play_VST_x64[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

play_VST_x64.dll
Size

45.3MB
MD5

e7fe0b330d086a28fa5ee8ad43f199fa
SHA1

a6f5da5833c4fab9181063743a194978ef8650fd
SHA256

e2de78dd8a36b9913c8901ace25dc396def80f94221d36a0ff6e3a7e1632df3d
SHA512

34d6f7f7e3324d8be53d3158038dfb5b26749349599d3aa8214c3b0f1fcd5ea498ecad073e36beff4a40a3b4fdaf0cf46b25bc5e326f3ce6de5b19e5d825d301
SSDEEP

393216:Ccqcyc2z3gZgh538RvF4Ug5gWmNOXblSv9GnFHV+2tZ74Y9epxnRh26ObxXHIR0Q:dgflSv9yvt9Ynh8VXHNyeP+w+X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
play_VST_x64.dll

Files

play_VST_x64.dll
.dll windows:6 windows x64 arch:x64

38b2e401643c4a5c9d79ca160660d72f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
LocalFileTimeToFileTime
GetPriorityClass
FileTimeToLocalFileTime
FormatMessageA
LocalFree
GetThreadPriority
GlobalSize
GlobalLock
GlobalAlloc
GetModuleFileNameW
GlobalUnlock
GetProcAddress
GetCurrentProcessId
ExitProcess
GetEnvironmentVariableW
CreateMutexW
SetPriorityClass
FindFirstFileW
GetNativeSystemInfo
SetFilePointer
TryEnterCriticalSection
PeekNamedPipe
SetLocalTime
MapViewOfFile
UnmapViewOfFile
GetDriveTypeW
SetEndOfFile
FreeLibrary
CreateProcessW
SetUnhandledExceptionFilter
VerSetConditionMask
GetCurrentProcess
GetLogicalDriveStringsW
QueryPerformanceCounter
CreateDirectoryW
SetHandleInformation
WaitForSingleObject
GetComputerNameW
SetEvent
ConnectNamedPipe
OutputDebugStringW
CreateNamedPipeW
SetFileTime
WriteFile
InitializeCriticalSection
GetSystemDirectoryW
LoadLibraryW
TerminateThread
GetLocaleInfoW
Sleep
CopyFileW
FormatMessageW
LeaveCriticalSection
GetExitCodeProcess
GetFileAttributesW
TerminateProcess
ReadFile
CreateFileW
GetOverlappedResult
SetThreadPriority
DisconnectNamedPipe
FlushFileBuffers
GetTempPathW
VerifyVersionInfoW
GetLastError
GetCurrentDirectoryW
MoveFileW
EnterCriticalSection
FindClose
ResetEvent
CreateFileMappingW
GlobalMemoryStatusEx
CreateEventW
SetCurrentDirectoryW
RemoveDirectoryW
RtlCaptureStackBackTrace
CreatePipe
WaitForMultipleObjects
CancelIo
IsDebuggerPresent
FindNextFileW
GetFileAttributesExW
QueryPerformanceFrequency
DeleteCriticalSection
SetThreadAffinityMask
ReleaseMutex
GetDiskFreeSpaceExW
CloseHandle
DeleteFileW
GetFileInformationByHandle
GetCurrentThread
GetVolumeInformationW
GetCommandLineW
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
CreateEventA
DeviceIoControl
GetSystemInfo
GetNumaHighestNodeNumber
GetProcessAffinityMask
GetNumaNodeProcessorMask
GetNumaAvailableMemoryNode
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetSystemTimeAsFileTime
WaitForSingleObjectEx
GetProcessHeap
HeapAlloc
HeapFree
SwitchToThread
VirtualAlloc
VirtualFree
GetLargePageMinimum
GetModuleFileNameA
LoadLibraryA
DeleteFileA
AreFileApisANSI
GetSystemTime
GetTempPathA
OutputDebugStringA
GetDiskFreeSpaceA
CreateFileMappingA
GetDiskFreeSpaceW
LockFileEx
HeapSize
MultiByteToWideChar
HeapValidate
HeapCreate
GetFileAttributesA
HeapDestroy
WideCharToMultiByte
UnlockFileEx
GetTickCount
LockFile
FlushViewOfFile
UnlockFile
SystemTimeToFileTime
HeapCompact
GetFileSize
CreateFileA
HeapReAlloc
GetFullPathNameA
GetFullPathNameW
CreateSemaphoreA
WaitForMultipleObjectsEx
ReleaseSemaphore
DuplicateHandle
RaiseException
CreateThread
GetLogicalProcessorInformation
GetStringTypeW
EncodePointer
DecodePointer
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineA
IsProcessorFeaturePresent
ExitThread
LoadLibraryExW
GetTimeZoneInformation
CreateProcessA
GetModuleHandleExW
GetCPInfo
FatalAppExitA
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
CreateSemaphoreW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetConsoleCtrlHandler
SetFilePointerEx
HeapQueryInformation
MoveFileExW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
lstrlenA
lstrlenW
PostQueuedCompletionStatus
GetFileTime
CreateDirectoryExW
OpenEventA
MulDiv
WTSGetActiveConsoleSessionId
GetEnvironmentStrings
FreeEnvironmentStringsA
GetCurrentDirectoryA
OpenProcess
WaitNamedPipeA
FindFirstFileA
GetTempFileNameW
GetVersionExW
SetWaitableTimer
ResumeThread
CreateWaitableTimerA
SetNamedPipeHandleState
CreateIoCompletionPort
CreateNamedPipeA
GetQueuedCompletionStatus
QueueUserAPC
GetDriveTypeA
GetLogicalDrives
SetErrorMode
GetSystemDirectoryA
GetLogicalDriveStringsA
GetVolumeInformationA
SleepEx
CreateWaitableTimerW
GetStringTypeExW
LCMapStringA
GetStringTypeExA
GetThreadTimes
GlobalMemoryStatus
DeleteTimerQueueTimer
GetVersion
IsDBCSLeadByte
GetVersionExA
SetCurrentDirectoryA
CreateDirectoryA
FindNextFileA
RemoveDirectoryA
SetFileAttributesA
GetProcessTimes
MoveFileA
GetConsoleOutputCP
ExpandEnvironmentStringsW
GetLocaleInfoA
GetWindowsDirectoryW
WakeAllConditionVariable
SleepConditionVariableSRW
GetModuleHandleA
SetFileAttributesW
GetCurrentThreadId

user32

LoadStringW
LoadStringA
EndDialog
CreateDialogIndirectParamW
GetUserObjectInformationW
GetProcessWindowStation
GetMessageW
TranslateMessage
GetClassNameW
GetParent
GetWindowTextW
SendMessageTimeoutW
DispatchMessageW
AttachThreadInput
EndPaint
DestroyWindow
SetCursor
EnumDisplayMonitors
CloseClipboard
GetUpdateRgn
MapVirtualKeyW
GetSystemMenu
ScreenToClient
SendInput
IsChild
SetCapture
UnregisterClassW
SetForegroundWindow
GetFocus
TrackMouseEvent
LoadCursorW
GetWindowInfo
MessageBeep
WindowFromPoint
GetWindowRect
GetClientRect
SetFocus
ShowCaret
BeginPaint
EnumWindows
CreateIconIndirect
GetIconInfo
GetDC
GetCapture
wsprintfW
GetForegroundWindow
RegisterClassExW
GetWindowPlacement
GetAsyncKeyState
InvalidateRect
SetCursorPos
GetWindowLongW
GetClipboardData
SystemParametersInfoW
PeekMessageW
ReleaseDC
EnableMenuItem
EmptyClipboard
SetWindowLongW
RedrawWindow
DestroyCursor
GetDesktopWindow
GetCursorPos
EnumChildWindows
SetLayeredWindowAttributes
ShowWindow
GetActiveWindow
CreateCaret
CreateWindowExW
OpenClipboard
MessageBoxW
ReleaseCapture
IsWindowVisible
SetCaretPos
SetWindowLongPtrW
SendMessageW
SetClipboardData
SetWindowTextW
ToUnicode
DestroyIcon
GetMonitorInfoW
DefWindowProcW
GetMessageTime
GetMessagePos
GetWindowThreadProcessId
GetSystemMetrics
DestroyCaret
MoveWindow
CallWindowProcW
RegisterWindowMessageW
SetWindowPos
GetKeyboardState
CharPrevA
PostMessageW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindowLongPtrW

ws2_32

listen
getsockopt
ntohl
accept
WSASetLastError
ioctlsocket
closesocket
__WSAFDIsSet
freeaddrinfo
socket
bind
send
connect
recv
sendto
setsockopt
getsockname
ntohs
htons
WSAGetLastError
select
getaddrinfo
htonl
inet_addr
recvfrom
WSAStartup
inet_ntoa
WSACleanup

dbghelp

SymGetModuleInfo64
SymInitialize
SymFromAddr

psapi

EnumProcessModules
GetProcessMemoryInfo
GetModuleInformation

winmm

midiOutGetNumDevs
midiOutLongMsg
midiInAddBuffer
midiInOpen
midiOutClose
midiOutShortMsg
midiInClose
midiOutOpen
midiInGetDevCapsW
midiOutPrepareHeader
midiOutUnprepareHeader
midiInGetNumDevs
midiInUnprepareHeader
timeEndPeriod
midiInStop
midiInPrepareHeader
midiOutGetDevCapsW
timeGetDevCaps
timeBeginPeriod
timeGetTime
timeKillEvent
timeSetEvent
midiInReset
midiInStart

imagehlp

ImageGetCertificateData
ImageEnumerateCertificates
ImageAddCertificate
ImageGetCertificateHeader

wintrust

WinVerifyTrust

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdA
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces

shlwapi

PathStripToRootW

rpcrt4

UuidCreate

imm32

ImmGetContext
ImmNotifyIME
ImmSetCandidateWindow
ImmGetCompositionStringW
ImmReleaseContext

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

gdi32

CreateRectRgnIndirect
CombineRgn
SetMapMode
SaveDC
CreateCompatibleDC
GetObjectW
CreateRectRgn
RestoreDC
GetPixel
SelectObject
StretchDIBits
DeleteObject
GetTextMetricsW
CreateFontIndirectW
RemoveFontMemResourceEx
GetOutlineTextMetricsW
SetMapperFlags
GetKerningPairsW
AddFontMemResourceEx
EnumFontFamiliesExW
GetGlyphOutlineW
GetGlyphIndicesW
DeleteDC
CreateDIBSection
GetDeviceCaps
ExcludeClipRect
CreateBitmap
GetRegionData

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

GetUserNameW
RegCreateKeyExW
RegQueryValueExW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegSetValueW
RegSaveKeyW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegCloseKey
RegSetValueExW
RegDeleteKeyExW
RegEnumKeyExW
RegEnumValueW
RegFlushKey
RegQueryInfoKeyA
RegLoadKeyW
RegCreateKeyW
RegConnectRegistryW
RegQueryValueExA
GetCurrentHwProfileW
QueryServiceConfigW
OpenServiceW
ConvertStringSecurityDescriptorToSecurityDescriptorW
QueryServiceConfigA
OpenServiceA
OpenSCManagerW
CloseServiceHandle
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegGetValueW
RegQueryInfoKeyW

shell32

ShellExecuteA
SHGetFolderPathW
SHGetSpecialFolderLocation
Shell_NotifyIconW
CommandLineToArgvW
SHGetSpecialFolderPathW
ShellExecuteW
SHFileOperationW
SHBrowseForFolderW
ExtractAssociatedIconW
SHGetPathFromIDListW
SHGetMalloc

ole32

CoTaskMemFree
CoUninitialize
CoCreateGuid
CoInitializeEx
CoSetProxyBlanket
OleUninitialize
OleInitialize
CoInitialize
CoCreateInstance
RegisterDragDrop
CLSIDFromString
OleSetContainedObject
OleCreate
CoTaskMemAlloc
DoDragDrop
RevokeDragDrop

oleaut32

SysAllocString
SysFreeString
VariantClear
GetErrorInfo
VariantInit
VariantChangeType
SetErrorInfo
CreateErrorInfo
SafeArrayUnaccessData
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayDestroy
SysStringLen

msvcr120

_spawnv
_cwait
_wputenv
_wsystem
_wgetenv
_exit
_wcsicmp
wcsncmp
_snwprintf
_open_osfhandle
_get_osfhandle
_wopen
_lseeki64
_commit
strpbrk
_vsnprintf
tolower
isdigit
_hypot
ungetc
isalpha
qsort
wcsrchr
wcschr
strstr
fputs
strtol
_copysign
putc
getc
_HUGE
isspace
ldexp
memchr
_stat64i32
strncpy
strncmp
fseek
fflush
signal
_fstat64i32
mbstowcs
getenv
atoi
abort
exit
strerror
strchr
rewind
ftell
fread
localeconv
memmove
sprintf
modf
frexp
realloc
malloc
free
fwrite
fprintf
ferror
clearerr
__iob_func
_isnan
_finite
__sys_nerr
__sys_errlist
_errno
strrchr
fopen
fclose
_tzname
_spawnve
_timezone
_daylight
_tzset
_execve
_execv
_getcwd
_stricmp
_umask
_msize
_wenviron
__pioinfo
wcsncpy
printf
feof
isxdigit
isalnum
_beginthreadex
_endthreadex
fgets
_gmtime64
_localtime64
isupper
ceil
floor
asctime
clock
_ctime64
_mktime64
_time64
wcsftime
_ftime64
_locking
_setmode
_getwch
_getwche
_putwch
_ungetwch
_heapmin
_getch
_getche
_kbhit
_putch
_ungetch
wcsxfrm
wcscoll
setlocale
_isatty
_fileno
_strdup
_unlink
_close
_dup
_lseek
_open
_fdopen
_strnicmp
_write
_getpid
_dup2
_read

wininet

InternetSetOptionW
InternetGetConnectedState
InternetCloseHandle
HttpEndRequestW
InternetSetFilePointer
HttpOpenRequestW
HttpQueryInfoW
InternetReadFile
InternetWriteFile
InternetConnectW
FtpOpenFileW
InternetCrackUrlW
HttpSendRequestExW
InternetQueryOptionW
InternetOpenW

userenv

GetAllUsersProfileDirectoryW

Exports

Exports

??_B?1??get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAEAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ@51
?get_const_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEBV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAEAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AEAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@EA
?instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@0AEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@EA
?is_destroyed@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?t@?1??get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAEAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A
?t@?1??get_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@detail@34@A
VSTPluginMain
acosh
asinh
atanh
log1p
main
round

Sections

.text
Size: 19.5MB - Virtual size: 19.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20.6MB - Virtual size: 20.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3.9MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 156KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

38b2e401643c4a5c9d79ca160660d72f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ws2_32

dbghelp

psapi

winmm

imagehlp

wintrust

setupapi

shlwapi

rpcrt4

imm32

version

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

msvcr120

wininet

userenv

Exports

Exports

Sections

.text Size: 19.5MB - Virtual size: 19.5MB

RT_CODE Size: 2KB - Virtual size: 4KB

.rdata Size: 20.6MB - Virtual size: 20.6MB

.data Size: 3.9MB - Virtual size: 4.6MB

.pdata Size: 1.1MB - Virtual size: 1.1MB

_RDATA Size: 14KB - Virtual size: 16KB

.tls Size: - Virtual size: 4KB

.rsrc Size: 67KB - Virtual size: 68KB

.reloc Size: 156KB - Virtual size: 160KB

.text
Size: 19.5MB - Virtual size: 19.5MB

RT_CODE
Size: 2KB - Virtual size: 4KB

.rdata
Size: 20.6MB - Virtual size: 20.6MB

.data
Size: 3.9MB - Virtual size: 4.6MB

.pdata
Size: 1.1MB - Virtual size: 1.1MB

_RDATA
Size: 14KB - Virtual size: 16KB

.tls
Size: - Virtual size: 4KB

.rsrc
Size: 67KB - Virtual size: 68KB

.reloc
Size: 156KB - Virtual size: 160KB