Static task
static1
Behavioral task
behavioral1
Sample
aa2989fe6983b680154928979e477171f171fd5428b693a8cc47fd4cc80843bf.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
aa2989fe6983b680154928979e477171f171fd5428b693a8cc47fd4cc80843bf.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
aa2989fe6983b680154928979e477171f171fd5428b693a8cc47fd4cc80843bf
-
Size
1.5MB
-
MD5
d13834523e274728104b3243f0c82d4e
-
SHA1
d46cd184e5c00c0db5f17ffaf7c7f109d03752dd
-
SHA256
aa2989fe6983b680154928979e477171f171fd5428b693a8cc47fd4cc80843bf
-
SHA512
79505cb9fab975cd47e54d430afb730ab0bec6a10e1ae9b404e31b0b5237e8dcbb7cbc53a61ae1bd939ed6e17213d9df075b33b3388608396d97f1ca150e23f8
-
SSDEEP
12288:NE0E59k9QZCZApwHMYJIyMSOaQzRwYZMmjlchzs+4oouO99/i3:NfLZmyMY4amjlclsbnuOz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa2989fe6983b680154928979e477171f171fd5428b693a8cc47fd4cc80843bf
Files
-
aa2989fe6983b680154928979e477171f171fd5428b693a8cc47fd4cc80843bf.exe windows:6 windows x64
7e85d45e2f064283d98eaa5a05a1ca3f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
qt5gui
?setParent@QWindow@@QEAAXPEAV1@@Z
?devicePixelRatio@QGuiApplication@@QEBANXZ
?fromWinId@QWindow@@SAPEAV1@_K@Z
wsap-filmorax
ord3568
ord3806
ord5401
ord9806
ord6191
ord2698
ord10222
ord6265
ord3155
ord2026
ord8377
ord9807
ord8051
ord6119
ord2294
ord9694
ord1525
ord9444
ord7684
ord3786
ord4406
ord3250
ord9614
ord3959
ord1194
ord760
ord2949
ord9160
ord3974
ord4850
ord1676
ord6913
ord1444
ord10411
ord9322
ord9126
ord1521
ord8312
ord8620
ord4087
ord626
ord4222
ord6109
ord98
ord6965
ord8071
ord1485
ord4795
ord2169
ord7250
ord3445
ord7671
ord3163
ord10410
ord8347
ord7045
ord2832
ord817
ord7786
ord1239
ord4933
ord3433
ord2896
ord3815
ord8292
ord1358
ord980
ord9046
ord7897
ord6728
ord10237
ord2821
ord3098
ord7270
ord2959
ord7206
ord9834
ord10472
ord9107
ord985
ord6894
ord4570
ord3206
ord5555
ord9703
ord3994
ord526
ord2252
ord9333
ord7594
ord917
ord3771
ord10046
ord4116
ord2621
ord4967
ord1074
ord785
ord3479
ord9054
ord8414
qt5core
?append@QListData@@QEAAPEAPEAXXZ
??4QString@@QEAAAEAV0@AEBVQByteArray@@@Z
?end@QListData@@QEBAPEAPEAXXZ
?deleteLater@QObject@@QEAAXXZ
?nextNode@QMapNodeBase@@QEBAPEBU1@XZ
?color@QMapNodeBase@@QEBA?AW4Color@1@XZ
?setColor@QMapNodeBase@@QEAAXW4Color@1@@Z
?setParent@QMapNodeBase@@QEAAXPEAU1@@Z
?freeNodeAndRebalance@QMapDataBase@@QEAAXPEAUQMapNodeBase@@@Z
?recalcMostLeftNode@QMapDataBase@@QEAAXXZ
?createNode@QMapDataBase@@QEAAPEAUQMapNodeBase@@HHPEAU2@_N@Z
?freeTree@QMapDataBase@@QEAAXPEAUQMapNodeBase@@H@Z
?createData@QMapDataBase@@SAPEAU1@XZ
?freeData@QMapDataBase@@SAXPEAU1@@Z
?allocateNode@QHashData@@QEAAPEAXH@Z
?freeNode@QHashData@@QEAAXPEAX@Z
?detach_helper@QHashData@@QEAAPEAU1@P6AXPEAUNode@1@PEAX@ZP6AX0@ZHH@Z
?willGrow@QHashData@@QEAA_NXZ
?hasShrunk@QHashData@@QEAAXXZ
?free_helper@QHashData@@QEAAXP6AXPEAUNode@1@@Z@Z
??0QMutexLocker@@QEAA@PEAVQBasicMutex@@@Z
??1QMutexLocker@@QEAA@XZ
?shared_null@QListData@@2UData@1@B
?shared_null@QMapDataBase@@2U1@B
?shared_null@QHashData@@2U1@B
?dispose@QListData@@SAXPEAUData@1@@Z
?indexOf@QString@@QEBAHAEBV1@HW4CaseSensitivity@Qt@@@Z
?setProperty@QObject@@QEAA_NPEBDAEBVQVariant@@@Z
??1QVariant@@QEAA@XZ
??0QVariant@@QEAA@_K@Z
??4QString@@QEAAAEAV0@$$QEAV0@@Z
??0QSize@@QEAA@HH@Z
?isEmpty@QSize@@QEBA_NXZ
?disconnect@QObject@@QEBA_NPEBV1@PEBD@Z
??0QString@@QEAA@AEBVQByteArray@@@Z
?arg@QString@@QEBA?AV1@AEBV1@HVQChar@@@Z
?isEmpty@QString@@QEBA_NXZ
??0QString@@QEAA@XZ
??1QByteArray@@QEAA@XZ
??0QChar@@QEAA@UQLatin1Char@@@Z
?eventFilter@QObject@@UEAA_NPEAV1@PEAVQEvent@@@Z
?event@QObject@@UEAA_NPEAVQEvent@@@Z
?timerId@QTimerEvent@@QEBAHXZ
?killTimer@QObject@@QEAAXH@Z
?startTimer@QObject@@QEAAHHW4TimerType@Qt@@@Z
?setObjectName@QObject@@QEAAXAEBVQString@@@Z
?number@QString@@SA?AV1@HH@Z
?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z
?cast@QMetaObject@@QEBAPEAVQObject@@PEAV2@@Z
?timerEvent@QObject@@MEAAXPEAVQTimerEvent@@@Z
?disconnectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z
?dispose@QListData@@QEAAXXZ
?realloc@QListData@@QEAAXH@Z
?detach_grow@QListData@@QEAAPEAUData@1@PEAHH@Z
?detach@QListData@@QEAAPEAUData@1@H@Z
?instance@QCoreApplication@@SAPEAV1@XZ
?setAttribute@QCoreApplication@@SAXW4ApplicationAttribute@Qt@@_N@Z
??4QString@@QEAAAEAV0@PEBD@Z
??AQJsonObject@@QEAA?AVQJsonValueRef@@AEBVQString@@@Z
??1QJsonObject@@QEAA@XZ
??0QJsonObject@@QEAA@XZ
?isNull@QJsonDocument@@QEBA_NXZ
?setObject@QJsonDocument@@QEAAXAEBVQJsonObject@@@Z
?object@QJsonDocument@@QEBA?AVQJsonObject@@XZ
?isEmpty@QJsonDocument@@QEBA_NXZ
?toJson@QJsonDocument@@QEBA?AVQByteArray@@W4JsonFormat@1@@Z
?fromJson@QJsonDocument@@SA?AV1@AEBVQByteArray@@PEAUQJsonParseError@@@Z
??1QJsonDocument@@QEAA@XZ
??0QJsonDocument@@QEAA@AEBVQJsonObject@@@Z
??0QJsonDocument@@QEAA@XZ
?toObject@QJsonValueRef@@QEBA?AVQJsonObject@@XZ
?toString@QJsonValueRef@@QEBA?AVQString@@XZ
?toInt@QJsonValueRef@@QEBAHXZ
??4QJsonValueRef@@QEAAAEAV0@AEBVQJsonValue@@@Z
??1QJsonValue@@QEAA@XZ
??0QJsonValue@@QEAA@AEBVQJsonObject@@@Z
??0QJsonValue@@QEAA@PEBD@Z
??0QJsonValue@@QEAA@AEBVQString@@@Z
??0QJsonValue@@QEAA@H@Z
?applicationVersion@QCoreApplication@@SA?AVQString@@XZ
??4QString@@QEAAAEAV0@AEBV0@@Z
??8QString@@QEBA_NPEBD@Z
?customEvent@QObject@@MEAAXPEAVQEvent@@@Z
?connectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z
?childEvent@QObject@@MEAAXPEAVQChildEvent@@@Z
?queryItemValue@QUrlQuery@@QEBA?AVQString@@AEBV2@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z
??1QUrlQuery@@QEAA@XZ
??0QUrlQuery@@QEAA@AEBVQString@@@Z
?query@QUrl@@QEBA?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z
??1QUrl@@QEAA@XZ
??0QUrl@@QEAA@AEBVQString@@W4ParsingMode@0@@Z
?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z
?toStdString@QString@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??0QString@@QEAA@PEBD@Z
?fromUtf8@QString@@SA?AV1@PEBDH@Z
??YQString@@QEAAAEAV0@AEBV0@@Z
?append@QString@@QEAAAEAV1@AEBV1@@Z
?startsWith@QString@@QEBA_NAEBV1@W4CaseSensitivity@Qt@@@Z
?contains@QString@@QEBA_NAEBV1@W4CaseSensitivity@Qt@@@Z
??1QString@@QEAA@XZ
??1Connection@QMetaObject@@QEAA@XZ
??1QMutex@@QEAA@XZ
??0QMutex@@QEAA@XZ
?dynamicMetaObject@QObjectData@@QEBAPEAUQMetaObject@@XZ
??0QString@@QEAA@AEBV0@@Z
?activate@QMetaObject@@SAXPEAVQObject@@PEBU1@HPEAPEAX@Z
?begin@QListData@@QEBAPEAPEAXXZ
?toUtf8@QString@@QEGBA?AVQByteArray@@XZ
fcore
??1FApplication@@UEAA@XZ
??1FIPCWebLoginFinishedEvent@@UEAA@XZ
??0FIPCChangeBackBtnStateEvent@@QEAA@_N@Z
??1FIPCChangeBackBtnStateEvent@@UEAA@XZ
??0FIPCWebCallbackEvent@@QEAA@AEBVQString@@0@Z
??1FIPCWebCallbackEvent@@UEAA@XZ
??0FApplication@@QEAA@AEAHPEAPEAD@Z
?init@FApplication@@MEAAXXZ
?prepareRun@FApplication@@MEAAXXZ
?runFinished@FApplication@@MEAAXXZ
?clearCefCache@FApplication@@IEBA_NH@Z
??1FIPCWebBrowserArguments@@UEAA@XZ
?preLoad@FIPCWebBrowserArguments@@QEBA_NXZ
?run@FApplication@@QEAAHXZ
??1FIPCWebLoadFinishEvent@@UEAA@XZ
??0FIPCWebLoadFinishEvent@@QEAA@G@Z
?hasDeviceAuth@FIPCLoginStateChangedEvent@@QEBA_NXZ
?hasDeviceLimit@FIPCLoginStateChangedEvent@@QEBA_NXZ
?result@FIPCLoginStateChangedEvent@@QEBA_NXZ
?stateType@FIPCLoginStateChangedEvent@@QEBA?AW4StateType@1@XZ
?createEvent@FIPCEventParser@@MEAAPEAVFFIPCEvent@@G@Z
??0FIPCWebBrowserArguments@@QEAA@AEBVFFIPCArguments@@@Z
??1FIPCEventParser@@UEAA@XZ
??0FIPCEventParser@@QEAA@XZ
?unInitAppLog@FApplication@@MEAAXXZ
?unInit@FApplication@@MEAAXXZ
?showSplashScreen@FApplication@@MEAAXXZ
?productName@FApplication@@UEAA?AVQString@@XZ
?needInitSkin@FApplication@@MEAA_NXZ
?needBugSplatProxy@FApplication@@MEAA_NXZ
?isMainApp@FApplication@@MEAA_NXZ
?initProductInfo@FApplication@@MEAAXXZ
?initDirInfo@FApplication@@MEAAXXZ
?clearCache@FIPCWebBrowserArguments@@QEBA_NXZ
?alreadyRun@FApplication@@MEAAXXZ
?initAppLog@FApplication@@MEAAXXZ
??0FIPCWebLoginFinishedEvent@@QEAA@AEBVQString@@@Z
ffcefview
?qt_metacast@FFCefView2@@UEAAPEAXPEBD@Z
?setWebStateGroupWidget@FFCefView2@@QEAAXPEAVFFWebStateGroupWidget@@@Z
??1FFCefView2@@UEAA@XZ
??0FFCefView2@@QEAA@AEBVQString@@PEAVQWidget@@@Z
?slotLinkClicked@FFCefView2@@MEAAXVQString@@@Z
?setWebStateWidgetType@FFCefView2@@IEAAXF@Z
?staticMetaObject@FFCefView2@@2UQMetaObject@@B
?qt_metacall@FFCefView2@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?reload@FFCefView2@@QEAAXXZ
ffqcefview
?cefWidget@QCefView@@QEAAPEAVQWidget@@XZ
?browserGoBack@QCefView@@QEAAXXZ
?sigLoadFinished@QCefView@@QEAAX_NVQString@@@Z
?hideScrollBar@QCefView@@QEAAXXZ
?changeEvent@QCefView@@MEAAXPEAVQEvent@@@Z
?eventFilter@QCefView@@MEAA_NPEAVQObject@@PEAVQEvent@@@Z
?onBrowserCreated@QCefView@@MEAAXXZ
?onInvokeMethodLocalPageNotify@QCefView@@MEAA?AVQString@@HHAEBV?$QList@VQVariant@@@@@Z
?onInvokeMethodNotify@QCefView@@MEAAXHHAEBVQString@@AEBV?$QList@VQVariant@@@@@Z
?onLoadEnd@QCefView@@MEAAXH@Z
?onLoadError@QCefView@@MEAAXHAEBVQString@@0@Z
?onLoadStart@QCefView@@MEAAXXZ
?onLoadUrlChanged@QCefView@@MEAAXVQString@@@Z
?onLoadingStateChanged@QCefView@@MEAAX_N00@Z
?onQCefQueryRequest@QCefView@@MEAAXAEBVQCefQuery@@@Z
?onQCefUrlRequest@QCefView@@MEAAXAEBVQString@@@Z
?browserCanGoBack@QCefView@@QEAA_NXZ
?staticMetaObject@QCefView@@2UQMetaObject@@B
?sigLoadEnd@QCefView@@QEAAXH@Z
?sigLoadError@QCefView@@QEAAXHVQString@@0@Z
?runJavaScript@QCefView@@QEAAXAEBVQString@@@Z
?initializeCef@QCefView@@SAXM@Z
?uninitializeCef@QCefView@@SAXXZ
?setCachePathByProcessName@QCefSetting@@YAXAEBVQString@@@Z
?DeleteCookies@QCefView@@QEAAXXZ
?SetProxyInfo@QCefView@@SAXHVQString@@0000@Z
ffipc
?processName@FFIPCProcessArguments@@QEBA?AVQString@@XZ
?hasProcess@FFIPCClient@@QEBA_NXZ
?baseArguments@FFIPCClient@@QEAAPEAVFFIPCProcessArguments@@XZ
??0FFIPCClient@@QEAA@PEAVQCoreApplication@@@Z
??1FFIPCClient@@UEAA@XZ
registerEventParser
?metaObject@FFIPCClient@@UEBAPEBUQMetaObject@@XZ
?qt_metacall@FFIPCClient@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?qt_metacast@FFIPCClient@@UEAAPEAXPEBD@Z
?quit@FFIPCClient@@MEAAXXZ
??1FFIPCArguments@@UEAA@XZ
??0FFIPCUITaskArguments@@QEAA@AEBVFFIPCArguments@@@Z
??1FFIPCUITaskArguments@@UEAA@XZ
?size@FFIPCUITaskArguments@@QEBA?AVQSize@@XZ
?startUrl@FFIPCUITaskArguments@@QEBA?AVQString@@XZ
ffwidgets
?CreatePrimaryButton@FFPushButton@@SAPEAV1@PEAVQWidget@@AEBW4FButtonSizeKind@1@@Z
?SetDisplayText@FFPushButton@@QEAAXAEBVQString@@@Z
?RetranslateUi@FFWidget@@MEAAXXZ
?FormatResourceFile@FFSkinStyle@@QEAA?AVQString@@AEBV2@@Z
?instance@?$FFSingleton@VFFSkinStyle@@@@SAPEAVFFSkinStyle@@XZ
?LoadImg@FFLabel@@QEAAXAEBVQString@@_N@Z
?CreateLabel@FFLabel@@SAPEAV1@PEAVQWidget@@AEBW4FFFontType@FFSkinFont@@AEBW4FFColorType@FFSkinColor@@@Z
?CreateLabel@FFLabel@@SAPEAV1@PEAVQWidget@@AEBVQString@@@Z
??1FFLoadingWebStateWidget@@UEAA@XZ
?setLabel1Text@FFLoadingWebStateWidget@@IEAAXAEBVQString@@@Z
??0FFLoadingWebStateWidget@@QEAA@PEAVQWidget@@@Z
??1FFWebStateGroupWidget@@UEAA@XZ
?qt_metacast@FFWidget@@UEAAPEAXPEBD@Z
?qt_metacall@FFWidget@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?qt_metacast@FFWebStateGroupWidget@@UEAAPEAXPEBD@Z
?qt_metacall@FFWebStateGroupWidget@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?qt_metacast@FFLoadingWebStateWidget@@UEAAPEAXPEBD@Z
?qt_metacall@FFLoadingWebStateWidget@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?staticMetaObject@FFWidget@@2UQMetaObject@@B
?staticMetaObject@FFWebStateGroupWidget@@2UQMetaObject@@B
?staticMetaObject@FFLoadingWebStateWidget@@2UQMetaObject@@B
??0FFWidget@@QEAA@PEAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@@Z
??1FFWidget@@UEAA@XZ
??0FFWebStateGroupWidget@@QEAA@PEAVQWidget@@@Z
?currentWidgetType@FFWebStateGroupWidget@@QEBAFXZ
?currentWidget@FFWebStateGroupWidget@@QEBAPEAVQWidget@@XZ
?sigCurrentChanged@FFWebStateGroupWidget@@QEAAXH@Z
?initHighDPI@FFApplication@@SAXH@Z
?setWidgetType@FFWebStateGroupWidget@@QEAAXF@Z
?qt_metacast@FFGIFLoadingWebStateWidget@@UEAAPEAXPEBD@Z
?qt_metacall@FFGIFLoadingWebStateWidget@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?metaObject@FFWebStateGroupWidget@@UEBAPEBUQMetaObject@@XZ
?metaObject@FFGIFLoadingWebStateWidget@@UEBAPEBUQMetaObject@@XZ
?RetranslateUi@FFGIFLoadingWebStateWidget@@EEAAXXZ
??1FFGIFLoadingWebStateWidget@@UEAA@XZ
?sigClose@FFWebStateGroupWidget@@QEAAXXZ
??0FFGIFLoadingWebStateWidget@@QEAA@PEAVQWidget@@@Z
?replaceWidget@FFWebStateGroupWidget@@QEAAXFPEAVFFWidget@@@Z
?qt_metacast@FFApplication@@UEAAPEAXPEBD@Z
?qt_metacall@FFApplication@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?metaObject@FFApplication@@UEBAPEBUQMetaObject@@XZ
?mousePressEvent@FFWidget@@UEAAXPEAVQMouseEvent@@@Z
?event@FFWidget@@MEAA_NPEAVQEvent@@@Z
?TranslateText@FFWidget@@MEAAXXZ
?SetBGColorType@FFUIStyle@@SAXPEAVQWidget@@H@Z
?addWidget@FFWebStateGroupWidget@@IEAAXFPEAVFFWidget@@@Z
ffcore
?getProxyInfo@FFNetworkProxyInfo@@QEBAAEBU_ProxyInfo@@XZ
?remove@FFLazySingletonManager@@QEAAXPEAVIFFLazySingleton@@@Z
?loadProxyInfo@FFNetworkProxyInfo@@QEAAXXZ
?getInstance@IFFAppInfo@@SAPEAV1@XZ
?GetGlobalLogInstance@@YAPEAVIFFBaseLog@@XZ
?instance@?$FFSingleton@VFFLocale@@@@SAPEAVFFLocale@@XZ
?languageH5code@FFLocale@@QEBA?AVQString@@XZ
?instance@?$FFSingleton@VFFLazySingletonManager@@@@SAPEAVFFLazySingletonManager@@XZ
?releaseAll@FFLazySingletonManager@@QEAAXXZ
?add@FFLazySingletonManager@@QEAAXPEAVIFFLazySingleton@@@Z
?instance@?$FFLazySingleton@VFFNetworkProxyInfo@@@@SAPEAVFFNetworkProxyInfo@@XZ
vcruntime140
__std_type_info_destroy_list
__std_exception_destroy
__std_exception_copy
memset
__C_specific_handler
__RTDynamicCast
memcpy
_CxxThrowException
__std_terminate
_purecall
__CxxFrameHandler3
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_register_thread_local_exe_atexit_callback
_c_exit
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
terminate
_configure_narrow_argv
_set_app_type
_get_narrow_winmain_command_line
_initialize_narrow_environment
_seh_filter_exe
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
kernel32
LocalFree
GetCommandLineW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
WideCharToMultiByte
shell32
CommandLineToArgvW
Sections
.text Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 174KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE