Static task
static1
Behavioral task
behavioral1
Sample
55e6ed696eec98b724879a23f7f1af479e71204d86c5f924ef78704b856a783e.exe
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral2
Sample
55e6ed696eec98b724879a23f7f1af479e71204d86c5f924ef78704b856a783e.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
General
-
Target
55e6ed696eec98b724879a23f7f1af479e71204d86c5f924ef78704b856a783e
-
Size
9.3MB
-
MD5
a01b4783e98f1d1f11127447fd3fa55a
-
SHA1
655392ee7f8e9283f355d66664d495c53ba99895
-
SHA256
55e6ed696eec98b724879a23f7f1af479e71204d86c5f924ef78704b856a783e
-
SHA512
96428105e868d061762dd5c57a5553a12c53241eca5a9c5889c99c5f426020da36850e9546d3844038f22911b5da2bc9de21b6b94a0894dc7d5adf5d8a1f0940
-
SSDEEP
98304:wQp3me+6l/tR4F6sHM6KZFMFMJd7UqjvkzlMzWW7wgTEMKlEg70VINj0Ek0kEU0Z:wEO6SKsyJdDzQmrkiyKaiS6KiyN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 55e6ed696eec98b724879a23f7f1af479e71204d86c5f924ef78704b856a783e
Files
-
55e6ed696eec98b724879a23f7f1af479e71204d86c5f924ef78704b856a783e.exe windows:6 windows x86
9b2a64e78d427dfe1790260d9347668c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenThread
K32GetMappedFileNameA
IsBadReadPtr
GetFileSize
CreateFileA
Module32Next
Module32First
ReadProcessMemory
CreateProcessA
CreatePipe
SetHandleInformation
ReadFile
GetModuleFileNameA
MultiByteToWideChar
SetFileAttributesA
Process32Next
Process32First
CreateToolhelp32Snapshot
K32GetProcessImageFileNameA
K32GetModuleFileNameExA
QueryDosDeviceA
GetLogicalDriveStringsA
WriteConsoleW
SetEndOfFile
HeapQueryInformation
HeapSize
OutputDebugStringW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
CreateThread
GetHandleInformation
IsBadCodePtr
VirtualQuery
GetModuleHandleA
GetFullPathNameA
FindNextFileA
FindFirstFileA
FindClose
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetStdHandle
DeleteFileW
SetFileAttributesW
SetCurrentDirectoryW
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
FlushFileBuffers
HeapReAlloc
CreateDirectoryW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetTimeZoneInformation
GetFileAttributesExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
HeapAlloc
RemoveVectoredExceptionHandler
FreeLibraryAndExitThread
ResumeThread
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetModuleHandleExW
ExitProcess
GetFullPathNameW
GetDriveTypeW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
RaiseException
InterlockedFlushSList
InterlockedPushEntrySList
GetFileSizeEx
VerifyVersionInfoA
FormatMessageW
WaitForMultipleObjects
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
SleepEx
SetFilePointerEx
GetComputerNameA
GetThreadTimes
SetLastError
GetModuleFileNameW
K32GetModuleInformation
PeekNamedPipe
GetStartupInfoW
IsDebuggerPresent
TerminateProcess
UnhandledExceptionFilter
InitializeSListHead
FindResourceW
FindResourceA
SizeofResource
LoadResource
LockResource
CreateFileW
IsProcessorFeaturePresent
InterlockedDecrement
GetProcessHeap
HeapValidate
InterlockedIncrement
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
GetLocaleInfoEx
LocalFree
CreateSymbolicLinkW
GetFileInformationByHandleEx
GetModuleHandleW
CloseThreadpoolWait
SetThreadpoolWait
TerminateThread
GetCurrentDirectoryW
GetTickCount
GetCurrentDirectoryA
DeleteFileA
ReleaseMutex
CreateMutexA
GlobalFree
lstrlenA
GetPrivateProfileStringA
MoveFileA
GetNativeSystemInfo
GetExitCodeThread
AddVectoredExceptionHandler
K32QueryWorkingSetEx
VerifyVersionInfoW
VirtualProtect
VirtualAlloc
VerSetConditionMask
Sleep
LoadLibraryA
GetProcAddress
WTSGetActiveConsoleSessionId
UnregisterWait
RegisterWaitForSingleObject
OpenProcess
GetCurrentThread
GetCurrentProcessId
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
InitOnceExecuteOnce
InitializeSRWLock
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTempPathW
SetFileInformationByHandle
InitializeCriticalSectionEx
GetStringTypeW
GetCurrentThreadId
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FormatMessageA
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
SetFilePointer
WinExec
SetUnhandledExceptionFilter
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
CreateDirectoryA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetSystemInfo
OutputDebugStringA
AllocConsole
GlobalAlloc
WaitNamedPipeW
SwitchToThread
GetCurrentProcess
GetLastError
CloseHandle
HeapFree
GetFileAttributesA
user32
ChangeDisplaySettingsA
MessageBoxA
LoadStringA
OffsetRect
SetRect
FillRect
GetClientRect
InvalidateRect
DefWindowProcA
UnregisterClassA
RegisterClassExA
CreateWindowExA
DestroyWindow
MoveWindow
SetFocus
UpdateWindow
SetForegroundWindow
CharNextExA
CharPrevExA
RegisterClassA
GetMenu
SetWindowTextA
GetWindowRect
AdjustWindowRectEx
LoadCursorA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
SendMessageW
DefWindowProcW
GetWindowLongA
InsertMenuA
DestroyMenu
CreatePopupMenu
UnregisterClassW
RegisterClassExW
CreateWindowExW
LoadImageW
ReleaseCapture
SetCapture
GetCapture
ShowWindow
ClientToScreen
SetCursorPos
LoadImageA
DestroyCursor
SetCursor
ShowCursor
GetKeyState
SystemParametersInfoA
DestroyIcon
LoadIconA
EndPaint
BeginPaint
SetTimer
KillTimer
ReleaseDC
GetDC
PeekMessageA
GetWindowModuleFileNameA
UnhookWinEvent
SetWinEventHook
DispatchMessageA
TranslateMessage
GetMessageA
FindWindowA
ScreenToClient
GetCursorPos
GetAsyncKeyState
SetWindowPos
FlashWindowEx
SendMessageA
PostQuitMessage
RegisterRawInputDevices
GetRawInputData
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetWindowThreadProcessId
SetWindowLongW
SetWindowLongA
IsWindowUnicode
IsWindow
TrackPopupMenu
GetSystemMetrics
gdi32
PatBlt
DeleteObject
GetTextExtentPoint32A
CreateSolidBrush
EnumFontFamiliesExA
GetStockObject
CreateCompatibleDC
DeleteDC
SelectObject
SetBkColor
SetBkMode
SetDIBitsToDevice
SetTextColor
CreateDIBSection
TextOutA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
StretchBlt
TextOutW
CreateFontIndirectA
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
SetKernelObjectSecurity
SetSecurityInfo
CryptEncrypt
RegCloseKey
shell32
Shell_NotifyIconA
SHGetSpecialFolderPathA
ShellExecuteA
ole32
CoInitialize
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoUninitialize
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
oleaut32
SafeArrayCreate
SafeArrayDestroy
SafeArrayAccessData
VariantInit
VariantClear
SysAllocString
SysFreeString
SysStringLen
SafeArrayGetLBound
SafeArrayGetUBound
winmm
timeBeginPeriod
timeEndPeriod
timeGetDevCaps
timeGetTime
d3d8
Direct3DCreate8
python27
PyTuple_GetItem
PyDict_GetItemString
PyInt_FromLong
PyLong_FromLongLong
PyTuple_New
PyTuple_SetItem
PyList_New
PyList_Append
PyDict_New
PyDict_SetItemString
PyLong_AsLong
PyModule_AddIntConstant
Py_InitModule4
Py_BuildValue
PyInt_AsLong
PyDict_Next
PyDict_Size
PyObject_GetAttrString
PyString_FromString
PyImport_ImportModule
PyObject_CallObject
PyString_AsString
PyThreadState_Get
PyErr_SetString
PyExc_RuntimeError
PyArg_ParseTuple
PyList_Size
PyList_GetItem
PyModule_AddStringConstant
PyString_InternFromString
PyTuple_Size
PyCallable_Check
PyLong_AsLongLong
PyLong_AsUnsignedLongLong
PyFloat_AsDouble
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyNumber_Check
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyEval_SetTrace
Py_FlushLine
PyImport_GetMagicNumber
PyImport_AddModule
PyObject_AsCharBuffer
PyCode_Addr2Line
PyEval_EvalCode
Py_OptimizeFlag
PyCode_Type
PyUnicodeUCS2_DecodeUTF8
_PyLong_FromByteArray
PyFloat_FromDouble
PyString_FromStringAndSize
PyList_SetItem
PyDict_SetItem
PyErr_Occurred
PyErr_NoMemory
PyEval_GetRestricted
PyCode_New
PyMarshal_ReadObjectFromString
_PyLong_New
_Py_EllipsisObject
PyExc_StopIteration
PyExc_EOFError
PyExc_ValueError
PyObject_GetAttr
PyComplex_FromCComplex
wtsapi32
WTSSendMessageA
netapi32
Netbios
imm32
ImmGetIMEFileNameA
ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
devil
ilInit
ilTexImage
ilSetPixels
ilSave
ilShutDown
ilOriginFunc
ilEnable
ilCopyPixels
ilConvertImage
ilLoad
ilGetInteger
ilGenImages
ilDeleteImages
ilBindImage
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
imagehlp
EnumerateLoadedModules
GetTimestampForLoadedLibrary
StackWalk
granny2
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyBeginControlledAnimation@8
_GrannyEndControlledAnimation@4
_GrannySetTrackGroupTarget@12
_GrannySetTrackGroupLOD@16
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetControlLoopCount@4
_GrannyFreeControlIfComplete@4
_GrannyDeformVertices@24
GrannyPNT332VertexType
_GrannySetLogCallback@4
_GrannyReadEntireFileFromMemory@8
_GrannyFreeFileSection@8
_GrannyFreeFile@4
_GrannyGetFileInfo@4
_GrannyGetMaterialTextureByType@8
_GrannyFindMatchingMember@16
_GrannySetControlSpeed@8
_GrannyGetSourceSkeleton@4
_GrannyCompleteControlAt@8
_GrannySetModelClock@8
_GrannyFreeCompletedModelControls@4
_GrannySampleModelAnimationsAccelerated@20
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyUpdateModelMatrix@20
_GrannyNewLocalPose@4
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyGetControlSpeed@4
_GrannyFreeLocalPose@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyInstantiateModel@4
_GrannyFreeModelInstance@4
_GrannyNewMeshBinding@12
_GrannyControlIsComplete@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFindBoneByName@12
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetControlLocalDuration@4
_GrannyConvertSingleObject@20
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyGetSourceModel@4
_GrannyFindTrackGroupForModel@12
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannySetControlLoopCount@8
_GrannyFreeMeshBinding@4
mss32
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_set_3D_sample_loop_count@8
_AIL_auto_update_3D_position@8
_AIL_update_3D_position@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_start_3D_sample@4
_AIL_release_3D_sample_handle@4
_AIL_allocate_3D_sample_handle@4
_AIL_sample_volume_pan@12
_AIL_sample_status@4
_AIL_set_sample_loop_count@8
_AIL_set_sample_volume_pan@12
_AIL_end_sample@4
_AIL_resume_sample@4
_AIL_stop_sample@4
_AIL_start_sample@4
_AIL_set_sample_file@12
_AIL_init_sample@4
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_last_error@0
_AIL_stream_status@4
_AIL_set_stream_loop_count@8
_AIL_stream_volume_levels@12
_AIL_set_stream_volume_levels@12
_AIL_pause_stream@8
_AIL_start_stream@4
_AIL_close_stream@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_3D_orientation@28
_AIL_set_3D_velocity@20
_AIL_set_3D_position@16
_AIL_close_3D_listener@4
_AIL_open_3D_listener@4
_AIL_close_3D_provider@4
_AIL_open_3D_provider@4
_AIL_enumerate_3D_providers@12
_AIL_close_digital_driver@4
_AIL_open_stream@12
_AIL_open_digital_driver@16
_AIL_file_type@8
_AIL_decompress_ADPCM@12
_AIL_decompress_ASI@24
_AIL_WAV_info@8
_AIL_set_file_callbacks@16
_AIL_file_read@8
_AIL_mem_free_lock@4
speedtreert
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?DeleteTransientData@CSpeedTreeRT@@QAEXXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1CSpeedTreeRT@@QAE@XZ
??2CSpeedTreeRT@@SAPAXI@Z
??3CSpeedTreeRT@@SAXPAX@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
dinput8
DirectInput8Create
ws2_32
accept
listen
WSASetLastError
freeaddrinfo
WSACloseEvent
WSACreateEvent
getsockopt
WSAEnumNetworkEvents
WSAEventSelect
__WSAFDIsSet
getpeername
bind
setsockopt
WSAIoctl
recvfrom
sendto
connect
gethostname
gethostbyname
ntohs
ntohl
inet_addr
htons
htonl
WSACleanup
WSAStartup
WSAGetLastError
socket
send
select
recv
ioctlsocket
closesocket
getaddrinfo
getsockname
ddraw
DirectDrawCreate
resource
PythonPlayerSettingsModuleLibRegisterVariables
LoadGameNPC
RegisterSkill
GetHorsePathNameByMode
PythonPlayerSettingsModuleLibRegisterFunctions
LoadPythonPlayerSettingsModuleLibrary
iphlpapi
GetAdaptersInfo
crypt32
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
PFXImportCertStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CryptStringToBinaryA
wldap32
ord22
ord26
ord41
ord50
ord32
ord33
ord35
ord79
ord30
ord200
ord143
ord45
ord301
ord60
ord211
ord27
ord217
ord46
normaliz
IdnToUnicode
IdnToAscii
Sections
.text Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 913KB - Virtual size: 913KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 190KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 222KB - Virtual size: 222KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ