Static task
static1
Behavioral task
behavioral1
Sample
290cfc41dc6bc6efab8443cd5d3d0dc84a372a5c275f2bd1a7353e78be95eefe.exe
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral2
Sample
290cfc41dc6bc6efab8443cd5d3d0dc84a372a5c275f2bd1a7353e78be95eefe.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
General
-
Target
290cfc41dc6bc6efab8443cd5d3d0dc84a372a5c275f2bd1a7353e78be95eefe
-
Size
8.0MB
-
MD5
7bfaf40c61589d4994a5d1d794dc813c
-
SHA1
3154e0c3e9802f800a9784b3e350df92afc7955d
-
SHA256
290cfc41dc6bc6efab8443cd5d3d0dc84a372a5c275f2bd1a7353e78be95eefe
-
SHA512
0d3f8bcc8d5fd388b26be2358c9ad4abb99b3779b9426025312d73913269dc64788c4f68fe39a51dd8791bbd2d55feca88e270c6d86fe32ffeb8e03025e949e0
-
SSDEEP
98304:YgzKeu2niX6x4Cc6eZlkxoXtEaS8gskvRdSmrD7i9yVafZ79j:YgOm+xIx0kj7ieahZj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 290cfc41dc6bc6efab8443cd5d3d0dc84a372a5c275f2bd1a7353e78be95eefe
Files
-
290cfc41dc6bc6efab8443cd5d3d0dc84a372a5c275f2bd1a7353e78be95eefe.exe windows:6 windows x86
5c5659f8bb14075e4091daa28da69861
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
IsBadReadPtr
GetFileSize
CreateFileA
RtlCaptureStackBackTrace
Module32Next
Module32First
ReadProcessMemory
CreateProcessA
CreatePipe
SetHandleInformation
ReadFile
GetModuleFileNameA
MultiByteToWideChar
SetFileAttributesA
GetModuleHandleA
Process32Next
Process32First
CreateToolhelp32Snapshot
K32GetProcessImageFileNameA
K32GetModuleFileNameExA
QueryDosDeviceA
GetLogicalDriveStringsA
WriteConsoleW
SetEndOfFile
HeapQueryInformation
HeapSize
OutputDebugStringW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
CreateThread
GetHandleInformation
IsBadCodePtr
VirtualQuery
K32GetMappedFileNameA
GetFullPathNameA
FindNextFileA
FindFirstFileA
FindClose
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetStdHandle
DeleteFileW
SetFileAttributesW
SetCurrentDirectoryW
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
FlushFileBuffers
HeapReAlloc
CreateDirectoryW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetTimeZoneInformation
GetFileAttributesExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTempPathW
SetConsoleCtrlHandler
HeapAlloc
HeapFree
RemoveVectoredExceptionHandler
ResumeThread
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetModuleHandleExW
ExitProcess
GetFullPathNameW
GetDriveTypeW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
RaiseException
InterlockedFlushSList
InterlockedPushEntrySList
GetFileSizeEx
VerifyVersionInfoA
FormatMessageW
WaitForMultipleObjects
GetFileType
GetStdHandle
GetEnvironmentVariableA
MoveFileExA
SleepEx
SetFilePointerEx
GetComputerNameA
GetThreadTimes
SetLastError
GetModuleFileNameW
WaitNamedPipeW
PeekNamedPipe
GetStartupInfoW
OpenThread
TerminateProcess
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
InitializeSListHead
FindResourceW
FindResourceA
SizeofResource
LoadResource
LockResource
CreateFileW
IsProcessorFeaturePresent
InterlockedDecrement
GetProcessHeap
HeapValidate
InterlockedIncrement
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
GetLocaleInfoEx
LocalFree
CreateSymbolicLinkW
GetFileInformationByHandleEx
K32GetModuleInformation
TerminateThread
GetCurrentDirectoryW
GetTickCount
GetCurrentDirectoryA
DeleteFileA
ReleaseMutex
CreateMutexA
GlobalFree
lstrlenA
GetPrivateProfileStringA
MoveFileA
GetNativeSystemInfo
AddVectoredExceptionHandler
K32QueryWorkingSetEx
VerifyVersionInfoW
VirtualProtect
VirtualAlloc
VerSetConditionMask
Sleep
LoadLibraryA
GetProcAddress
WTSGetActiveConsoleSessionId
UnregisterWait
RegisterWaitForSingleObject
OpenProcess
GetCurrentThread
GetCurrentProcessId
GetModuleHandleW
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetFileInformationByHandle
GetStringTypeW
GetCurrentThreadId
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
FormatMessageA
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
GetExitCodeThread
WriteFile
SetFilePointer
WinExec
SetUnhandledExceptionFilter
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
CreateDirectoryA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetSystemInfo
OutputDebugStringA
AllocConsole
GlobalAlloc
IsDebuggerPresent
SwitchToThread
GetCurrentProcess
GetLastError
CloseHandle
FreeLibraryAndExitThread
GetFileAttributesA
user32
OffsetRect
SetRect
FillRect
GetClientRect
InvalidateRect
EndPaint
DefWindowProcA
UnregisterClassA
RegisterClassExA
CreateWindowExA
DestroyWindow
MoveWindow
SetFocus
UpdateWindow
LoadStringA
CharNextExA
CharPrevExA
RegisterClassA
GetMenu
SetWindowTextA
GetWindowRect
AdjustWindowRectEx
LoadCursorA
PostThreadMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
GetWindowLongA
SendMessageW
ChangeDisplaySettingsA
SetForegroundWindow
TrackPopupMenu
InsertMenuA
DestroyMenu
CreatePopupMenu
DefWindowProcW
UnregisterClassW
RegisterClassExW
CreateWindowExW
ReleaseCapture
SetCapture
GetCapture
ShowWindow
ClientToScreen
SetCursorPos
LoadImageA
DestroyCursor
SetCursor
ShowCursor
GetKeyState
SystemParametersInfoA
SetTimer
LoadImageW
BeginPaint
ReleaseDC
DestroyIcon
LoadIconA
FindWindowA
GetDC
PeekMessageA
GetWindowModuleFileNameA
UnhookWinEvent
SetWinEventHook
DispatchMessageA
TranslateMessage
GetMessageA
ScreenToClient
GetCursorPos
GetAsyncKeyState
SetWindowPos
FlashWindowEx
SendMessageA
PostQuitMessage
RegisterRawInputDevices
GetRawInputData
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetWindowThreadProcessId
SetWindowLongW
SetWindowLongA
IsWindowUnicode
KillTimer
IsWindow
MessageBoxA
GetSystemMetrics
gdi32
PatBlt
DeleteObject
GetTextExtentPoint32A
CreateSolidBrush
EnumFontFamiliesExA
GetStockObject
CreateCompatibleDC
DeleteDC
SelectObject
SetBkColor
SetBkMode
SetDIBitsToDevice
SetTextColor
CreateDIBSection
TextOutA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
StretchBlt
TextOutW
CreateFontIndirectA
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
SetKernelObjectSecurity
SetSecurityInfo
CryptEncrypt
RegCloseKey
shell32
SHGetSpecialFolderPathA
Shell_NotifyIconA
ShellExecuteA
ole32
CoInitialize
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoUninitialize
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
oleaut32
SafeArrayCreate
SafeArrayAccessData
SysFreeString
VariantClear
VariantInit
SysAllocString
SafeArrayDestroy
SysStringLen
SafeArrayGetLBound
SafeArrayGetUBound
winmm
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
timeGetTime
d3d8
Direct3DCreate8
python27
PyTuple_GetItem
PyDict_GetItemString
PyInt_FromLong
PyLong_FromLongLong
PyTuple_New
PyTuple_SetItem
PyList_New
PyList_Append
PyDict_New
PyDict_SetItemString
PyInt_AsLong
PyTuple_Size
PyModule_AddIntConstant
Py_InitModule4
Py_BuildValue
PyDict_Next
PyDict_Size
PyObject_GetAttrString
PyString_FromString
PyImport_ImportModule
PyObject_CallObject
PyString_AsString
PyThreadState_Get
PyErr_SetString
PyExc_RuntimeError
PyArg_ParseTuple
PyList_Size
PyList_GetItem
PyDict_SetItem
PyModule_AddStringConstant
PyLong_AsLong
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyLong_AsUnsignedLongLong
PyFloat_AsDouble
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyNumber_Check
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyEval_SetTrace
Py_FlushLine
PyImport_GetMagicNumber
PyImport_AddModule
PyObject_AsCharBuffer
PyCode_Addr2Line
PyEval_EvalCode
Py_OptimizeFlag
PyCode_Type
PyUnicodeUCS2_DecodeUTF8
PyFloat_FromDouble
PyComplex_FromCComplex
PyString_FromStringAndSize
PyList_SetItem
PyErr_Occurred
PyErr_NoMemory
PyEval_GetRestricted
PyCode_New
PyMarshal_ReadObjectFromString
_PyLong_New
_Py_EllipsisObject
PyExc_StopIteration
PyExc_EOFError
PyExc_ValueError
PyString_InternFromString
_PyLong_FromByteArray
wtsapi32
WTSSendMessageA
netapi32
Netbios
imm32
ImmGetIMEFileNameA
ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
devil
ilInit
ilTexImage
ilSetPixels
ilSave
ilShutDown
ilOriginFunc
ilEnable
ilCopyPixels
ilConvertImage
ilLoad
ilGetInteger
ilGenImages
ilDeleteImages
ilBindImage
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
imagehlp
GetTimestampForLoadedLibrary
EnumerateLoadedModules
StackWalk
granny2
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyBeginControlledAnimation@8
_GrannyEndControlledAnimation@4
_GrannySetTrackGroupTarget@12
_GrannySetTrackGroupLOD@16
_GrannyGetMeshTriangleGroupCount@4
_GrannySetControlEaseIn@8
_GrannyGetControlLocalDuration@4
_GrannyFreeControlIfComplete@4
_GrannyControlIsComplete@4
_GrannySetLogCallback@4
_GrannyReadEntireFileFromMemory@8
_GrannyFreeFileSection@8
_GrannyFreeFile@4
_GrannyGetFileInfo@4
_GrannyGetMaterialTextureByType@8
_GrannyFindMatchingMember@16
_GrannyConvertSingleObject@20
_GrannySetControlSpeed@8
_GrannySetModelClock@8
_GrannyFreeCompletedModelControls@4
_GrannyFreeControlOnceUnused@4
_GrannySampleModelAnimationsAccelerated@20
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
_GrannyUpdateModelMatrix@20
_GrannyNewLocalPose@4
_GrannyFreeLocalPose@4
GrannyPNT332VertexType
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyGetControlLoopCount@4
_GrannyInstantiateModel@4
_GrannyFreeModelInstance@4
_GrannyCompleteControlAt@8
_GrannyFreeMeshBinding@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFindBoneByName@12
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannyGetWorldPose4x4@8
_GrannyGetSourceSkeleton@4
_GrannySetControlLoopCount@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyGetSourceModel@4
_GrannyFindTrackGroupForModel@12
_GrannyFreeControl@4
_GrannyGetControlSpeed@4
_GrannyNewMeshBinding@12
mss32
_AIL_set_file_callbacks@16
_AIL_auto_update_3D_position@8
_AIL_file_read@8
_AIL_mem_free_lock@4
_AIL_update_3D_position@8
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_set_3D_sample_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_start_3D_sample@4
_AIL_release_3D_sample_handle@4
_AIL_allocate_3D_sample_handle@4
_AIL_sample_volume_pan@12
_AIL_sample_status@4
_AIL_set_sample_loop_count@8
_AIL_set_sample_volume_pan@12
_AIL_end_sample@4
_AIL_resume_sample@4
_AIL_stop_sample@4
_AIL_start_sample@4
_AIL_WAV_info@8
_AIL_init_sample@4
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_last_error@0
_AIL_stream_status@4
_AIL_set_stream_loop_count@8
_AIL_stream_volume_levels@12
_AIL_set_stream_volume_levels@12
_AIL_pause_stream@8
_AIL_start_stream@4
_AIL_close_stream@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_3D_orientation@28
_AIL_set_3D_velocity@20
_AIL_set_3D_position@16
_AIL_close_3D_listener@4
_AIL_open_3D_listener@4
_AIL_close_3D_provider@4
_AIL_open_3D_provider@4
_AIL_enumerate_3D_providers@12
_AIL_close_digital_driver@4
_AIL_open_stream@12
_AIL_open_digital_driver@16
_AIL_file_type@8
_AIL_decompress_ADPCM@12
_AIL_decompress_ASI@24
_AIL_set_sample_file@12
speedtreert
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1CSpeedTreeRT@@QAE@XZ
??2CSpeedTreeRT@@SAPAXI@Z
??3CSpeedTreeRT@@SAXPAX@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?DeleteTransientData@CSpeedTreeRT@@QAEXXZ
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
dinput8
DirectInput8Create
ws2_32
listen
WSAIoctl
freeaddrinfo
WSACloseEvent
WSACreateEvent
WSASetLastError
__WSAFDIsSet
closesocket
connect
getsockopt
getsockname
getpeername
setsockopt
WSAEnumNetworkEvents
WSAEventSelect
recvfrom
sendto
accept
recv
gethostname
gethostbyname
ntohs
ntohl
inet_addr
htons
htonl
WSACleanup
WSAStartup
WSAGetLastError
socket
send
getaddrinfo
ioctlsocket
bind
select
ddraw
DirectDrawCreate
resource
PythonPlayerSettingsModuleLibRegisterVariables
LoadGameNPC
RegisterSkill
GetHorsePathNameByMode
PythonPlayerSettingsModuleLibRegisterFunctions
LoadPythonPlayerSettingsModuleLibrary
iphlpapi
GetAdaptersInfo
crypt32
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
PFXImportCertStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CryptStringToBinaryA
wldap32
ord41
ord22
ord45
ord50
ord27
ord32
ord33
ord35
ord79
ord30
ord301
ord200
ord60
ord211
ord46
ord26
ord143
ord217
normaliz
IdnToUnicode
IdnToAscii
Sections
.text Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 921KB - Virtual size: 921KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 177KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ