Xftp[.]exe[.]7z

Resubmissions

22/04/2024, 20:11

240422-yydjlsfe95 1

22/04/2024, 20:09

240422-yxcwpafe82 1

Sharing

Copy URL Twitter E-mail

General

Target

Xftp.exe.7z
Size

780KB
MD5

1171ccf552d5a8137b92490aa6d7c605
SHA1

0f82ebd1417d2bba5b0f585f2c9671241504e51e
SHA256

47fa9a7a62e5538fbdc7828a7da6fa8b85fdb245e096477a933edcc7daae5d17
SHA512

54a795a0495144fbb647fbcbfbda24f85cbed8553ffc085f637ff22fdb5d3acaba6645ae6e77abb19c0bfce5eb53a4946795a27b1d2568916a1dc8b4ac0eedd8
SSDEEP

12288:RXNjCqZYUxsKL4/2NuZktRzCXhW2HQ6JgKQ/6D2iJsCbfCW4+e7A+:t3TzuIuZ+RzSBHjJgKQ/qjsCbf3le0+

Score

1^/10

Malware Config

Signatures

Files

Xftp.exe.7z
.7z

Password: infected
Xftp.exe
.exe windows:6 windows x86 arch:x86

Password: infected

9d5fab8b705a1ea2901fa206c3f812a3

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:ca:e8:57:ad:b2:0b:83:72:59:af:85
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

14/03/2023, 03:09

Not After

16/04/2026, 06:23

Subject

SERIALNUMBER=110111-1535991,CN=NetSarang Computer\, Inc.,O=NetSarang Computer\, Inc.,STREET=85 Gwangnaru-ro 56-gil,L=Gwangjin-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07/11/2023, 17:13

Not After

09/12/2034, 17:13

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f2:2d:27:49:fa:b7:2a:e6:46:50:ad:b1:ab:03:a0:0f:62:bf:93:35:52:15:1a:c5:ee:f1:4f:20:2c:ce:13:15
Signer

Actual PE Digest

f2:2d:27:49:fa:b7:2a:e6:46:50:ad:b1:ab:03:a0:0f:62:bf:93:35:52:15:1a:c5:ee:f1:4f:20:2c:ce:13:15

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\TortoiseSVN\NSC7\bin\Release\Xftp.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

dhcpcsvc

DhcpRequestParams

nsactivate

NSACTIVATE_IsActivationSkipDaysExpired
NSACTIVATE_IsProductUseConcurrent
ord3
NSACTIVATE_GetActivateMethod
NSACTIVATE_GetProductLocalServerAddress
NSACTIVATE_GetConcurrentLocalServerInfo
NSACTIVATE_GetCheckoutData
ord8
NSACTIVATE_GetProductBorrowInterval
NSACTIVATE_GetProductBorrowPeriod
NSACTIVATE_SetCheckoutErrorMessageTime
NSACTIVATE_CheckCheckoutErrorMessageSkip

nslicense

ord33
ord32
ord47
ord41
ord52
ord43
ord23
ord48

nsprofile2

?Find@CProfileFolder@@QAEPAVCProfileItem@@PBG@Z
?GetCount@CProfileFolder@@QAEHXZ
?CreateShortcut@CProfileFile@@QAEHPBG0@Z
?DelFolderSession@CProfileFile@@UAEHXZ
?HasFolderSession@CProfileFile@@UAEHXZ
?IsFolder@CProfileFile@@UAEHXZ
?RemoveChild@CProfileFolder@@QAEHPAVCProfileItem@@@Z
?MutualSaveSubFolder@CProfileFile@@QAEHPBGI0@Z
??1CProfileFile@@UAE@XZ
??0CProfileDlg@@QAE@XZ
??0CProfileFile@@QAE@XZ
?GetNext@CProfileFolder@@QAEPAVCProfileItem@@AAPAU__POSITION@@@Z
?GetHeadPosition@CProfileFolder@@QAEPAU__POSITION@@XZ
?Sort@CProfileFolder@@QAEXXZ
?Enumerate@CProfileFolder@@QAEXIIH@Z
??1CProfileFolder@@UAE@XZ
??0CProfileFolder@@QAE@XZ
?Add@CProfileDlgColumnArray@@QAEHPBGHH@Z
?DoModal@CProfileDlg@@QAEHXZ
?SetExtension@CProfileFile@@SAXPBG@Z
?SetIcons@CProfileFile@@SAXPAPAUHICON__@@I@Z
?SetNewInstanceProc@CProfileFile@@SAXP6APAV1@XZ@Z
??1CProfileDlg@@UAE@XZ

nsresource

?GetThisClass@CNsToolBar@@SGPAUCRuntimeClass@@XZ
??0CNsToolBar@@QAE@XZ
??1CNsToolBar@@UAE@XZ
?GetThisMessageMap@CNsToolBar@@KGPBUAFX_MSGMAP@@XZ
?PreTranslateMessage@CNsToolBar@@MAEHPAUtagMSG@@@Z
?WindowProc@CNsToolBar@@MAEJIIJ@Z
?DoPaint@CNsToolBar@@MAEXPAVCDC@@@Z
?LoadToolBarEx@CNsToolBar@@MAEHIAAVCMFCToolBarInfo@@H@Z
?GetRowHeight@CNsToolBar@@MBEHXZ
?GetColumnWidth@CNsToolBar@@MBEHXZ
?SetThemeColor@CNsListCtrl@@QAEXXZ
?GetThisClass@CNsThemeMDIFrame@@SGPAUCRuntimeClass@@XZ
?PreSubclassWindow@CNsListCtrl@@MAEXXZ
?GetThisMessageMap@CNsThemeMDIFrame@@KGPBUAFX_MSGMAP@@XZ
??0CNsThemeMDIFrame@@QAE@XZ
??1CNsThemeMDIFrame@@UAE@XZ
?OnCreate@CNsThemeMDIFrame@@IAEHPAUtagCREATESTRUCTW@@@Z
?PreCreateWindow@CNsThemeMDIFrame@@MAEHAAUtagCREATESTRUCTW@@@Z
?SetSortArrow@CNsListCtrl@@QAEXHH@Z
?SetPaneText@CNsStatusBar@@QAEHHPBG@Z
?OnTimer@CNsThemeMDIFrame@@IAEXI@Z
?IsLocked@CNsReBar@@QAEHXZ
?InitTitleBar@CNsCustomTitleBar@@QAEXHV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@H@Z
?IsMonoIcon@CNsVisualManagerWindows@@QAEHPBG@Z
?SetPaneStyle@CNsStatusBar@@QAEXHI@Z
?SetFont@CNsStatusBar@@QAEXPBUtagLOGFONTW@@@Z
?SetPaneWidthByDPI@CNsStatusBar@@QAEXHH@Z
?SaveReBarState@CNsReBar@@QAEHPBG@Z
?LoadReBarState@CNsReBar@@QAEHPBG@Z
?OnActivate@CNsThemeMDIFrame@@IAEXIPAVCWnd@@H@Z
?SetTitle@CNsCustomTitleBar@@QAEHV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@0@Z
?WindowProc@CNsThemeMDIFrame@@MAEJIIJ@Z
?OnSetMenu@CNsThemeMDIFrame@@MAEHPAUHMENU__@@@Z
?Create@CNsComboBox@@QAEHV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@VCRect@@PAVCWnd@@I@Z
?SetImageList@CNsComboBox@@QAEXPAVCImageList@@@Z
?SetIcon@CNsComboBox@@QAEXH@Z
?SetThemeColor@CNsComboBox@@QAEXXZ
?SetFont@CNsComboBox@@QAEXPAVCFont@@H@Z
?GetEditCtrl@CNsComboBox@@QAEPAVCNsComboBoxEditCtrl@@XZ
?FindStringExact@CNsComboBox@@QAEHHPBG@Z
?ResetContent@CNsComboBox@@QAEXXZ
?InsertItem@CNsComboBox@@QAEXPAUtagCOMBOBOXEXITEMW@@@Z
?GetCount@CNsComboBox@@QAEHXZ
?DeleteItem@CNsComboBox@@QAEXH@Z
?GetThis@CNsVisualManagerWindows@@SAPAV1@XZ
?GetThisClass@CNsListCtrl@@SGPAUCRuntimeClass@@XZ
?Lock@CNsReBar@@QAEHH@Z
?AddBar@CNsReBar@@QAEHPAVCWnd@@PBGPAVCBitmap@@K@Z
??1CNsReBar@@UAE@XZ
??0CNsReBar@@QAE@XZ
?OpenPopupMenu@CToolBarDynamicMenuButton@@MAEHPAVCWnd@@@Z
?OnClick@CToolBarDynamicMenuButton@@MAEHPAVCWnd@@H@Z
?OnDraw@CToolBarDynamicMenuButton@@MAEXPAVCDC@@ABVCRect@@PAVCMFCToolBarImages@@HHHHH@Z
??1CToolBarDynamicMenuButton@@UAE@XZ
??0CToolBarDynamicMenuButton@@QAE@XZ
??1CNsPropertySheet@@UAE@XZ
?AFX_NSREBAR_WM_CONTEXTMENU@@3IA
?BuildPropPageArray@CNsPropertySheet@@UAEXXZ
??0CNsPropertySheet@@QAE@PBGPAVCWnd@@I@Z
?GetThisClass@CNsToolBarMenuButton@@SGPAUCRuntimeClass@@XZ
?GetThisClass@CNsMsgWhenEmptyEdit@@SGPAUCRuntimeClass@@XZ
??0CNsMsgWhenEmptyEdit@@QAE@PBG@Z
??1CNsMsgWhenEmptyEdit@@UAE@XZ
?GetThisMessageMap@CNsMsgWhenEmptyEdit@@KGPBUAFX_MSGMAP@@XZ
??0CNsComboBox@@QAE@XZ
??1CNsComboBox@@UAE@XZ
?GetThisMessageMap@CNsComboBox@@KGPBUAFX_MSGMAP@@XZ
?OnCommand@CNsComboBox@@MAEHIJ@Z
?OnLButtonDown@CNsComboBox@@IAEXIVCPoint@@@Z
?PreTranslateMessage@CNsComboBox@@MAEHPAUtagMSG@@@Z
?MeasureItem@CNsComboBox@@UAEXPAUtagMEASUREITEMSTRUCT@@@Z
??0CNsThemeListCtrl@@QAE@XZ
??1CNsThemeListCtrl@@UAE@XZ
?GetThisMessageMap@CNsThemeListCtrl@@KGPBUAFX_MSGMAP@@XZ
?GetThisClass@CNsVisualManagerWindows@@SGPAUCRuntimeClass@@XZ
?GetRuntimeClass@CNsThemeListCtrl@@UBEPAUCRuntimeClass@@XZ
?GetHeaderCtrl@CNsThemeListCtrl@@UAEAAVCMFCHeaderCtrl@@XZ
?InitHeader@CNsThemeListCtrl@@UAEXXZ
??0CNsPropertySheet@@QAE@IPAVCWnd@@I@Z
??0CNsToolBarMenuButton@@QAE@XZ
?OnClick@CNsToolBarMenuButton@@MAEHPAVCWnd@@H@Z
??1CNsToolBarMenuButton@@UAE@XZ
?OnDraw@CNsToolBarMenuButton@@MAEXPAVCDC@@ABVCRect@@PAVCMFCToolBarImages@@HHHHH@Z
?LoadFrame@CNsThemeMDIFrame@@MAEHIKPAVCWnd@@PAUCCreateContext@@@Z
?OnFillButtonInterior@CNsVisualManagerWindows@@UAEXPAVCDC@@PAVCMFCToolBarButton@@VCRect@@W4AFX_BUTTON_STATE@CMFCVisualManager@@@Z
??0CNsListCtrl@@QAE@XZ
??1CNsListCtrl@@UAE@XZ
?GetThisMessageMap@CNsListCtrl@@KGPBUAFX_MSGMAP@@XZ
?GetRuntimeClass@CNsListCtrl@@UBEPAUCRuntimeClass@@XZ
??0CNsTabCtrl@@QAE@XZ
??1CNsTabCtrl@@UAE@XZ
?GetThisClass@CNsThemeListCtrl@@SGPAUCRuntimeClass@@XZ
?UpdateShadow@CNsThemeMDIFrame@@QAEXXZ
?GetThisClass@CNsStatusBar@@SGPAUCRuntimeClass@@XZ
??0CNsStatusBar@@QAE@XZ
??1CNsStatusBar@@UAE@XZ
?GetThisMessageMap@CNsStatusBar@@KGPBUAFX_MSGMAP@@XZ
?DoPaint@CNsStatusBar@@MAEXPAVCDC@@@Z
?RecalcLayout@CNsStatusBar@@MAEXXZ
?CalcFixedLayout@CNsStatusBar@@UAE?AVCSize@@HH@Z
?OnDrawPane@CNsStatusBar@@UAEXPAVCDC@@PAVCMFCStatusBarPaneInfo@@@Z
?SetHeight@CNsStatusBar@@UAEXH@Z
?DrawPaneBackground@CNsStatusBar@@UAEXPAVCDC@@PAVCMFCStatusBarPaneInfo@@@Z
??0CNsVisualManagerWindows@@QAE@XZ
??1CNsVisualManagerWindows@@UAE@XZ
?GetNsThemeColor@CNsVisualManagerWindows@@UAEKPBG0@Z
?OnDrawTab@CNsVisualManagerWindows@@UAEXPAVCDC@@VCRect@@HHPBVCMFCBaseTabCtrl@@@Z
?OnEraseTabsFrame@CNsVisualManagerWindows@@UAEHPAVCDC@@VCRect@@PBVCMFCBaseTabCtrl@@@Z
?OnEraseTabsArea@CNsVisualManagerWindows@@UAEXPAVCDC@@VCRect@@PBVCMFCBaseTabCtrl@@@Z
?IsLightToolbar@CNsVisualManagerWindows@@QAEHXZ
?OnFillBarBackground@CNsVisualManagerWindows@@UAEXPAVCDC@@PAVCBasePane@@VCRect@@2H@Z
?OnUpdateSystemColors@CNsVisualManagerWindows@@UAEXXZ
?OnDrawPaneBorder@CNsVisualManagerWindows@@UAEXPAVCDC@@PAVCBasePane@@AAVCRect@@@Z
?OnDrawMenuBorder@CNsVisualManagerWindows@@UAEXPAVCDC@@PAVCMFCPopupMenu@@VCRect@@@Z
?OnDrawBarGripper@CNsVisualManagerWindows@@UAEXPAVCDC@@VCRect@@HPAVCBasePane@@@Z
?GetCurrentTheme@CNsVisualManagerWindows@@UAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?GetThemeNames@CNsVisualManagerWindows@@UAEPAVCStringList@@XZ
?SetTheme@CNsVisualManagerWindows@@UAEXPBG@Z
?DrawThemeToolBarButtonBackground@CNsVisualManagerWindows@@UAEXPAUHDC__@@HPBUtagRECT@@1@Z
?OnDrawHeaderCtrlBorder@CNsVisualManagerWindows@@UAEXPAVCMFCHeaderCtrl@@PAVCDC@@AAVCRect@@HH@Z
?OnFillHeaderCtrlBackground@CNsVisualManagerWindows@@UAEXPAVCMFCHeaderCtrl@@PAVCDC@@VCRect@@@Z
?OnDrawMiniFrameBorder@CNsVisualManagerWindows@@UAEXPAVCDC@@PAVCPaneFrameWnd@@VCRect@@2@Z
?OnFillMiniFrameCaption@CNsVisualManagerWindows@@UAEKPAVCDC@@VCRect@@PAVCPaneFrameWnd@@H@Z
?IsDockingTabHasBorder@CNsVisualManagerWindows@@UAEHXZ
?OnFillCaptionBarButton@CNsVisualManagerWindows@@UAEKPAVCDC@@PAVCMFCCaptionBar@@VCRect@@HHHHH@Z
?GetToolbarButtonTextColor@CNsVisualManagerWindows@@UAEKPAVCMFCToolBarButton@@W4AFX_BUTTON_STATE@CMFCVisualManager@@@Z
?OnDrawMenuCheck@CNsVisualManagerWindows@@UAEXPAVCDC@@PAVCMFCToolBarMenuButton@@VCRect@@HH@Z
?GetMenuItemTextColor@CNsVisualManagerWindows@@UAEKPAVCMFCToolBarMenuButton@@HH@Z
?GetHighlightedMenuItemTextColor@CNsVisualManagerWindows@@UAEKPAVCMFCToolBarMenuButton@@@Z
?OnHighlightMenuItem@CNsVisualManagerWindows@@UAEXPAVCDC@@PAVCMFCToolBarMenuButton@@VCRect@@AAK@Z
??0CNsToolBarMenuButton@@QAE@IPAUHMENU__@@HPBGH@Z
?GetStatusBarPaneTextColor@CNsVisualManagerWindows@@UAEKPAVCMFCStatusBar@@PAVCMFCStatusBarPaneInfo@@@Z
?OnDrawStatusBarPaneBorder@CNsVisualManagerWindows@@UAEXPAVCDC@@PAVCMFCStatusBar@@VCRect@@II@Z
?OnDrawCaptionButton@CNsVisualManagerWindows@@UAEXPAVCDC@@PAVCMFCCaptionButton@@HHHHH@Z
?OnDrawPaneCaption@CNsVisualManagerWindows@@UAEKPAVCDC@@PAVCDockablePane@@HVCRect@@2@Z
?OnDrawSeparator@CNsVisualManagerWindows@@UAEXPAVCDC@@PAVCBasePane@@VCRect@@H@Z

nssecurity

??0CNsSetMasterPwDlg@@QAE@HV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
??0CNsCheckMasterPwDlg@@QAE@PAVCWnd@@V?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@H@Z
??0CNsResetMasterPwDlg@@QAE@PAVCWnd@@@Z
??0CMngMasterPw@@QAE@XZ
??1CMngMasterPw@@QAE@XZ
?GetInstance@CMngMasterPwSInst@@SAPAV1@XZ
?LoadMP@CMngMasterPw@@QAEXXZ
?IsAuthMasterPw@CMngMasterPw@@QAEHXZ
?CheckMasterPassword@CMngMasterPw@@QAEHPAVCWnd@@@Z
?IsDummyPassword@CMngMasterPw@@QAEHV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?NsRunSetMasterPw@@YAXPAVCWnd@@@Z
?EncryptWithMasterPw@CMngMasterPw@@QAEHAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?EncryptWithNormalPw@CMngMasterPw@@QAEHAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?DecryptWithNormalPwInXFtp@CMngMasterPw@@QAEHAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBG@Z
?DecryptWithMasterPw@CMngMasterPw@@QAEHAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?DecryptWithNormalPwInXShell@CMngMasterPw@@QAEHAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBG@Z
?RemoveInstance@CMngMasterPwSInst@@SAXXZ

nssftp

??0CSftpSubsystem@@QAE@PAVCSftpSubsystemListener@@@Z
??1CSftpSubsystem@@UAE@XZ
?SetUTF8@CSftpSubsystem@@QAEXH@Z
?GetRealPath@CSftpSubsystem@@QAEEPBD@Z
?CreateDir@CSftpSubsystem@@QAEEPBD@Z
?NewFile@CSftpSubsystem@@QAEEPBD@Z
?RemoveDir@CSftpSubsystem@@QAEEPBD@Z
?RemoveFile@CSftpSubsystem@@QAEEPBD@Z
?RenameFile@CSftpSubsystem@@QAEEPBD0@Z
?InitVersionExchange@CSftpSubsystem@@QAEXH@Z
?ChangePermission@CSftpSubsystem@@QAEEPBDI@Z
?ListDirectory@CSftpSubsystem@@QAEEPBD@Z
?ReceiveFile@CSftpSubsystem@@QAEPAXPBD_KW4SFTP_DATATYPE@@@Z
?SendFile@CSftpSubsystem@@QAEPAXPBD_KW4SFTP_DATATYPE@@@Z
?SendFile@CSftpSubsystem@@QAEPAXPBD_KW4SFTP_DATATYPE@@1@Z
?CancelTransfer@CSftpSubsystem@@QAEEPAX@Z
?Pump@CSftpSubsystem@@QAEXXZ
?InputData@CSftpSubsystem@@QAEEPBEI@Z
?GetSftpVersion@CSftpSubsystem@@QAEIXZ
?IsUTF8@CSftpSubsystem@@QAEHXZ
??0CSftpSubsystemListener@@QAE@XZ

nssock2

??0CClientSocket@@QAE@PAVCClientSocketListener@@I@Z
??1CClientSocket@@UAE@XZ
?SetIPV@CGenericSocket@@QAEXW4IPV@@@Z
??0CProxyInfo@@QAE@XZ
??1CProxyInfo@@QAE@XZ
?Load@CProxyInfo@@QAEHPBGH@Z
?SetProxyInfo@CClientSocket@@QAEHPBVCProxyInfo@@@Z
?Connect@CClientSocket@@QAEHPBGGH@Z
?GetState@CGenericSocket@@QAE?AW4SOCKET_STATE@@XZ
?GetBuffer@CSessionSocket@@QAEPAVCBuffer@@H@Z
?Send@CSessionSocket@@QAEHPBEI@Z
?GetResolvedName@CClientSocket@@QAEHAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?Close@CClientSocket@@UAEXXZ
?OnSocketEvent@CClientSocket@@MAEXII@Z
?Bind@CGenericSocket@@MAEHGPAUaddrinfo@@@Z
?OnSocketOOB@CSessionSocketListener@@MAEXPAVCSessionSocket@@PBEI@Z
?OnSocketError@CSessionSocketListener@@MAEXPAVCSessionSocket@@II@Z
?OnSocketLookingUpHost@CClientSocketListener@@UAEXPAVCClientSocket@@PBG@Z
?OnSocketResolve@CClientSocketListener@@UAEXPAVCClientSocket@@PBG@Z
?OnSocketConnecting@CClientSocketListener@@UAEXPAVCClientSocket@@PBG@Z
??0CClientSocketListener@@QAE@XZ
?NSSOCK_DoProxyListDlg@@YAHPAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBGH@Z
?SetRecvLimit@CSessionSocket@@QAEXI@Z
??0CServerSocket@@QAE@PAVCServerSocketListener@@@Z
??1CServerSocket@@UAE@XZ
?NSSOCK_ProcessPendingEvent@@YAHXZ
??0CServerSocketListener@@QAE@XZ
?OnSocketEvent@CServerSocket@@MAEXII@Z
?GetPeerInfo@CSessionSocket@@QAEHAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@AAG@Z
?Send@CSessionSocket@@QAEHPBDI@Z
?GetSockAddrString@CGenericSocket@@QAEHAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?GetSockPort@CGenericSocket@@QAEGXZ
?GetSockInfo@CGenericSocket@@QAEHAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@AAG@Z
?Listen@CServerSocket@@QAEHGH@Z
?IsIPV4@CClientSocket@@QAEHXZ
?Close@CGenericSocket@@UAEXXZ
?Accept@CServerSocket@@QAEPAVCSessionSocket@@PAVCSessionSocketListener@@I@Z

nsssh3

?NSSSH_ResetLicense@@YAXII@Z
??0CSshAlgorithmListDialog@@QAE@XZ
??1CSshAlgorithmListDialog@@QAE@XZ
?DoModal@CSshAlgorithmListDialog@@QAEHXZ
?GetSupportedAlgorithmList@CSshBackendOption@@SAPBGW4ALGORITHM@1@@Z
?SaveSshAlgorithms@@YA?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@W4ALGORITHM@CSshBackendOption@@PBG@Z
?GetHost@CEncryptedUserCredential@@QAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?GetUserNameW@CEncryptedUserCredential@@QAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?GetPassword@CEncryptedUserCredential@@QAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?GetUserKey@CEncryptedUserCredential@@QAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?GetPassphrase@CEncryptedUserCredential@@QAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?GetPkcs11Pin@CEncryptedUserCredential@@QAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?GetCapiKey@CEncryptedUserCredential@@QAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?GetCapiPin@CEncryptedUserCredential@@QAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?SetUserName@CEncryptedUserCredential@@QAEHPBG@Z
?SetPassword@CEncryptedUserCredential@@QAEHPBG@Z
?SetUserKey@CEncryptedUserCredential@@QAEHPBG@Z
?SetPassphrase@CEncryptedUserCredential@@QAEHPBG@Z
?SetPkcs11Pin@CEncryptedUserCredential@@QAEHPBG@Z
?SetCapiKey@CEncryptedUserCredential@@QAEHPBG@Z
?SetCapiPin@CEncryptedUserCredential@@QAEHPBG@Z
??0CEncryptedUserCredential@@QAE@XZ
??1CEncryptedUserCredential@@UAE@XZ
?Ping@CSshBackend@@QAEHXZ
?Disconnect@CSshBackend@@QAEHXZ
?OpenSession@CSshBackend@@QAEIXZ
??0CSshData@@QAE@PBEI@Z
?SendSessionData@CSshBackend@@QAEHIPBVCSshData@@@Z
??0CSshBackendOption@@QAE@XZ
??1CSshBackendOption@@UAE@XZ
?SetAlgorithmList@CSshBackendOption@@QAEHW4ALGORITHM@1@PBG@Z
??0CSshBackend@@QAE@PAVCSshBackendListener@@PAVCSshBackendOption@@PAUHWND__@@@Z
??1CSshBackend@@UAE@XZ
?InputNetworkData@CSshBackend@@QAEHPAVCBuffer@@@Z
?PopupErrorInfo@CSshError@@QBEXXZ
?SetHost@CSshUserAuth@@QAEHPBG@Z
??0CSshUserNameDialog@@QAE@XZ
??1CSshUserNameDialog@@UAE@XZ
?DoModal@CSshUserNameDialog@@QAEHXZ
?GetUserNameW@CSshUserAuth@@QAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?LoadUserKey@CSshUserKey@@QAE?AW4_ERROR@CSshPublicKey@@PBG0PAV1@PAH@Z
?GetPassphrase@CSshUserAuth@@QAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?LoadPkcs11Key@CSshUserKey@@QAE?AW4_ERROR@CSshPublicKey@@PBG0@Z
?LoadHWCertKeyList@CSshUserAuth@@QAEXPAVCStringList@@@Z
?SetEncryptedPkcs11Pin@CSshUserAuth@@QAEXPBG@Z
?LoadCapiKey@CSshUserKey@@QAE?AW4_ERROR@CSshPublicKey@@PBG0PAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@H@Z
??0CSshUserAuthDialog@@QAE@XZ
??1CSshUserAuthDialog@@UAE@XZ
?DoModal@CSshUserAuthDialog@@QAEHXZ
?GetPassword@CSshUserAuth@@QAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?GetUserKey@CSshUserAuth@@QAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?SetEncryptedKbdPassword@CEncryptedUserCredential@@QAEXPBG@Z
?GetEncryptedKbdPassword@CSshUserAuth@@QAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?SendGlobalRequest@CSshBackend@@QAEHPBVCSshGlobalRequest@@@Z
?ListenPort@CSshBackend@@QAEHIHPBG@Z
?SendSessionRequest@CSshBackend@@QAEHIPBVCSshSessionRequest@@@Z
?CloseSession@CSshBackend@@QAEHI@Z
?IsCert@CSshPublicKey@@QAEHXZ
?CheckHostKey@CSshHostKey@@QAEHPBG0AAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?DropCert@CSshPublicKey@@QAEHXZ
?SshCheckHostKey@@YAHPAVCSshBackend@@PAVCSshHostKey@@PBGIH@Z
?GetVersionString@CSshBackend@@QAEPBDH@Z
?Load@CSshHostKey@@QAE?AW4_ERROR@CSshPublicKey@@PBGHH@Z
?OnSshServerHostKeyPrompt@CSshBackendListener@@UAEHPAVCSshBackend@@PAVCSshHostKey@@@Z
?OnSshQueryUserName@CSshBackendListener@@UAEHPAVCSshBackend@@PAVCSshUserAuth@@@Z
?OnSshQueryPassword@CSshBackendListener@@UAEHPAVCSshBackend@@PAVCSshUserAuth@@H@Z
?OnSshQueryKbdInteractive@CSshBackendListener@@UAEHPAVCSshBackend@@PAVCSshUserAuth@@H@Z
?OnSshQueryPublicKey@CSshBackendListener@@UAEHPAVCSshBackend@@PAVCSshUserAuth@@@Z
?OnSshQueryAuthType@CSshBackendListener@@UAEHPAVCSshBackend@@PAHPAIPAG@Z
?OnSshRequestReply@CSshBackendListener@@UAEHPAVCSshBackend@@H@Z
?OnSshForwardedX11@CSshBackendListener@@UAEHPAVCSshBackend@@PAVCSshHost@@@Z
?OnSshForwardedTcpip@CSshBackendListener@@UAEHPAVCSshBackend@@PBVCSshHost@@1PAV3@@Z
?OnSshForwardedAgent@CSshBackendListener@@UAEHPAVCSshBackend@@@Z
?OnSshForwardingDisconnect@CSshBackendListener@@UAEHPAVCSshBackend@@I@Z
?OnSshIsBackgroundMode@CSshBackendListener@@UAEHXZ
?OnSshGetPromptPkcs11Pin@CSshBackendListener@@UAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?OnSshSetPromptPkcs11Pin@CSshBackendListener@@UAEXV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
??0CSshBackendListener@@QAE@XZ
?SetHost@CEncryptedUserCredential@@QAEHPBG@Z
?AuthMethodIndex@@YAHPBG@Z
?EncryptString@CSshUtil@@SAHPBDAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@W4MAC@1@W4ENC@1@@Z
?SshPkeySetup@@YAHAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@AAH01HH@Z
?SshGSSAPISetup@@YAHAAH000@Z
?SshPkcs11Setup@@YAHAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@AAH01PAVCStringList@@1HH@Z
?SshCapiSetup@@YAHAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@AAH01PAVCStringList@@1H@Z
?DoModal@CSshHostKeyDialog@@QAEHXZ
??0CSshHostKeyDialog@@QAE@XZ
??1CSshHostKeyDialog@@UAE@XZ
?DoModal@CSshUserKeyDialog@@QAEHXZ
??0CSshUserKeyDialog@@QAE@H@Z
??1CSshUserKeyDialog@@UAE@XZ
?DoModal@CSshKeygenDlg@@QAEHXZ
??0CSshKeygenDlg@@QAE@XZ
??1CSshKeygenDlg@@UAE@XZ
?DecryptString@CSshUtil@@SAHPBDAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@W4MAC@1@W4ENC@1@@Z
?LoadSshAlgorithms@@YA?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@W4ALGORITHM@CSshBackendOption@@PBG@Z

nsutil2

?EnsureFolderExistRecursive@@YAHPBG@Z
?NsGetLiveUpdateInformation@@YAXIIAAHAAI@Z
?NsSetLiveUpdate@@YAXIIHI@Z
?AfxGetSessionPath@@YA?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBG@Z
?ChangeSessionPath@@YAHPBG0@Z
?AfxConvertPath@@YAXAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBGH@Z
?DeleteFolderFiles@@YAHPBGH@Z
?GetAppScale@@YAHH@Z
?GetPrimaryDPI@@YAHPAVCDC@@@Z
?GetAppDPI@@YAHXZ
?GetScaleSizeEx@@YA?AVCSize@@PAVCDC@@HH@Z
??0CIniFile@@QAE@PBG@Z
??1CIniFile@@UAE@XZ
?GetValue@CIniFile@@QAEHPBG0H@Z
?GetValue@CIniFile@@QAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBG00@Z
?SetValue@CIniFile@@QAEXPBG0H@Z
?SetValue@CIniFile@@QAEXPBG00@Z
?Write@CIniFile@@QAEHPBGHH@Z
?EnsureFolderExist@@YAHPBG@Z
?XFTP_CLASS_NAME@@3V?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@B
?InitAppDPI@@YAXPAVCDC@@@Z
?ResetAppDPI@@YAXI@Z
??0CUrlInfo@@QAE@XZ
?Open@CRegistry@@QAEHPAUHKEY__@@PBGHK@Z
??1CUrlInfo@@UAE@XZ
??0CRegistry@@QAE@XZ
?MakeURL@CUrlInfo@@QBEHAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?GetProductPath@@YAIPBGAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?ShowInvalidFileNameMessage@@YAXXZ
?NsSmartFileRename@@YAXAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?csFmt@@YA?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@IZZ
?ResolveShortcut@@YAJPBGAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@H@Z
NsOpenHomePage
MLS_NsGetUserLanguage
?Configure@CNsExpFeatures@@QAEHII@Z
?GetInstance@CNsExpFeatures@@SAAAV1@XZ
?IsValidFileName@@YAHPBG@Z
?ReplaceFnameOfPath@@YAXAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBG1@Z
?GetUserDataFolderPath@@YAPBGH@Z
?DoesFolderExist@@YAHPBG@Z
?GetAppScaleSize@@YA?AVCSize@@HH@Z
?QueryValue@CRegistry@@QAEHPBGPAGK@Z
?MLS_NsChangeLanguage@@YAGPBGAAH@Z
?AfxGetDefaultSessionPath@@YA?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBG@Z
??1CBrowseFolderEdit@@UAE@XZ
?ExecuteXtransportForMove@@YAXPBG@Z
??0CBrowseFolderEdit@@QAE@XZ
??1CBrowseEdit@@UAE@XZ
?NsChangeDataFolder@@YAHXZ
??0CBrowseEdit@@QAE@XZ
?__WriteInfoAppLog@@YAXHPBGZZ
?MLS_NsSaveLanguage@@YAXPBGGH@Z
??0CAnsiString@@QAE@PBG@Z
??1CAnsiString@@QAE@XZ
??0CAnsiString@@QAE@PBD@Z
?DeleteAllValues@CRegistry@@QAEHXZ
??BCAnsiString@@QBEPBDXZ
?DoesFileExist@@YAHPBG@Z
?BeginWatch@CNsFolderWatch@@QAEHPBGHPAUHWND__@@IK@Z
??1CNsFolderWatch@@UAE@XZ
?NsGetResellerName@@YA?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@II@Z
?ConvertStaticToHyperlink@@YAHPAUHWND__@@I@Z
?Parse_URL@CUrlInfo@@QAEHPBGH@Z
?EnumValue@CRegistry@@QAEHKPAGK@Z
??0CFNameEdit@@QAE@XZ
??1CFNameEdit@@UAE@XZ
?NsGetHTTPLink@@YA?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@IIGW4HTTP_LINK_TYPE@@I@Z
??0CNsFolderWatch@@QAE@XZ
?NsGetHttpTransactAddress@@YA?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?Ptr@CBuffer@@QBEPBEXZ
?Clear@CBuffer@@QAEXH@Z
??0CCharSetEncoder@@QAE@I@Z
??1CCharSetEncoder@@UAE@XZ
??0CCharSetDecoder@@QAE@I@Z
?GetLangID@CCodePageList@@QAEIH@Z
??1CCharSetDecoder@@UAE@XZ
?SetCodepage@CCharSetConverter@@UAEHI@Z
?GetAppScale2@@YAHHH@Z
?GetCodePage@CCodePageList@@QAEIH@Z
?GetName@CCodePageList@@QAEPBGH@Z
?GetDPIEx@@YAXPAVCDC@@PAH1@Z
?_InitApplicationLog@@YAXPBG0HH@Z
?__WriteGlobalAppLog@@YAXHPBGZZ
?GetCount@CCodePageList@@QAEHXZ
?Encode@CCharSetEncoder@@QAEHPBGAAVCBuffer@@@Z
??1CBuffer@@UAE@XZ
??0CBuffer@@QAE@PBEI@Z
?NsVerifyNetSarangExe@@YAHPBGH@Z
?DeleteKey@CRegistry@@QAEHPBGH@Z
?CreateEmptyFile@@YAHPBG@Z
?GetLongFileName@@YAHPAGPBG@Z
NsOpenHelpFile
?FindIndex@CCodePageList@@QAEHI@Z
??0CCodePageList@@QAE@XZ
NsOpenHelpPdfFile
?GetMsgAckTranslation@@YA?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?NsGetAboutLicenseText@@YAXIIAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@H@Z
?AfxGetModulePath@@YAXAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBG@Z
?NsGetUserDataPath@@YAHPAG@Z
?EnumKey@CRegistry@@QAEHKPAGK@Z
NsCrashReportUninstall
?PopupOnce@CNsExpFeatures@@QAEXII@Z
?NsIsValidDataFolder@@YAHXZ
?NsCheckLiveUpdate@@YAHIIH@Z
?NsCheckActivationNeed@@YAHII@Z
?NsSetLocale@@YAXXZ
?NsInitDataFolder@@YAXI@Z
?NsCheckServiceDown@@YAHII@Z
NsCrashReportInstall
??0CTimerListener@@QAE@XZ
?SetValue@CRegistry@@QAEHPBGK@Z
?SetValue@CRegistry@@QAEHPBG0@Z
?NsCommonInitialize@@YAXI@Z
??1CRegistry@@UAE@XZ
?NsCheckVCRedistVersion@@YAXXZ
?Close@CRegistry@@QAEXXZ
?GetValue@CRegistry@@QAEKPBGK@Z
?GetValue@CRegistry@@QAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBGABV23@@Z
?NsLoadAppLangResourceDLL@@YAPAUHINSTANCE__@@PAU1@PBG@Z
?Start@CTimer@@QAEHII@Z
?Stop@CTimer@@QAEXI@Z
?SetListener@CTimer@@QAEPAVCTimerListener@@PAV2@@Z
??1CTimer@@UAE@XZ
??0CTimer@@QAE@PAVCTimerListener@@@Z
?ShowInvalidIntRangeMessage@@YAXHHH@Z
?ShowEnterUIntMessage@@YAXXZ
?csFmt@@YA?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBGZZ
?ClearAll@CIniFile@@UAEXPBG@Z
?GetImageDPI@@YAHXZ
?WildcardMatch@@YAHPBG0@Z
?SHRenameFile@@YAHPBG0@Z
?SHDeleteFile@@YAHPBG@Z
?EndWatch@CNsFolderWatch@@QAEXXZ
?GetFnameofPath@@YA?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBG@Z
?NsSelectCommandFolder@@YAHPAUNsSelectCommandParam@@PBG@Z
?DoesFolderHave@@YAHPBG0@Z
?NsCopyStringList@@YAXPAVCStringList@@0@Z
?AppendPath@@YAHAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBG@Z
?Read@CIniFile@@QAEHPBG@Z
?DoModal@CFolderOpenDlg@@QAEHXZ
??1CFolderOpenDlg@@UAE@XZ
??0CFolderOpenDlg@@QAE@PAVCWnd@@@Z
?QueryValue@CRegistry@@QAEHPBGAAK@Z
?DeleteValue@CRegistry@@QAEHPBG@Z
?GetDefault@CCodePage@@SAIXZ
?Len@CBuffer@@QBEIXZ
?NsRunXagent@@YAHHPBG@Z
?Decode@CCharSetDecoder@@QAEHEAAGPAEPAI@Z
?SetCodepage@CCharSetDecoder@@UAEHI@Z

mfc140u

ord3404
ord4092
ord11396
ord12131
ord458
ord3696
ord7493
ord12172
ord1511
ord2178
ord13144
ord12142
ord3117
ord9036
ord9099
ord4599
ord9062
ord8631
ord2404
ord9751
ord8999
ord11714
ord12949
ord12829
ord3003
ord6973
ord4886
ord8207
ord8230
ord13208
ord5023
ord13614
ord13888
ord11990
ord3388
ord3425
ord644
ord14025
ord7109
ord462
ord975
ord1451
ord3882
ord6566
ord6489
ord1113
ord7495
ord5422
ord13654
ord265
ord266
ord12612
ord9235
ord12173
ord8773
ord7125
ord7654
ord3833
ord2256
ord3359
ord3237
ord6801
ord1405
ord1413
ord2303
ord2008
ord929
ord14657
ord12405
ord12348
ord14604
ord6751
ord6805
ord316
ord1046
ord1700
ord1697
ord10394
ord914
ord1408
ord7626
ord13225
ord7815
ord12144
ord4610
ord3805
ord8161
ord12141
ord7627
ord6249
ord6248
ord9225
ord9253
ord1928
ord5037
ord11641
ord12217
ord8171
ord8225
ord7073
ord7066
ord7441
ord6531
ord6802
ord11000
ord12216
ord11021
ord9042
ord8977
ord11235
ord10570
ord11169
ord11932
ord11935
ord11933
ord11934
ord6309
ord3054
ord3238
ord4108
ord10498
ord985
ord1462
ord8892
ord14377
ord3337
ord3142
ord6470
ord1055
ord3961
ord4885
ord7296
ord2385
ord4649
ord13117
ord4977
ord4915
ord4905
ord4991
ord5006
ord4945
ord5000
ord1774
ord1747
ord1733
ord12170
ord5312
ord8174
ord8317
ord8244
ord8338
ord2703
ord5441
ord5436
ord4032
ord4792
ord12481
ord3311
ord8996
ord8941
ord14197
ord6303
ord8815
ord14129
ord3131
ord14441
ord11089
ord11321
ord4112
ord2067
ord5080
ord5085
ord3133
ord13216
ord12148
ord4017
ord8806
ord14315
ord8145
ord13480
ord11162
ord9002
ord8957
ord2618
ord2113
ord11130
ord3066
ord9291
ord8997
ord12676
ord13487
ord4016
ord4509
ord11264
ord14298
ord2389
ord3010
ord305
ord300
ord5922
ord2991
ord1654
ord4324
ord5111
ord12560
ord1530
ord1533
ord8759
ord12922
ord8361
ord554
ord1185
ord555
ord1186
ord7378
ord1143
ord4093
ord3872
ord2993
ord8744
ord4222
ord3147
ord9128
ord6497
ord1070
ord3363
ord3254
ord6830
ord1442
ord4225
ord9132
ord5984
ord6589
ord1180
ord6380
ord503
ord1144
ord4735
ord8177
ord8345
ord3693
ord5173
ord13337
ord4486
ord3797
ord14234
ord7379
ord13028
ord14131
ord4882
ord5419
ord997
ord1474
ord13087
ord2865
ord8817
ord12107
ord9305
ord11544
ord3194
ord13285
ord3209
ord4026
ord5039
ord5033
ord9175
ord9213
ord3940
ord5934
ord13700
ord9237
ord2557
ord4495
ord12181
ord3834
ord12081
ord8209
ord8400
ord5034
ord12462
ord1790
ord7692
ord13709
ord5939
ord13707
ord5938
ord11432
ord5956
ord8831
ord9352
ord11803
ord11795
ord5369
ord3843
ord4587
ord11495
ord10402
ord11797
ord8318
ord2071
ord10841
ord12538
ord5642
ord14726
ord14544
ord11651
ord7019
ord11135
ord11649
ord11650
ord7020
ord14021
ord1796
ord481
ord1128
ord7121
ord10976
ord7501
ord5609
ord6199
ord6545
ord9212
ord10251
ord5976
ord5765
ord3849
ord4703
ord12660
ord12418
ord13352
ord2843
ord7655
ord2558
ord8395
ord2858
ord9081
ord3857
ord9197
ord12575
ord11252
ord9484
ord2718
ord12964
ord12093
ord4088
ord14511
ord5377
ord5368
ord10431
ord10721
ord11138
ord11139
ord9363
ord11743
ord9979
ord7071
ord853
ord1374
ord7486
ord8874
ord841
ord12552
ord2529
ord9508
ord8873
ord8875
ord5813
ord5653
ord7891
ord9513
ord10250
ord5781
ord12887
ord9990
ord540
ord1171
ord842
ord1368
ord2614
ord4076
ord12526
ord6300
ord8746
ord4227
ord6607
ord3932
ord2526
ord3127
ord6915
ord2139
ord4881
ord3339
ord3148
ord6498
ord1071
ord8066
ord3873
ord2562
ord4499
ord6301
ord4866
ord3352
ord9333
ord12616
ord8475
ord13300
ord5300
ord13311
ord5120
ord14551
ord2646
ord8390
ord12768
ord13138
ord11713
ord4926
ord4911
ord1769
ord1743
ord1721
ord9247
ord2725
ord4387
ord14313
ord8995
ord8940
ord11771
ord11331
ord1773
ord2672
ord8956
ord8955
ord8962
ord3217
ord12827
ord8388
ord13314
ord8060
ord8061
ord8089
ord12651
ord3821
ord12872
ord5839
ord5798
ord13318
ord2701
ord12876
ord7903
ord14395
ord12222
ord8845
ord11367
ord10362
ord9087
ord9106
ord2656
ord4181
ord4194
ord2249
ord1731
ord9984
ord9506
ord9511
ord9521
ord8864
ord4713
ord2094
ord4269
ord3330
ord9382
ord4371
ord9023
ord1984
ord14173
ord2659
ord8938
ord12971
ord8426
ord14254
ord7111
ord469
ord1116
ord7496
ord9299
ord3264
ord11535
ord11372
ord5842
ord7909
ord4670
ord2203
ord7284
ord7176
ord2535
ord12175
ord14577
ord8175
ord8340
ord8218

kernel32

GetTimeFormatW
GetDateFormatW
MoveFileW
CompareFileTime
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionEx
CopyFileW
MoveFileExW
DeleteCriticalSection
RemoveDirectoryW
CopyFileExW
GetProcessTimes
CreateEventA
VirtualAlloc
VirtualFree
GetDriveTypeA
GetVolumeInformationA
SetLastError
InitializeCriticalSection
GetCurrentProcessId
CreateFileA
GetFileTime
SetFileTime
CreateThread
TerminateProcess
Sleep
lstrcatW
GetVersionExW
GlobalAddAtomW
GetLocalTime
SystemTimeToFileTime
GetDateFormatA
FileTimeToLocalFileTime
FindFirstFileA
FindNextFileA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetVersionExA
lstrlenA
GetWindowsDirectoryW
LoadLibraryA
SetErrorMode
DeviceIoControl
ReadFile
WriteFile
SetNamedPipeHandleState
SleepEx
WaitNamedPipeA
LoadLibraryExA
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
WaitForSingleObjectEx
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
FormatMessageA
GetNumberFormatW
GetLocaleInfoW
DeleteFileW
ExitThread
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetFileAttributesW
GetCurrentProcess
GetProcAddress
WaitForSingleObject
lstrcpyW
CreateDirectoryW
MultiByteToWideChar
GetEnvironmentVariableW
GlobalFindAtomW
GlobalDeleteAtom
GlobalGetAtomNameW
FreeLibrary
LoadLibraryW
MulDiv
GetLastError
LocalFree
FormatMessageW
FindNextChangeNotification
WaitForMultipleObjects
ResetEvent
FindFirstChangeNotificationW
FindCloseChangeNotification
SetEvent
CreateEventW
GetVersion
CreateFileW
GetEnvironmentVariableA
OutputDebugStringW
GetSystemDirectoryA
LocalAlloc
CreateMutexA
ReleaseMutex
GetModuleHandleA
FindClose
FindNextFileW
lstrcmpW
FindFirstFileW
VerifyVersionInfoW
VerSetConditionMask
GetTickCount
CloseHandle
TerminateThread
GlobalFree
GetExitCodeThread
FileTimeToSystemTime
GetModuleHandleW
lstrcmpiW
GetWindowsDirectoryA
lstrlenW
GlobalUnlock
GlobalLock
GlobalAlloc
SystemTimeToTzSpecificLocalTime
CreateProcessW
GetTimeZoneInformation

user32

CopyRect
GetWindow
WindowFromPoint
SetMenuItemInfoW
CharNextW
GetSystemMenu
IntersectRect
GetDesktopWindow
ReleaseDC
GetDC
wsprintfW
FindWindowW
SetCursor
LoadBitmapW
GetSysColor
UpdateWindow
SetMenuDefaultItem
GetSysColorBrush
EnableMenuItem
ScreenToClient
ClientToScreen
SetRectEmpty
InvalidateRect
LockWindowUpdate
GetMenuState
GetMenuItemID
GetMenuItemCount
LoadMenuW
GetMenuDefaultItem
GetSystemMetrics
CreatePopupMenu
SetClassLongW
GetClassLongW
PtInRect
InflateRect
RegisterClipboardFormatW
GetWindowTextW
MessageBoxW
GetKeyState
RegisterClassExW
LoadCursorW
LoadIconW
GetClientRect
DefWindowProcW
SetWindowLongW
CreateWindowExW
RegisterClassW
DestroyWindow
AppendMenuW
InsertMenuW
DeleteMenu
GetSubMenu
ModifyMenuW
RemoveMenu
GetAsyncKeyState
CheckMenuItem
TranslateAcceleratorW
RegisterWindowMessageW
IsWindowVisible
LoadAcceleratorsW
IsWindow
GetClassNameW
RedrawWindow
GetWindowLongW
SetDlgItemTextW
GetDlgItemTextW
GetParent
SetForegroundWindow
BringWindowToTop
PostMessageW
SetTimer
KillTimer
SetClipboardData
CloseClipboard
EmptyClipboard
OpenClipboard
MessageBeep
GetFocus
IsChild
SendMessageW
EnableWindow
DestroyIcon
GetMenuItemInfoW
InsertMenuItemW
GetCursor
SetCapture
ReleaseCapture
EqualRect
DrawTextW
FillRect
GetClassInfoW
CheckMenuRadioItem
ExitWindowsEx
SystemParametersInfoW
IsMenu
GetMenuInfo
SetMenuInfo
IsRectEmpty
GetActiveWindow
MessageBoxA
SendMessageA
ShowWindow
MoveWindow
EndDialog
GetDlgItem
SetDlgItemTextA
GetDlgItemTextA
SetWindowTextA
GetWindowLongA
CreateDialogIndirectParamA
DialogBoxIndirectParamA
wsprintfA
GetCursorPos
IsIconic
SetFocus
GetWindowRect
OffsetRect
TrackPopupMenu

gdi32

CreateCompatibleBitmap
CreateSolidBrush
CreatePen
DeleteObject
CreateDIBSection
SetDIBColorTable
DeleteDC
SelectObject
ExtTextOutW
GetBkColor
GetTextMetricsW
Rectangle
StretchBlt
GetStockObject
BitBlt
CreateCompatibleDC
CreateFontIndirectW
GetObjectW
CreateRectRgn
GetTextExtentPoint32W

msimg32

TransparentBlt

comdlg32

GetFileTitleW
GetOpenFileNameA

advapi32

RegCloseKey
GetFileSecurityW
OpenProcessToken
DuplicateToken
MapGenericMask
AccessCheck
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExW
RegSetValueExW
RegDeleteValueA
RegEnumValueA
RegOpenKeyExA
RegCreateKeyExA
GetUserNameA
GetUserNameW
RegQueryValueExA
RegSetValueExA
RegEnumKeyExA
RegQueryInfoKeyA
CloseServiceHandle
OpenSCManagerA
OpenServiceA
QueryServiceStatus
StartServiceA

shell32

ShellExecuteExW
ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
DragQueryFileW
DragFinish
SHGetDesktopFolder
SHGetFileInfoW
ord680
SHGetMalloc
SHFileOperationW
ord155
ord716
SHGetSpecialFolderPathW
SHBindToParent
SHGetSpecialFolderLocation
SHParseDisplayName
SHGetFolderPathW

comctl32

ord17
ImageList_Draw
ImageList_ReplaceIcon
ImageList_AddMasked
ImageList_Add
ImageList_DrawEx
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_GetIcon
ImageList_Copy
InitCommonControlsEx

shlwapi

StrTrimW
StrRetToBufW
PathFindExtensionW
PathRemoveBackslashW
PathIsUNCW

ole32

CoTaskMemFree
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
CoInitializeSecurity

oleaut32

SysStringLen
SysAllocString
VariantInit
SysAllocStringByteLen
SystemTimeToVariantTime
SysFreeString
VariantClear
VarBstrFromDate
VarDateFromStr
VarUdateFromDate
SysAllocStringLen
SafeArrayDestroy
SafeArrayGetUBound
VariantTimeToSystemTime
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData

gdiplus

GdipCreateBitmapFromFile
GdipGetImagePixelFormat
GdipGetImageHeight
GdipSaveImageToFile
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImageThumbnail
GdipBitmapUnlockBits
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipCloneImage
GdipAlloc
GdipFree
GdipDisposeImage
GdiplusStartup
GdipDeleteGraphics
GdipBitmapLockBits
GdipGetImageGraphicsContext
GdipCreateHBITMAPFromBitmap
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImageWidth
GdiplusShutdown
GdipDrawImageI

ws2_32

htonl
WSAGetLastError
socket
setsockopt
send
WSACleanup
recv
ioctlsocket
connect
closesocket
__WSAFDIsSet
getnameinfo
inet_addr
WSAStartup
select
inet_ntoa
getaddrinfo
getsockopt
freeaddrinfo

msvcp140

_Mtx_init_in_situ
_Mtx_destroy_in_situ
?_Xlength_error@std@@YAXPBD@Z
_Mtx_unlock
?_Xout_of_range@std@@YAXPBD@Z
?_Xinvalid_argument@std@@YAXPBD@Z
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
?_Xbad_function_call@std@@YAXXZ

vcruntime140

memset
__CxxFrameHandler3
memcmp
memcpy
__std_exception_copy
_CxxThrowException
_except_handler4_common
__current_exception_context
__current_exception
strchr
memmove
strrchr
wcschr
wcsstr
wcsrchr
strstr
_purecall
__std_exception_destroy
__std_terminate

api-ms-win-crt-string-l1-1-0

strlen
isxdigit
ispunct
strncmp
strncpy
_strlwr
isprint
isgraph
_strnicmp
strcpy
_strdup
strcspn
_wcsdup
wcsncmp
iswdigit
wcsncpy_s
isalnum
_wcsicmp
_wcsnicmp
strcat
wcstok_s
strtok
isdigit
_stricmp
strcpy_s
iscntrl
wcscpy_s
strncpy_s
iswctype
toupper
towupper
wcsnlen
__isascii
tolower
isspace
isupper
islower
isalpha

api-ms-win-crt-time-l1-1-0

wcsftime
_gmtime64
_localtime64_s
_mktime64
_time64
_localtime64

api-ms-win-crt-stdio-l1-1-0

ferror
__acrt_iob_func
feof
__p__commode
ftell
_set_fmode
__stdio_common_vswprintf
__stdio_common_vfprintf
_getcwd
fread
ungetc
fseek
fgets
fgetc
clearerr
__stdio_common_vsscanf
fwrite
fopen
__stdio_common_vswscanf
fclose
_wfopen
_fseeki64
_wfsopen
fflush
__stdio_common_vsprintf
__stdio_common_vswprintf_s
__stdio_common_vsnprintf_s

api-ms-win-crt-runtime-l1-1-0

_endthread
_beginthread
_exit
exit
__sys_nerr
__sys_errlist
_wassert
_resetstkoflw
_getpid
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
_set_app_type
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_errno
terminate
_initialize_onexit_table
_controlfp_s
_crt_atexit
_register_onexit_function

api-ms-win-crt-filesystem-l1-1-0

_findclose
_findfirst64i32
_findnext64i32
_wstat64i32
_wstat64
_stat64i32
_wsplitpath_s
_wsplitpath

api-ms-win-crt-convert-l1-1-0

_atoi64
atoi
wcstoll
wcstoull
atol
strtod
strtol
strtoul
_wtoi
atof

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
calloc
realloc
_recalloc
malloc

api-ms-win-crt-utility-l1-1-0

rand_s
qsort
rand
srand
bsearch

api-ms-win-crt-environment-l1-1-0

_wgetenv
getenv

api-ms-win-crt-math-l1-1-0

__setusermatherr
ceil

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

netapi32

Netbios

wintrust

WinVerifyTrust

crypt32

CertGetNameStringA
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose
CryptQueryObject

Exports

Exports

??0CMngMasterPw@@QAE@ABV0@@Z
??0CMngMasterPwSInst@@AAE@XZ
??0CMngMasterPwSInst@@QAE@ABV0@@Z
??1CMngMasterPwSInst@@QAE@XZ
??4CMngMasterPw@@QAEAAV0@ABV0@@Z
??4CMngMasterPwSInst@@QAEAAV0@ABV0@@Z
??_FCNsCheckMasterPwDlg@@QAEXXZ
??_FCNsResetMasterPwDlg@@QAEXXZ
??_FCNsSetMasterPwDlg@@QAEXXZ
isblank

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textidx
Size: 477KB - Virtual size: 477KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.my_text
Size: 512B - Virtual size: 223B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 294KB - Virtual size: 293KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 457KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fnp_dir
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fnp_mar
Size: 512B - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

9d5fab8b705a1ea2901fa206c3f812a3

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

48:ca:e8:57:ad:b2:0b:83:72:59:af:85Certificate

Extended Key Usages

Key Usages

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

f2:2d:27:49:fa:b7:2a:e6:46:50:ad:b1:ab:03:a0:0f:62:bf:93:35:52:15:1a:c5:ee:f1:4f:20:2c:ce:13:15Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

dhcpcsvc

nsactivate

nslicense

nsprofile2

nsresource

nssecurity

nssftp

nssock2

nsssh3

nsutil2

mfc140u

kernel32

user32

gdi32

msimg32

comdlg32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

gdiplus

ws2_32

msvcp140

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

netapi32

wintrust

crypt32

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.textidx Size: 477KB - Virtual size: 477KB

.my_text Size: 512B - Virtual size: 223B

.rdata Size: 294KB - Virtual size: 293KB

.data Size: 45KB - Virtual size: 457KB

.fnp_dir Size: 512B - Virtual size: 100B

.fnp_mar Size: 512B - Virtual size: 1B

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

48:ca:e8:57:ad:b2:0b:83:72:59:af:85
Certificate

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

f2:2d:27:49:fa:b7:2a:e6:46:50:ad:b1:ab:03:a0:0f:62:bf:93:35:52:15:1a:c5:ee:f1:4f:20:2c:ce:13:15
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.textidx
Size: 477KB - Virtual size: 477KB

.my_text
Size: 512B - Virtual size: 223B

.rdata
Size: 294KB - Virtual size: 293KB

.data
Size: 45KB - Virtual size: 457KB

.fnp_dir
Size: 512B - Virtual size: 100B

.fnp_mar
Size: 512B - Virtual size: 1B

.rsrc
Size: 1.5MB - Virtual size: 1.5MB