ClearDesktopMonitorHook
ReleaseFromExplorer
SetDesktopMonitorHook
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
/active_desktop_render_x64.dll
Resource
win7-20230712-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
/active_desktop_render_x64.dll
Resource
win10v2004-20230703-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
/ffmpeg.dll
Resource
win7-20230712-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
/ffmpeg.dll
Resource
win10v2004-20230703-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
/ƹרԱ- -ϴѧ.exe
Resource
win7-20230712-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
/ƹרԱ- -ϴѧ.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
简历.zip
-
Size
168KB
-
MD5
f1c56cc405029826cf7a21a1394bf18e
-
SHA1
1b9080ac30d6fc8963457e90aa9d5e56bb7eace0
-
SHA256
4e7a06b20666a62613cca9f75ae58a35cfc5d721c05c8b435170a4e8024ba87e
-
SHA512
31597e85de1b58bfadc88f2b79bc0f7dcaa79d8d63cdb4517cb35f7d99df643ab34b096931af44029e3c16c5ed6a183437009a4dc144c65cbf15034c7c6caa53
-
SSDEEP
3072:v0qEgiHe4UvUmvUVCn/CudT8opk05O/q9hLLePw/95HMxlvFiqbM9PjX:nQewOv/DqoXQ/q9hvX15HMxl08OjX
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001//active_desktop_render_x64.dll
Files
-
简历.zip.zip
-
/active_desktop_render_x64.dll.dll windows x64
9f4024940c96838dbdd86ea9ba16ef8c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateProcessA
VirtualAllocEx
WriteProcessMemory
QueueUserAPC
ResumeThread
GetProcAddress
ExitProcess
lstrcpyW
LoadLibraryW
FreeLibrary
DisableThreadLibraryCalls
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
user32
MessageBoxW
wsprintfW
wsprintfA
vcruntime140
__std_type_info_destroy_list
__C_specific_handler
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initialize_onexit_table
_seh_filter_dll
_initialize_narrow_environment
_cexit
_execute_onexit_table
_initterm
_configure_narrow_argv
Exports
Exports
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 492B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
/ffmpeg.dll.dll windows x64
d6d47dcf5d08b8857f1394ed003fe1b8
Code Sign
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before22-10-2013 12:00Not After22-10-2028 12:00SubjectCN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0d:4d:d6:2a:88:46:e5:85:e1:c5:eb:61:ad:a0:3e:bdCertificate
IssuerCN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before19-01-2021 00:00Not After23-01-2024 23:59SubjectCN=GuangZhou KuGou Computer Technology Co.\,Ltd.,O=GuangZhou KuGou Computer Technology Co.\,Ltd.,L=Guangzhou,ST=Guangdong Province,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01-08-2022 00:00Not After09-11-2031 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23-03-2022 00:00Not After22-03-2037 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
03:cb:34:fd:3d:ff:12:11:33:9f:f0:7c:4b:21:57:c7Certificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before30-08-2022 00:00Not After29-08-2023 23:59SubjectCN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before22-10-2013 12:00Not After22-10-2028 12:00SubjectCN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0d:4d:d6:2a:88:46:e5:85:e1:c5:eb:61:ad:a0:3e:bdCertificate
IssuerCN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before19-01-2021 00:00Not After23-01-2024 23:59SubjectCN=GuangZhou KuGou Computer Technology Co.\,Ltd.,O=GuangZhou KuGou Computer Technology Co.\,Ltd.,L=Guangzhou,ST=Guangdong Province,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
03:cb:34:fd:3d:ff:12:11:33:9f:f0:7c:4b:21:57:c7Certificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before30-08-2022 00:00Not After29-08-2023 23:59SubjectCN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23-03-2022 00:00Not After22-03-2037 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01-08-2022 00:00Not After09-11-2031 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
e4:3b:0a:88:3e:e9:6d:c5:e6:1d:4d:55:f9:c8:d2:86:63:2e:3d:49:2a:d3:bd:a8:bd:98:bf:63:ce:49:76:49Signer
Actual PE Digeste4:3b:0a:88:3e:e9:6d:c5:e6:1d:4d:55:f9:c8:d2:86:63:2e:3d:49:2a:d3:bd:a8:bd:98:bf:63:ce:49:76:49Digest Algorithmsha256PE Digest Matchestrue2c:5a:45:6f:ad:2b:b6:c5:27:f2:ab:bc:cc:22:18:31:df:f5:70:faSigner
Actual PE Digest2c:5a:45:6f:ad:2b:b6:c5:27:f2:ab:bc:cc:22:18:31:df:f5:70:faDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateThread
GetModuleHandleW
GetTickCount
GetProcAddress
CreateFileW
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
OutputDebugStringW
HeapReAlloc
LoadLibraryExW
FreeLibrary
SetConsoleCtrlHandler
CloseHandle
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetStringTypeW
FatalAppExitA
LeaveCriticalSection
EnterCriticalSection
CreateSemaphoreW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
ResetEvent
FreeLibraryAndExitThread
GetModuleFileNameW
Sleep
LoadLibraryW
SetEvent
WriteFile
WaitForSingleObject
CreateMutexW
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
GetLastError
CreateFileMappingW
OpenFileMappingW
DuplicateHandle
ReleaseMutex
EncodePointer
DecodePointer
GetCommandLineA
GetCurrentThreadId
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThread
MultiByteToWideChar
HeapFree
HeapAlloc
ExitProcess
GetModuleHandleExW
AreFileApisANSI
WideCharToMultiByte
HeapSize
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
user32
ClientToScreen
SetCursor
ScreenToClient
GetMessageW
FillRect
GetParent
LoadCursorW
GetClientRect
PtInRect
TranslateMessage
OffsetRect
IntersectRect
SystemParametersInfoW
GetCursorPos
ShowWindow
IsWindow
IsWindowVisible
SendMessageW
IsRectEmpty
DispatchMessageW
InvalidateRect
FindWindowExW
SetWindowLongPtrW
CallWindowProcW
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
GetWindowThreadProcessId
PostMessageW
FindWindowW
RegisterWindowMessageW
gdi32
DeleteDC
CreateDIBSection
DeleteObject
SelectObject
CreateCompatibleDC
GetObjectW
GetStockObject
BitBlt
Exports
Exports
ClearDesktopMonitorHook
ReleaseFromExplorer
SetDesktopMonitorHook
Sections
.text Size: 157KB - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ZS Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
/ƹרԱ- -ϴѧ .exe.exe windows x64
1ad7d70d7b6c16d05f66818c394cb860
Code Sign
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before22-10-2013 12:00Not After22-10-2028 12:00SubjectCN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0d:4d:d6:2a:88:46:e5:85:e1:c5:eb:61:ad:a0:3e:bdCertificate
IssuerCN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before19-01-2021 00:00Not After23-01-2024 23:59SubjectCN=GuangZhou KuGou Computer Technology Co.\,Ltd.,O=GuangZhou KuGou Computer Technology Co.\,Ltd.,L=Guangzhou,ST=Guangdong Province,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01-08-2022 00:00Not After09-11-2031 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23-03-2022 00:00Not After22-03-2037 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
03:cb:34:fd:3d:ff:12:11:33:9f:f0:7c:4b:21:57:c7Certificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before30-08-2022 00:00Not After29-08-2023 23:59SubjectCN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before22-10-2013 12:00Not After22-10-2028 12:00SubjectCN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0d:4d:d6:2a:88:46:e5:85:e1:c5:eb:61:ad:a0:3e:bdCertificate
IssuerCN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before19-01-2021 00:00Not After23-01-2024 23:59SubjectCN=GuangZhou KuGou Computer Technology Co.\,Ltd.,O=GuangZhou KuGou Computer Technology Co.\,Ltd.,L=Guangzhou,ST=Guangdong Province,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
03:cb:34:fd:3d:ff:12:11:33:9f:f0:7c:4b:21:57:c7Certificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before30-08-2022 00:00Not After29-08-2023 23:59SubjectCN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23-03-2022 00:00Not After22-03-2037 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01-08-2022 00:00Not After09-11-2031 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
f1:af:a3:c1:c3:e3:b6:bf:2f:63:6c:e3:bd:09:4a:0b:0a:e8:d7:01:68:b5:13:78:c9:00:e8:aa:bf:3a:e4:ecSigner
Actual PE Digestf1:af:a3:c1:c3:e3:b6:bf:2f:63:6c:e3:bd:09:4a:0b:0a:e8:d7:01:68:b5:13:78:c9:00:e8:aa:bf:3a:e4:ecDigest Algorithmsha256PE Digest Matchestrueb9:ee:ae:5d:e0:4e:08:6c:99:90:07:9b:10:ec:ef:40:bb:ac:16:9eSigner
Actual PE Digestb9:ee:ae:5d:e0:4e:08:6c:99:90:07:9b:10:ec:ef:40:bb:ac:16:9eDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
active_desktop_render_x64
SetDesktopMonitorHook
ClearDesktopMonitorHook
kernel32
TlsAlloc
CreateFileW
CloseHandle
GetCommandLineW
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
SetLastError
GetCurrentThreadId
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
HeapFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
OutputDebugStringW
HeapAlloc
HeapReAlloc
GetStringTypeW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ