1-1-0

__p__commode

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-math-l1-1-0

_dclass

api-ms-win-crt-string-l1-1-0

strpbrk

api-ms-win-crt-time-l1-1-0

_gmtime64

api-ms-win-crt-utility-l1-1-0

qsort

advapi32

CryptDestroyKey

shell32

ShellExecuteA

Exports

Exports

��p�ʳ��CZ*��5k>*�S�p��I��hH� �k��22��w�VA��1j[p��S��<9�s�Ң��w��%Ί:�Ԋ#��b&�=�很�� b*��l�4�j�\Γ�}�:xT["��R�5p��V�:��) �E�� #d�M��ԛϊ��9�{�f-��O��o�v��BӃ�i`o � �# �9�.�3hU�*>�O��1g�Z��S͡��&�r]�� F�IƦG�n��$<S��S�R��94l�\t��^>�p��߁qz��#W�đ�zߒ��-Vv�s{�S�%-�g�ːJ�*�P��`�<1��<+��rڨR�ySzٞL�O}t��(��6ԛk*��8ugSZ�Im�F�n��n��$( ��%�w��@��f:ɩ��0��Ě|��'��W�6�6��d`LM��&1�9c�@�6i-��3n.��Z��Э�Lw`1E��t��g��3ɠ�g��p.Y�V��$5�)Ż��sx�}L��|j4�� I�_v �9�Lئ��j��H^�C��\<KT#Z�3��r)2:��'ebX�_�&\�b�d}(4��տg9��l�!;ר�V�6�E��q��r�o�׊�� j ̙4LY��JA|?rh��j��|}�eم�Կ�k�ē��B��֮��M�Ӯ��˃�� "k�s�0��YŶF��٫y�LMX��N��u _��5��r@��Pe¶�Rx�6�9I(�jpw��Xש $�X�bir̜�]��mAd�r>R5��b�fC�!�- ��R|�REJ��Ğv��D��^��l� 9|Q��]�K\p�� og��Ӈ�R�h�*��d�6�aYJ��BR��X^.V��òA��Q�\!˥w��Bu-�DƉw��C�h��C|y�8OĚt� j]�O�O��U~\��^"��q�wC�v�,�b��Хr%��6�?m��)�1+�g�Z�h��>�u�ed��.��ɟf>��^쥳��J5�{�!�E��E~x�Pቂ�}� �*�Bd�0y�HWiH=j� ��Ы�٬�zN��@V��0�H��U5&�ڜ��-��o��l��jN�ӕ�6~ĕ��W�iGޘa��w��/�A��O6C�x6+�� 9x��RS΍p�u�zY��o�^X bSy ��s�)��e��ً� ��hg��)�! �� ~e�e�r�I��Q��f��<��-��Ƽ�]S��"�ҵZ��N<�Y��[(ie[r��<~��4�.��J��ve��2y�I�+�$)�ʂ;�l��]�M� ��8�$ew%�+�G��^*��Si<�T�s�G�U�ww��M��2��f�h�3�.��YEZ��v��HU�~3��Cj��u�Y��z��LF��(�[��ŘR��e�>�r��S�]X��7��.��R5�м��}%!��ե˛�l�#�A1��5!0pv/��f;��Td`��{5��N��6EI��R�E9=�A�@��q}[�Dn��Oi��7�X��Fd��>��\E�*�MW�_�[r�h�ʌ�'��|oʺ�[��q��-;.� @�1�&l\ {��TLB�EsAFAj�m�A�F��> p��m�� o� ��]�u�%�f��f�5��^�)h��Bڰs=X��)f��v�Y. �TI�9��Y��`�k9�Z�^�٧,8o�(c7�Ѝ��b��R��i*ˎIyP6�)�{�(e��ɱ�JZ��5��QT�))�k�x�{?ZpX��U��,R� ��D��£~��iZ��D�sؔ��`��;,D8bUbpC��"��Q��p��,��gⵅ�>B��I��\��x�%�S��<R)s�K�6;��O'�HO��4K�yiZ+\��D�E��FHIJf~(�ڂ��dF|WU��'�<�!��i\nX��'E7F��F�n��.��3� z-�H��\�NuL��R'��j�~��z�� ݡ�-��ː.�#��˝�XE�Ӷ��UZW��u�$u�瘕6��\��G�(��S�x_�_P1�֟�=�ϚG�#�� Z�>��t � ��·�S��.��=2�g�� N��P��m�A@j�.��|�I�E��'�pY&��G�~8��-�u |��:��I ��;�^�#b�ۥ�vJJ�S�Q0Z�q�9Jf�;S�Clk��Ŋ�2�"hj��\�`8i:� �q��B33�)T�G��Q%y��1�N`j��}-��w�lT�u4:'�(��S"�|��9v�C�F��@��Æ#!�P��}8�ݴ��]��O��i��bm�Sp~(k��"/��g�:jn��U�+��b3K~�D��:{%��^�ᖟ�F{J��- ��=.�~�&� h�ߖ�y��,�j��(�%~�T-;{��ӂ�]�P��^)�Ȁ�c��O�zhЃ �oz�`�#npl�&I�X��DD��sţn�I&\�Ԝ"��=)�K_S]�Wl��xb�&=k�Ij��r�>�E��{�󎬂��Q��_�ۍl�̾f��G��8��T�b%�=��v��러0�� x��,��o��2��1��Xu-��W��8��]jߙy�!�7�8)cfk6U D;�l�y�O(��L[�m��v��y9r$ҥdL�h��O�n$E9��I�cUPu�Ŕ��S�j��w<�>/L؟��U��p��դ��%��Ky@��χuW��-��iʌ�� <ܐ��p7��*�9mw]�Ǥ��L%�!q��0B��z��E�6�yz�Quc��8��!/u�2\��d|�%�o�Z��P�W�ț��*P��:�B�Ő`Y`��RC

Sections

.text
Size: - Virtual size: 469KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vak
Size: - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.~Dt
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.OE_
Size: 6.5MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
HookValo Spoofer/Cleaner Pack/Cleaner2.exe
.exe windows:4 windows x86 arch:x86

c29ab370ed500debe05d495f2d8c12c2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathA
GetModuleFileNameA
GetStdHandle
SetConsoleMode
GetConsoleMode
Sleep
SetConsoleTextAttribute
GetTickCount
SetConsoleCursorInfo
SetConsoleCursorPosition
GetVolumeInformationA
ReadConsoleInputA
WriteConsoleA
LCMapStringW
LCMapStringA
SetEnvironmentVariableA
CompareStringW
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
SetHandleCount
GetFileType
GetStartupInfoA
GetLastError
ReadFile
SetFilePointer
HeapFree
CloseHandle
GetFileAttributesA
GetProcAddress
GetModuleHandleA
WriteFile
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
HeapAlloc
SetStdHandle
FlushFileBuffers
VirtualAlloc
HeapReAlloc
CreateFileA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
SetEndOfFile
CompareStringA

user32

FindWindowA
GetDesktopWindow
GetWindowRect
SetWindowPos

winmm

timeGetTime

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
HookValo Spoofer/Guna.UI2.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
HookValo Spoofer/How to Use/Method 2.txt
HookValo Spoofer/How to Use/Ultra Spoofer & Mac Changer How To Use .txt
HookValo Spoofer/Ultra Spoofer Mac Changer.exe
.exe windows:6 windows x64 arch:x64

1dd72477872310600da0114a3ec62d58

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\beney\Desktop\Keyauth Spoofer\Spoofer taywan\x64\Release\KeyAuth C++ CLR Example.pdb

Imports

kernel32

HeapAlloc
GetCurrentProcessId
DecodePointer
HeapDestroy
LocalFree
DeleteCriticalSection
GetProcessHeap
GetSystemTimeAsFileTime
RaiseException
CloseHandle
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
GetLastError
HeapSize
InitializeCriticalSectionEx
GetCurrentProcess
GetCurrentThreadId
GetFileSizeEx
CreateFileA
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
WideCharToMultiByte
SetConsoleTitleA
Sleep
GetModuleFileNameA
GetModuleHandleA
CreateThread
WinExec
SetLastError
FormatMessageA
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
VerifyVersionInfoA
QueryPerformanceCounter
GetTickCount
MoveFileExA
MultiByteToWideChar
GetEnvironmentVariableA
HeapFree

user32

UnregisterClassA
MessageBoxA

advapi32

CryptEncrypt
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
GetUserNameA
CryptDestroyKey
ConvertSidToStringSidA
CopySid
IsValidSid
OpenProcessToken
CryptImportKey
GetLengthSid
GetTokenInformation

msvcp140

?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setf@ios_base@std@@QEAAHHH@Z
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_Getmonths@_Locinfo@std@@QEBAPEBDXZ
?_Getdays@_Locinfo@std@@QEBAPEBDXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Xlength_error@std@@YAXPEBD@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
_Mbrtowc
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

userenv

UnloadUserProfile

api-ms-win-crt-runtime-l1-1-0

strerror
_set_app_type
__sys_nerr
_errno
_invalid_parameter_noinfo
_getpid
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_get_initial_wide_environment
_beginthreadex
_invalid_parameter_noinfo_noreturn
_resetstkoflw
_configure_wide_argv
abort
_seh_filter_exe
system
exit
terminate

api-ms-win-crt-heap-l1-1-0

malloc
calloc
_callnewh
_recalloc
realloc
free
_set_new_mode

api-ms-win-crt-time-l1-1-0

_localtime64_s
_gmtime64
_time64

api-ms-win-crt-convert-l1-1-0

strtod
strtoul
strtol
strtoll
strtoull
atoi

api-ms-win-crt-math-l1-1-0

_dclass
__setusermatherr

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception
memset
_CxxThrowException
memmove
__std_terminate
__std_exception_copy
__std_exception_destroy
__current_exception_context
__C_specific_handler
memchr
memcmp
strstr
strrchr
strchr
memcpy
__FrameUnwindFilter

shell32

ShellExecuteA

urlmon

URLDownloadToFileW

api-ms-win-crt-stdio-l1-1-0

_close
_open
_read
_write
fgets
__stdio_common_vsprintf
_pclose
__acrt_iob_func
fread
_lseeki64
fwrite
fclose
fopen
fflush
fputc
fputs
__stdio_common_vsscanf
feof
_set_fmode
ftell
__p__commode
_popen
fseek

api-ms-win-crt-locale-l1-1-0

localeconv
_configthreadlocale

api-ms-win-crt-string-l1-1-0

strncmp
strcspn
strncpy
_strdup
isupper
strspn
tolower
strcmp
strpbrk

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_unlink
_stat64
_access

normaliz

IdnToAscii
IdnToUnicode

wldap32

ord30
ord79
ord33
ord32
ord27
ord26
ord200
ord41
ord50
ord45
ord301
ord60
ord211
ord46
ord217
ord22
ord35
ord143

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertCreateCertificateChainEngine
CertFreeCertificateContext
CertOpenStore
CertFindCertificateInStore
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain

ws2_32

gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
recv
closesocket
ntohl

rpcrt4

UuidCreate
UuidToStringA
RpcStringFreeA

httpapi

HttpReceiveHttpRequest
HttpSetUrlGroupProperty
HttpCreateServerSession
HttpAddUrlToUrlGroup
HttpCreateRequestQueue
HttpCreateUrlGroup
HttpInitialize
HttpSendHttpResponse

psapi

GetModuleInformation

mscoree

_CorExeMain

Sections

.text
Size: 615KB - Virtual size: 615KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nep
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 305KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
HookValo Spoofer/Ultra Spoofer.exe
.exe windows:6 windows x64 arch:x64

4f18d8f5190b7c0f5a4164ca3c2d888a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VerifyVersionInfoA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

FindWindowA
CharUpperBuffW

msvcp140

?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A

normaliz

IdnToAscii

wldap32

ord79

crypt32

CertFreeCertificateContext

ws2_32

WSASetLastError

rpcrt4

UuidToStringA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

__sys_nerr

api-ms-win-crt-filesystem-l1-1-0

_stat64

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-stdio-l1-1-0

__p__commode

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-math-l1-1-0

_dclass

api-ms-win-crt-string-l1-1-0

strpbrk

api-ms-win-crt-time-l1-1-0

_gmtime64

api-ms-win-crt-utility-l1-1-0

qsort

advapi32

CryptDestroyKey

shell32

ShellExecuteA

Exports

Exports

�q��O��jtG�G��P��){G_�4�v��I��cSS��s�N<Kl΁�y�r� (�XV혮:�=�3[�.B[��a�RԖi�dЁ��}B��W��Y �1h̢�pBrn �!�Ł�Ȅ0�"��P��y��JI��~�=�ـ�3��o�b��ۿ��hu��i��;�S�O)�\�ø�5i�N�!_�S��,��7!��lR�)��m(�L��<��Ah�ؖK�v>Pn5\��O�\�@� tк��x��F:Sތ5"ĠN��c�t#��mp�Ǻ��ܓj��/Q��?��|'�D;��]��5��N�D=�|��ʖ�!H '��(��ady��w�Ʃ�5:'� \?*��xw4��x��t��Fa4i�0�+��G|r�T��^�>g�!'!��ǻYMb��>m.ζ��N �h�p��abN`��I�x��l�h�T ��9�J3~MR?Ʒ=�3ǿ�(�R+�7j��GNT��3,� Xf=t�_��.|d��Nd�~"#s�w\�yUL��e�m�}�L��y�:W��$Sل��ﾎ�S*�l�CX2��6�Gܘ�z y��B��E�v��H@��D�k4O��t;��AMm��S�(jY�>��ڧxv��B��RM�9�/sPL0>.�ks8-Jbp�''$c��&/=��R̥�??��%H\��-��fU&��I<cm��%C��טr*�2�d��PU$��6��\"��4�@Lm�� ^�`h(V�^��9�"�u�19m��|�4�t�+��7��բ�菇'F�70�2��X��3��;�*.� �ٿz�iH{��|3��k2�0>��wĽ�^XՂ�^-@{!Õ^@Cg?��^��Y� � ψ��ѫ��L��y��tC` \~� ��4�I�;�E��w�v�7�{��'|wAr.��b��V�:��ݞT�ז5v�܉�f=M�*�/I(��V��T�J��n�lîS��kF�!@a��7��"��W�sz��g��e�4[��A��A��u�wX��RR��5Ms+䲮��#�6��/�JG�� m��"��f��_��|��&7��h G�MqJF��.M��y|��He�hҕC#��x��ǢTg'֛0q�p��&M��h��3{q��:"�y\�fW�l7�t5�� G�j�3�G}�8 ,;�Ň�d-��:�*]Jv��YZ�;��v��hxB�+G��e�QE��l��k�ܴｫ��R��p��x�vӈ�%��W�z�S~^ ��- Q��}�d��t��":"��u&��E"�r9�A�S?H�ᘸ��c��7� ��B�U��~/V��u�7��\Y ]�I^r��PX�@�t �a��䑙�z��vK|;3c�&�n&M��_ ��#_�eAĪiVe|ۺ��9�l�}��`��]�u��I�.��r?ρ%&�U��SpY%!�g��m%� �5�$s� 05��\ �OzSG��_G �9��Q�b2Iu��Vm#i�\Zq��g��W~��6wf��ArW�i��Z��B&!q��S�O�{B��Go�Y\!U<��i%z��;c��P!y?8��2�/%�Ǟ��b}��D ��d��)��%k3�q�(�G��(�8gU��%��m�P)Up��T{~!:�w�%#3cb�F��8.l�z�` |]�ʔ6�&�-R�wAd,��*&�F��AmN)>��_=6�[Ļ�D�௴�I�_��g+̧�3��K��|E��l��݌�t�j˕m��)@ӝ�\��~��b�@�%��~��b� :��@U��`j�qvN��u��/� �h��Z�sg��ߢ@V$%�1~��@p�Z��k��[l��4L�.Ⱥۦ�GS9@0}�eo��3�6E;4��{�82�EP�7L�E��x2�q��A�/@��r :��lZZ(�R�z�'*�U�MJK?0+��EsU�!Z��}�S��;�dy��<]��?e�X��T� ��{Q���7��N�K�'z��l3��:G8#Y�Q1��M�׮G��B��U�+��`�p��e�#>�� (r::��RgHX�6�]*��n�X��Ȱ��<O�beov�R"g�.��Y�O#��cv�$h��#CdZ�<A݇B�d�G м��s�M�%��bǥ�$l�!��{��پqP+�}SqB^^+H�̀��;*�>Y��,`P�w��`|~��ʥ��ŭ��C�G�/,9f��#n*|�\�$�.�S�Te�M�O#Gi��V+��h��b��z`��;��^7� A�j8Z.�X~aa��w��Xֆ��PP�� u~��Sn�'�Z��ddBz�~��L zzM��)*�4��&�ޥ�qND��߼z�L�J:�8��rz�6�|�'��̍b�!�E�( Q]�fy��_ �C�Y�Q,��Q��<�v�3��o��1D�:�<�=��Yx�۬��;��N_��|�~��jĥ��b�L��:��]�[�vhЧA�q��K�.m��m�$� ^Vk�m2kIa�`�"��o؄4TQ�ߒ��cdy��5��`�g2 5��Z�c�i�lZ��uЏ�Y0��9��Ge�,��TfRz��2��dT�Ϛ��o��b�X-��p$�[Fg��-9��j-�g��dd�hdA�L>Ug(E� D��Is��\Î��3��SeL�^�T�#�H3�cp��g�Q�l� J5�ϐB��+\U;�2h�ו�9��vT,yyA�.$3;�;x�:T��(��K��D��c��|�^��::�6��&ʰt=��}��*l��3D'Z ��F�A��dd��Q��]U7{`��b|�A� i �g\p��z��^��$V_@��mIV

Sections

.text
Size: - Virtual size: 462KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.=c&
Size: - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.*)h
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.%+m
Size: 6.5MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
HookValo Spoofer/injector.exe
.exe windows:6 windows x64 arch:x64

dfba6051f61aaa818c5807dd939ef741

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Gebruiker.EGON\source\repos\Injector\x64\Release\Injector.pdb

Imports

kernel32

WriteProcessMemory
LoadLibraryA
CloseHandle
GetProcAddress
VirtualAllocEx
CreateRemoteThread
SetConsoleTitleA
OpenProcess
CreateProcessA
FindClose
FormatMessageA
LocalFree
FindNextFileW
AreFileApisANSI
GetLastError
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
FindFirstFileExW
QueryPerformanceCounter
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId

msvcp140

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove
memcpy
__std_terminate
__std_exception_destroy
__std_exception_copy
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
memcmp
memset

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argc
exit
_exit
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_initialize_onexit_table
_set_app_type
_seh_filter_exe
_register_onexit_function
_crt_atexit
terminate
__p___argv
_invalid_parameter_noinfo_noreturn
_initterm_e

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
free
malloc

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode
_getcwd
__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
HookValo Spoofer/vroom.dll
.dll windows:6 windows x64 arch:x64

0102a9b17dff01f910ff4e7a68b9b1a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Gebruiker.EGON\source\repos\valo-rip\valo-rip\x64\Release\bypass.pdb

Imports

kernel32

Thread32Next
Thread32First
SuspendThread
GetModuleHandleA
CreateToolhelp32Snapshot
CloseHandle
GetProcAddress
GetCurrentProcessId
OpenThread
VirtualProtect
GetCurrentProcess
VirtualAlloc
GetModuleHandleW
FlushInstructionCache
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentThreadId
GetThreadContext
SetThreadContext
ResumeThread
Sleep
VirtualFree
VirtualQuery
GetSystemInfo
LeaveCriticalSection
FreeLibrary
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetLastError
EnterCriticalSection

user32

MessageBoxA

msvcp140

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
_Xtime_get_ticks
_Thrd_detach
_Query_perf_counter
_Thrd_sleep
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Throw_Cpp_error@std@@YAXH@Z
_Query_perf_frequency
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__vcrt_LoadLibraryExW
__vcrt_GetModuleFileNameW
__std_type_info_destroy_list
memchr
memcmp
memmove
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__std_terminate
memcpy
memset
__C_specific_handler_noexcept
__C_specific_handler
__current_exception_context
__current_exception

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
terminate
_register_onexit_function
_beginthreadex
_crt_atexit
_initterm_e
_cexit
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
_initterm

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

api-ms-win-crt-string-l1-1-0

strcat_s
strcpy_s

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f18d8f5190b7c0f5a4164ca3c2d888a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp140

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

advapi32

shell32

Exports

Exports

Sections

.text Size: - Virtual size: 469KB

.rdata Size: - Virtual size: 105KB

.data Size: - Virtual size: 4KB

.pdata Size: - Virtual size: 18KB

.vak Size: - Virtual size: 3.9MB

.~Dt Size: 4KB - Virtual size: 4KB

.OE_ Size: 6.5MB - Virtual size: 6.5MB

.reloc Size: 512B - Virtual size: 224B

.rsrc Size: 104KB - Virtual size: 104KB

c29ab370ed500debe05d495f2d8c12c2

Headers

File Characteristics

Imports

kernel32

user32

winmm

Sections

.text Size: 60KB - Virtual size: 59KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 8KB - Virtual size: 11.0MB

.rsrc Size: 4KB - Virtual size: 728B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 3.7MB - Virtual size: 3.7MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

1dd72477872310600da0114a3ec62d58

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

msvcp140

userenv

api-ms-win-crt-runtime-l1-1-0

.text
Size: - Virtual size: 469KB

.rdata
Size: - Virtual size: 105KB

.data
Size: - Virtual size: 4KB

.pdata
Size: - Virtual size: 18KB

.vak
Size: - Virtual size: 3.9MB

.~Dt
Size: 4KB - Virtual size: 4KB

.OE_
Size: 6.5MB - Virtual size: 6.5MB

.reloc
Size: 512B - Virtual size: 224B

.rsrc
Size: 104KB - Virtual size: 104KB

.text
Size: 60KB - Virtual size: 59KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 8KB - Virtual size: 11.0MB

.rsrc
Size: 4KB - Virtual size: 728B

.text
Size: 3.7MB - Virtual size: 3.7MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 615KB - Virtual size: 615KB

.nep
Size: 4KB - Virtual size: 3KB

.rdata
Size: 305KB - Virtual size: 304KB

.data
Size: 6KB - Virtual size: 9KB

.pdata
Size: 29KB - Virtual size: 28KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: - Virtual size: 462KB

.rdata
Size: - Virtual size: 104KB

.data
Size: - Virtual size: 4KB

.pdata
Size: - Virtual size: 17KB

.=c&
Size: - Virtual size: 3.9MB

.*)h
Size: 4KB - Virtual size: 4KB

.%+m
Size: 6.5MB - Virtual size: 6.5MB

.reloc
Size: 512B - Virtual size: 216B

.rsrc
Size: 104KB - Virtual size: 104KB