�%��;D�9��ߥ�9!4eo`�9�(��+Q6�3�9��'E/��r�YoT���c)��y\ɰ�=\2�Vx-��I��^c_ �U����a6.��R/!{G��2�k�Hވ"���UmU8����%9f�nـ6�*�A�n�D$b�C�?�=S�g�xS{4�T=m�O���2����ϓ�I��Mcg�6H� ܭ�v{�Ũ��Ab���&No�v��,"Z��h\и2���9x�u)c� Q������3['�����')T�9��#�W�&t�� ��\����W7��^dc�Dq�Y�\�` ���` j8����7�����8�����y�K8�9m��8�Tkg6��=�����s����BD�$.��6�sjf�);J ��IIi���W������CX���������*Mg���P� �$����c�OФ��EBd�^7y��z+� �X4lm~8�PY=���D�z��C\h�$���t���/=?�S!�#E��Hg�d���Ռ�j�Ƹ>��A���� Y sb�E���=1�&�VN:I�8@x�O��r������v���gU~��&4�RZ�Ɣ+�����/BX:-��_��"��~�\�l�� ��W&��c���Hc�~%�G�a�P�#�/��� �����s���%�q���{���[�R��� �\\�;d�2���4�V�5[�M��r!5���F[�4��1��0��Xj�nm���F'�|$���,��f��!�w��%��l��#�a�m�̓�K�ZR@Q8s��2��t2tכ��r@A'�0��,��`�U��\t�PW�(��?/~��S���(U��{υ�p~�9�:��:n�FQ�z�U�r"%����lq/_i�eC9Qcu���d�K��ዴd���{���4��1gE�rAj�5�b�D؎v;�F �\2����]'Ɔ� P�jy���N�-{����F��cC�ɂ �ƜI`�{�ѓ�q(�����fz����X�)�����Q#Ĉ�W1=7z9H�ס�0�����xϹQP��O9���?��4噛�J}~�=��D�)wD�.%��{7����GD�����@\��"�\�C��.m=�P������c�+�Ӝ�4�#�k t;��N?7�G�T|���C;7�l��`����b�L�����`�ɉ@���NYJ"�n��0���h��/��*[��D'�5m�)[c!�t�b�����]f�8 N�[ɾS��/�J?�a�����-�&��m� ��u�K�r���,SF[Ӿ|��s s7ς��|��ʬ� ���t�T�V��z0����z�;ᅃ��\�˴�T$n��6B�b�铕~��9��=��x����W���7��i�@V<�c�((3���XO����K�3�r��j١�N�&�$�WTC�¾�K� �Eg�PZ��1桶�w\��M���Q#�ʥv�a��s,\*�G6�?��-j@��-��\r���!�mY͚:�V�����Q�n�� �ۿ"E�C.�P�u�Hs�[����_�B\�D�m��wll6����Y"*�ؙ���.�e��Z� ���袮�g�r��b|or$�nX��G�6���j��KS'od����S���I]���@|�N��Uљ��Vv+\a�+���tk��sY3xI.���+� ���2�(��#����΅������k�Z?�S3�*nߍ���sط����?�xݓ������a���BJ��O���C�R���x�%������n�&���!�e�LЇir�BC�m�T������r�KΏ��a�5Z)�ft�VȲ�ۘP��O�&?E��,fGq��� xN��gxTr�5�˷�v��]o�mJ�A�_��ǜߑ��Y�U�П~�o����>+Ԝk�v�t�����>E�PH<������yA�y&_^FH��ɖ�Y�$l�0��R�A���K���쳻�� -�35�p� ���3���LKqH�%y��i\�57xJ�-��S�가J���������y��Ơ�5�$�`�At3�����fm�o#c�)ťt_r`\/h_��*Z�8�DW͓t��`o��E�A��;�).����w���2t���1���@��Diw�'q!B�C�Wϻӯ0���j#ث�qaDS�vG�`�� ��b#�� ��yC K���(�"�.�V.���/�5��E�m��Q�k5 nzX��QV���ֈNƂ�$p�ť\�9���J��l��,6eeD�S.�K\���ڠT �g �Gⷥ!����6w���걍K |E[k ��%������p$1ߜ�h�'@-������=8��'R%]�yC[����~� Ϛ�$&���7��q�����9NG+6 �U%�� Y�.�l����_#�!Q(�/e+��1Sڱ����;�]�`.�"�]�ZN�붱��:�.���]t���*K� �j����;����ٸjX��8t�*��T�>d(w�yljx)������-���[��+�9���'���Nc��l��m/K��1J��ut�ׂDU��N�*�G�D�0���`{��v ���F<���-�Z���{nH�WMb~�J�h����*g��4E�`���D����,a�T���Ei�\Zv =���{ۺ~�MG駷����33�����#}�>xh#ps�([D��;fC��q���Jd�w`{�P�ϰ(N��5�E�N3�w-�16K����D����W����ہ�Eߎ��{G����X��CH�7��Fg���-�b���Q�Z|f �T(�F)ǿ��Q丑T��`�2Z���q�KO� h_�!bxmǬN5�#��H�eL���O�Vw���~��0���d��.��\㰳��pwQl4mD\{c�nx`R�?$����r�*'��i���-�'q19���Y�Ʉ�w�;o�j���b�oӬ�P� {�Sƪ�J��]@z�͡�L�s7ds��z�!�����Z^{��N*-qWu���K���E�nd�*L��vG��O#Y/t:����O ����t|�<�yn8�:���l��O�1���K�����z� ul��?,��x6� r�o^�Y%���0�_hԶ���wA�8,�;y��V��G� !a�w]9 q�
Static task
static1
Behavioral task
behavioral1
Sample
2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2.exe
Resource
win10v2004-20240508-en
General
-
Target
2.dat
-
Size
15.0MB
-
MD5
a10770651dcb97605c4adcab4e578673
-
SHA1
21b8f6de0304890dc52c847452399b0d6c92e991
-
SHA256
466e66ff447fd77214e68bef2477d7cd147cf03c8616916bd9a17336e6d069fd
-
SHA512
55e41a07bc9b414ea312b971572fd22f25d643398fa0257958cf075cbc4c9345ebfad86f61ac0f65ce45806165c1a6e455cde2593ec8d3f0690a53285562220f
-
SSDEEP
393216:y0fJyqO0GlrgdGvM9KXjn/SKdVcGIpnL6iLmmC:yqJwvlrgdqM8XrSKdVcG0L4mC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2.dat
Files
-
2.dat.exe windows:6 windows x86 arch:x86
cb225f0d250aaf28cadfcae9b7d97b9a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindNextFileW
FreeLibrary
GetModuleHandleExW
ReleaseSemaphore
CreateSemaphoreW
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
GetExitCodeProcess
GetUserDefaultLangID
GlobalFree
SetHandleInformation
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
lstrcmpW
GetVolumeInformationW
GetDriveTypeW
OutputDebugStringA
FormatMessageA
RaiseException
SetLastError
SystemTimeToFileTime
GetStdHandle
GetModuleHandleA
FindFirstFileA
FindNextFileA
GetTickCount
GlobalMemoryStatus
FlushConsoleInputBuffer
GetExitCodeThread
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
SetFileInformationByHandle
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitOnceExecuteOnce
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetSystemTimeAsFileTime
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
WideCharToMultiByte
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
GetFileInformationByHandleEx
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
CreateSymbolicLinkW
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetFileSize
SetFileAttributesW
GetVolumeInformationA
GetComputerNameA
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
SetConsoleCtrlHandler
GetCommandLineA
ExitThread
FreeLibraryAndExitThread
SetStdHandle
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
ExitProcess
PeekNamedPipe
GetConsoleCP
HeapFree
HeapAlloc
LCMapStringW
IsValidLocale
EnumSystemLocalesW
CreatePipe
HeapReAlloc
SetEnvironmentVariableW
GetFileSizeEx
SetConsoleMode
GetNumberOfConsoleInputEvents
ReadConsoleInputW
PeekConsoleInputA
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
WriteConsoleW
FindFirstFileExW
MultiByteToWideChar
OpenFileMappingW
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
FindFirstFileW
FindClose
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
MoveFileExW
UnmapViewOfFile
MapViewOfFile
VirtualQuery
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
MoveFileW
CopyFileW
DeviceIoControl
GetVolumePathNamesForVolumeNameW
GetTempPathW
RemoveDirectoryW
CloseThreadpoolTimer
GetLongPathNameW
CreateFileMappingW
WriteFile
SetFilePointerEx
SetEndOfFile
ReadFile
GetLogicalDrives
GetFileType
FlushFileBuffers
GetTickCount64
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleFileNameW
GetStartupInfoW
GetSystemInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
TerminateThread
SetThreadPriority
CreateThread
SwitchToThread
WaitForMultipleObjects
Sleep
WaitForSingleObject
DuplicateHandle
GetUserPreferredUILanguages
GetCurrencyFormatW
GetTimeFormatW
GetDateFormatW
GetThreadPriority
GetCurrentThread
ResetEvent
LoadLibraryW
GetSystemDirectoryW
DeleteFileW
CreateEventW
WaitForSingleObjectEx
SetEvent
GetConsoleWindow
OutputDebugStringW
GetLocalTime
GetSystemTime
GetNativeSystemInfo
GetCommandLineW
GetUserDefaultLCID
GetCurrentProcessId
CompareStringW
GlobalSize
LoadLibraryA
GetLocaleInfoW
GlobalLock
GlobalUnlock
GlobalAlloc
OpenProcess
CheckRemoteDebuggerPresent
ExpandEnvironmentStringsW
SetErrorMode
FormatMessageW
LocalFree
GetProcAddress
GetModuleHandleW
GetCurrentThreadId
GetLastError
InitializeCriticalSection
ReleaseMutex
CreateMutexW
VirtualAlloc
VirtualFree
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
K32EnumProcesses
CreateProcessW
CloseHandle
CreateFileW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
SubmitThreadpoolWork
VirtualQuery
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
dwmapi
DwmEnableBlurBehindWindow
DwmIsCompositionEnabled
user32
GetUserObjectInformationW
MessageBoxA
FindWindowExW
GetDoubleClickTime
IsWindow
MessageBeep
GetCaretBlinkTime
GetDesktopWindow
SystemParametersInfoW
UpdateLayeredWindowIndirect
SendMessageW
PostMessageW
AttachThreadInput
DefWindowProcW
CreateWindowExW
IsChild
DestroyWindow
ShowWindow
UpdateLayeredWindow
SetLayeredWindowAttributes
FlashWindowEx
MoveWindow
FindWindowW
GetQueueStatus
DispatchMessageW
TranslateMessage
RealGetWindowClassW
EnumWindows
GetWindowTextW
GetMessageExtraInfo
TrackMouseEvent
GetClipboardFormatNameW
RegisterClassW
GetCursorInfo
GetIconInfo
CreateIconIndirect
CreateCursor
LoadCursorW
GetCursor
SetCursorPos
NotifyWinEvent
SetMenuItemInfoW
TrackPopupMenuEx
GetMenu
MapVirtualKeyW
ToUnicode
ToAscii
GetKeyboardState
GetKeyState
IsZoomed
PeekMessageW
SetCaretPos
HideCaret
DestroyCaret
CreateCaret
RegisterWindowMessageW
GetWindowPlacement
SetWindowPlacement
IsWindowVisible
IsIconic
SetFocus
GetProcessWindowStation
MapWindowPoints
DrawIconEx
MessageBoxW
CharNextExA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
KillTimer
SetTimer
SetWindowPos
MsgWaitForMultipleObjectsEx
GetCapture
SetCapture
ReleaseCapture
GetSystemMetrics
GetSystemMenu
EnableMenuItem
GetForegroundWindow
SetForegroundWindow
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
SetWindowRgn
InvalidateRect
SetWindowTextW
GetWindowRect
AdjustWindowRectEx
SetCursor
ClientToScreen
ScreenToClient
GetWindowLongW
SetWindowLongW
GetParent
GetSysColorBrush
SetParent
GetWindowThreadProcessId
DestroyCursor
DestroyIcon
GetAncestor
GetKeyboardLayoutList
GetKeyboardLayout
GetAsyncKeyState
RegisterClipboardFormatW
ChangeClipboardChain
SetClipboardViewer
IsHungAppWindow
LoadIconW
GetSysColor
EnumDisplayMonitors
GetMonitorInfoW
LoadImageW
ChildWindowFromPointEx
GetCursorPos
GetClientRect
GetFocus
RegisterClassExW
GetClassInfoW
UnregisterClassW
GetProcessWindowStation
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
shell32
Shell_NotifyIconW
SHGetKnownFolderPath
CommandLineToArgvW
SHGetFileInfoW
SHGetStockIconInfo
ord727
ShellExecuteW
SHCreateItemFromIDList
SHCreateItemFromParsingName
SHGetMalloc
SHGetPathFromIDListW
SHGetKnownFolderIDList
SHBrowseForFolderW
ole32
OleGetClipboard
OleFlushClipboard
OleIsCurrentClipboard
CoCreateInstance
DoDragDrop
CoTaskMemFree
OleInitialize
CoInitialize
RegisterDragDrop
CoLockObjectExternal
ReleaseStgMedium
CoGetMalloc
CoTaskMemAlloc
CoCreateGuid
StringFromGUID2
OleSetClipboard
RevokeDragDrop
OleUninitialize
CoUninitialize
advapi32
CryptGenRandom
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
CopySid
FreeSid
GetLengthSid
GetTokenInformation
CryptAcquireContextW
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegFlushKey
RegSetValueExW
RegNotifyChangeKeyValue
DeregisterEventSource
RegisterEventSourceA
ReportEventA
CryptAcquireContextA
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashA
CryptEnumProvidersA
RegCloseKey
ws2_32
select
listen
htons
getsockname
getpeername
closesocket
bind
__WSAFDIsSet
WSAGetLastError
WSASendTo
WSAIoctl
setsockopt
inet_addr
getsockopt
htonl
WSAAsyncSelect
WSACleanup
WSAStartup
gethostname
WSASocketW
WSANtohl
accept
WSANtohs
WSARecv
WSAAccept
WSAConnect
ntohl
WSAHtonl
WSARecvFrom
gethostbyaddr
WSASend
connect
ioctlsocket
recv
recvfrom
send
sendto
shutdown
socket
WSASetLastError
freeaddrinfo
inet_pton
ntohs
WSAPoll
inet_ntop
gethostbyname
getaddrinfo
gdi32
ChoosePixelFormat
DescribePixelFormat
GetPixelFormat
SetPixelFormat
SwapBuffers
GetBitmapBits
GetObjectW
CreateFontIndirectW
EnumFontFamiliesExW
GetFontData
GetStockObject
AddFontResourceExW
RemoveFontResourceExW
AddFontMemResourceEx
RemoveFontMemResourceEx
GetTextMetricsW
GetTextFaceW
SelectObject
GdiFlush
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextExtentPoint32W
GetCharABCWidthsI
SetBkMode
SetGraphicsMode
SetTextColor
SetTextAlign
SetWorldTransform
ExtTextOutW
CreateBitmap
GetDIBits
GetRegionData
GetObjectA
DeleteDC
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
GetDeviceCaps
SelectClipRgn
OffsetRgn
DeleteObject
CreateRectRgn
CombineRgn
CreateDIBSection
BitBlt
oleaut32
SysFreeString
SysStringLen
VariantInit
VariantChangeType
SystemTimeToVariantTime
GetErrorInfo
VariantClear
SetErrorInfo
CreateErrorInfo
SysAllocStringLen
SysAllocString
imm32
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringW
ImmNotifyIME
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetVirtualKey
ImmGetDefaultIMEWnd
winmm
timeSetEvent
PlaySoundW
timeKillEvent
crypt32
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateContext
CertCreateCertificateContext
uxtheme
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
GetThemeBackgroundRegion
ord47
CloseThemeData
OpenThemeData
GetThemeEnumValue
GetThemeMargins
GetThemePropertyOrigin
SetWindowTheme
IsThemeActive
IsAppThemed
GetCurrentThemeName
GetThemeTransitionDuration
GetThemeBool
GetThemeInt
GetThemeColor
iphlpapi
GetAdaptersInfo
GetAdaptersAddresses
GetNetworkParams
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 16.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 290KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qtmetad Size: - Virtual size: 582B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 782B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 265B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 606B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: - Virtual size: 415B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xd0 Size: - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xd1 Size: 14.9MB - Virtual size: 14.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ