General

  • Target
    LetsVPN.exe
  • Size 27.5MB
  • Sample260704-plefpsfs9v
  • SHA256 26c54b1a0cb5d8636966e6f27505035b2521c7733ee8827b21a9a76f934665e7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • DLL Hijacking vulnerability 1 IoCs

    Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.

  • Unsigned PE 45 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 2 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • LetsVPN.exe
    .exe 27.5MB
  • $PLUGINSDIR/InstallOptions.dll
    .dll 32KB
  • $PLUGINSDIR/System.dll
    .dll 28KB
  • $PLUGINSDIR/ioSpecial.ini
    211B
  • $PLUGINSDIR/modern-wizard.bmp
    25KB
  • .DS_Store
    12KB
  • LetsPRO.exe
    .exe 243KB
  • LetsPRO.ini
    1KB
  • Microsoft.exe
    .exe 19KB
  • Update.exe
    .exe 1.8MB
  • api-ms-win-core-console-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-datetime-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-debug-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-errorhandling-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-file-l1-1-0.dll
    .dll 14KB
  • api-ms-win-core-file-l1-2-0.dll
    .dll 11KB
  • api-ms-win-core-file-l2-1-0.dll
    .dll 11KB
  • api-ms-win-core-handle-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-heap-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-interlocked-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-libraryloader-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-localization-l1-2-0.dll
    .dll 13KB
  • api-ms-win-core-memory-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-namedpipe-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-processenvironment-l1-1-0.dll
    .dll 12KB
  • api-ms-win-core-processthreads-l1-1-0.dll
    .dll 13KB
  • api-ms-win-core-processthreads-l1-1-1.dll
    .dll 11KB
  • api-ms-win-core-profile-l1-1-0.dll
    .dll 10KB
  • api-ms-win-core-rtlsupport-l1-1-0.dll
    .dll 10KB
  • api-ms-win-core-string-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-synch-l1-1-0.dll
    .dll 13KB
  • api-ms-win-core-synch-l1-2-0.dll
    .dll 11KB
  • api-ms-win-core-sysinfo-l1-1-0.dll
    .dll 12KB
  • api-ms-win-core-timezone-l1-1-0.dll
    .dll 11KB
  • api-ms-win-core-util-l1-1-0.dll
    .dll 11KB
  • api-ms-win-crt-conio-l1-1-0.dll
    .dll 12KB
  • api-ms-win-crt-convert-l1-1-0.dll
    .dll 15KB
  • api-ms-win-crt-environment-l1-1-0.dll
    .dll 11KB
  • api-ms-win-crt-filesystem-l1-1-0.dll
    .dll 13KB
  • api-ms-win-crt-heap-l1-1-0.dll
    .dll 12KB
  • api-ms-win-crt-locale-l1-1-0.dll
    .dll 11KB
  • api-ms-win-crt-math-l1-1-0.dll
    .dll 21KB
  • api-ms-win-crt-multibyte-l1-1-0.dll
    .dll 19KB
  • api-ms-win-crt-private-l1-1-0.dll
    .dll 62KB
  • api-ms-win-crt-process-l1-1-0.dll
    .dll 12KB
  • api-ms-win-crt-runtime-l1-1-0.dll
    .dll 15KB
  • api-ms-win-crt-stdio-l1-1-0.dll
    .dll 17KB
  • api-ms-win-crt-string-l1-1-0.dll
    .dll 17KB
  • api-ms-win-crt-time-l1-1-0.dll
    .dll 13KB
  • api-ms-win-crt-utility-l1-1-0.dll
    .dll 11KB
  • app-3.20.0/CommunityToolkit.Mvvm.dll
    .dll 110KB
  • app-3.20.0/DeltaCompressionDotNet.MsDelta.dll
    .dll 5KB
  • app-3.20.0/DeltaCompressionDotNet.PatchApi.dll
    .dll 5KB
  • app-3.20.0/DeltaCompressionDotNet.dll
    .dll 4KB
  • app-3.20.0/FontAwesome.WPF.dll
    .dll 204KB
  • app-3.20.0/Hardcodet.Wpf.TaskbarNotification.dll
    .dll 44KB
  • app-3.20.0/ICSharpCode.AvalonEdit.dll
    .dll 603KB
  • app-3.20.0/INIFileParser.dll
    .dll 28KB
  • app-3.20.0/LetsGoogleAnalytics.dll
    .dll 7.6MB
  • app-3.20.0/LetsGoogleAnalytics.exe
    .exe 123KB
  • app-3.20.0/LetsPRO.exe
    .exe 1.8MB
  • app-3.20.0/LetsPRO.exe.config
    .xml 26KB
  • app-3.20.0/LetsVPNDomainModel.dll
    .dll 24KB
  • app-3.20.0/LetsVPNInfraStructure.dll
    .dll 33KB
  • app-3.20.0/MdXaml.dll
    .dll 109KB
  • app-3.20.0/Microsoft.Bcl.AsyncInterfaces.dll
    .dll 21KB
  • app-3.20.0/Microsoft.Expression.Interactions.dll
    .dll 89KB
  • app-3.20.0/Microsoft.Toolkit.Uwp.Notifications.dll
    .dll 158KB
  • app-3.20.0/Microsoft.Web.WebView2.Core.dll
    .dll 634KB
  • app-3.20.0/Microsoft.Web.WebView2.WinForms.dll
    .dll 37KB
  • app-3.20.0/Microsoft.Web.WebView2.Wpf.dll
    .dll 81KB
  • app-3.20.0/Microsoft.Win32.Primitives.dll
    .dll 20KB
  • app-3.20.0/Microsoft.Win32.Registry.AccessControl.dll
    .dll 19KB
  • app-3.20.0/Microsoft.Win32.Registry.dll
    .dll 25KB
  • app-3.20.0/Microsoft.Win32.SystemEvents.dll
    .dll 22KB
  • app-3.20.0/Mono.Cecil.Mdb.dll
    .dll 42KB
  • app-3.20.0/Mono.Cecil.Pdb.dll
    .dll 87KB
  • app-3.20.0/Mono.Cecil.Rocks.dll
    .dll 27KB
  • app-3.20.0/Mono.Cecil.dll
    .dll 337KB
  • app-3.20.0/Newtonsoft.Json.dll
    .dll 695KB
  • app-3.20.0/NuGet.Squirrel.dll
    .dll 498KB
  • app-3.20.0/PusherClient.dll
    .dll 41KB
  • app-3.20.0/SQLite-net.dll
    .dll 91KB
  • app-3.20.0/SQLiteNetExtensions.dll
    .dll 36KB
  • app-3.20.0/SQLiteNetExtensionsAsync.dll
    .dll 13KB
  • app-3.20.0/SQLitePCLRaw.batteries_v2.dll
    .dll 11KB
  • app-3.20.0/SQLitePCLRaw.core.dll
    .dll 50KB
  • app-3.20.0/SQLitePCLRaw.nativelibrary.dll
    .dll 9KB
  • app-3.20.0/SQLitePCLRaw.provider.dynamic_cdecl.dll
    .dll 64KB
  • app-3.20.0/SVGImage.dll
    .dll 96KB
  • app-3.20.0/Sentry.dll
    .dll 679KB
  • app-3.20.0/SharpCompress.dll
    .dll 443KB
  • app-3.20.0/Squirrel.dll
    .dll 274KB
  • app-3.20.0/SuperSocket.ClientEngine.dll
    .dll 41KB
  • app-3.20.0/System.AppContext.dll
    .dll 20KB
  • app-3.20.0/System.Buffers.dll
    .dll 20KB
  • app-3.20.0/System.CodeDom.dll
    .dll 27KB
  • app-3.20.0/System.Collections.Concurrent.dll
    .dll 20KB
  • app-3.20.0/System.Collections.Immutable.dll
    .dll 184KB
  • app-3.20.0/System.Collections.NonGeneric.dll
    .dll 20KB
  • app-3.20.0/System.Collections.Specialized.dll
    .dll 20KB
  • app-3.20.0/System.Collections.dll
    .dll 21KB
  • app-3.20.0/System.ComponentModel.Annotations.dll
    .dll 42KB
  • app-3.20.0/System.ComponentModel.EventBasedAsync.dll
    .dll 21KB
  • app-3.20.0/System.ComponentModel.Primitives.dll
    .dll 21KB
  • app-3.20.0/System.ComponentModel.TypeConverter.dll
    .dll 22KB
  • app-3.20.0/System.ComponentModel.dll
    .dll 20KB
  • app-3.20.0/System.Configuration.ConfigurationManager.dll
    .dll 84KB
  • app-3.20.0/System.Console.dll
    .dll 20KB
  • app-3.20.0/System.Data.Common.dll
    .dll 150KB
  • app-3.20.0/System.Data.Odbc.dll
    .dll 79KB
  • app-3.20.0/System.Data.OleDb.dll
    .dll 96KB
  • app-3.20.0/System.Data.SqlClient.dll
    .dll 217KB
  • app-3.20.0/System.Diagnostics.Contracts.dll
    .dll 21KB
  • app-3.20.0/System.Diagnostics.Debug.dll
    .dll 20KB
  • app-3.20.0/System.Diagnostics.EventLog.dll
    .dll 31KB
  • app-3.20.0/System.Diagnostics.FileVersionInfo.dll
    .dll 20KB
  • app-3.20.0/System.Diagnostics.PerformanceCounter.dll
    .dll 39KB
  • app-3.20.0/System.Diagnostics.Process.dll
    .dll 21KB
  • app-3.20.0/System.Diagnostics.StackTrace.dll
    .dll 23KB
  • app-3.20.0/System.Diagnostics.TextWriterTraceListener.dll
    .dll 20KB
  • app-3.20.0/System.Diagnostics.Tools.dll
    .dll 20KB
  • app-3.20.0/System.Diagnostics.TraceSource.dll
    .dll 21KB
  • app-3.20.0/System.Diagnostics.Tracing.dll
    .dll 30KB
  • app-3.20.0/System.Drawing.Common.dll
    .dll 52KB
  • app-3.20.0/System.Drawing.Primitives.dll
    .dll 20KB
  • app-3.20.0/System.Dynamic.Runtime.dll
    .dll 21KB
  • app-3.20.0/System.Globalization.Calendars.dll
    .dll 21KB
  • app-3.20.0/System.Globalization.Extensions.dll
    .dll 25KB
  • app-3.20.0/System.Globalization.dll
    .dll 20KB
  • app-3.20.0/System.IO.Compression.ZipFile.dll
    .dll 20KB
  • app-3.20.0/System.IO.Compression.dll
    .dll 108KB
  • app-3.20.0/System.IO.FileSystem.AccessControl.dll
    .dll 27KB
  • app-3.20.0/System.IO.FileSystem.DriveInfo.dll
    .dll 20KB
  • app-3.20.0/System.IO.FileSystem.Primitives.dll
    .dll 20KB
  • app-3.20.0/System.IO.FileSystem.Watcher.dll
    .dll 20KB
  • app-3.20.0/System.IO.FileSystem.dll
    .dll 20KB
  • app-3.20.0/System.IO.IsolatedStorage.dll
    .dll 20KB
  • app-3.20.0/System.IO.MemoryMappedFiles.dll
    .dll 20KB
  • app-3.20.0/System.IO.Packaging.dll
    .dll 45KB
  • app-3.20.0/System.IO.Pipes.AccessControl.dll
    .dll 25KB
  • app-3.20.0/System.IO.Pipes.dll
    .dll 20KB
  • app-3.20.0/System.IO.Ports.dll
    .dll 32KB
  • app-3.20.0/System.IO.UnmanagedMemoryStream.dll
    .dll 20KB
  • app-3.20.0/System.IO.dll
    .dll 20KB
  • app-3.20.0/System.Linq.Expressions.dll
    .dll 21KB
  • app-3.20.0/System.Linq.Parallel.dll
    .dll 20KB
  • app-3.20.0/System.Linq.Queryable.dll
    .dll 20KB
  • app-3.20.0/System.Linq.dll
    .dll 20KB
  • app-3.20.0/System.Management.Automation.dll
    .dll 346KB
  • app-3.20.0/System.Memory.dll
    .dll 138KB
  • app-3.20.0/System.Net.Http.dll
    .dll 193KB
  • app-3.20.0/System.Net.IPNetwork.dll
    .dll 26KB
  • app-3.20.0/System.Net.NameResolution.dll
    .dll 20KB
  • app-3.20.0/System.Net.NetworkInformation.dll
    .dll 21KB
  • app-3.20.0/System.Net.Ping.dll
    .dll 20KB
  • app-3.20.0/System.Net.Primitives.dll
    .dll 21KB
  • app-3.20.0/System.Net.Requests.dll
    .dll 20KB
  • app-3.20.0/System.Net.Security.dll
    .dll 21KB
  • app-3.20.0/System.Net.Sockets.dll
    .dll 29KB
  • app-3.20.0/System.Net.WebHeaderCollection.dll
    .dll 20KB
  • app-3.20.0/System.Net.WebSockets.Client.dll
    .dll 20KB
  • app-3.20.0/System.Net.WebSockets.dll
    .dll 20KB
  • app-3.20.0/System.Numerics.Vectors.dll
    .dll 113KB
  • app-3.20.0/System.ObjectModel.dll
    .dll 21KB
  • app-3.20.0/System.Reflection.Extensions.dll
    .dll 20KB
  • app-3.20.0/System.Reflection.Metadata.dll
    .dll 451KB
  • app-3.20.0/System.Reflection.Primitives.dll
    .dll 21KB
  • app-3.20.0/System.Reflection.dll
    .dll 21KB
  • app-3.20.0/System.Resources.Reader.dll
    .dll 20KB
  • app-3.20.0/System.Resources.ResourceManager.dll
    .dll 20KB
  • app-3.20.0/System.Resources.Writer.dll
    .dll 20KB
  • app-3.20.0/System.Runtime.CompilerServices.Unsafe.dll
    .dll 17KB
  • app-3.20.0/System.Runtime.CompilerServices.VisualC.dll
    .dll 21KB
  • app-3.20.0/System.Runtime.Extensions.dll
    .dll 21KB
  • app-3.20.0/System.Runtime.Handles.dll
    .dll 20KB
  • app-3.20.0/System.Runtime.InteropServices.RuntimeInformation.dll
    .dll 27KB
  • app-3.20.0/System.Runtime.InteropServices.dll
    .dll 23KB
  • app-3.20.0/System.Runtime.Numerics.dll
    .dll 20KB
  • app-3.20.0/System.Runtime.Serialization.Formatters.dll
    .dll 20KB
  • app-3.20.0/System.Runtime.Serialization.Json.dll
    .dll 20KB
  • app-3.20.0/System.Runtime.Serialization.Primitives.dll
    .dll 26KB
  • app-3.20.0/System.Runtime.Serialization.Xml.dll
    .dll 24KB
  • app-3.20.0/System.Runtime.dll
    .dll 28KB
  • app-3.20.0/System.Security.AccessControl.dll
    .dll 35KB
  • app-3.20.0/System.Security.Claims.dll
    .dll 20KB
  • app-3.20.0/System.Security.Cryptography.Algorithms.dll
    .dll 45KB
  • app-3.20.0/System.Security.Cryptography.Cng.dll
    .dll 18KB
  • app-3.20.0/System.Security.Cryptography.Csp.dll
    .dll 20KB
  • app-3.20.0/System.Security.Cryptography.Encoding.dll
    .dll 20KB
  • app-3.20.0/System.Security.Cryptography.Pkcs.dll
    .dll 19KB
  • app-3.20.0/System.Security.Cryptography.Primitives.dll
    .dll 21KB
  • app-3.20.0/System.Security.Cryptography.ProtectedData.dll
    .dll 18KB
  • app-3.20.0/System.Security.Cryptography.X509Certificates.dll
    .dll 22KB
  • app-3.20.0/System.Security.Cryptography.Xml.dll
    .dll 48KB
  • app-3.20.0/System.Security.Permissions.dll
    .dll 27KB
  • app-3.20.0/System.Security.Principal.Windows.dll
    .dll 17KB
  • app-3.20.0/System.Security.Principal.dll
    .dll 20KB
  • app-3.20.0/System.Security.SecureString.dll
    .dll 21KB
  • app-3.20.0/System.ServiceModel.Duplex.dll
    .dll 13KB
  • app-3.20.0/System.ServiceModel.Http.dll
    .dll 14KB
  • app-3.20.0/System.ServiceModel.NetTcp.dll
    .dll 14KB
  • app-3.20.0/System.ServiceModel.Primitives.dll
    .dll 20KB
  • app-3.20.0/System.ServiceModel.Security.dll
    .dll 14KB
  • app-3.20.0/System.ServiceModel.Syndication.dll
    .dll 17KB
  • app-3.20.0/System.ServiceProcess.ServiceController.dll
    .dll 19KB
  • app-3.20.0/System.Text.Encoding.CodePages.dll
    .dll 744KB
  • app-3.20.0/System.Text.Encoding.Extensions.dll
    .dll 20KB
  • app-3.20.0/System.Text.Encoding.dll
    .dll 21KB
  • app-3.20.0/System.Text.Encodings.Web.dll
    .dll 75KB
  • app-3.20.0/System.Text.Json.dll
    .dll 503KB
  • app-3.20.0/System.Text.RegularExpressions.dll
    .dll 20KB
  • app-3.20.0/System.Threading.AccessControl.dll
    .dll 29KB
  • app-3.20.0/System.Threading.Overlapped.dll
    .dll 36KB
  • app-3.20.0/System.Threading.Tasks.Extensions.dll
    .dll 25KB
  • app-3.20.0/System.Threading.Tasks.Parallel.dll
    .dll 20KB
  • app-3.20.0/System.Threading.Tasks.dll
    .dll 21KB
  • app-3.20.0/System.Threading.Thread.dll
    .dll 20KB
  • app-3.20.0/System.Threading.ThreadPool.dll
    .dll 20KB
  • app-3.20.0/System.Threading.Timer.dll
    .dll 20KB
  • app-3.20.0/System.Threading.dll
    .dll 21KB
  • app-3.20.0/System.ValueTuple.dll
    .dll 77KB
  • app-3.20.0/System.Web.Services.Description.dll
    .dll 15KB
  • app-3.20.0/System.Windows.Interactivity.dll
    .dll 39KB
  • app-3.20.0/System.Xml.ReaderWriter.dll
    .dll 21KB
  • app-3.20.0/System.Xml.XDocument.dll
    .dll 21KB
  • app-3.20.0/System.Xml.XPath.XDocument.dll
    .dll 22KB
  • app-3.20.0/System.Xml.XPath.dll
    .dll 20KB
  • app-3.20.0/System.Xml.XmlDocument.dll
    .dll 21KB
  • app-3.20.0/System.Xml.XmlSerializer.dll
    .dll 21KB
  • app-3.20.0/ToastNotifications.Messages.dll
    .dll 88KB
  • app-3.20.0/ToastNotifications.dll
    .dll 107KB
  • app-3.20.0/Utils.dll
    .dll 135KB
  • app-3.20.0/View/Assets/notification_icon.png
    .png 11KB
  • app-3.20.0/WebSocket4Net.dll
    .dll 60KB
  • app-3.20.0/WpfAnimatedGif.dll
    .dll 41KB
  • app-3.20.0/cs/System.Web.Services.Description.resources.dll
    .dll 17KB
  • app-3.20.0/de/System.Web.Services.Description.resources.dll
    .dll 17KB
  • app-3.20.0/es/System.Web.Services.Description.resources.dll
    .dll 17KB
  • app-3.20.0/fr/System.Web.Services.Description.resources.dll
    .dll 17KB
  • app-3.20.0/it/System.Web.Services.Description.resources.dll
    .dll 17KB
  • app-3.20.0/ja/System.Web.Services.Description.resources.dll
    .dll 18KB
  • app-3.20.0/ko/System.Web.Services.Description.resources.dll
    .dll 18KB
  • app-3.20.0/libwin.dll
    .dll 13.3MB
  • app-3.20.0/log4net.config
    1KB
  • app-3.20.0/log4net.dll
    .dll 264KB
  • app-3.20.0/microsoft.identitymodel.dll
    .dll 1.1MB
  • app-3.20.0/netstandard.dll
    .dll 96KB
  • app-3.20.0/pl/System.Web.Services.Description.resources.dll
    .dll 17KB
  • app-3.20.0/pt-BR/System.Web.Services.Description.resources.dll
    .dll 17KB
  • app-3.20.0/ru/LetsPRO.resources.dll
    .dll 89KB
  • app-3.20.0/ru/System.Web.Services.Description.resources.dll
    .dll 19KB
  • app-3.20.0/runtimes/win-arm/native/e_sqlite3.dll
    .dll 1.2MB
  • app-3.20.0/runtimes/win-arm64/native/WebView2Loader.dll
    143KB
  • app-3.20.0/runtimes/win-x64/native/WebView2Loader.dll
    .dll 155KB
  • app-3.20.0/runtimes/win-x64/native/e_sqlite3.dll
    .dll 1.7MB
  • app-3.20.0/runtimes/win-x86/native/WebView2Loader.dll
    .dll 117KB
  • app-3.20.0/runtimes/win-x86/native/e_sqlite3.dll
    .dll 1.4MB
  • app-3.20.0/tr/System.Web.Services.Description.resources.dll
    .dll 17KB
  • app-3.20.0/wintun.dll
    .dll 538KB
  • app-3.20.0/zh-CN/LetsPRO.resources.dll
    .dll 69KB
  • app-3.20.0/zh-HK/LetsPRO.resources.dll
    .dll 69KB
  • app-3.20.0/zh-Hans/System.Web.Services.Description.resources.dll
    .dll 17KB
  • app-3.20.0/zh-Hant/System.Web.Services.Description.resources.dll
    .dll 17KB
  • app-3.20.0/zh-MO/LetsPRO.resources.dll
    .dll 69KB
  • app-3.20.0/zh-SG/LetsPRO.resources.dll
    .dll 69KB
  • app-3.20.0/zh-TW/LetsPRO.resources.dll
    .dll 69KB
  • cef_frame.dll
    .dll 11.1MB
  • driver/OemVista.inf
    7KB
  • driver/tap0901.cat
    10KB
  • driver/tap0901.sys
    .sys 38KB
  • driver/tapinstall.exe
    .exe 99KB
  • libcrypto.dll
    .dll 3.4MB
  • msvcp100.dll
    .dll 412KB
  • msvcp140.dll
    .dll 429KB
  • msvcr100.dll
    .dll 756KB
  • ndp462-web.exe
    .exe 1.4MB
  • uninst.exe
    .exe 98KB
  • $PLUGINSDIR/modern-header.bmp
    9KB
  • $PLUGINSDIR/nsExec.dll
    .dll 7KB
  • $PLUGINSDIR/nsProcess.dll
    .dll 4KB
  • vcruntime140.dll
    .dll 83KB

LetsVPN.exe

  • IMPHASH f4d1e4cd7416ef83f79f7c6a038875b3
  • SHA256 26c54b1a0cb5d8636966e6f27505035b2521c7733ee8827b21a9a76f934665e7
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
4
Entry point
17792
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED
PDB paths