AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
92f95a1c99ef0f1257ee84e95add541017e01bcfdd2d5f9232dcca175242fd4f.exe
Resource
win7-20230831-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
92f95a1c99ef0f1257ee84e95add541017e01bcfdd2d5f9232dcca175242fd4f.exe
Resource
win10v2004-20230831-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
92f95a1c99ef0f1257ee84e95add541017e01bcfdd2d5f9232dcca175242fd4f
-
Size
6.5MB
-
MD5
94fec6113f35bed9e45cde0637ecadbe
-
SHA1
9eca98e2ca23b161c3c01b4aa9e821738a9f6a1f
-
SHA256
92f95a1c99ef0f1257ee84e95add541017e01bcfdd2d5f9232dcca175242fd4f
-
SHA512
b31b2baa5e41d39297aa7f8d23a76bbdf3577b220ca2c7a45017896c8e081f42bdbd967b7023e2079f7197900414f143648afc32e9b2285745d611c818457750
-
SSDEEP
98304:uyRAHwceX9klDaiHwvJtQQBiF26C5BExeBU9FVPr7:uyyumQvJKQQFOE8u/
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 92f95a1c99ef0f1257ee84e95add541017e01bcfdd2d5f9232dcca175242fd4f
Files
-
92f95a1c99ef0f1257ee84e95add541017e01bcfdd2d5f9232dcca175242fd4f.exe windows x86
ff73c077ed0b5fa0d896ec46a8c32ac8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
K32GetModuleInformation
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventA
Sleep
SetThreadPriority
OpenProcess
GetSystemInfo
TryEnterCriticalSection
InterlockedPopEntrySList
QueryDepthSList
LoadLibraryW
SignalObjectAndWait
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
UnregisterWaitEx
SetEndOfFile
HeapQueryInformation
HeapSize
MoveFileExW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetVersionExW
GetACP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
SetStdHandle
DeleteFileW
SetFileAttributesW
SetCurrentDirectoryW
OutputDebugStringW
CreateProcessW
GetExitCodeProcess
GetTimeZoneInformation
GetFileSizeEx
SetConsoleCtrlHandler
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileAttributesExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapAlloc
GetCurrentDirectoryW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetFullPathNameW
GetDriveTypeW
WriteConsoleW
GetFileType
GetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
LoadLibraryExW
LocalFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
RaiseException
GetThreadTimes
lstrcpynW
GetFileAttributesW
FindNextFileW
FindFirstFileW
CreateDirectoryW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
SetProcessAffinityMask
CreateTimerQueue
WaitForMultipleObjectsEx
MoveFileA
GetPrivateProfileStringA
lstrlenA
GlobalFree
CreateMutexA
ReleaseMutex
DeleteFileA
GetCurrentDirectoryA
GetOEMCP
GetTickCount
UnhandledExceptionFilter
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
FindResourceW
FindResourceA
SizeofResource
LoadResource
LockResource
InterlockedDecrement
GetProcessHeap
HeapValidate
InterlockedIncrement
GetCPInfo
CompareStringEx
CreateSymbolicLinkW
GetFileInformationByHandleEx
GetModuleHandleW
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
SleepConditionVariableCS
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTempPathW
SetFileInformationByHandle
GetLocaleInfoEx
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
QueryPerformanceFrequency
FormatMessageA
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
WaitForSingleObjectEx
ReadProcessMemory
GetSystemFirmwareTable
IsProcessorFeaturePresent
ExitProcess
FindNextFileA
FindFirstFileA
FindClose
MultiByteToWideChar
SetFileAttributesA
Module32Next
Module32First
Process32Next
Process32First
HeapFree
CreateToolhelp32Snapshot
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
QueryPerformanceCounter
CopyFileA
VirtualFree
VirtualProtect
VirtualAlloc
GetThreadContext
GetCurrentThread
CreateSemaphoreA
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
SetFilePointer
GetCurrentThreadId
GetFileSize
CreateFileA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
OutputDebugStringA
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
CreateDirectoryA
AllocConsole
WaitNamedPipeW
PeekNamedPipe
WriteFile
ReadFile
CreateFileW
lstrlenW
GetModuleFileNameW
GlobalAlloc
LocalAlloc
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
VirtualQuery
GetCurrentProcessId
GetCurrentProcess
GetLastError
SetUnhandledExceptionFilter
DuplicateHandle
TlsFree
CloseHandle
RtlCaptureStackBackTrace
user32
UpdateLayeredWindow
CreateWindowExW
GetDesktopWindow
MessageBoxA
GetWindowRect
LoadStringA
OffsetRect
SetRect
FillRect
GetClientRect
InvalidateRect
EndPaint
BeginPaint
UnregisterClassA
ReleaseDC
GetDC
PeekMessageA
GetSystemMetrics
ChangeDisplaySettingsA
ReleaseCapture
SetCapture
GetCapture
ShowWindow
ClientToScreen
SetCursorPos
LoadImageA
DestroyCursor
SetCursor
ShowCursor
GetKeyState
RegisterClassExW
SystemParametersInfoA
LoadIconA
FindWindowA
ScreenToClient
GetCursorPos
GetAsyncKeyState
SetWindowDisplayAffinity
GetWindowDisplayAffinity
SetWindowPos
FlashWindowEx
SendMessageA
PostQuitMessage
DefWindowProcA
LoadCursorW
UpdateWindow
RegisterClassExA
CreateWindowExA
IsWindow
DestroyWindow
MoveWindow
SetFocus
DefWindowProcW
GetWindowLongA
SetWindowLongA
RegisterClassA
GetMenu
SetWindowTextA
AdjustWindowRectEx
LoadCursorA
CharNextExA
CharPrevExA
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
SetWindowLongW
MonitorFromPoint
GetMonitorInfoA
SetClipboardData
TrackMouseEvent
DispatchMessageW
PeekMessageW
PostMessageW
GetWindowLongW
gdi32
SelectObject
BitBlt
GetPixel
GetDeviceCaps
TextOutA
CreateDIBSection
SetDIBitsToDevice
SetBkMode
CreateSolidBrush
GetTextExtentPoint32A
DeleteObject
PatBlt
StretchBlt
DeleteDC
GetStockObject
EnumFontFamiliesExA
CreateFontIndirectA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
CreateCompatibleBitmap
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
shell32
SHGetSpecialFolderPathA
ShellExecuteA
SHAppBarMessage
ole32
OleUninitialize
OleInitialize
CoGetClassObject
OleSetContainedObject
CoUninitialize
CoInitialize
CoCreateInstance
CoInitializeEx
winmm
timeGetDevCaps
timeGetTime
timeEndPeriod
timeBeginPeriod
d3d8
Direct3DCreate8
python27
_PyLong_New
_Py_EllipsisObject
PyUnicodeUCS2_DecodeUTF8
PyExc_EOFError
PyExc_ValueError
PyCode_Type
PyCode_New
Py_OptimizeFlag
PyMarshal_ReadObjectFromString
PyEval_GetRestricted
PyErr_NoMemory
PyErr_Occurred
PyEval_EvalCode
PyCode_Addr2Line
PyObject_AsCharBuffer
PyDict_SetItem
PyImport_GetMagicNumber
Py_FlushLine
PyEval_SetTrace
PyRun_StringFlags
Py_Finalize
Py_Initialize
Py_SetProgramName
PyErr_Fetch
PyModule_GetDict
_Py_NoneStruct
PyNumber_Check
PyObject_CallObject
PyErr_Print
PyErr_BadArgument
PyErr_Clear
PyString_AsString
PyFloat_AsDouble
PyLong_AsUnsignedLongLong
PyCallable_Check
PyObject_GetAttr
PyString_FromStringAndSize
PyComplex_FromCComplex
PyFloat_FromDouble
PyImport_AddModule
_PyLong_FromByteArray
PyObject_GetAttrString
PyString_InternFromString
PyImport_ImportModule
Py_BuildValue
PyModule_AddIntConstant
Py_InitModule4
PyLong_AsLong
PyTuple_Size
PyTuple_GetItem
PyDict_GetItemString
PyArg_ParseTuple
PyInt_FromLong
PyLong_FromLongLong
PyList_New
PyList_Append
PyDict_New
PyDict_SetItemString
PyInt_AsLong
PyDict_Next
PyDict_Size
PyLong_AsLongLong
PyList_SetItem
PyErr_SetString
PyExc_RuntimeError
PyString_FromString
PyTuple_New
PyTuple_SetItem
PyExc_StopIteration
PyModule_AddStringConstant
imm32
ImmGetCompositionStringW
ImmGetIMEFileNameA
ImmIsIME
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmNotifyIME
ImmSetCompositionStringW
ImmGetCandidateListW
ImmGetConversionStatus
ImmSetConversionStatus
ImmGetOpenStatus
gdiplus
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArcI
GdipClosePathFigure
GdipCreatePen2
GdipDeletePath
GdipCreatePath
GdipFree
GdipAlloc
GdipCreateFontFamilyFromName
GdipDeletePen
GdipResetPath
GdipRotateWorldTransform
GdiplusShutdown
GdiplusStartup
GdipSetStringFormatTabStops
GdipSetStringFormatTrimming
GdipGetStringFormatFlags
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipDrawRectangleI
GdipSetTextRenderingHint
GdipDeleteGraphics
GdipCreateFromHDC
GdipFillPath
GdipFillRectangleI
GdipDrawPath
ws2_32
inet_addr
recv
select
htons
ioctlsocket
socket
WSAGetLastError
WSAStartup
WSACleanup
htonl
ntohl
closesocket
__WSAFDIsSet
send
connect
ntohs
gethostname
gethostbyname
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
devil
ilInit
ilTexImage
ilSetPixels
ilSave
ilShutDown
ilOriginFunc
ilEnable
ilCopyPixels
ilConvertImage
ilLoad
ilGetInteger
ilGenImages
ilDeleteImages
ilBindImage
granny2
_GrannyFreeMeshDeformer@4
_GrannySetLogCallback@4
_GrannyGetLogMessageTypeString@4
_GrannyGetLogMessageOriginString@4
_GrannyGetMaterialTextureByType@8
_GrannyFindMatchingMember@16
_GrannyConvertSingleObject@20
_GrannyReadEntireFileFromMemory@8
_GrannyFreeFileSection@8
_GrannyFreeFile@4
_GrannyGetFileInfo@4
_GrannyGetSourceSkeleton@4
_GrannySetModelClock@8
_GrannyFreeCompletedModelControls@4
_GrannySampleModelAnimationsAccelerated@20
_GrannyUpdateModelMatrix@20
_GrannyNewLocalPose@4
_GrannyFreeLocalPose@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyInstantiateModel@4
_GrannyFreeModelInstance@4
_GrannyNewMeshBinding@12
_GrannyFreeMeshBinding@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFindBoneByName@12
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyGetMeshVertexCount@4
mss32
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_update_3D_position@8
_AIL_auto_update_3D_position@8
_AIL_set_sample_loop_count@8
_AIL_mem_free_lock@4
speedtreert
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?DeleteTransientData@CSpeedTreeRT@@QAEXXZ
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
dinput8
DirectInput8Create
ddraw
DirectDrawCreate
cshield
?charName@@3PADA
?CheckValues@@YA_NXZ
?InitializeCShield@@YA?AU_CShieldData@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0K@Z
?GenKey@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_NK@Z
?GetCShieldLoginKey@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD@Z
?GetCShieldCaptcha@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD@Z
?CheckMove@@YA_N_N0MM@Z
?clientCode@@3KA
advapi32
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
oleaut32
VariantClear
SysFreeString
SafeArrayAccessData
VariantInit
SysAllocString
SafeArrayCreate
SafeArrayDestroy
Exports
Exports
Sections
.text Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 999KB - Virtual size: 999KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 192KB - Virtual size: 803KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 319KB - Virtual size: 318KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 213KB - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ