f9f25c1fa7b810c59cd1a5556e56561a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f9f25c1fa7b810c59cd1a5556e56561a_JaffaCakes118
Size

2.7MB
MD5

f9f25c1fa7b810c59cd1a5556e56561a
SHA1

735c9a7c82c058b0b755b42e700fc80079c6528d
SHA256

9d004832a63fa93e6eac43776b5823964eecd110cbc149fedc408d52c54b178e
SHA512

4ba480a54d71e0917d2fa8d265d408a6f9f8dffc3744cb7c4e0ee2b6f96a031af733c33394cf07881b9dea6a06d135200bdc6a6c429145d6b66a9e9fd08efad8
SSDEEP

49152:dEoUed88zaYJ/vlL5J7+47bLtVEAG6Q4xGCRvXlje0tZ2l7pmf/lFpP9vxtuynX:dEz48M7L5JS47bLhGCZ1e0twlcNFvpYG

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/HA_PFS802_chenmy.exe
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/StartMenu.dll
unpack002/Plugins/8bf.pfl
unpack002/Plugins/Raw.pfl
unpack002/StudioCN.plg
unpack002/Uninstall.exe
unpack002/pf-studio.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
static1/unpack001/HA_PFS802_chenmy.exe	nsis_installer_1
static1/unpack002/Uninstall.exe	nsis_installer_1

Files

f9f25c1fa7b810c59cd1a5556e56561a_JaffaCakes118
.rar
HA_PFS802_chenmy.exe
.exe windows:4 windows x86 arch:x86

1cf4252ebbb4f173d97a6ef4f79a60b5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17
ImageList_AddMasked
ImageList_Destroy
ImageList_Create

kernel32

ExpandEnvironmentStringsA
GetEnvironmentVariableA
lstrcmpiA
CloseHandle
SetFileTime
GetFileAttributesA
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
WaitForSingleObject
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
GlobalFree
MulDiv
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
SetFilePointer
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
lstrcpynA

user32

ExitWindowsEx
CharNextA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
DispatchMessageA
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
PeekMessageA

gdi32

GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SetBkColor
SelectObject

advapi32

RegEnumValueA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegEnumKeyA

shell32

ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHFileOperationA

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

922b855d216a21490e4bcbf6c29b7f7d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GetModuleHandleA
GetPrivateProfileIntA
GlobalAlloc
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
lstrcmpiA

user32

GetDlgCtrlID
GetClientRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
MapWindowPoints
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
PtInRect
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
SendMessageA
SetWindowTextA
GetWindowTextA
wsprintfA
CharNextA
CreateWindowExA

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

comdlg32

GetOpenFileNameA
CommDlgExtendedError
GetSaveFileNameA

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
ShellExecuteA

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 930B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/StartMenu.dll
.dll windows:4 windows x86 arch:x86

7d85f9c30f9e87a65fff848de2c96ac1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpynA
GlobalAlloc
MulDiv
GetModuleHandleA
GlobalFree
FindClose
FindNextFileA
FindFirstFileA
lstrcmpiA
lstrcatA
lstrcpyA

user32

GetMessageA
IsDialogMessageA
PostMessageA
CallWindowProcA
TranslateMessage
CheckDlgButton
ShowWindow
LoadIconA
GetClientRect
MoveWindow
ScreenToClient
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextA
SendMessageA
GetWindowTextA
IsDlgButtonChecked
DispatchMessageA
DestroyWindow
GetDlgItem
CreateDialogParamA
SetWindowLongA
wsprintfA
GetWindowLongA

gdi32

GetTextMetricsA
SelectObject

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

Exports

Exports

Init
Select
Show

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/hanzify.ini
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
Brushes/Animals.png
.png
Brushes/Birds.png
.png
Brushes/Decoration.png
.png
Brushes/Default.png
.png
Brushes/Misc.png
.png
Brushes/Nature.png
.png
Brushes/Pastels.png
.png
LicenseStudio.txt
Masks/Aerographe.gif
.gif
Masks/Aquarelle.gif
.gif
Masks/Brume.gif
.gif
Masks/Brush.gif
.gif
Masks/Bubbles.gif
.gif
Masks/Bulles.gif
.gif
Masks/Camera.gif
.gif
Masks/Chaos.gif
.gif
Masks/Dechire.gif
.gif
Masks/Diapositive.gif
.gif
Masks/Diffuse.gif
.gif
Masks/Diffusion.gif
.gif
Masks/Dilution.gif
.gif
Masks/Ellipse.gif
.gif
Masks/Encrage.gif
.gif
Masks/Eponge.gif
.gif
Masks/Etoile.gif
.gif
Masks/Flame.gif
.gif
Masks/Flocons.gif
.gif
Masks/Fog.gif
.gif
Masks/Humide.gif
.gif
Masks/Ink.gif
.gif
Masks/Keyhole.gif
.gif
Masks/Lignes.gif
.gif
Masks/Lines.gif
.gif
Masks/Pastels.gif
.gif
Masks/Pinceau.gif
.gif
Masks/Serrure.gif
.gif
Masks/Slide.gif
.gif
Masks/Snowflake.gif
.gif
Masks/Soleil.gif
.gif
Masks/Spirale.gif
.gif
Masks/Sponge.gif
.gif
Masks/Spray.gif
.gif
Masks/Star.gif
.gif
Masks/Sun.gif
.gif
Masks/Torn.gif
.gif
Masks/Twirl.gif
.gif
Masks/Watercolor.gif
.gif
Masks/Wet.gif
.gif
Nozzles/Clipart.png
.png
Nozzles/Floral01.png
.png
Nozzles/Mains.png
.png
Nozzles/PFS.png
.png
Nozzles/Star01.png
.png
Nozzles/Stars02.png
.png
Patterns/Bois01.jpg
.jpg
Patterns/Bois02.jpg
.jpg
Patterns/Bois03.jpg
.jpg
Patterns/Canvas01.jpg
.jpg
Patterns/Canvas02.jpg
.jpg
Patterns/Canvas03.jpg
.jpg
Patterns/Color01.jpg
.jpg
Patterns/Color02.jpg
.jpg
Patterns/Color03.jpg
.jpg
Patterns/Couleur01.jpg
.jpg
Patterns/Couleur02.jpg
.jpg
Patterns/Couleur03.jpg
.jpg
Patterns/Fabric01.jpg
.jpg
Patterns/Fabric02.jpg
.jpg
Patterns/Fabric03.jpg
.jpg
Patterns/Gres01.jpg
.jpg
Patterns/Gres02.jpg
.jpg
Patterns/Gres03.jpg
.jpg
Patterns/Marble01.jpg
.jpg
Patterns/Marble02.jpg
.jpg
Patterns/Marble03.jpg
.jpg
Patterns/Marbre01.jpg
.jpg
Patterns/Marbre02.jpg
.jpg
Patterns/Marbre03.jpg
.jpg
Patterns/Metal01.jpg
.jpg
Patterns/Metal02.jpg
.jpg
Patterns/Metal03.jpg
.jpg
Patterns/Mur01.jpg
.jpg
Patterns/Mur02.jpg
.jpg
Patterns/Mur03.jpg
.jpg
Patterns/Nature01.jpg
.jpg
Patterns/Nature02.jpg
.jpg
Patterns/Nature03.jpg
.jpg
Patterns/Paper01.jpg
.jpg
Patterns/Paper02.jpg
.jpg
Patterns/Paper03.jpg
.jpg
Patterns/Papier01.jpg
.jpg
Patterns/Papier02.jpg
.jpg
Patterns/Papier03.jpg
.jpg
Patterns/Rayures01.gif
Patterns/Rayures02.gif
Patterns/Rayures03.gif
Patterns/Sandstone01.jpg
.jpg
Patterns/Sandstone02.jpg
.jpg
Patterns/Sandstone03.jpg
.jpg
Patterns/Scanlines01.gif
Patterns/Scanlines02.gif
Patterns/Scanlines03.gif
Patterns/Tissus01.jpg
.jpg
Patterns/Tissus02.jpg
.jpg
Patterns/Tissus03.jpg
.jpg
Patterns/Toile01.jpg
.jpg
Patterns/Toile02.jpg
.jpg
Patterns/Toile03.jpg
.jpg
Patterns/Wall01.jpg
.jpg
Patterns/Wall02.jpg
.jpg
Patterns/Wall03.jpg
.jpg
Patterns/Wood01.jpg
.jpg
Patterns/Wood02.jpg
.jpg
Patterns/Wood03.jpg
.jpg
PhotoFiltre.htm
.html
PhotoMasque.htm
.html
Plugins/8bf.pfl
.dll windows:4 windows x86 arch:x86

8a5031a3c50a404b0b8d03d7b0c18598

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryExA
FindResourceA
EnumResourceNamesA
LockResource
LoadResource
TlsFree
SetUnhandledExceptionFilter
TerminateProcess
HeapAlloc
HeapFree
HeapReAlloc
RtlUnwind
RaiseException
GetCommandLineA
GetVersion
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCPInfo
GetACP
GetOEMCP
GetCurrentThreadId
TlsSetValue
TlsAlloc
FreeLibrary
SetLastError
TlsGetValue
GetLastError
IsBadReadPtr
GetStringTypeW
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
IsBadCodePtr
LoadLibraryA
InterlockedDecrement
InterlockedIncrement

user32

wsprintfA

gdi32

SetDIBitsToDevice
SetICMMode

Exports

Exports

InvokePSPlugin
ScanPSPlugin

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/Raw.pfl
.dll windows:4 windows x86 arch:x86

619c85efe2794b8e53db7c0575cd790f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

htons
ntohs
ntohl
htonl

kernel32

HeapDestroy
HeapCreate
GetSystemTime
SetEnvironmentVariableW
GetLocalTime
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
HeapFree
InterlockedDecrement
InterlockedIncrement
RtlUnwind
GetCommandLineA
GetVersion
GetProcAddress
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
ExitProcess
TerminateProcess
GetCurrentProcess
InitializeCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
WideCharToMultiByte
GetTimeZoneInformation
SetStdHandle
WriteFile
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
VirtualFree
VirtualAlloc
HeapReAlloc
SetFilePointer
ReadFile
CloseHandle
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
FlushFileBuffers
GetCPInfo
LocalFileTimeToFileTime
SystemTimeToFileTime
CreateFileA
GetACP
GetOEMCP
LoadLibraryA
LCMapStringA
LCMapStringW
RaiseException
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetCurrentDirectoryA
GetFullPathNameA
GetDriveTypeA
SetFileTime

Exports

Exports

ExtractThumbnail
FromRawToPSD
RawInfo
Raw_get_shrink_values
nMSdcRAW
rotate_values

Sections

.text
Size: 140KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Selections/Arrow01.pfs
Selections/Arrow02.pfs
Selections/Arrow03.pfs
Selections/Balloon01.pfs
Selections/Balloon02.pfs
Selections/Croix.pfs
Selections/Cross.pfs
Selections/Etoile01.pfs
Selections/Etoile02.pfs
Selections/Fleche01.pfs
Selections/Fleche02.pfs
Selections/Fleche03.pfs
Selections/Hexagon.pfs
Selections/Hexagone.pfs
Selections/InfoBulle01.pfs
Selections/InfoBulle02.pfs
Selections/RightAngledTriangle.pfs
Selections/Star01.pfs
Selections/Star02.pfs
Selections/TriangleRectangle01.pfs
StudioCN.plg
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

GetCompatibility
GetDlgByte
GetDlgBytes
GetDlgCancel
GetDlgConfirmation
GetDlgError
GetDlgGb
GetDlgInformation
GetDlgInput
GetDlgKb
GetDlgMb
GetDlgNo
GetDlgOk
GetDlgOtherColors
GetDlgPictureFmt
GetDlgPictureNone
GetDlgPicturePreview
GetDlgWarning
GetDlgYes
GetFltIconFile
GetMnuAlt
GetMnuBkSp
GetMnuCtrl
GetMnuDel
GetMnuDown
GetMnuEnd
GetMnuEnter
GetMnuEsc
GetMnuHome
GetMnuIns
GetMnuLeft
GetMnuPgDn
GetMnuPgUp
GetMnuRight
GetMnuShift
GetMnuSpace
GetMnuTab
GetMnuUp
GetOeAll
GetOeMsgErrorOpening
GetOeMsgErrorSaving
GetShpMsgStreamError
GetTrBtnCancel
GetTrBtnDel
GetTrBtnEraseText
GetTrBtnExport
GetTrBtnNewText
GetTrBtnOk
GetTrBtnPreview
GetTrBtnPrint
GetTrBtnReset
GetTrBtnRestore
GetTrBtnSaveSettings
GetTrBtnSetup
GetTrBtnTxtSel
GetTrCharset
GetTrCode
GetTrDate
GetTrDefaultFont
GetTrDldGlb1
GetTrDldGlb2
GetTrDldGlb4
GetTrDlgBatch1
GetTrDlgBatch2
GetTrDlgBatch3
GetTrDlgBatch4
GetTrDlgBatch5
GetTrDlgBatch6
GetTrDlgExplore1
GetTrDlgExplore2
GetTrDlgGlb5
GetTrDlgGlb6
GetTrDlgGlb7
GetTrDlgImage1
GetTrDlgImage10
GetTrDlgImage11
GetTrDlgImage12
GetTrDlgImage2
GetTrDlgImage3
GetTrDlgImage4
GetTrDlgImage5
GetTrDlgImage6
GetTrDlgImage7
GetTrDlgImage8
GetTrDlgImage9
GetTrDlgLayer1
GetTrDlgLayer2
GetTrDlgLayer3
GetTrDlgLayer4
GetTrDlgMain1
GetTrDlgMain10
GetTrDlgMain11
GetTrDlgMain12
GetTrDlgMain13
GetTrDlgMain2
GetTrDlgMain3
GetTrDlgMain4
GetTrDlgMain5
GetTrDlgMain6
GetTrDlgMain7
GetTrDlgMain8
GetTrDlgMain9
GetTrDlgPrint1
GetTrDlgPrint2
GetTrDlgPrint3
GetTrDlgPrint4
GetTrDlgPrint5
GetTrDlgReg
GetTrDlgSel1
GetTrDlgTool1
GetTrDlgTool2
GetTrDlgTwain1
GetTrDlgTwain2
GetTrFmtAmount
GetTrFmtAmplitude
GetTrFmtAverage
GetTrFmtBottomDistort
GetTrFmtBrightness
GetTrFmtCellSize
GetTrFmtCompress
GetTrFmtContrast
GetTrFmtDuplicate
GetTrFmtExploreProperties
GetTrFmtFileDate
GetTrFmtFileSize
GetTrFmtGamma
GetTrFmtHistory
GetTrFmtHue
GetTrFmtImageProperties
GetTrFmtInfoSel
GetTrFmtInfoSel2
GetTrFmtIntensity
GetTrFmtLayerName
GetTrFmtLeftDistort
GetTrFmtLevel
GetTrFmtLevel2
GetTrFmtMediane
GetTrFmtOpacity
GetTrFmtPeriod
GetTrFmtPiecesSize
GetTrFmtPointLength
GetTrFmtRadius
GetTrFmtResolution
GetTrFmtResolution2
GetTrFmtRightDistort
GetTrFmtSaturation
GetTrFmtScale
GetTrFmtSequenceExample
GetTrFmtSkewLeftRight
GetTrFmtSkewTopBootom
GetTrFmtThreshold
GetTrFmtTolerance
GetTrFmtTopDistort
GetTrFmtUntitled
GetTrFmtWidth
GetTrHntArtTool
GetTrHntBlurTool
GetTrHntCloneStampTool
GetTrHntDeformTool
GetTrHntEraseTool
GetTrHntFillTool
GetTrHntFingerTool
GetTrHntLayerTool
GetTrHntLineTool
GetTrHntNozzlesTool
GetTrHntPaintbrush2Tool
GetTrHntPaintbrushTool
GetTrHntPipetteTool
GetTrHntRetouchTool
GetTrHntScrollTool
GetTrHntSelTool
GetTrHntSprayTool
GetTrHntWandTool
GetTrLanguage
GetTrLbl24bits
GetTrLbl4bits
GetTrLbl8bfDir
GetTrLbl8bits
GetTrLblAcceptDeform
GetTrLblAdjust
GetTrLblAdjustSize
GetTrLblAlignment
GetTrLblAllLayers
GetTrLblAlphaBlendForm
GetTrLblAngle
GetTrLblAntialias
GetTrLblAntialiased
GetTrLblAntialiasing
GetTrLblArrow
GetTrLblAskToUser
GetTrLblAspectRation
GetTrLblAssemblePos
GetTrLblAuto
GetTrLblAutoAntialias
GetTrLblAutoCreateImage
GetTrLblAutoFilter
GetTrLblAutoSaveImage
GetTrLblAverage
GetTrLblBatchInterrupted
GetTrLblBilinear
GetTrLblBkg
GetTrLblBkgPattern
GetTrLblBlue
GetTrLblBoth
GetTrLblBottom
GetTrLblBottomLeft
GetTrLblBottomRight
GetTrLblBottomToTop
GetTrLblCellSize
GetTrLblChannel
GetTrLblChannelAlls
GetTrLblChannelBlue
GetTrLblChannelCyan
GetTrLblChannelGreen
GetTrLblChannelMagenta
GetTrLblChannelRed
GetTrLblChannelYellow
GetTrLblClearRecent
GetTrLblClockwise
GetTrLblCm
GetTrLblColor
GetTrLblColor1
GetTrLblColor128
GetTrLblColor16
GetTrLblColor2
GetTrLblColor256
GetTrLblColor32
GetTrLblColor64
GetTrLblColor8
GetTrLblColorCount
GetTrLblComment
GetTrLblCommonImages
GetTrLblCompression
GetTrLblContour
GetTrLblCopies
GetTrLblCounterClockwise
GetTrLblCrossPoint1
GetTrLblCrossPoint2
GetTrLblCrossPoint3
GetTrLblCrossPoint4
GetTrLblCurrentSize
GetTrLblCustomSelection
GetTrLblCustomSize
GetTrLblDecrease
GetTrLblDefaultForFit
GetTrLblDefaultFormat
GetTrLblDefaultValues
GetTrLblDelay
GetTrLblDescription
GetTrLblDiagonal
GetTrLblDiaporama
GetTrLblDiffusion
GetTrLblDigitalPhoto
GetTrLblDirectPreview
GetTrLblDirection
GetTrLblDisableBkgTexture
GetTrLblDisableDisplay
GetTrLblDisableTrans
GetTrLblDisableZoom
GetTrLblDispersion
GetTrLblDithering
GetTrLblDivisor
GetTrLblEffect
GetTrLblEffects
GetTrLblEnd
GetTrLblEval
GetTrLblExifRotation
GetTrLblExtension
GetTrLblFade
GetTrLblFast
GetTrLblFileName
GetTrLblFilesError
GetTrLblFilesOk
GetTrLblFill
GetTrLblFillOptions
GetTrLblFillPattern
GetTrLblFilter1
GetTrLblFilter2
GetTrLblFilterType
GetTrLblFindEdges
GetTrLblFineGrain
GetTrLblFixed
GetTrLblFlat
GetTrLblFloating
GetTrLblFolders
GetTrLblFont
GetTrLblFontBold
GetTrLblFontItalic
GetTrLblFontStrikeOut
GetTrLblFontUnderline
GetTrLblForce16M
GetTrLblForceCompression
GetTrLblForceDPI
GetTrLblFormat
GetTrLblFreeUse
GetTrLblGray16
GetTrLblGray256
GetTrLblGray4
GetTrLblGreen
GetTrLblHeight
GetTrLblHelp
GetTrLblHigh
GetTrLblHighlights
GetTrLblHistogramm
GetTrLblHistory
GetTrLblHorz
GetTrLblHorzAxis
GetTrLblHorzLines
GetTrLblInch
GetTrLblInches
GetTrLblIncrease
GetTrLblInterlaced
GetTrLblJacketCD1
GetTrLblJacketCD2
GetTrLblJacketDVD
GetTrLblJpegTitle
GetTrLblLandscape
GetTrLblLanguage
GetTrLblLarge
GetTrLblLargeGrain
GetTrLblLayerBkg
GetTrLblLayerThumb0
GetTrLblLayerThumb1
GetTrLblLayerThumb2
GetTrLblLayerThumb3
GetTrLblLeft
GetTrLblLeftToRight
GetTrLblLicensedTo
GetTrLblLimitList
GetTrLblLimits
GetTrLblLoadPlugins
GetTrLblLockDir
GetTrLblLocked
GetTrLblLoop
GetTrLblLow
GetTrLblMagicErase
GetTrLblManual
GetTrLblMargin
GetTrLblMask
GetTrLblMatrix
GetTrLblMaxColors
GetTrLblMedium
GetTrLblMemory
GetTrLblMenu
GetTrLblMenuXP
GetTrLblMergeDifference
GetTrLblMergeLuminosity
GetTrLblMergeMode
GetTrLblMergeMultiply
GetTrLblMergeNormal
GetTrLblMergeOverlay
GetTrLblMergeScreen
GetTrLblMergeTransColor
GetTrLblModeColor
GetTrLblModeTransparent
GetTrLblMonoDithering
GetTrLblMonoDuotone
GetTrLblMonochrom
GetTrLblMoveLayer
GetTrLblName
GetTrLblNearest
GetTrLblNeedRestart
GetTrLblNegativeMode
GetTrLblNewImage
GetTrLblNewPos
GetTrLblNewSize
GetTrLblNoSaved
GetTrLblNone
GetTrLblOpacity
GetTrLblOptimize
GetTrLblOptimizedMode
GetTrLblOptimizedPalette
GetTrLblOuterBevel
GetTrLblOutputDir
GetTrLblOutputFormat
GetTrLblOutside
GetTrLblPaeth
GetTrLblPaperTexture
GetTrLblPastel
GetTrLblPattern
GetTrLblPct
GetTrLblPercent
GetTrLblPhoto
GetTrLblPicture
GetTrLblPictures
GetTrLblPixel
GetTrLblPixels
GetTrLblPngTitle
GetTrLblPortrait
GetTrLblPosition
GetTrLblPostcard
GetTrLblPrecise
GetTrLblPreserveExif
GetTrLblPreserveFileDate
GetTrLblPressure
GetTrLblProgressive
GetTrLblRGB_BGR
GetTrLblRGB_BRG
GetTrLblRGB_GBR
GetTrLblRGB_GRB
GetTrLblRGB_RBG
GetTrLblRadius
GetTrLblRainbow
GetTrLblRed
GetTrLblRedEye
GetTrLblRegKey
GetTrLblRegUser
GetTrLblReplaceTranspColor
GetTrLblRequiredMemory
GetTrLblResampling
GetTrLblResetSize
GetTrLblResolution
GetTrLblRestoreBkg
GetTrLblResult
GetTrLblRight
GetTrLblRightToLeft
GetTrLblRounded
GetTrLblRunMulti
GetTrLblSaving
GetTrLblScale
GetTrLblSelFileName
GetTrLblSendToClipboard
GetTrLblSequence
GetTrLblSettings
GetTrLblShadow
GetTrLblShadows
GetTrLblShape
GetTrLblSize
GetTrLblSizeList
GetTrLblSizeMemory
GetTrLblSmooth
GetTrLblSourceDir
GetTrLblSourceFormat
GetTrLblSplashScreen
GetTrLblStandard
GetTrLblStart
GetTrLblStartup
GetTrLblStep
GetTrLblStepAuto
GetTrLblStretchMask
GetTrLblStrkeOptions
GetTrLblStroke
GetTrLblStyle
GetTrLblSub
GetTrLblSymmetry
GetTrLblSystemMode
GetTrLblSystemPalette
GetTrLblTextInput
GetTrLblTileMask
GetTrLblTolerance
GetTrLblToolsAlign
GetTrLblToolsGrid
GetTrLblTop
GetTrLblTopLeft
GetTrLblTopRight
GetTrLblTopToBottom
GetTrLblTransition
GetTrLblTransparent
GetTrLblUniform
GetTrLblUniqueDir
GetTrLblUnit
GetTrLblUnits
GetTrLblUp
GetTrLblUsedByNextImage
GetTrLblVert
GetTrLblVertAxis
GetTrLblVertLines
GetTrLblVeryLarge
GetTrLblVisible
GetTrLblWeb
GetTrLblWidth
GetTrLblWindows20
GetTrLblWindows256
GetTrLblbatchSuccess
GetTrMnuAboutPhotoFiltre
GetTrMnuAboutPlugins
GetTrMnuAction
GetTrMnuAddNoise
GetTrMnuAdjust
GetTrMnuAged
GetTrMnuAncientBW
GetTrMnuAnimatedGif
GetTrMnuAntialias
GetTrMnuArrangeAll
GetTrMnuArtistic
GetTrMnuArtisticBlur
GetTrMnuAssemblePaste
GetTrMnuAutoCrop
GetTrMnuAutoCtr
GetTrMnuAutoLevels
GetTrMnuAutoTransparency
GetTrMnuAutoZoom
GetTrMnuBC
GetTrMnuBatch
GetTrMnuBlackPencil
GetTrMnuBlankLayer
GetTrMnuBlood
GetTrMnuBlue
GetTrMnuBlur
GetTrMnuBlurMore

Sections

CODE
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Uninstall.exe
.exe windows:4 windows x86 arch:x86

1cf4252ebbb4f173d97a6ef4f79a60b5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17
ImageList_AddMasked
ImageList_Destroy
ImageList_Create

kernel32

ExpandEnvironmentStringsA
GetEnvironmentVariableA
lstrcmpiA
CloseHandle
SetFileTime
GetFileAttributesA
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
WaitForSingleObject
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
GlobalFree
MulDiv
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
SetFilePointer
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
lstrcpynA

user32

ExitWindowsEx
CharNextA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
DispatchMessageA
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
PeekMessageA

gdi32

GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SetBkColor
SelectObject

advapi32

RegEnumValueA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegEnumKeyA

shell32

ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHFileOperationA

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
pf-studio.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 74KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 28B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 565KB - Virtual size: 564KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
˵.txt
下载说明.htm
.html .js polyglot

Sharing

General

Malware Config

Signatures

Files

1cf4252ebbb4f173d97a6ef4f79a60b5

Headers

File Characteristics

Imports

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 108KB

.ndata Size: - Virtual size: 40KB

.rsrc Size: 3KB - Virtual size: 4KB

922b855d216a21490e4bcbf6c29b7f7d

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

shell32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 930B

7d85f9c30f9e87a65fff848de2c96ac1

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 5KB

.rsrc Size: 512B - Virtual size: 296B

.reloc Size: 512B - Virtual size: 460B

8a5031a3c50a404b0b8d03d7b0c18598

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 33KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 77KB

.reloc Size: 8KB - Virtual size: 4KB

619c85efe2794b8e53db7c0575cd790f

Headers

File Characteristics

Imports

ws2_32

kernel32

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 138KB

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 108KB

.ndata
Size: - Virtual size: 40KB

.rsrc
Size: 3KB - Virtual size: 4KB

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 930B

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 296B

.reloc
Size: 512B - Virtual size: 460B

.text
Size: 36KB - Virtual size: 33KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 77KB

.reloc
Size: 8KB - Virtual size: 4KB

.text
Size: 140KB - Virtual size: 138KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 24KB - Virtual size: 158KB

.reloc
Size: 16KB - Virtual size: 14KB

CODE
Size: 76KB - Virtual size: 76KB

DATA
Size: 1KB - Virtual size: 1KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 1KB

.edata
Size: 23KB - Virtual size: 22KB

.reloc
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 4KB

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 108KB

.ndata
Size: - Virtual size: 40KB

.rsrc
Size: 3KB - Virtual size: 4KB

CODE
Size: 2.1MB - Virtual size: 2.1MB

DATA
Size: 208KB - Virtual size: 208KB

BSS
Size: - Virtual size: 74KB

.idata
Size: 11KB - Virtual size: 11KB

.tls
Size: - Virtual size: 28B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 128KB - Virtual size: 127KB

.rsrc
Size: 565KB - Virtual size: 564KB