Behavioral task
behavioral1
Sample
fb649af245b195baa02a4790f237b4c7dad4d9a116ab10ec5fdb9be45dbd628a.exe
Resource
win7-20240221-en
General
-
Target
f91e26ad117d187f3fc7bc2aeadb9c4d.bin
-
Size
3.8MB
-
MD5
3034f348cddd8165ab6efa68e6f891a8
-
SHA1
45c0550dcc6bd99c8e3f2abbc88b8de6c723f175
-
SHA256
177a2c7fd93f43203d8f0d1af204442c0a673bb632440bede23d3adddcb20ed9
-
SHA512
9aad85432bc61eeacebf60fa844d5810e51a33142ebfc1bad983138bf69bd9999d2a7d88ef8b349c007e0c962701fc853550303a850fba2dd19829fa358e919c
-
SSDEEP
98304:OpQvoyD4k8KX7DmKDZpE47RwcOqTD6ycG5MN5/xc:3//tiwvB6yRoxc
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule static1/unpack001/fb649af245b195baa02a4790f237b4c7dad4d9a116ab10ec5fdb9be45dbd628a.exe family_zgrat_v1 -
Zgrat family
Files
-
f91e26ad117d187f3fc7bc2aeadb9c4d.bin.zip
Password: infected
-
fb649af245b195baa02a4790f237b4c7dad4d9a116ab10ec5fdb9be45dbd628a.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
15:09:3a:44:68:a4:45:48:bb:52:b8:4b:44:6b:04:41Certificate
IssuerCN=Honor Studio,OU=Honor Studio,O=Creted by Honor Studio,L=ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„,ST=Made in,C=GreekNot Before24-02-2024 10:04Not After23-07-2026 00:00SubjectCN=Honor Studio,OU=Honor Studio,O=Creted by Honor Studio,L=ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„,ST=Made in,C=Greek39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03-05-2023 00:00Not After02-08-2034 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
42:ae:84:f8:93:3c:07:80:19:99:79:c4:f1:6b:6f:35:5e:6a:b0:64:06:c8:43:9c:9a:e8:02:22:87:85:f6:61Signer
Actual PE Digest42:ae:84:f8:93:3c:07:80:19:99:79:c4:f1:6b:6f:35:5e:6a:b0:64:06:c8:43:9c:9a:e8:02:22:87:85:f6:61Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
gitunitteamfrendly.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 6.8MB - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ