49927b91ee2f2c136cba4606e19e6ed0N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

49927b91ee2f2c136cba4606e19e6ed0N.exe
Size

1.1MB
MD5

49927b91ee2f2c136cba4606e19e6ed0
SHA1

12bf50db3c928cb31e6c55c879b955ea91d262e4
SHA256

b1617b5fd35ac777fde2bd2ddae52adc1859d7b0e86ce1694235640bcb8a2ad7
SHA512

5f9ff6eafa3daad09c75052275044adc64d199138f8198eb8d171ef136ce6bb4ec1c0bd5dcccff06b143c7fa6537287d350dfc2e175ad6dc592d040865cabdaf
SSDEEP

12288:VFHgF/VlMpeK3XCOYU5eWnErl+T5hZzojZuYewu3/gK0uDBNpsmh2radOEKjK6qu:VFAtVlMpeodSmkradOEKjK6aiT8Yj

Score

1^/10

Malware Config

Signatures

Files

49927b91ee2f2c136cba4606e19e6ed0N.exe
.dll regsvr32 windows:6 windows x64 arch:x64

ee5bf96deb722a972b7d2515b1a135b4

Code Sign

1f:00:00:00:03:72:03:d5:d2:32:c4:46:60:00:00:00:00:00:03
Certificate

Issuer

CN=JW-ROOT-G1,O=JW,C=US

Not Before

16-03-2022 14:55

Not After

16-03-2032 15:05

Subject

CN=JW-INT1-G1,O=JW,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5b:00:00:00:13:34:35:c2:5e:54:89:1a:b2:00:01:00:00:00:13
Certificate

Issuer

CN=JW-INT1-G1,O=JW,C=US

Not Before

16-03-2022 18:59

Not After

16-03-2027 19:09

Subject

CN=JW-INT1-DAR1-G1,O=JW,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:4a:71:b8:00:06:00:00:02:b5
Certificate

Issuer

CN=JW-INT1-DAR1-G1,O=JW,C=US

Not Before

22-02-2023 12:00

Not After

21-02-2025 12:00

Subject

CN=MEPS Programming WTS,OU=MEPS,O=WATCHTOWER,L=Warwick,ST=New York,C=US,1.2.840.113549.1.9.1=#0c1e496e626f784d455053496e666f5365634062657468656c2e6a772e6f7267

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f9:ba:91:90:64:ed:fd:fe:ef:e9:d0:78:ca:b3:d3:22:aa:d9:49:f7:f3:60:6c:a7:ca:0f:86:f9:bf:21:db:51
Signer

Actual PE Digest

f9:ba:91:90:64:ed:fd:fe:ef:e9:d0:78:ca:b3:d3:22:aa:d9:49:f7:f3:60:6c:a7:ca:0f:86:f9:bf:21:db:51

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\TFSBuilds\01\1186\s\output\weaselx64.pdb

Imports

kernel32

LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
GetModuleFileNameW
VerifyVersionInfoW
VerSetConditionMask
GetCurrentThreadId
lstrcpyW
DeleteCriticalSection
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
WriteConsoleW
CreateFileW
GetModuleHandleExW
GetLastError
SetLastError
RaiseException
DecodePointer
GetUserDefaultLCID
GetStringTypeExW
FreeLibrary
LoadLibraryA
LCMapStringW
MulDiv
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
EncodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
GetLocaleInfoEx
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
HeapAlloc
HeapFree
GetProcessHeap
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetStdHandle
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesW
HeapSize
HeapReAlloc
SetFilePointerEx
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
CloseHandle

user32

CreateWindowExW
LoadStringW
GetDC
SetWindowPos
ReleaseDC
RedrawWindow
InflateRect
GetClientRect
GetWindowRect
CopyRect
OffsetRect
SetWindowLongPtrW
GetMonitorInfoW
DrawIconEx
DestroyIcon
DefWindowProcW
KillTimer
EndPaint
GetWindowLongPtrW
CallWindowProcW
SetRect
DestroyWindow
LoadCursorW
GetClassInfoExW
ShowWindow
IsWindow
RegisterClassExW
UnregisterClassW
MonitorFromRect
GetWindowThreadProcessId
GetForegroundWindow
GetSystemMetrics
LoadImageW
DestroyMenu
TrackPopupMenuEx
GetSubMenu
LoadMenuW
GetMenuItemInfoW
GetMenuItemCount
GetKeyboardState
ToUnicodeEx
GetFocus
BeginPaint

advapi32

RegOpenKeyA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA

ole32

CoCreateInstance

oleaut32

SysAllocString
SysAllocStringLen

usp10

ScriptStringOut
ScriptStringAnalyse
ScriptStringFree

gdi32

TextOutW
GetTextExtentPoint32W
CreateFontW
BitBlt
CreateCompatibleDC
CreateSolidBrush
SetViewportOrgEx
DeleteDC
GetCurrentObject
GetDeviceCaps
SelectObject
SetBkColor
DeleteObject
SetTextColor
FillRgn
Rectangle
RoundRect
CreatePen
CreateRectRgnIndirect
CreateCompatibleBitmap
SetBkMode

rpcrt4

RpcStringFreeA
RpcBindingFromStringBindingA
RpcBindingFree
NdrClientCall3
RpcStringBindingComposeA

Exports

Exports

??0?$codecvt_null@_W@archive@boost@@QEAA@_K@Z
??0?$singleton@V?$extended_type_info_typeid@UCandidateInfo@weasel@@@serialization@boost@@@serialization@boost@@IEAA@XZ
??0?$singleton@V?$extended_type_info_typeid@UText@weasel@@@serialization@boost@@@serialization@boost@@IEAA@XZ
??0?$singleton@V?$extended_type_info_typeid@UTextAttribute@weasel@@@serialization@boost@@@serialization@boost@@IEAA@XZ
??0?$singleton@V?$extended_type_info_typeid@UTextRange@weasel@@@serialization@boost@@@serialization@boost@@IEAA@XZ
??0?$singleton@V?$extended_type_info_typeid@UUIStyle@weasel@@@serialization@boost@@@serialization@boost@@IEAA@XZ
??0?$singleton@V?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@IEAA@XZ
??0?$singleton@V?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@IEAA@XZ
??1?$codecvt_null@_W@archive@boost@@UEAA@XZ
??_F?$codecvt_null@_W@archive@boost@@QEAAXXZ
?do_always_noconv@?$codecvt_null@_W@archive@boost@@EEBA_NXZ
?do_encoding@?$codecvt_null@_W@archive@boost@@EEBAHXZ
?do_in@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?do_max_length@?$codecvt_null@_W@archive@boost@@EEBAHXZ
?do_out@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UCandidateInfo@weasel@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@UCandidateInfo@weasel@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UText@weasel@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@UText@weasel@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UTextAttribute@weasel@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@UTextAttribute@weasel@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UTextRange@weasel@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@UTextRange@weasel@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UUIStyle@weasel@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@UUIStyle@weasel@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@23@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UText@weasel@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vtext_wiarchive@archive@boost@@UText@weasel@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@weasel@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@weasel@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UUIStyle@weasel@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vtext_wiarchive@archive@boost@@UUIStyle@weasel@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEBV?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ
?get_mutable_instance@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEAV?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?is_destroyed@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_locked@singleton_module@serialization@boost@@QEAA_NXZ
?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z
?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UText@weasel@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z
?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z
?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@weasel@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z
?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UUIStyle@weasel@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z
?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z
?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z
?lock@?1??get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@QEAAXXZ
?unlock@singleton_module@serialization@boost@@QEAAXXZ
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 579KB - Virtual size: 578KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 331KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee5bf96deb722a972b7d2515b1a135b4

Code Sign

1f:00:00:00:03:72:03:d5:d2:32:c4:46:60:00:00:00:00:00:03Certificate

Key Usages

5b:00:00:00:13:34:35:c2:5e:54:89:1a:b2:00:01:00:00:00:13Certificate

Key Usages

11:4a:71:b8:00:06:00:00:02:b5Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

f9:ba:91:90:64:ed:fd:fe:ef:e9:d0:78:ca:b3:d3:22:aa:d9:49:f7:f3:60:6c:a7:ca:0f:86:f9:bf:21:db:51Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

usp10

gdi32

rpcrt4

Exports

Exports

Sections

.text Size: 579KB - Virtual size: 578KB

.rdata Size: 166KB - Virtual size: 165KB

.data Size: 20KB - Virtual size: 27KB

.pdata Size: 25KB - Virtual size: 25KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 331KB - Virtual size: 331KB

.reloc Size: 6KB - Virtual size: 5KB

1f:00:00:00:03:72:03:d5:d2:32:c4:46:60:00:00:00:00:00:03
Certificate

5b:00:00:00:13:34:35:c2:5e:54:89:1a:b2:00:01:00:00:00:13
Certificate

11:4a:71:b8:00:06:00:00:02:b5
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

f9:ba:91:90:64:ed:fd:fe:ef:e9:d0:78:ca:b3:d3:22:aa:d9:49:f7:f3:60:6c:a7:ca:0f:86:f9:bf:21:db:51
Signer

.text
Size: 579KB - Virtual size: 578KB

.rdata
Size: 166KB - Virtual size: 165KB

.data
Size: 20KB - Virtual size: 27KB

.pdata
Size: 25KB - Virtual size: 25KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 331KB - Virtual size: 331KB

.reloc
Size: 6KB - Virtual size: 5KB