photon[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

photon.exe
Size

4.7MB
MD5

6c17266811117637106691593a7c9526
SHA1

a350536476e447a9124b0ae459fae6d3c980b76c
SHA256

f04347e31ab4a24a5f27a4902d21f088f6f140262964a71d821c1943bd32392b
SHA512

53ac61459189066c9e7d8979306ce9a5116b0b33d8855a3bb688835dd06ebcf2bcc6acf7caeeeaf6e46ec7a7a6076c6fe98ffbc7e691beb478b1e8c7b4e9a2cc
SSDEEP

49152:yxJ6aaXP3Alr9uNDC4NwSvIMn0aXIUcEYKG50Cutqix1IE5XzzUuGa4AyFhSpTs+:vvIiXIUA0YE5jzUoOhSwEOTWB9WB4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
photon.exe

Files

photon.exe
.exe windows:6 windows x64 arch:x64

18cf090c5783bf0ae0c8fa60cede54a4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

B:\github-photon\photonexternal\build\release\photon.pdb

Imports

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
_Xtime_get_ticks
?_Random_device@std@@YAIXZ
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
_Strcoll
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
_Strxfrm
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
_Mtx_unlock
_Mtx_lock
??Bios_base@std@@QEBA_NXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?widen@?$ctype@_W@std@@QEBA_WD@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??7ios_base@std@@QEBA_NXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?good@ios_base@std@@QEBA_NXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?uncaught_exceptions@std@@YAHXZ
??Bid@locale@std@@QEAA_KXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Thrd_detach
_Query_perf_counter
_Cnd_do_broadcast_at_thread_exit
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

winmm

PlaySoundA

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

NtQuerySystemInformation
VerSetConditionMask
RtlInitUnicodeString
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

d3dcompiler_47

D3DCompile

gdi32

CreateSolidBrush

dwmapi

DwmExtendFrameIntoClientArea

user32

GetWindowLongPtrA
UnregisterClassA
PostQuitMessage
RegisterClassExA
UpdateWindow
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetKeyState
GetMessageExtraInfo
LoadCursorA
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
PeekMessageA
SetCursor
SetProcessDPIAware
IsWindowUnicode
ReleaseCapture
SetCursorPos
GetClientRect
GetWindowThreadProcessId
EnumWindows
GetMessageA
DispatchMessageA
TranslateMessage
GetForegroundWindow
ScreenToClient
GetSystemMetrics
DefWindowProcA
MoveWindow
SetWindowDisplayAffinity
LoadIconA
CreateWindowExA
SetLayeredWindowAttributes
GetWindowLongA
SetWindowLongA
DestroyWindow
GetWindowRect
SendInput
GetAsyncKeyState
MessageBoxA
ShowWindow
GetCursorPos
SetCapture

kernel32

MultiByteToWideChar
GetLocaleInfoA
CreateProcessA
ExitProcess
GlobalFindAtomA
lstrcmpiA
Process32Next
GlobalAddAtomA
CreateToolhelp32Snapshot
Process32First
IsDebuggerPresent
GetTickCount
GetTempPathW
GetCurrentProcessId
CreateFileW
VirtualAlloc
DeviceIoControl
VirtualFree
GetConsoleWindow
ReadProcessMemory
CloseHandle
Sleep
InitializeCriticalSectionEx
GetCurrentThreadId
VirtualProtect
FormatMessageA
FreeLibrary
GetProcAddress
GetLastError
LoadLibraryExA
GetModuleFileNameA
WideCharToMultiByte
WakeAllConditionVariable
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceFrequency
GetSystemTimeAsFileTime
InitializeSListHead
QueryPerformanceCounter
HeapSize
GlobalAlloc
GlobalFree
LoadLibraryA
DeleteCriticalSection
GetCurrentProcess
CreateThread
CreateFileMappingW
GetModuleFileNameW
GetModuleHandleW
QueryFullProcessImageNameW
SetLastError
LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
SleepConditionVariableSRW
GetLocaleInfoEx
OutputDebugStringW
GlobalLock
GlobalUnlock
CreateFileA
GetFileSizeEx
ReadFile
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileInformationByHandleEx
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
HeapDestroy
IsProcessorFeaturePresent
GetFileAttributesExW
SetFileInformationByHandle
GetModuleHandleA
AreFileApisANSI

imm32

ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow

advapi32

CryptCreateHash
RegCreateKeyW
RegDeleteTreeW
RegCloseKey
RegSetKeyValueW
OpenEventLogW
CloseEventLog
ClearEventLogW
OpenProcessToken
AddAccessAllowedAce
GetLengthSid
GetTokenInformation
InitializeAcl
IsValidSid
GetUserNameA
SetSecurityInfo
CopySid
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
RegOpenKeyW
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA

normaliz

IdnToAscii

wldap32

ord32
ord79
ord30
ord27
ord35
ord33
ord200
ord301
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord22
ord26
ord143

crypt32

CertOpenStore
CertEnumCertificatesInStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore

ws2_32

ntohl
sendto
recvfrom
recv
closesocket
freeaddrinfo
bind
WSAGetLastError
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
gethostname
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
send
connect

shell32

ShellExecuteA
SHGetFolderPathW

shlwapi

PathFindFileNameW

rpcrt4

UuidCreate
RpcStringFreeA
UuidToStringA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
memcmp
__std_exception_destroy
__std_exception_copy
_purecall
_local_unwind
__std_terminate
__current_exception
__current_exception_context
__intrinsic_setjmp
strstr
strchr
longjmp
strrchr
__C_specific_handler
wcsstr
memcpy
memmove
memchr
memset

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers
_write
_fseeki64
__stdio_common_vsprintf_s
fread
_close
ftell
_read
_open
_wfopen
__stdio_common_vsscanf
feof
_set_fmode
fsetpos
ungetc
fseek
_popen
setvbuf
fgetpos
__stdio_common_vfprintf
__stdio_common_vsprintf
fputs
getc
_lseeki64
__acrt_iob_func
tmpnam
freopen
fopen
ferror
fwrite
fgets
fgetc
tmpfile
_pclose
fclose
clearerr
fflush
_ftelli64
fputc
__p__commode

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
realloc
free
_callnewh
malloc

api-ms-win-crt-math-l1-1-0

asin
ceil
acos
ceilf
atan2
atan2f
cos
cosf
exp
floor
floorf
fmod
fmodf
__setusermatherr
_dsign
llround
log
log10
pow
powf
sin
tan
sinf
frexp
sqrt
sqrtf
ldexp
acosf
round

api-ms-win-crt-convert-l1-1-0

atof
mbstowcs
strtol
strtoull
strtoll
atoi
strtoul
strtod

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_cexit
_crt_atexit
exit
abort
_beginthreadex
_register_onexit_function
_initialize_narrow_environment
terminate
_configure_narrow_argv
system
_errno
_getpid
_resetstkoflw
_invalid_parameter_noinfo
__sys_nerr
_get_initial_narrow_environment
_initterm
_initterm_e
_initialize_onexit_table
_exit
__p___argc
__p___argv
strerror
_c_exit
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_set_app_type

api-ms-win-crt-string-l1-1-0

isspace
strncmp
strpbrk
strcmp
isdigit
isxdigit
strncpy_s
_wcsicmp
strspn
_stricmp
toupper
isblank
_strdup
isgraph
isupper
tolower
strncpy
strcoll
islower
strcspn
ispunct
isalnum
iscntrl
isalpha

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_wremove
rename
remove
_stat64
_access
_fstat64
_unlink
_lock_file

api-ms-win-crt-locale-l1-1-0

localeconv
_configthreadlocale
___lc_codepage_func
setlocale

api-ms-win-crt-time-l1-1-0

strftime
_localtime64_s
_gmtime64
_mktime64
_localtime64
_time64
_difftime64
clock

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

rand
srand
qsort

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 461KB - Virtual size: 478KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

18cf090c5783bf0ae0c8fa60cede54a4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp140

winmm

d3d11

ntdll

d3dcompiler_47

gdi32

dwmapi

user32

kernel32

imm32

advapi32

normaliz

wldap32

crypt32

ws2_32

shell32

shlwapi

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 461KB - Virtual size: 478KB

.pdata Size: 128KB - Virtual size: 127KB

.msvcjmc Size: 14KB - Virtual size: 13KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 461KB - Virtual size: 478KB

.pdata
Size: 128KB - Virtual size: 127KB

.msvcjmc
Size: 14KB - Virtual size: 13KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 8KB - Virtual size: 7KB