Fexxflui-Exploit-main[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

Fexxflui-Exploit-main.zip
Size

14.4MB
MD5

3b6ff7ccbe996b8a0ab0f7e073c76b50
SHA1

d3cc726a7d3e0b6f44f8a59a33f06fbbb953ecd0
SHA256

13ac590eb4c0f6477632f7ee88b2c7ac0f3677727750a2839529fc9d29c89949
SHA512

0b7bc023de0bde1b5fe8d4a7ebdafe5a0fc3a700ed75463751f3c54a13d989c2ef64927745df810fa30d8a42baf731a0a7fe67af157ff80683d8f3faa2bbf353
SSDEEP

393216:x9/wZq5CuDdN26VzjEUBFzhAqa0RdECKcNk/bqpsT8s0Yos:ToZqPDdNRhrBFz+103BK2kzq48zC

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/bin/injector.exe	vmprotect

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/Fexxflui.exe
unpack001/Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/Oxygen API.dll
unpack001/Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScintillaNET.dll
unpack001/Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/bin/injector.exe
unpack001/Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/oxygen.dll
unpack001/Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/obj/Debug/Fexxflui.exe
unpack001/Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/obj/Debug/TempPE/Properties.Resources.Designer.cs.dll

Files

Fexxflui-Exploit-main.zip
.zip
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/App.config
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/Fexxflui.csproj
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/Form1.resx
.vbs
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/Properties/AssemblyInfo.cs
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/Properties/Resources.Designer.cs
.vbs
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/Properties/Resources.resx
.vbs
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/Properties/Settings.Designer.cs
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/Properties/Settings.settings
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/Resources/Fexxflui.png
.png
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/Fexxflui.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\jepit\source\repos\Fexxflui\Fexxflui\obj\Debug\Fexxflui.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/Fexxflui.exe.config
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/Fexxflui.pdb
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/Oxygen API.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Jack\source\repos\Oxygen API\Oxygen\obj\Release\Oxygen API.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 289KB - Virtual size: 289KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScintillaNET.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\jacob\Documents\Projects\ScintillaNET\src\ScintillaNET\obj\Release\ScintillaNET.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/ARSENAL MONEY SCRIPT.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Advanced Prison Life UI.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Anti-AFK.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/AutoRob.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/BrokenBonesIV.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/ClickTeleport.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Cmd-X.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Dex Explorer V2.txt
.js
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Enable Reset Character.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/FPS Aimlock.lua
.js
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Food Hack.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Giant head.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Infinite Donuts.lua
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Kick Off Script.txt
.js
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Linorix Hub.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Lumber Dominator.txt
.js
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/MM2 Auto Farm.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/MM2.lua
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Murder Mystery 2 Hack Work in SYnapse X or Serversides.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/OP ROBLOX ARSENAL GUI SHOWCASED BY SMOKEZ SQUAD.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Paint N Guess Auto.lua
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Prison Life GUI v2.2.lua
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/PrisonBreakerX.lua
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/PrisonHax.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/PrisonHaxx.lua
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Script (1).txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Script.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/SharkBite GUI.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/SharkBite.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Sharkbite2 inf teeth.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Shazam Fly Da Hood.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Speed Run 4 Farm.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Tall Hack.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/TopKek ScriptHub.txt
.js
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Unrestricted Btools.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/Weightlifting Simulator 2 GUI.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/[FE] Chat Bypass.txt
.js
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/[FE] E to TP.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/[FE] Fly.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/[FE] God Mode.txt
.js
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/[FE] Infinite Yield.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/[FE] Invisible Character.lua
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/[FE] Invisible Fling.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/[FE] Speed Cheat.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/[[BEST]] Script LIST.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/adopt me script.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/ScriptsFUI/zombie attack hack.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/Siticone.UI.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

3a:93:0b:19:8f:29:72:9a:49:b0:8b:f3:6d:f8:17:ae
Certificate

Issuer

CN=Siticone Root CA

Not Before

05-02-2020 06:42

Not After

22-10-2030 17:00

Subject

CN=Siticone Technology

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

34:8f:92:bf:68:07:1b:a4:18:d3:f6:b4:4e:02:5a:2c:51:c0:51:c0
Signer

Actual PE Digest

34:8f:92:bf:68:07:1b:a4:18:d3:f6:b4:4e:02:5a:2c:51:c0:51:c0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Ilham-PC\Documents\Visual Studio 2015\Projects\Siticone.UI\Build\Release\Siticone.UI.WinForms\Siticone.UI.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/bin/injector.exe
.exe windows:6 windows x86 arch:x86

50ca805a824acdd145c856d5be6546cb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentDirectoryA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

msvcp140

?_Xlength_error@std@@YAXPBD@Z

shlwapi

PathAddBackslashA

vcruntime140

__std_terminate

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

wtsapi32

WTSSendMessageW

user32

GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

Sections

.text
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/oxygen.dll
.dll windows:6 windows x86 arch:x86

28884b57f6cf6765a0c5a74809a13180

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AllocConsole
AreFileApisANSI
CloseHandle
ConnectNamedPipe
ConvertFiberToThread
ConvertThreadToFiberEx
CopyFileA
CreateDirectoryW
CreateEventA
CreateEventW
CreateFiberEx
CreateFileA
CreateFileW
CreateNamedPipeA
CreateRemoteThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFiber
DisableThreadLibraryCalls
DisconnectNamedPipe
EnterCriticalSection
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FormatMessageA
FormatMessageW
FreeConsole
FreeLibrary
GetACP
GetConsoleMode
GetConsoleWindow
GetCurrentConsoleFontEx
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableA
GetEnvironmentVariableW
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetLastError
GetLocaleInfoEx
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetStdHandle
GetSystemDirectoryA
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
InitOnceBeginInitialize
InitOnceComplete
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InitializeSRWLock
IsDebuggerPresent
IsProcessorFeaturePresent
K32EnumProcessModules
K32GetModuleFileNameExA
K32GetModuleInformation
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
Module32FirstW
Module32NextW
MoveFileExA
MultiByteToWideChar
OpenProcess
PeekNamedPipe
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleA
ReadConsoleW
ReadFile
ReadProcessMemory
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ResetEvent
SetConsoleMode
SetConsoleTextAttribute
SetConsoleTitleA
SetCurrentConsoleFontEx
SetEvent
SetFileInformationByHandle
SetLastError
SetUnhandledExceptionFilter
Sleep
SleepEx
SwitchToFiber
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VerSetConditionMask
VerifyVersionInfoW
VirtualAllocEx
VirtualFree
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WideCharToMultiByte
WriteFile
WriteProcessMemory
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptEnumProvidersW
CryptExportKey
CryptGenRandom
CryptGetHashParam
CryptGetProvParam
CryptGetUserKey
CryptHashData
CryptImportKey
CryptReleaseContext
CryptSetHashParam
CryptSignHashW
DeregisterEventSource
GetCurrentHwProfileA
RegisterEventSourceW
ReportEventW

user32

CallWindowProcA
ClientToScreen
CloseClipboard
CreateWindowExA
DefWindowProcA
DeleteMenu
DestroyWindow
EmptyClipboard
GetCapture
GetClientRect
GetClipboardData
GetCursorPos
GetDC
GetForegroundWindow
GetProcessWindowStation
GetSystemMenu
GetSystemMetrics
GetUserObjectInformationW
GetWindowLongA
GetWindowRect
IsChild
LoadCursorA
MapVirtualKeyA
MessageBoxA
MessageBoxW
MonitorFromPoint
MonitorFromWindow
OpenClipboard
RegisterClassExA
RegisterClipboardFormatA
ReleaseCapture
ReleaseDC
ScreenToClient
SendInput
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetProcessDPIAware
SetWindowLongA
ShowWindow
TrackMouseEvent
UnregisterClassA
keybd_event
mouse_event
GetProcessWindowStation
GetUserObjectInformationW

shell32

ShellExecuteA

dbghelp

StackWalk
SymCleanup
SymFunctionTableAccess
SymGetLineFromAddr
SymGetModuleBase
SymGetSymFromAddr
SymInitialize
UnDecorateSymbolName

gdi32

CreateRectRgn
DeleteObject
GetDeviceCaps

ws2_32

WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAIoctl
WSAResetEvent
WSASetLastError
WSAStartup
WSAWaitForMultipleEvents
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyaddr
gethostbyname
gethostname
getpeername
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
inet_ntop
inet_pton
ioctlsocket
listen
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

shlwapi

PathMatchSpecA

crypt32

CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetCertificateContextProperty
CertGetNameStringA
CertOpenStore
CryptDecodeObjectEx
CryptQueryObject
CryptStringToBinaryA
PFXImportCertStore

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
??0_Lockit@std@@QAE@H@Z
??0facet@locale@std@@IAE@I@Z
??0ios_base@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1_Locinfo@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??1facet@locale@std@@MAE@XZ
??1ios_base@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAJ@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getctype@_Locinfo@std@@QBE?AU_Ctypevec@@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
?_Incref@facet@locale@std@@UAEXXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Random_device@std@@YAIXZ
?_Syserror_map@std@@YAPBDH@Z
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Winerror_map@std@@YAHH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xbad_function_call@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?fail@ios_base@std@@QBE_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?good@ios_base@std@@QBE_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uncaught_exception@std@@YA_NXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
_Cnd_destroy_in_situ
_Cnd_do_broadcast_at_thread_exit
_Cnd_init_in_situ
_Cnd_signal
_Cnd_timedwait
_Cnd_wait
_Mtx_current_owns
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Mtx_lock
_Mtx_unlock
_Query_perf_counter
_Query_perf_frequency
_Thrd_detach
_Thrd_id
_Thrd_join
_Thrd_sleep
_Tolower
_Toupper
_Xtime_get_ticks

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow
DwmGetColorizationColor
DwmIsCompositionEnabled

wldap32

ord301
ord45
ord22
ord32
ord26
ord30
ord35
ord143
ord200
ord41
ord33
ord27
ord50
ord211
ord60
ord217
ord46
ord79

normaliz

IdnToAscii

bcrypt

BCryptGenRandom

vcruntime140

_CxxThrowException
__CxxFrameHandler3
__RTDynamicCast
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_destroy_list
_except_handler3
_except_handler4_common
_purecall
memchr
memcmp
memcpy
memmove
memset
strchr
strrchr
strstr
wcsstr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vswprintf
_close
_fileno
_fseeki64
_get_stream_buffer_pointers
_lseeki64
_open
_read
_setmode
_wfopen
_write
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fopen_s
fputc
fputs
fread
freopen_s
fseek
fsetpos
ftell
fwrite
puts
setvbuf
ungetc

api-ms-win-crt-runtime-l1-1-0

__sys_errlist
__sys_nerr
_beginthreadex
_cexit
_configure_narrow_argv
_crt_atexit
_errno
_execute_onexit_table
_exit
_getpid
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_seh_filter_dll
abort
exit
raise
signal
strerror
strerror_s
system
terminate

api-ms-win-crt-filesystem-l1-1-0

_access
_fstat64
_lock_file
_stat64
_stat64i32
_unlink
_unlock_file

api-ms-win-crt-utility-l1-1-0

_byteswap_uint64
_byteswap_ulong
qsort
rand

api-ms-win-crt-heap-l1-1-0

_callnewh
calloc
free
malloc
realloc

api-ms-win-crt-math-l1-1-0

_dsign
_dtest
_fdopen
acos
asin
atan
atan2
ceil
cos
cosh
exp
exp2
floor
fmod
frexp
ldexp
log
log10
log2
modf
pow
round
sin
sinh
sqrt
tan
tanh

api-ms-win-crt-time-l1-1-0

_gmtime64
_gmtime64_s
_localtime64
_time64
strftime

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
localeconv

api-ms-win-crt-convert-l1-1-0

atof
atoi
strtod
strtol
strtoll
strtoul
strtoull
wcstombs

api-ms-win-crt-string-l1-1-0

_strdup
isalnum
isalpha
isdigit
isspace
isupper
strcat
strcat_s
strcmp
strcpy_s
strcspn
strlen
strncat
strncmp
strncpy
strncpy_s
strnlen
strpbrk
strspn
tolower
toupper
wcslen

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

ensure_injector
injector_call

Sections

.text
Size: - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.astaghf
Size: - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.astaghf
Size: 6.7MB - Virtual size: 6.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 223B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/bin/Debug/workspace/CMD-X.lua
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/favicon (23).ico
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/obj/Debug/DesignTimeResolveAssemblyReferences.cache
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/obj/Debug/Fexxflui.Form1.resources
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/obj/Debug/Fexxflui.Properties.Resources.resources
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/obj/Debug/Fexxflui.csproj.AssemblyReference.cache
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/obj/Debug/Fexxflui.csproj.CoreCompileInputs.cache
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/obj/Debug/Fexxflui.csproj.FileListAbsolute.txt
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/obj/Debug/Fexxflui.csproj.GenerateResource.cache
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/obj/Debug/Fexxflui.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\jepit\source\repos\Fexxflui\Fexxflui\obj\Debug\Fexxflui.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/obj/Debug/Fexxflui.pdb
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/obj/Debug/TempPE/Properties.Resources.Designer.cs.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fexxflui-Exploit-main/Fexxflui Exploit/Fexxflui – kopio/obj/Debug/_IsIncrementalBuild

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 169KB - Virtual size: 169KB

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 289KB - Virtual size: 289KB

.rsrc Size: 1024B - Virtual size: 888B

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

3a:93:0b:19:8f:29:72:9a:49:b0:8b:f3:6d:f8:17:aeCertificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

34:8f:92:bf:68:07:1b:a4:18:d3:f6:b4:4e:02:5a:2c:51:c0:51:c0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 512B - Virtual size: 12B

.rsrc Size: 1KB - Virtual size: 1KB

50ca805a824acdd145c856d5be6546cb

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcp140

shlwapi

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

wtsapi32

user32

Sections

.text Size: - Virtual size: 23KB

.rdata Size: - Virtual size: 8KB

.data Size: - Virtual size: 1KB

.vmp0 Size: - Virtual size: 3.2MB

.vmp1 Size: 5.2MB - Virtual size: 5.2MB

.text
Size: 169KB - Virtual size: 169KB

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 289KB - Virtual size: 289KB

.rsrc
Size: 1024B - Virtual size: 888B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 1.3MB - Virtual size: 1.3MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

3a:93:0b:19:8f:29:72:9a:49:b0:8b:f3:6d:f8:17:ae
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

34:8f:92:bf:68:07:1b:a4:18:d3:f6:b4:4e:02:5a:2c:51:c0:51:c0
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 512B - Virtual size: 12B

.rsrc
Size: 1KB - Virtual size: 1KB

.text
Size: - Virtual size: 23KB

.rdata
Size: - Virtual size: 8KB

.data
Size: - Virtual size: 1KB

.vmp0
Size: - Virtual size: 3.2MB

.vmp1
Size: 5.2MB - Virtual size: 5.2MB

.rsrc
Size: 512B - Virtual size: 469B

.text
Size: - Virtual size: 4.8MB

.rdata
Size: - Virtual size: 1.3MB

.data
Size: - Virtual size: 1.0MB

.00cfg
Size: - Virtual size: 8B

.tls
Size: - Virtual size: 9KB

.astaghf
Size: - Virtual size: 2.2MB

.astaghf
Size: 6.7MB - Virtual size: 6.7MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 223B

.text
Size: 169KB - Virtual size: 169KB

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 3KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 12B