Static task
static1
Behavioral task
behavioral1
Sample
ef4f9158cd675550869df82d864c97a6f8984896dd7941366845aeb32588ef13.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ef4f9158cd675550869df82d864c97a6f8984896dd7941366845aeb32588ef13.exe
Resource
win10v2004-20220812-en
General
-
Target
ef4f9158cd675550869df82d864c97a6f8984896dd7941366845aeb32588ef13.exe
-
Size
7.9MB
-
MD5
d1d8f96f41a624bec2c0a55d874f8518
-
SHA1
072ec53de45cf1459d4625b01d1ed0ede8199253
-
SHA256
ef4f9158cd675550869df82d864c97a6f8984896dd7941366845aeb32588ef13
-
SHA512
95af9fd314afa0257605325b3ee11b4f1e0d19b40d97f3f6df2362d7da11c66af3a52f51b4881dd7e3a40899ce59465ff838bdd7f08c6a2d6db6744e71c43f44
-
SSDEEP
49152:IyTkZyH/xxHZiE/Qc/YmQd6ZhSOJV6yVucWTSJcHVSIL0Ni//Mpt3SKLAPVgbKWO:Pild6Pb7f/qXM3ih4w3D7nTsReRR9J
Malware Config
Signatures
Files
-
ef4f9158cd675550869df82d864c97a6f8984896dd7941366845aeb32588ef13.exe.exe windows x64
2de3919b2068ccb8c2f2d1e6a90601c0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
webservices
WsInitializeMessage
WsResetMessage
WsFreeMessage
WsSetHeader
WsAddMappedHeader
WsGetMappedHeader
WsGetMessageProperty
WsFreeReader
WsSetInput
WsCreateReader
WsCreateMessageForChannel
WsCreateError
WsMoveWriter
WsSetWriterPosition
WsGetWriterPosition
WsGetPrefixFromNamespace
WsWriteNode
WsWriteStartCData
WsWriteText
WsPushBytes
WsWriteCharsUtf8
WsWriteQualifiedName
WsWriteArray
WsWriteXmlBufferToBytes
WsWriteXmlBuffer
WsWriteXmlnsAttribute
WsWriteEndStartElement
WsMoveReader
WsSetReaderPosition
WsGetReaderPosition
WsReadArray
WsReadCharsUtf8
WsReadValue
WsSkipNode
WsReadNode
WsReadElement
WsFreeHeap
WsCreateHeap
WsGetErrorProperty
WsGetErrorString
WsReadToStartElement
WsWriteBytes
WsXmlStringEquals
WsWriteEndElement
WsPullBytes
WsWriteChars
WsWriteValue
WsWriteEndAttribute
WsWriteStartAttribute
WsWriteStartElement
WsCreateChannel
WsOpenChannel
WsGetChannelProperty
WsWriteMessageStart
WsWriteMessageEnd
WsReadMessageStart
WsReadMessageEnd
WsCloseChannel
WsAbortChannel
WsFreeChannel
WsResetChannel
WsAbandonMessage
WsFreeError
WsResetError
WsReadBytes
WsReadChars
WsFindAttribute
WsReadEndElement
WsReadEndAttribute
WsReadStartAttribute
WsReadStartElement
WsGetReaderNode
vcruntime140
strchr
__telemetry_main_return_trigger
memchr
__C_specific_handler
__vcrt_InitializeCriticalSectionEx
wcschr
wcsstr
__std_exception_destroy
__std_exception_copy
__CxxFrameHandler3
__std_terminate
wcsrchr
memmove
__telemetry_main_invoke_trigger
__std_type_info_compare
memset
memcpy
_CxxThrowException
memcmp
msvcp140
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
_Query_perf_frequency
_Query_perf_counter
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
_Thrd_sleep
_Xtime_get_ticks
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?_BADOFF@std@@3_JB
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAI@Z
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?widen@?$ctype@_W@std@@QEBA_WD@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPEBD@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
?setf@ios_base@std@@QEAAHH@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_IsNonBlockingThread@_Task_impl_base@details@Concurrency@@SA_NXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
_Cnd_broadcast
_Cnd_wait
_Cnd_destroy_in_situ
_Cnd_init_in_situ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?fail@ios_base@std@@QEBA_NXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
api-ms-win-crt-runtime-l1-1-0
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
__p___argc
_set_app_type
_seh_filter_exe
__p___wargv
_cexit
_register_thread_local_exe_atexit_callback
_clearfp
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_fpreset
terminate
_errno
_invalid_parameter_noinfo
_resetstkoflw
_c_exit
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
free
calloc
_aligned_free
_aligned_malloc
realloc
api-ms-win-crt-string-l1-1-0
strncpy_s
iswalpha
wcsnlen
wcscmp
strcpy_s
wcscpy_s
wcsncat_s
isdigit
wmemcpy_s
wcsncmp
_wcsicmp
towlower
_wcsnicmp
wcsncpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnprintf_s
_set_fmode
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
fputc
__stdio_common_vswprintf
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
__stdio_common_vsprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vswscanf
__stdio_common_vswprintf_s
__p__commode
api-ms-win-crt-convert-l1-1-0
strtol
_wtoi
_ui64tow_s
_i64tow_s
_wtof
wcstod
wcstol
wcstoul
_wcstoui64
_wtoi64
_wtol
wcstombs_s
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
_unlock_file
_lock_file
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-math-l1-1-0
logf
__setusermatherr
expf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
__initialize_lconv_for_unsigned_char
kernel32
VirtualQuery
InterlockedFlushSList
LocaleNameToLCID
LCIDToLocaleName
GetLocaleInfoW
GetFileAttributesW
GetTempFileNameW
ReplaceFileW
GetFileInformationByHandleEx
SetFileInformationByHandle
CopyFileW
GetFileType
GetFileSizeEx
CreateFileW
CancelIoEx
GetLongPathNameW
K32GetProcessMemoryInfo
GlobalMemoryStatusEx
CreateWaitableTimerW
CancelWaitableTimer
SetWaitableTimerEx
LocalAlloc
GlobalFree
GlobalAlloc
OpenFileMappingA
CreateFileMappingA
OpenSemaphoreA
CreateSemaphoreA
OpenMutexA
OpenEventA
LoadLibraryExA
CreateMutexA
GetSystemPowerStatus
IsSystemResumeAutomatic
CreateMemoryResourceNotification
SleepEx
WerUnregisterMemoryBlock
QueryFullProcessImageNameW
GetProcessAffinityMask
WaitForMultipleObjects
WaitForSingleObject
RtlCaptureStackBackTrace
InterlockedPopEntrySList
GetThreadIOPendingFlag
GetCurrentThread
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
LoadLibraryW
GetModuleHandleExW
CreateThread
OutputDebugStringA
CompareFileTime
GetVersionExW
GetStringTypeW
GetShortPathNameA
GetModuleFileNameA
FindResourceW
SizeofResource
LoadResource
GetUserDefaultLocaleName
IsValidCodePage
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
TryEnterCriticalSection
QueryDepthSList
CreateEventA
SetEndOfFile
CompareStringEx
EncodePointer
FormatMessageW
GetStringTypeExW
CompareStringOrdinal
GetTimeZoneInformation
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
LocalFree
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WerRegisterMemoryBlock
VirtualProtect
HeapSetInformation
InitOnceExecuteOnce
IsDebuggerPresent
RemoveDirectoryW
GetTempPathW
GetSystemInfo
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
GetCurrentProcessId
OpenMutexW
GetModuleFileNameW
GlobalFindAtomW
GlobalAddAtomW
CreateProcessW
GetCurrentProcess
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
CancelIo
GetOverlappedResult
WaitNamedPipeW
CreateNamedPipeW
SetNamedPipeHandleState
DisconnectNamedPipe
ConnectNamedPipe
RaiseException
DecodePointer
GetTickCount
GetComputerNameW
OpenProcess
Sleep
CopyFileExW
DeviceIoControl
GetVolumePathNamesForVolumeNameW
GetDriveTypeW
GetCurrentDirectoryW
UnlockFileEx
LockFileEx
LoadLibraryExW
GetModuleHandleW
WaitForMultipleObjectsEx
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
GetSystemTime
FileTimeToSystemTime
GetDiskFreeSpaceExW
OpenEventW
OutputDebugStringW
SystemTimeToFileTime
WideCharToMultiByte
GetLocalTime
GetProcAddress
FreeLibrary
InterlockedPushEntrySList
InitializeSListHead
CreateEventExW
GetSystemTimeAsFileTime
MoveFileExW
SetLastError
WriteFile
SetFilePointerEx
ReadFile
GetFileAttributesExW
FlushFileBuffers
FindNextFileW
FindFirstFileExW
FindClose
DeleteFileW
CreateDirectoryW
SetFileAttributesW
MultiByteToWideChar
CreateEventW
ResetEvent
SetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
CreateSemaphoreExW
CreateMutexExW
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
GetLastError
GetTickCount64
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
CloseHandle
ole32
StringFromIID
CoRevokeInitializeSpy
CoRegisterInitializeSpy
CoInitializeEx
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
IIDFromString
StringFromCLSID
CoSetProxyBlanket
CreateStreamOnHGlobal
CLSIDFromString
CoCreateGuid
StringFromGUID2
PropVariantClear
dnsapi
DnsFree
DnsCancelQuery
DnsQueryEx
iphlpapi
GetIfEntry2
CreateSortedAddressPairs
ConvertInterfaceGuidToLuid
FreeMibTable
propsys
InitPropVariantFromBuffer
PSCoerceToCanonicalValue
PSGetPropertyKeyFromName
ws2_32
FreeAddrInfoExW
GetAddrInfoExCancel
WSAStartup
WSACleanup
GetAddrInfoExOverlappedResult
GetAddrInfoExW
api-ms-win-crt-time-l1-1-0
_time64
Sections
.text Size: 4.8MB - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 268KB - Virtual size: 274KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 252KB - Virtual size: 251KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ