Static task
static1
Behavioral task
behavioral1
Sample
c0711604980f78afbac585be87933271d2b2c809ceaf058a2e10d75473a5e614.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
c0711604980f78afbac585be87933271d2b2c809ceaf058a2e10d75473a5e614.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
c0711604980f78afbac585be87933271d2b2c809ceaf058a2e10d75473a5e614
-
Size
8.0MB
-
MD5
6cf4f00faf505b4a99bb3e5b06cd68cb
-
SHA1
b7f7cf9d1841a129943cc4f97aa61cf4108fe917
-
SHA256
c0711604980f78afbac585be87933271d2b2c809ceaf058a2e10d75473a5e614
-
SHA512
3aa9f0ae3bae75551ceab979269d5eed44221f3669211c49f096b92171e4b73224eb758495657c51b8a9cc8c4954b61befa26bbf6b6c360f598f8da9bfb7738d
-
SSDEEP
98304:J8zwLbE2reYbkiXUZ7MRgm1MEP1l+Kag9ruJfcLAVyHISVntd:gsydo715usXntd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c0711604980f78afbac585be87933271d2b2c809ceaf058a2e10d75473a5e614
Files
-
c0711604980f78afbac585be87933271d2b2c809ceaf058a2e10d75473a5e614.exe windows:6 windows x86
9ad4c078cc284bce3de14898b17421a6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenThread
K32GetMappedFileNameA
IsBadReadPtr
GetFileSize
CreateFileA
Module32Next
Module32First
ReadProcessMemory
CreateProcessA
CreatePipe
SetHandleInformation
ReadFile
GetModuleFileNameA
MultiByteToWideChar
SetFileAttributesA
Process32Next
Process32First
CreateToolhelp32Snapshot
K32GetProcessImageFileNameA
K32GetModuleFileNameExA
QueryDosDeviceA
GetLogicalDriveStringsA
WriteConsoleW
SetEndOfFile
HeapQueryInformation
HeapSize
OutputDebugStringW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
CreateThread
GetHandleInformation
IsBadCodePtr
VirtualQuery
GetModuleHandleA
GetFullPathNameA
FindNextFileA
FindFirstFileA
FindClose
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetStdHandle
DeleteFileW
SetFileAttributesW
SetCurrentDirectoryW
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
FlushFileBuffers
HeapReAlloc
CreateDirectoryW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetTimeZoneInformation
GetFileAttributesExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTempPathW
SetConsoleCtrlHandler
HeapAlloc
RemoveVectoredExceptionHandler
FreeLibraryAndExitThread
ResumeThread
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetModuleHandleExW
ExitProcess
GetFullPathNameW
GetDriveTypeW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
RaiseException
InterlockedFlushSList
InterlockedPushEntrySList
GetFileSizeEx
VerifyVersionInfoA
FormatMessageW
WaitForMultipleObjects
GetFileType
GetStdHandle
GetEnvironmentVariableA
MoveFileExA
SleepEx
SetFilePointerEx
GetComputerNameA
GetThreadTimes
SetLastError
GetModuleFileNameW
WaitNamedPipeW
PeekNamedPipe
GetStartupInfoW
K32GetModuleInformation
TerminateProcess
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
InitializeSListHead
FindResourceW
FindResourceA
SizeofResource
LoadResource
LockResource
CreateFileW
IsProcessorFeaturePresent
InterlockedDecrement
GetProcessHeap
HeapValidate
InterlockedIncrement
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
GetLocaleInfoEx
LocalFree
CreateSymbolicLinkW
TerminateThread
GetCurrentDirectoryW
GetTickCount
GetCurrentDirectoryA
DeleteFileA
ReleaseMutex
CreateMutexA
GlobalFree
lstrlenA
GetPrivateProfileStringA
MoveFileA
GetNativeSystemInfo
GetExitCodeThread
AddVectoredExceptionHandler
K32QueryWorkingSetEx
VerifyVersionInfoW
VirtualProtect
VirtualAlloc
VerSetConditionMask
Sleep
LoadLibraryA
GetProcAddress
WTSGetActiveConsoleSessionId
UnregisterWait
RegisterWaitForSingleObject
OpenProcess
GetCurrentThread
GetCurrentProcessId
GetFileInformationByHandleEx
GetModuleHandleW
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetFileInformationByHandle
GetStringTypeW
GetCurrentThreadId
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
FormatMessageA
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
SetFilePointer
WinExec
SetUnhandledExceptionFilter
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
CreateDirectoryA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetSystemInfo
OutputDebugStringA
AllocConsole
GlobalAlloc
IsDebuggerPresent
SwitchToThread
GetCurrentProcess
GetLastError
CloseHandle
HeapFree
GetFileAttributesA
user32
OffsetRect
SetRect
FillRect
GetClientRect
InvalidateRect
DefWindowProcA
UnregisterClassA
RegisterClassExA
CreateWindowExA
DestroyWindow
MoveWindow
SetFocus
UpdateWindow
GetWindowLongA
LoadStringA
CharPrevExA
RegisterClassA
GetMenu
SetWindowTextA
GetWindowRect
AdjustWindowRectEx
LoadCursorA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
SendMessageW
DefWindowProcW
CharNextExA
ChangeDisplaySettingsA
SetForegroundWindow
TrackPopupMenu
InsertMenuA
DestroyMenu
CreatePopupMenu
UnregisterClassW
RegisterClassExW
CreateWindowExW
LoadImageW
ReleaseCapture
SetCapture
GetCapture
ShowWindow
ClientToScreen
SetCursorPos
LoadImageA
DestroyCursor
SetCursor
ShowCursor
GetKeyState
SystemParametersInfoA
DestroyIcon
SetTimer
KillTimer
EndPaint
BeginPaint
ReleaseDC
LoadIconA
GetDC
PeekMessageA
GetWindowModuleFileNameA
UnhookWinEvent
SetWinEventHook
DispatchMessageA
TranslateMessage
GetMessageA
FindWindowA
ScreenToClient
GetCursorPos
GetAsyncKeyState
SetWindowPos
FlashWindowEx
SendMessageA
PostQuitMessage
RegisterRawInputDevices
GetRawInputData
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetWindowThreadProcessId
SetWindowLongW
SetWindowLongA
IsWindowUnicode
IsWindow
MessageBoxA
GetSystemMetrics
gdi32
PatBlt
DeleteObject
GetTextExtentPoint32A
CreateSolidBrush
EnumFontFamiliesExA
GetStockObject
CreateCompatibleDC
DeleteDC
SelectObject
SetBkColor
SetBkMode
SetDIBitsToDevice
SetTextColor
CreateDIBSection
TextOutA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
StretchBlt
TextOutW
CreateFontIndirectA
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
SetKernelObjectSecurity
SetSecurityInfo
CryptEncrypt
RegCloseKey
shell32
ShellExecuteA
Shell_NotifyIconA
SHGetSpecialFolderPathA
ole32
CoInitialize
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoUninitialize
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
oleaut32
SafeArrayDestroy
SafeArrayCreate
SysAllocString
SysFreeString
VariantInit
VariantClear
SafeArrayAccessData
SysStringLen
SafeArrayGetLBound
SafeArrayGetUBound
winmm
timeBeginPeriod
timeEndPeriod
timeGetTime
timeGetDevCaps
d3d8
Direct3DCreate8
python27
PyTuple_GetItem
PyDict_GetItemString
PyInt_FromLong
PyLong_FromLongLong
PyTuple_New
PyTuple_SetItem
PyList_New
PyList_Append
PyDict_New
PyDict_SetItemString
PyLong_AsLong
PyModule_AddIntConstant
Py_InitModule4
Py_BuildValue
PyInt_AsLong
PyDict_Next
PyDict_Size
PyObject_GetAttrString
PyString_FromString
PyImport_ImportModule
PyObject_CallObject
PyString_AsString
PyThreadState_Get
PyErr_SetString
PyExc_RuntimeError
PyArg_ParseTuple
PyList_Size
PyList_GetItem
PyModule_AddStringConstant
PyString_InternFromString
PyTuple_Size
PyCallable_Check
PyLong_AsLongLong
PyLong_AsUnsignedLongLong
PyFloat_AsDouble
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyNumber_Check
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyEval_SetTrace
Py_FlushLine
PyImport_GetMagicNumber
PyImport_AddModule
PyObject_AsCharBuffer
PyCode_Addr2Line
PyEval_EvalCode
Py_OptimizeFlag
PyCode_Type
PyUnicodeUCS2_DecodeUTF8
_PyLong_FromByteArray
PyFloat_FromDouble
PyString_FromStringAndSize
PyList_SetItem
PyDict_SetItem
PyErr_Occurred
PyErr_NoMemory
PyEval_GetRestricted
PyCode_New
PyMarshal_ReadObjectFromString
_PyLong_New
_Py_EllipsisObject
PyExc_StopIteration
PyExc_EOFError
PyExc_ValueError
PyObject_GetAttr
PyComplex_FromCComplex
wtsapi32
WTSSendMessageA
netapi32
Netbios
imm32
ImmGetIMEFileNameA
ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
devil
ilInit
ilTexImage
ilSetPixels
ilSave
ilShutDown
ilOriginFunc
ilEnable
ilCopyPixels
ilConvertImage
ilLoad
ilGetInteger
ilGenImages
ilDeleteImages
ilBindImage
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
imagehlp
GetTimestampForLoadedLibrary
EnumerateLoadedModules
StackWalk
granny2
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyBeginControlledAnimation@8
_GrannyEndControlledAnimation@4
_GrannySetTrackGroupTarget@12
_GrannySetTrackGroupLOD@16
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetControlLoopCount@4
_GrannyFreeControlIfComplete@4
_GrannySetLogCallback@4
_GrannyReadEntireFileFromMemory@8
_GrannyFreeFileSection@8
_GrannyFreeFile@4
_GrannyGetFileInfo@4
_GrannyGetMaterialTextureByType@8
_GrannyFindMatchingMember@16
_GrannyConvertSingleObject@20
_GrannyGetSourceSkeleton@4
_GrannySetControlSpeed@8
_GrannyFreeCompletedModelControls@4
_GrannyCompleteControlAt@8
_GrannySampleModelAnimationsAccelerated@20
_GrannyUpdateModelMatrix@20
_GrannyNewLocalPose@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
_GrannyFreeLocalPose@4
_GrannyGetWorldPoseComposite4x4Array@4
GrannyPNT332VertexType
_GrannyInstantiateModel@4
_GrannyGetControlSpeed@4
_GrannyFreeModelInstance@4
_GrannyNewMeshBinding@12
_GrannyControlIsComplete@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFindBoneByName@12
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetControlLocalDuration@4
_GrannySetModelClock@8
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyGetSourceModel@4
_GrannyFindTrackGroupForModel@12
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannySetControlLoopCount@8
_GrannyFreeMeshBinding@4
mss32
_AIL_set_file_callbacks@16
_AIL_auto_update_3D_position@8
_AIL_update_3D_position@8
_AIL_file_read@8
_AIL_mem_free_lock@4
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_set_3D_sample_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_start_3D_sample@4
_AIL_release_3D_sample_handle@4
_AIL_allocate_3D_sample_handle@4
_AIL_sample_volume_pan@12
_AIL_sample_status@4
_AIL_set_sample_loop_count@8
_AIL_set_sample_volume_pan@12
_AIL_end_sample@4
_AIL_resume_sample@4
_AIL_stop_sample@4
_AIL_start_sample@4
_AIL_WAV_info@8
_AIL_init_sample@4
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_last_error@0
_AIL_stream_status@4
_AIL_set_stream_loop_count@8
_AIL_stream_volume_levels@12
_AIL_set_stream_volume_levels@12
_AIL_pause_stream@8
_AIL_start_stream@4
_AIL_close_stream@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_3D_orientation@28
_AIL_set_3D_velocity@20
_AIL_set_3D_position@16
_AIL_close_3D_listener@4
_AIL_open_3D_listener@4
_AIL_close_3D_provider@4
_AIL_open_3D_provider@4
_AIL_enumerate_3D_providers@12
_AIL_close_digital_driver@4
_AIL_open_stream@12
_AIL_open_digital_driver@16
_AIL_file_type@8
_AIL_decompress_ADPCM@12
_AIL_decompress_ASI@24
_AIL_set_sample_file@12
speedtreert
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1CSpeedTreeRT@@QAE@XZ
??2CSpeedTreeRT@@SAPAXI@Z
??3CSpeedTreeRT@@SAXPAX@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?DeleteTransientData@CSpeedTreeRT@@QAEXXZ
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
dinput8
DirectInput8Create
ws2_32
getaddrinfo
freeaddrinfo
accept
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAIoctl
__WSAFDIsSet
closesocket
connect
WSASetLastError
getsockopt
getpeername
bind
recvfrom
sendto
select
setsockopt
listen
recv
gethostname
gethostbyname
ntohs
ntohl
inet_addr
htons
htonl
WSACleanup
WSAStartup
WSAGetLastError
socket
send
ioctlsocket
WSACloseEvent
getsockname
ddraw
DirectDrawCreate
resource
PythonPlayerSettingsModuleLibRegisterVariables
LoadGameNPC
RegisterSkill
GetHorsePathNameByMode
PythonPlayerSettingsModuleLibRegisterFunctions
LoadPythonPlayerSettingsModuleLibrary
iphlpapi
GetAdaptersInfo
crypt32
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
PFXImportCertStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CryptStringToBinaryA
wldap32
ord22
ord26
ord45
ord41
ord50
ord33
ord35
ord79
ord30
ord200
ord301
ord143
ord32
ord60
ord211
ord27
ord217
ord46
normaliz
IdnToUnicode
IdnToAscii
Sections
.text Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 919KB - Virtual size: 918KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 177KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 224KB - Virtual size: 223KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ