6db7eb8417d857e5ec233780642a849807a4e1ad7ab6f60e43d45ce0018e75bf

Sharing

Copy URL

Twitter E-mail

General

Target

6db7eb8417d857e5ec233780642a849807a4e1ad7ab6f60e43d45ce0018e75bf
Size

6.2MB
MD5

df8db7498d66ae3d86ddf5384b33aa31
SHA1

1ed661673fd64c8394243a706893109afc1fe2e9
SHA256

6db7eb8417d857e5ec233780642a849807a4e1ad7ab6f60e43d45ce0018e75bf
SHA512

44c40e93048a7b54972d65d29b0de3a2166ef8224d56a5069a0819b01371a2dd7b0917de8b4b93d44d95992818f4e709f24014c99db2ff609686ebdbc0fdbdbc
SSDEEP

196608:4sTbYMORs/04EWeRuNETq7+9lD60R9fAz5kElVjqwSS:43A3en6AZ/bfJCjtSS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/vsdebugeng.dll

Files

6db7eb8417d857e5ec233780642a849807a4e1ad7ab6f60e43d45ce0018e75bf
.rar
Ordine n°24-00980.exe
.exe windows:6 windows x64 arch:x64

619cc0438687a13d277d457fdbc4c7b2

Code Sign

33:00:00:01:c4:94:d6:bf:eb:13:69:22:10:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Phone Production PCA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-09-2024 19:20

Not After

11-09-2025 19:20

Subject

CN=Windows Phone,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0b:fc:f9:8e:58:4c:15:50:bf:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24-07-2012 22:23

Not After

24-07-2027 22:33

Subject

CN=Microsoft Windows Phone Production PCA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f7:0d:fc:b0:f1:f7:aa:ce:4b:81:11:ae:c1:bd:3e:a2:b1:0c:d3:56:65:06:c1:1c:2b:8f:b6:ec:99:64:a4:d5
Signer

Actual PE Digest

f7:0d:fc:b0:f1:f7:aa:ce:4b:81:11:ae:c1:bd:3e:a2:b1:0c:d3:56:65:06:c1:1c:2b:8f:b6:ec:99:64:a4:d5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\dbs\el\ddvsm\out\binaries\amd64ret\Debugger\CoreSystem\msvsmon.pdb

Imports

vcruntime140

__std_exception_destroy
__std_exception_copy
memset
__current_exception_context
memcpy
memmove
__current_exception
__C_specific_handler
wcsstr
wcsrchr
_purecall
wcschr
_CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-convert-l1-1-0

_ultow_s
wcstol
_i64tow_s
_itow_s
_wtoi

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
_set_new_mode
calloc
_recalloc
realloc

api-ms-win-crt-string-l1-1-0

wcsnlen
wcspbrk
wmemcpy_s
wcsncpy_s

api-ms-win-crt-runtime-l1-1-0

__p___wargv
__p___argc
_initterm
_cexit
_crt_atexit
_configure_wide_argv
_get_initial_wide_environment
_initialize_wide_environment
_c_exit
_errno
_invalid_parameter_noinfo
_set_app_type
_initialize_onexit_table
terminate
_exit
exit
_initterm_e
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_register_onexit_function

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__p__commode
__stdio_common_vfwprintf
__stdio_common_vswprintf_s
__stdio_common_vswprintf
__stdio_common_vfwscanf
_set_fmode
__acrt_iob_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

vsdebugeng

DkmDllSetRootProcessId
DkmDllEnsureInitialized
DkmDllUninitialize
ProcDkmString3

api-ms-win-core-libraryloader-l1-1-1

LoadResource
SizeofResource
LockResource
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
FreeLibrary
GetModuleHandleW
FindResourceExW

api-ms-win-core-file-l1-1-0

WriteFile
FlushFileBuffers
GetLongPathNameW
GetFileAttributesW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetErrorMode
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

DeleteProcThreadAttributeList
UpdateProcThreadAttribute
GetCurrentProcess
InitializeProcThreadAttributeList
CreateThread
TerminateProcess
CreateProcessW
ResumeThread
GetExitCodeProcess
GetProcessId
OpenProcessToken
GetCurrentThread
SetThreadPriority
GetCurrentProcessId
SuspendThread
GetCurrentThreadId

api-ms-win-core-handle-l1-1-0

CloseHandle
SetHandleInformation
DuplicateHandle

api-ms-win-core-heap-l1-1-0

HeapSetInformation
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
GetProcessHeap

api-ms-win-core-com-l1-1-0

CLSIDFromString
CoUninitialize
StringFromGUID2
CoTaskMemFree
CoCreateGuid
CoTaskMemRealloc
CoTaskMemAlloc
CoInitializeEx
CoCreateInstance

api-ms-win-core-kernel32-legacy-l1-1-0

FindResourceW
LoadLibraryW
GetComputerNameW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource
RegisterEventSourceW
ReportEventW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
MapViewOfFile

api-ms-win-core-synch-l1-1-0

CreateEventW
LeaveCriticalSection
OpenEventW
WaitForMultipleObjectsEx
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
SetEvent
WaitForSingleObject

api-ms-win-security-base-l1-1-0

GetSidSubAuthorityCount
GetSidIdentifierAuthority
GetSecurityDescriptorControl
GetTokenInformation
MakeSelfRelativeSD
PrivilegeCheck
AdjustTokenPrivileges
AccessCheck
GetSecurityDescriptorSacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
MakeAbsoluteSD
GetSecurityDescriptorOwner
CopySid
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetAclInformation
InitializeAcl
AddAce
SetSecurityDescriptorDacl
GetLengthSid
GetSecurityDescriptorGroup
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
IsValidSid
GetSecurityDescriptorLength

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW
LookupAccountSidW
LookupAccountNameW

api-ms-win-core-processthreads-l1-1-1

GetThreadContext
IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-namedpipe-l1-1-0

DisconnectNamedPipe
CreateNamedPipeW
ConnectNamedPipe

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
SetEnvironmentVariableW
GetEnvironmentVariableW

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW

api-ms-win-core-localization-l1-2-0

FormatMessageA
GetThreadLocale
FormatMessageW
LCMapStringW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

sspicli

GetUserNameExW

oleaut32

SysAllocString
SysAllocStringByteLen
SysStringByteLen
VarUI4FromStr
SysAllocStringLen
SysFreeString
SysStringLen

ws2_32

WSAStartup
htons
ntohs
inet_addr
closesocket
bind
WSAGetLastError
socket
setsockopt
getsockname
htonl

Exports

Exports

CreateHostedInstance
IsFallbackLoadRemoteManagedPdbsEnabled
IsInServiceMode
OnAbnormalAbort

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 214KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vsdebugeng.dll
.dll windows:6 windows x64 arch:x64

17e05739ca77cc84b5bdc9dcf581766a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

AdjustTokenPrivileges
CheckTokenMembership
DeregisterEventSource
DuplicateTokenEx
GetTokenInformation
ImpersonateLoggedOnUser
LookupPrivilegeValueW
OpenProcessToken
OpenThreadToken
RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryValueExW
RegisterEventSourceW
ReportEventW
RevertToSelf

bcrypt

BCryptOpenAlgorithmProvider
BCryptImportKeyPair
BCryptImportKey
BCryptHashData
BCryptGetProperty
BCryptGenRandom
BCryptFinishHash
BCryptExportKey
BCryptEncrypt
BCryptDestroyKey
BCryptDestroyHash
BCryptDecrypt
BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptSetProperty

crypt32

PFXImportCertStore
PFXExportCertStore
CryptUnprotectMemory
CryptQueryObject
CryptProtectMemory
CryptImportPublicKeyInfoEx2
CryptFormatObject
CryptFindOIDInfo
CryptDecodeObject
CertVerifyTimeValidity
CertVerifyCertificateChainPolicy
CertSerializeCertificateStoreElement
CertSaveStore
CertOpenStore
CertNameToStrW
CertGetValidUsages
CertAddCertificateContextToStore
CertAddCertificateLinkToStore
CertCloseStore
CertControlStore
CertCreateCertificateChainEngine
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetCertificateContextProperty
CertGetIntendedKeyUsage
CertGetNameStringW

iphlpapi

GetNetworkParams
GetAdaptersAddresses
GetPerAdapterInfo
if_nametoindex

kernel32

InterlockedFlushSList
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
EncodePointer
SetUnhandledExceptionFilter
CancelIoEx
CancelSynchronousIo
CancelThreadpoolIo
CloseHandle
CloseThreadpoolIo
CloseThreadpoolWait
CloseThreadpoolWork
CompareStringEx
CompareStringOrdinal
CopyFileExW
CreateDirectoryW
CreateEventExW
CreateFileMappingW
CreateFileW
CreatePipe
CreateProcessA
CreateProcessW
CreateThread
CreateThreadpoolIo
CreateThreadpoolTimer
CreateThreadpoolWait
CreateThreadpoolWork
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
EnumCalendarInfoExEx
EnumTimeFormatsEx
ExitProcess
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNLSStringEx
FindStringOrdinal
FlushFileBuffers
FlushViewOfFile
FormatMessageW
FreeConsole
FreeLibrary
GetCPInfo
GetCPInfoExW
GetCalendarInfoEx
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumberEx
GetCurrentThread
GetCurrentThreadId
GetDynamicTimeZoneInformation
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileType
GetFullPathNameW
GetLastError
GetLocaleInfoEx
GetLongPathNameW
GetModuleFileNameW
GetOverlappedResult
GetProcAddress
GetProcessId
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetThreadPriority
GetTickCount64
GetTimeZoneInformation
GetUserPreferredUILanguages
GlobalMemoryStatusEx
InitializeConditionVariable
InitializeCriticalSection
IsDebuggerPresent
IsWow64Process
K32EnumProcessModulesEx
K32EnumProcesses
K32GetModuleBaseNameW
K32GetModuleFileNameExW
K32GetModuleInformation
LCIDToLocaleName
LCMapStringEx
LeaveCriticalSection
LoadLibraryExW
LocalAlloc
LocalFree
LocaleNameToLCID
MapViewOfFile
MultiByteToWideChar
OpenProcess
OpenThread
QueryPerformanceCounter
QueryPerformanceFrequency
QueryUnbiasedInterruptTime
RaiseFailFastException
ReadConsoleW
ReadFile
ResetEvent
ResolveLocaleName
ResumeThread
SetConsoleTextAttribute
SetEvent
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetLastError
SetThreadErrorMode
SetThreadPriority
SetThreadpoolTimer
SetThreadpoolWait
Sleep
SleepConditionVariableCS
StartThreadpoolIo
SubmitThreadpoolWork
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualQuery
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForThreadpoolWaitCallbacks
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
FlushProcessWriteBuffers
WaitForSingleObjectEx
AddVectoredExceptionHandler
GetModuleHandleW
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
VerSetConditionMask
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
CreateMemoryResourceNotification
QueryInformationJobObject
GetModuleHandleExW
GetProcessAffinityMask
VerifyVersionInfoW
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
DebugBreak
SleepEx
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
UnhandledExceptionFilter
RtlLookupFunctionEntry

ncrypt

NCryptDeleteKey
NCryptGetProperty
NCryptImportKey
NCryptOpenKey
NCryptOpenStorageProvider
NCryptSetProperty
NCryptFreeObject

ole32

CoCreateGuid
CoGetApartmentType
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoWaitForMultipleHandles
CoInitializeEx

user32

LoadStringW

ws2_32

setsockopt
send
recv
ioctlsocket
getsockopt
shutdown
closesocket
bind
WSAStartup
WSASocketW
WSASend
WSARecv
getpeername
select
FreeAddrInfoExW
FreeAddrInfoW
GetAddrInfoExW
GetAddrInfoW
GetNameInfoW
WSACleanup
WSAConnect
WSAEventSelect
WSAGetOverlappedResult
WSAIoctl

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free
calloc

api-ms-win-crt-math-l1-1-0

sqrt
sin
pow
modf
fmodf
tan
ceil
cos
floor
fmod

api-ms-win-crt-string-l1-1-0

_stricmp
strcpy_s
strcmp
wcsncmp
strncpy_s

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_initterm_e
_seh_filter_dll
_cexit
_configure_narrow_argv
terminate
abort
_initterm

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vfprintf
__acrt_iob_func

Exports

Exports

010JTwimxEbhrMDoDruMt7AX5W
030nlIOQYqXUvhp2Ckx
036waPxJMdkYVUpyRchmQ
044mrLPILkSgWV5nPdWKVwJzy
05TmgyBspDX4o3T4NoIKrZG2R17
0J7rubTHFmkJU5FD
0M0lAXGPHrWAorPUcqz5erNiLSZaKb0O
0RcHEIxh5B0ZZS7D
0TIJiMIu1P7Qe2vLiFZI2
0WU7aMYrnnKXN1OZ
0gnZ4r4s29JpkzUAUYr
0l7Fv7ySCqZpBbEpyfq4LxS78
0nDgJWg0ef
0rz5X18ZY9KyM9p5Bqcmxp3T8
0sXsH2S27Ax
0shhonzQ20mhmib2RUUXHm0cRfZhe
0wZjwD4
0yRY0tfe7XTTMp34O
11GOFGIwqmHiISLq0weq6oT870gfwG6X
12JkPFX9QInL8SP
12eY7id7i2snDK4oRwwn
1C0SJJPBnQUU7byzyTZPw
1CxBpvi06j4cAuDRL3b
1FbACXvVpgZ9kCh
1R5qbxgVpUhtSTUkNmCy
1RY4EVLZs7P867EYjEON
1SKGu1icR3GG6R5maILAJd65KwdJOl
1TbjuQ5
1XN8Lcv81CZ2vVVhbBI5NBScmir3wf
1XUaxwR5w1
1Z5ZlYaLi0BMAHtB4Czy36
1hHQY4sQ8Gt4Mr3SeEb8okHcp
1mR96UF0md7SWgvgY7P4BHOI2
1pGh2REL
1ucm3hKTnZAo
21umdrK1YhCe7DQ1xOlvW
23kGvVu1jlM8m51ogTNMIa9KmUOXb
27Uo16P
29wu9WtUnfMBOkfnbs5D6CPYRAEp
2B8LbrlsHqiKWNev9NQc
2GllSA5o7OTeRaGiDHvbrVHQS
2PtSCVm3tyT0XXLU41jTUOMTTa4
2RsgZztloHJ
2TtHfjGr72isE7THJ0Z
2UaqLDzsrIleMQD
2X5jgDluhk6j6md7wLsg4fu9
2ZkneTO627t3WF3LbmQd
2jZRdw90u3Az5HUBTVG
2m1VSyD34aFF76
2mKCfe0kNT9W50oCX8VeSxwJw
2mkRY1IWxm
2pAz42OQEF6EuUIstywraERK5PUewe
2rzkCeLXvk6Uif2LMZQfNs1pPtQlHxzz
2vrVkk9fBFjkiVXFJqRroORKu
2xlt6N7lKTX8rBNyHLR
3D3nCGcSbojz6hd
3FOAKd7dUwdHiS
3FV9JX3ABXVSER6dCb7
3IiktzMMlFt64tXvc209yzADLvatU
3KJvDCzCsViaznM8RQko
3KM8Y8VQDggg11xgUWEJ90ErwTG5TMU
3Oe0XL3xvLZXFUq9nV
3QQzV8QZ
3Ql1fmqKskirgbrXeLBp3l4A
3Zbq8Y56P1In3eosX3uzY3zAcst6C
3aSNIC2V8xxm0KbR93Xzp39iq2uaZi
3csn3W4PzlqgOVUiS6
3eOxNQ2Vb3C0O
3gl2zzVxvpDwblZw3gBwERPboR
3k3eigIwcYFTZyW8QBhx2I4
3wc5KLgIeZUFQjX6AerK4albHnx
3xbS6RqkVq
4BuPv3iIzUORLvKmJ6MxAPYj
4DVBVqOUuD4RBlvEySAPg1
4H7fcNL4n7yPVFk7uin
4J56rNm7X2aBtPVQ4mqNeqf0u655
4LZA0qX
4PuE0o8hNJEqPJXSOo30jW7jZ52
4QspEQMCB8i680rkDAj
4RUcinKgvaGFY19vV8iutM
4UEDKRg5LB45pFLki
4YWqJgprMoIFYRXukW
4ZbcuJQ6FpE
4aMqM6f0Y
4bMjrxuTGtMisZ
4g2bWOayxMAVkDK5eAwc
4g8d8m44zXPUGjsM4wUJ9nl8lCFP4j0
4h8AbIanN
4kH7tgLsBDvwizZ2aZx9NbAOz6Ct2tup
4o12gIPdapGpOX52812
4paLSUMVkekCNEA
4qmyqLT
4tlFYp9ACuBwf5x
4xUiSGJaB9f9V1
4yaghfBPblvFFVthXtCCxEAIC
50fjulKteUSL
58Y2ptYNBoen0EGYnKDjsP5bgOa
58tGAeBjc9WCL1n6O0ifrO2KJf9bYCqr
5H5zkPTDyjO0eC
5HtvqorLQymcfX1yeIWrmu9Y4xIr
5JjJcrqI7fBLJvvhQbQtvK
5KD9giCtsuEFWKG8Nrsi2Y5jDoP
5Nze6TBHbaVI9T8dgogXEoAnOvGlr
5PSZu5KPhF2XfHb8o9PKsad3Zu
5QjpTQg4oFtC7k1pIuLqQBv2xPkmH
5UdytmgxQZzoNwCA
5Us9FDJ0h4ee0p98Ab68CV8
5Y9wLhQjRXLfNcXfq2talUblkZ
5aJhrveVGIO51YbnUOS3lucX2YoGzeNC
5bd560Vh6peaaNTMuezQuBUS
5iIAOtMfhBU7HwFbFr4tCkGv
5kgcr6spz2U4wn6HRlisjyYPpU4VgzUF
5mLnUuyfAQBE7YJEdACLhZzDuGKP5vi
5qqmlatMTtfn1FA8jSNdB0h
5s07653HKKk6GiUnzAoMoXmIbhvi
5wTel6LIBeTYtb4t
5xekYl1J9pu4g151ApZY4sCul1o
61IvmVlNMO5p3qVJP1V0
65fHqZSvA7kAzLp
69XhyzX3ZoPxjHq9ZzQKp4s0lOBv8
6AzpgYEtxQfNXKybM
6L2X0sX48VCuj7UDc46hHFvvGe0jWwCA
6LXjZMOmXpCBJMPiAc9J
6LxoK7VcwsewhLnxBH1EKOTA9A4aw6
6MhtRCcrN1VLSdlBAW3rk
6aVoULvCvFOXXccY8mzoCI93Lob
6rtfiAmSs2N9hBEosFbe
6tkPU9Gp9w75y
6wlGmsxDt00CgzTsdC3QZo6cc20M
6zua3H8ysNMW8rHe
703O7j2zH5MPK6e
74XCEv3jLsZ3bky6aPzE
77dK4tv
7EOQDy73LD3XJny5
7ERFqxSzHUDnVo5fNsTWh4yhpgu0F
7GUahnHPIYqIFthhkPWhQ
7IFGtxJR1w1giUu2sUkN9UguOLg6n
7R1B9eXy0W8dQN0dRI
7UXDhBmXekQzQ5cfpYe
7WBRAfGn0olZXLD
7YsqieKfhq5V
7YzNFfkyJJKZrXI2M9jT2Co
7b9waUQRCT
7ca9aFlAR2P0GE
7d949BIj9Ukylo
7e4CIEl7gjsXZ9Rba
7gaIZGb
7h6d6skWT0qa56Q4DgoQ4G3nKMw
7hRQTWOakwDfT8ctZD5qkXd6y
7o6Ir9unepCFwS
7o8szVkvjoclf29b1oGmeFoGJNcat0q
7tKoeAsnj
7uAeb979xBkghaN
7vIldgu9HoDYw1D
81aGuw2QbyhJzseyf
84OdmgyaymqCMJfVY653E7Jq
84VUzwgomjUd
89SqX5wRtzmO
89oZ2tsH
8Fn0TC8iDH
8LPdXYUeAXWViDIqAODoNGaTpnCu
8NTiD8HXAijVA4q0Gi7UgumoAVE
8ORGXR64u5IV
8Q6oE7wmUgC6YStH
8QUqnWZ0vvP
8SGtB3ouvM
8Vh2CABUrhYGUmcRtYY5HTC1U
8Y5uiKYJV9s8ZcKIR67XODAHWlKjMKLs
8Zo3B8Hr
8aYuGVboqKbADq2543VP
8cYuKl9jsyPvTxR5yx7hxsBK
8eEvX3K92J
8fxcnwEuYeU0Zy1T01ATZo
8lyHOc8TYPOMbw4RkUcDwpLnW1JupH
8vvkYE7QqCLDw0aqi4x
937JWyRQcIjE5a1Zo
94L6Visqz
95JILSr4Cz
96eWTRLvAxmeBTNf
96eXOMoXEFhEMi
988XGIQgif
99LPQ8gzlAyq
9AXO8HNFNZiIi6AcUJ3O6G
9AhjPP1gp1tgM7pQNNb
9Apo5ej8nZXKj
9CqarovXSeKcD9KVRYoq2hdX6
9DFOe5BCLR4Nf4D63ILw
9FU88kf4zfz0A41qbuHDWTZ9aZJ
9X62qJ30IZ3HiZ5zVZWQ
9XVv7Es7Jgq62O5RRm5z8ET0a6JDP
9etHIsP1m7n9szC
9gcbwsV1lKe
9gdSMBHX
9jU5f12zsP7t3
9jWTaBKMFCOt7c7ZX
9qLhoSA3O7Rxx0xDU
9qxDbRLhZiLDhuUPiVndRT
A6jXxrZKQA1tKzSJbvpp
A7XtME2O3Z5tlYWBO7MXwkqRe
A8jvdo9UOR2yRCrPjXB
A9QgkvyT1
AAgjdbod912GD
AB8jABd9sOtbw56lRBNXTF2uhA
AE7nFDbWFGchRqegYJ
AFWJTCq
AKpYAuFjAtFY38lCHfztcAbLTI7dtew
ALfeI3jGgpNzFlp1S53c6hejtvS7t
AN6V224lJc
ANKHz4Tnr7gz3XUS75jo4ywq
AOdaKt6gdxnSSinDoXZ
APLL6U02T
ARefK0DFdBskUZgxDytsfBv4QGIpCam
ARmZLgrROwMODsljyfTyTAOWG
ASY1XbzBIrdxZu5EcO6rLhjAm
ASYBSNLAjYoSjIfqDQ
AWu9ILaUkwDpJxYv
AbKQqOvbijC33
AcwImesaYB3ee6LMQcYRT1sbQD0Fp8y
AixssH5ozlgmXOL
AjxpOz5XRh6mie
AoDKB3grQXFgPqOMv2O7R
AoyYGbKMQhWrr99cDNkxX0U5trnOY
Asu48DtIZgu9QIbNIYuMaK
AtRfbc5rJSwaiXL5p
AxM0XG08ERtGbWp3H
AyR5uK35bBxcVkiSRw9OSdWrr
B7awt94OOTW5S1918l1TKehssCXGjk3
BDAIWlP9zrt
BDK1tVRjIVKOabpjrrflizjQK
BDOuhOh6sIkG
BLtJzAys7qiYTN42st
BNuOV3v0qJIX5r1RjB0TDC3KrT
BPBCb8NiqCYsR
BR9pUohehH4kUmg0L
BSTAWzr7GNR2nhedMU0l
BXXSt6Y7cTYn2vM0cLnsDlx5ui0S3xqB
BYeqX9k4Jz5jgXP8DKdX21r04g8
BiCAbeDy3lDKA
Bijq2rw4ife
BoyRt6AtHMOULIB
BpQltXBcb
C2auhaRemVj3pLxlQsDPGzcAruI8r
C4vbOuk8mL4nvqEap
C5CGjGy9uXQp
CAlt9mSYI042bW7X2XQQERvwKh
CBfFMZjR7f3RuGW8nR8f2LypLdFW
CC64ua4zSt4TsN1a0QSSwmq8BFCt0Ydt
CLaacenOv2DLOcM9KhrActRE8js
CPwhN91VZZ8IFOgnMWM
CTHAnev4xMnobFHi1al5bY
CUEDsVed
CUVhTtN9Npfnn
CZjmvDVR6nl5YG6rk2cKfc
CZzeMBjXQg0bWEv6MWpYAf7dkQxEnZM
CakZaxfSAdn09C
CaoZ6ZD3RQyyAuKh7
CbhrzgWz9y4
CcEK6BTyObkoPau6uC
Cd3WMs0DOjfWIfFBPIWDMJ8I9
CdQCucM9nnQGkTYJNf
Cjt96sDxwpErjh2xF
ClgmgcS0w3Z3
CoDUJb4KHBYkc53ZaDJvSYapFoacRg
Cqri3ScnN1Vu
CrCRqdBHBI628otLH4UmA8TFN
Cv3HnltV5WCEOBsh4kwq
CvsLtlCwIl2zUFoU
Cx2lKqMrkPn
Cy8e66owPQ5kIu7biqIgKlpy
D2mXfj0plD2jAuGOqlR54gaHQH
D5k0zeAE
D6tJIHKLAupV
D81doIa0zkWJp3IcK2aOqBirr
DA0X6GoBcSAxEeuHe
DETbUxUun
DF2QyayYEqYSxn0nSLn674PdfAv8
DKsw955khrCcQ
DVjwKzJFc8h0L8cg9MOi
DW5lPwSo
DWNHsesgy1pNXveL1Diw71fLmBsEZ2J
DXQFUzrug9ADzJWnb7xqbVhyxZrG0gYw
DZsiIARe1fHTXjIBNx
Da0lfmO16PBtu2G6SOS7nx2bGKK
Ddb9dtcin3dG
DfXPUiR5w09Qd2YPIkqY98jfuOav
Dh5VEmTSD5c1Sn1i3TRa5FXqgrm
DiNMqaz8
DjDTHQqY1V3s6sv
DkmCreateManagedInterface
DkmDisplayRetailAssert
DkmDllCreateManagedDelegate
DkmDllEnsureInitialized
DkmDllSetRootProcessId
DkmDllUninitialize
DkmDllUnloadDebuggerComponents
DkmGetComponentDirectory
DkmOpenTransportConnection
DkmSetManagedHostFunction
DlRoohXQNYI15oMJD4
DliBWPZyO16jrylGKDVYoeX5
J7&oZs/U8Un?`Pzl"U}|X`xGs4r
DoVXI8BOK2J8VfL07OXzBUHriqGzIR7o
DofZfQnphgLN6VO1dEHFJmpGc
DrFB31TYMfe3bUXL5Nxbwipfziff
DtQvG80tJxuAbhE3jdKC93xk0LZU
DuhuJXL0xcVbUyPip7Tf
Dvd8s5mO3xgrf0LQsWYZ7KpwePkHKUz
DvecDFw6E
DxbJK8Ql
E3aRRFtzr
EDQIPwbHH5JGG1J2pO033zzpulVGhd
EHQXjBRki3F7TuF16GubWB7sgFt
ELBAvgFGBWI8Q5lL
EP4NptZWWXHoXq
EUvoyjP
EVcPxyQZj
EW4D8NvITkTbMMxMzFJyp7I0
EWU6yIqNO5C1K8Nz9E6L78G
EaZK1PfreH7pze
EcaNSeoPNZCDfNcvs
EdXbUt9ZUsoAu2kEQmRMUz0y
EelPcXsQfnNP0UYhyLjrgYIBI7M7Dw
Ei4cvTSckuZeOPn7qEL
EoBLAYQKpmriHm
EsPV0AeLKSNaKXSsaHoB2IhPkq0n9YR
EszOzPhIJAlC
Evu5R0i
EwekviyQ
F0FUEkl2ppx10albN
F1ZTX3W7fwY3G
F31MH26nxBAldR3md2QKcc2x3Buk8W
F3XXybKpaoGYN6xGEB26Cfl8E1hldh
F4be90YE8jG5Ce65cA2F4YAeNdrBjH
FKMQ3WKZMYWSQRkS3
FKdwxThO9gGCY2Ki
FNIKwAoPEoLDXtJpFOzW
FPavKsDWgsXV5p1ywXVqUxnO
FQsoV7tUg1oyBRgtVfiCugt20
FRE1dLp7H
FRFYtBS89Zb7nhi8SeljosJZ24ML
FSypg7UZZB10srz13IE5
FTPOHbcYWvQeBrL8Myfl
FTe5nmxJAbHFgDDopICFTX3hO
FcUm8SMJf2CFWHSo
FdVrcawVXFQbF
FeqfmYPtn4tGc
FgdOWi0u3P6HnNgwf
Fifpdg0xaG7inV4T04HmZ2uAa7
Fl1UwvFW
FrvC4jFzSvD6enanxiRxVdFFabeHe0
Fs5t1ySgdQrbjkkRJ1bAbP
G07crjxPprJDvhaQCcwv
G7B2kTL8B
G9JFdSXArgIYN1Lrm1r
GB0bpYQ9W8SqHOQUfxm3
GCLl262domNm0bfkAC6irxgGG6b6P3GO
GIzrcvIOxoWZNlM
GNa3icY1k4Ui3BzlTFso9qbmFw
GSlYZkYdTTSWCufQtmypOCWEr
GTd5N5UqGriq4noWTG0Oe8
GW9krqvhEI0sgi9O7E
GZZaYHAC2l
Garu1SnAy8rPxNTPzJdvSgPe
Get250481482FAEDAA4BBEBC807B24DD715
Get5A5033115F5D59291645BEAAE598F0BD
Get645AD40C25493913B4F735C441506A16
Get96CE29879FF9E93DFE4900A29B219287
GetC5849E9833F5F36297EB088EC664A234
GetEE6D45A22822D04D9205C8DEAAD59330
Gh2cxlCpTEj66U9Cd
GoL2sTB34skwQuzjvHlvBoUeVkzUuon0
GoLIV6Y5g
GpeQwNtNt
Grc1MtywMNLadcNBlzPzP0
Gvsk4gPCFjvq5
GvuA8IP
GwMzrbylBPFcf8glV0FCpS
GyArRvZXq72viNIanKvrbl
H0QTySLApX
H1GHdFlTn2AH1iJ9zaKcsSAtEqbWA2
H8skXUSD0tp843g9twmkoFIVKd
HCyrnqCh8x7jX9rJQL3C
HE7VpW2dMZSGS1aoRV4S9vl
HEDW4AUuOwj4x5FwzHA5UUgc
HEQw4JC6uBfirfXjFqGuPp146TRhhc
HKLzxsLO0g7qME3k3np1l6n
HLEk7UNZX3zmCx4HKhjKGeul5
HNcdvLHAnKLpi
HNyPKNL
HOzQzTDoyC
HV4laeTjVMdwbrpKbU8rgpb
HWkPHFVYye8YgCA7FWjcabFzDn
HadTW7IC5
HeFmY5tqrExAVrHluhDYZZjzwuj7F
HkLh6pAd
Hl7DnQP2zNgoiswVaQveoI4vyz9Tmu
HmdDhu70BX
HsHXnz59UhGb0XSeIUPrFzQR3
HsOYPcwN0mSwgOU3DCkUyd
I1MgfIN7NZVfiUBeb
IA5mIeml7aLLEhJOjKkvWUjN
IAJpFiuvG9yCaaq2Xju4KhsJGDpObZBV
IEzbkfurSY2oZZ48irTZZtb7
IIV9PVlM
IJ7yiqhKQiw08rx
IK8bVmV4R
IL9oyG3mGndY78xYa5BTu
IO7XHn3EVZNhW2ANs9jhY3q8j00o
IOv7ubAtIcqPaxGnBF
ITOtu7REnY6JusZ7Tnx0tp
IbHCknNvwJewfRyIoLHlP
Ie5zXvQCNj4aPRUG3
IiB8WCEsiGaLezzT4Y5wq6n1s
ImYOYWHHbtcyRdB9A60lH9sgiY6
IqSItWlW4
IqdZsxHCbq0FEKI3
ItBKPA2rkROV7U525KapLBOjMBMB
IvCATeoKkzxUa5ZIZbrMfxO
IvLhe4SE
IvcvJO9lkeHn23PFPNs1dus
IyXLx9J0jSBudC
J1hP2waeIDXNIB85kvleQAZxOT3L
J5iiGfXkItDx0xa0NyEov
J5qNZb54HwUOG
J6jqoF10he0il5ub
J7BVYrN0J8Z4IgBI
JFyebMoz
JHb0yrnsEy
JRYrAvu6TuBOagY2YIqhj8d7I
JVmHFEe0bm2TIV5z4LnQ6SW
JXEt1W96cGKbCimiaIOFwgz5QG8IUqO
JZZJUu2kYgXLgzajM2G9AOB7A6kanC
Jc0bdnf0m5E
JeI9YhIh103jeuiKtnK
JfllKm7i034p
JiQJjnhXVJPTNccSn1Fkfw9a5AUB
Jp9bpZwxMSavOyR9hopaThzbP9Wx1
JpTgPOxOcivBayrjlP663K
Jqv6cHCPl28M7yQMpeIX4qXYEPc2
Jr32yVxuhSJTBssdnTzFN
Jr3nrT6u4MtuMJCd5oguURj6hZQG
JtFCzdUv7p4uBk4imobBarLq71WP2W7
JvsWoSfYXTAj
Jy2Rrc2IMGsF
JyzvMV4
K0PKWxq1H9eC
K4dK5nUnHrFFx6po
K4jogOoqd6lZMkZ48nIjSl
K5Dwi4ZtEL0arojNKVtsspuzY
KAp9tXXPxguepdjVRZpnNk
KFT8Tnn8hEjACOvKiJ
KHmvh4C4xwKnBp
KJ7ScnPm3qlbGxgQ
KL1sMeldGrX6GpRctW9
KLeNd6k9
KPTvQnhlFGOl9d8VQL07j2E
KQKSWq4DzopA2H8Dj
KRMw21gSkYUlAGj0UJtB
KS5FrUile6zQqLePbw9Oscarr2vNmbM5
KSpbBE3fTRCgh7fm8YjsKXZDg
KTV4qWrG2Zk0pJRVt4SIF4IE5
KVduLiZX6tU3miI0oe8
KXKMk6HMlXPN0T3G
KY7nYLAjwsRLEAnySTa4V2a1OewW
KZCWwIA43V0Gpu83hwjhKt0ma
KaAPGN9nB
KbQKiRmyHhr69HjcPriNLde4
KbUlISRHnnrVRl93fr9Vu7
Kfke6nQW4AOQaTboh54
KiOPiwuXYug9eXMthrxzfpA8mJpT3
KlB8v5XFSoRAn5pD9EyPl5bKkVVGNt
KwsjjOTm
Kxyr5QI5iAQyjejgc8DaWvvusV2S1
Ky5i9uM7F
L0lsVPAw
L27uC6xwpYhxIEymzEYdOTB
L5CkUlxazUSDjp
L8bpgkpO5BI9Mv7qJIBc
L98JiskgGc1Kc
LCBrIOo48iioe6tGmK
LExBWkJkB8h
LF9MBXi8gHZb
LJsBPqkwTaOQZTydMTHM4jEh
LKLHNjkXzOYt3zvKXDnJG1M
LKoVV1kb
LY88paO
Laj7nOtPW29M8a
LhqL4ALIx7E5SytwlrX
LoCntTPFUJqByEAW7wkWko5ONReIlD
LuxjsOYFXcj2jVQ2FLYBA1JKVvCi
LvdxkLJVqohaTkhf4QRcV8pHVpSptw
M6BLeeXLJt9PXRsKVVV9fIZT
MEcxbcUIxi
MFXCLzXC2
MH6gOHLK
MJ0zrcP5nO9Y1mrPYFC7pWUI
MQKQ1AxQoXYZEx1SnueiGh16
MVt4s9bn80
MX9wSqxVmXh24eLfY
MXdYGKSB7xY3Hgz

Sections

.text
Size: 12.6MB - Virtual size: 12.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.4MB - Virtual size: 7.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 874KB - Virtual size: 874KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

619cc0438687a13d277d457fdbc4c7b2

Code Sign

33:00:00:01:c4:94:d6:bf:eb:13:69:22:10:00:00:00:00:01:c4Certificate

Extended Key Usages

33:00:00:00:0b:fc:f9:8e:58:4c:15:50:bf:00:00:00:00:00:0bCertificate

Key Usages

f7:0d:fc:b0:f1:f7:aa:ce:4b:81:11:ae:c1:bd:3e:a2:b1:0c:d3:56:65:06:c1:1c:2b:8f:b6:ec:99:64:a4:d5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

vcruntime140

vcruntime140_1

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

vsdebugeng

api-ms-win-core-libraryloader-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

sspicli

oleaut32

ws2_32

Exports

Exports

Sections

.text Size: 69KB - Virtual size: 69KB

.rdata Size: 32KB - Virtual size: 32KB

.data Size: 1024B - Virtual size: 4KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 214KB - Virtual size: 213KB

.reloc Size: 512B - Virtual size: 376B

17e05739ca77cc84b5bdc9dcf581766a

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

crypt32

iphlpapi

kernel32

33:00:00:01:c4:94:d6:bf:eb:13:69:22:10:00:00:00:00:01:c4
Certificate

33:00:00:00:0b:fc:f9:8e:58:4c:15:50:bf:00:00:00:00:00:0b
Certificate

f7:0d:fc:b0:f1:f7:aa:ce:4b:81:11:ae:c1:bd:3e:a2:b1:0c:d3:56:65:06:c1:1c:2b:8f:b6:ec:99:64:a4:d5
Signer

.text
Size: 69KB - Virtual size: 69KB

.rdata
Size: 32KB - Virtual size: 32KB

.data
Size: 1024B - Virtual size: 4KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 214KB - Virtual size: 213KB

.reloc
Size: 512B - Virtual size: 376B

.text
Size: 12.6MB - Virtual size: 12.6MB

.rdata
Size: 7.4MB - Virtual size: 7.4MB

.data
Size: 55KB - Virtual size: 3.9MB

.pdata
Size: 874KB - Virtual size: 874KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB