Static task
static1
Behavioral task
behavioral1
Sample
67ed14b6d9953e6da4f4164ee5567b476f45481ab849ca417b4ec0765ea9e086.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
67ed14b6d9953e6da4f4164ee5567b476f45481ab849ca417b4ec0765ea9e086.exe
Resource
win10v2004-20220812-en
General
-
Target
67ed14b6d9953e6da4f4164ee5567b476f45481ab849ca417b4ec0765ea9e086
-
Size
4.0MB
-
MD5
3724c872c0758285e1314739f2188173
-
SHA1
4e109c99c875bd56d7b611fd0e9cc2617a8e633f
-
SHA256
67ed14b6d9953e6da4f4164ee5567b476f45481ab849ca417b4ec0765ea9e086
-
SHA512
c543e5ab15646df60a08249827c8544f1b1e0263e813f294addd5e82bcbe0a4988c4ca9710591469d4bb5c8190cc6692c2f9ca8ee21aaf39886871c89aaa298c
-
SSDEEP
24576:Nl8urK2QvJGmgKUBWAw5zwu3i4xAdRFfVnyr40mlyRx7t4VL7et:N9QvJx7AowyiR7QRxk7
Malware Config
Signatures
Files
-
67ed14b6d9953e6da4f4164ee5567b476f45481ab849ca417b4ec0765ea9e086.exe windows x86
544d9d8e4e0c31428a3d7999295dbbf5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyW
RegQueryValueExA
RegOpenCurrentUser
RegQueryValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExA
kernel32
SetFilePointerEx
GetDiskFreeSpaceExW
GetFullPathNameW
GetFileTime
GetFileSizeEx
GetLogicalDrives
TerminateThread
ResumeThread
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetEndOfFile
WriteFile
GetTimeZoneInformation
SystemTimeToFileTime
OutputDebugStringA
SetFileTime
DeleteFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
WaitForSingleObject
GetVolumeInformationW
lstrcpynW
GetTickCount
GetCurrentProcess
VirtualQuery
VirtualProtect
LoadLibraryA
CreateFileW
DeviceIoControl
WideCharToMultiByte
GetVersionExW
FormatMessageW
GetLongPathNameW
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
FindActCtxSectionGuid
lstrcatW
GetWindowsDirectoryW
lstrcmpiW
lstrcpyW
GetEnvironmentVariableW
IsBadReadPtr
GetModuleFileNameA
LocalFree
GetLocaleInfoW
GetSystemDefaultLangID
CloseHandle
GetDriveTypeW
lstrlenW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FindResourceW
SizeofResource
LoadResource
LockResource
GlobalAlloc
GlobalLock
GlobalUnlock
GetModuleFileNameW
SetLastError
LoadLibraryW
GetLastError
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GlobalFree
FreeLibrary
lstrlenA
WinExec
GetModuleHandleA
MultiByteToWideChar
FindClose
FindNextFileW
FindFirstFileW
gdi32
TextOutW
SelectObject
GetTextExtentPointW
SetTextJustification
CreateDIBSection
SetDIBitsToDevice
SetPixelV
GetPixel
GetStockObject
SelectPalette
CreateDIBitmap
CreatePalette
RealizePalette
SetViewportOrgEx
GetTextColor
GetBkColor
CreateSolidBrush
ExtTextOutW
CreateCompatibleBitmap
StretchBlt
BitBlt
CreateCompatibleDC
GetDeviceCaps
GetTextExtentPoint32W
GetObjectW
CreateFontIndirectW
user32
CopyIcon
MessageBeep
GetCapture
GetWindow
GetMenu
GetClassNameW
GetWindowLongW
IsMenu
SetWindowLongW
GetWindowRect
GetMenuItemCount
GetMenuItemID
GetSubMenu
ModifyMenuW
GetWindowTextW
IsDialogMessageW
IsWindowEnabled
SetWindowTextW
MessageBoxW
GetClientRect
LoadIconW
LoadImageW
EnableWindow
GetSystemMetrics
SetWindowPos
GetDlgItem
IsWindowVisible
DestroyCursor
KillTimer
GetSysColorBrush
GetDlgCtrlID
GetDC
ReleaseDC
InvalidateRect
RedrawWindow
DestroyIcon
GetSysColor
IsWindow
PtInRect
ScreenToClient
GetCursorPos
SendMessageW
AppendMenuW
CreatePopupMenu
DrawIcon
LoadAcceleratorsW
PostMessageW
TranslateAcceleratorW
SetCursor
LoadCursorW
SetActiveWindow
SetRectEmpty
DrawStateW
SetForegroundWindow
GetDesktopWindow
ClientToScreen
SystemParametersInfoW
IsIconic
ReleaseCapture
DestroyWindow
SetCapture
OffsetRect
DrawIconEx
LockWindowUpdate
GetKeyState
MapDialogRect
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
SetTimer
WindowFromPoint
GetNextDlgTabItem
GetFocus
DrawFrameControl
UpdateWindow
FillRect
CopyRect
IsRectEmpty
InflateRect
DrawEdge
DrawFocusRect
ShowScrollBar
GetParent
SetParent
msvcp80
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?_Xlen@_String_base@std@@SAXXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@_W@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?rend@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$reverse_iterator@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@XZ
?rbegin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$reverse_iterator@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IABV12@@Z
?_Init@locale@std@@CAPAV_Locimp@12@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_W@Z
?push_back@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEX_W@Z
??1locale@std@@QAE@XZ
?is@?$ctype@_W@std@@QBE_NF_W@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
??0_Lockit@std@@QAE@H@Z
?id@?$ctype@_W@std@@2V0locale@2@A
??1_Lockit@std@@QAE@XZ
?_Id_cnt@id@locale@std@@0HA
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@@Z
?_Incref@facet@locale@std@@QAEXXZ
?facet_Register@facet@locale@std@@CAXPAV123@@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?_Xran@_String_base@std@@SAXXZ
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IPB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
msvcr80
_strupr_s
??3@YAXPAX@Z
free
calloc
_recalloc
__CxxFrameHandler3
??2@YAPAXI@Z
memcpy
memcpy_s
malloc
memset
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??_V@YAXPAX@Z
_wcsicmp
_stricmp
_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
_mktime64
_localtime64_s
towupper
wcsftime
_wcsdup
_time64
_purecall
toupper
_amsg_exit
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
?terminate@@YAXXZ
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
strchr
isalnum
isalpha
isspace
sscanf_s
fprintf
ftell
_wassert
wcscmp
strlen
_wstat64i32
_wfindfirst64
_findclose
strncpy_s
strcmp
_vsnprintf_s
strcat_s
_snwprintf_s
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
tolower
memmove_s
wcschr
wcstoul
fseek
strncmp
_wtoi
wcsncpy_s
fopen_s
fread
wcsstr
_wmakepath_s
_wsplitpath_s
wcsrchr
_CIexp
fclose
mfc80u
ord3080
ord753
ord563
ord1156
ord1970
ord3331
ord4101
ord2317
ord1086
ord2321
ord4026
ord3645
ord5053
ord5867
ord2860
ord3483
ord5862
ord760
ord3590
ord6279
ord1386
ord4112
ord290
ord1416
ord5640
ord355
ord1920
ord777
ord3280
ord2066
ord3395
ord4347
ord3946
ord1921
ord3417
ord566
ord2239
ord2984
ord757
ord300
ord578
ord2009
ord1047
ord3586
ord372
ord5414
ord5558
ord287
ord1198
ord6044
ord4388
ord1006
ord6251
ord1720
ord1182
ord1178
ord577
ord870
ord2460
ord293
ord746
ord283
ord558
ord6201
ord747
ord559
ord3168
ord1479
ord2895
ord282
ord6700
ord1472
ord2340
ord1176
ord3249
ord1172
ord5316
ord1571
ord6282
ord5327
ord6293
ord2261
ord774
ord4100
ord5524
ord1906
ord2260
ord776
ord4038
ord548
ord4255
ord4475
ord3943
ord2638
ord3703
ord3713
ord3712
ord2527
ord2640
ord2534
ord2832
ord2708
ord4301
ord2829
ord2725
ord2531
ord5562
ord5226
ord4562
ord3942
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord5096
ord1007
ord3800
ord5579
ord2054
ord4320
ord3795
ord6272
ord4008
ord4032
ord5209
ord1079
ord3677
ord2011
ord1117
ord1121
ord3824
ord6063
ord6111
ord3238
ord2085
ord4094
ord1946
ord1274
ord605
ord354
ord3176
ord4256
ord4480
ord2856
ord2365
ord1590
ord1646
ord1647
ord1955
ord5171
ord1353
ord4961
ord3339
ord6275
ord3796
ord6273
ord1513
ord2163
ord2169
ord2399
ord2381
ord2379
ord2397
ord2409
ord2386
ord2402
ord2407
ord2390
ord2392
ord2394
ord2388
ord2404
ord2384
ord931
ord927
ord929
ord925
ord920
ord5229
ord5231
ord5956
ord1591
ord4276
ord4716
ord3397
ord5199
ord4179
ord6271
ord5067
ord1899
ord5148
ord4238
ord1392
ord3940
ord1608
ord1611
ord5908
ord6720
ord1542
ord1661
ord1662
ord4884
ord5178
ord1785
ord4743
ord709
ord501
ord6140
ord2651
ord2159
ord6086
ord3990
ord2311
ord1118
ord280
ord5705
ord6061
ord5609
ord4574
ord2444
ord3927
ord3756
ord2858
ord3983
ord3635
ord3435
ord715
ord741
ord4729
ord5803
ord894
ord1252
ord5149
ord3204
ord1925
ord2362
ord3198
ord1271
ord4119
ord1894
ord572
ord3311
ord2985
ord5210
ord4234
ord1393
ord5911
ord6721
ord1582
ord2086
ord3286
ord1572
ord1634
ord2155
ord5727
ord4314
ord2648
ord2461
ord5398
ord2361
ord3158
ord4226
ord1536
ord2077
ord587
ord4228
ord2080
ord4092
ord1474
ord1922
ord1058
ord3166
ord1539
ord1627
ord592
ord2364
ord3390
ord6751
ord6749
ord2151
ord1555
ord416
ord2318
ord896
ord3872
ord5829
ord5434
ord865
ord4060
ord899
ord1002
ord2282
ord5426
ord2121
ord663
ord426
ord620
ord3189
ord2870
ord2490
ord4206
ord2366
ord6133
ord2656
ord6278
ord3224
ord2952
ord4232
ord2083
ord658
ord3873
ord3869
ord5869
ord5456
ord630
ord744
ord1443
ord2876
ord6306
ord5091
ord3050
ord556
ord2012
ord385
ord5484
ord1021
ord3841
ord281
ord3155
ord1270
ord5633
ord602
ord5884
ord347
ord6013
ord758
ord567
ord5638
ord5723
ord6033
ord860
ord5747
ord642
ord3208
ord1549
ord1628
ord2081
ord3157
ord3678
ord3581
ord754
ord651
ord2861
ord4882
ord1476
ord3877
ord5864
ord3985
ord3793
ord3344
ord2255
ord4558
ord5982
ord5618
ord3346
ord3342
ord5981
ord1957
ord4109
ord3674
ord2893
ord3424
ord5698
ord2421
ord3064
ord3547
ord3546
ord6001
ord5710
ord6002
ord5711
ord745
ord722
ord557
ord530
ord772
ord3842
ord1190
ord356
ord1091
ord5485
ord6116
ord5196
ord2932
gdiplus
GdipDrawImagePointRectI
GdipDrawImageRectI
GdipCloneBrush
GdipDisposeImage
GdipAlloc
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipBitmapGetPixel
GdipDrawString
GdipBitmapSetPixel
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCloneImage
GdiplusStartup
GdiplusShutdown
GdipDeleteBrush
GdipCreateStringFormat
GdipDeleteStringFormat
GdipDeleteGraphics
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipCreateBitmapFromScan0
GdipCreateSolidFill
GdipCreateFromHWND
GdipGetImageGraphicsContext
GdipFillRectangleI
GdipFree
ole32
CoInitialize
CLSIDFromString
CoCreateInstance
CoTaskMemFree
CoInitializeEx
CoUninitialize
CreateStreamOnHGlobal
oleaut32
SysStringLen
SysAllocStringLen
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
shell32
ShellExecuteW
SHGetFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHCreateDirectoryExW
comctl32
_TrackMouseEvent
ord17
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
psapi
EnumProcessModules
dbghelp
ImageDirectoryEntryToData
ImageNtHeader
Sections
.text Size: 392KB - Virtual size: 392KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 160KB - Virtual size: 420KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE