Static task
static1
Behavioral task
behavioral1
Sample
4182804fb9248717527b3ebae0764a95_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
4182804fb9248717527b3ebae0764a95_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
4182804fb9248717527b3ebae0764a95_JaffaCakes118
-
Size
1.3MB
-
MD5
4182804fb9248717527b3ebae0764a95
-
SHA1
0bc704817991a273b8dc4fe7b9c8544424a52cbf
-
SHA256
44cbf5cd7900f7c236bdebcdd7fd796469b394ec756c9f1c198759f917bb2a57
-
SHA512
a0d25d4341ea95458e62c4e7fef994f891a3af587be3306b34ff50dc04e96f7659b1af00833cd6ae8384ea6d52b403122055c9a36369b75c6e451b9f7232fc7f
-
SSDEEP
12288:fsMMm0IjFPbVUC/Uo/Q7xjN19Lrk49RQEOyfGNbd5ZM+oZHqQ5:fsMMEjFPbVUC/Uo/a/15IbdED5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4182804fb9248717527b3ebae0764a95_JaffaCakes118
Files
-
4182804fb9248717527b3ebae0764a95_JaffaCakes118.exe windows:4 windows x86 arch:x86
bb4a66f405b8143958cf6e4cc9ebf4ac
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
dnsapi
DnsQuery_A
DnsRecordListFree
winmm
PlaySoundA
mfc71
ord3244
ord1955
ord6144
ord2372
ord1283
ord1425
ord2958
ord5866
ord2322
ord2866
ord1647
ord1589
ord3315
ord1654
ord1598
ord2987
ord3328
ord754
ord739
ord781
ord3883
ord6182
ord2884
ord907
ord2496
ord5751
ord1482
ord6138
ord1486
ord3991
ord3799
ord1554
ord3195
ord4104
ord3302
ord5807
ord1262
ord630
ord2882
ord3088
ord2021
ord385
ord1056
ord563
ord753
ord1009
ord2654
ord6255
ord3406
ord3990
ord4085
ord5403
ord2468
ord3684
ord2090
ord1637
ord1558
ord4236
ord3214
ord642
ord3651
ord2883
ord2873
ord6120
ord3163
ord3287
ord602
ord1966
ord5523
ord4001
ord4123
ord5641
ord502
ord326
ord5639
ord5588
ord1279
ord347
ord2306
ord1181
ord2259
ord2794
ord4109
ord2271
ord667
ord584
ord1434
ord317
ord433
ord3108
ord6304
ord1970
ord2907
ord432
ord5491
ord2272
ord3850
ord2292
ord6168
ord4749
ord4394
ord1545
ord4232
ord3164
ord587
ord3989
ord2176
ord1308
ord911
ord2451
ord4081
ord5235
ord5233
ord2390
ord2400
ord2398
ord2396
ord2392
ord2415
ord2403
ord3441
ord5182
ord4212
ord4735
ord4890
ord2020
ord1671
ord1670
ord1551
ord5912
ord1620
ord1617
ord3946
ord1401
ord4244
ord5152
ord1908
ord5073
ord6275
ord4185
ord3403
ord4722
ord4282
ord1600
ord5960
ord923
ord928
ord932
ord930
ord934
ord2410
ord2394
ord2413
ord2408
ord2385
ord2387
ord2405
ord2178
ord2172
ord1522
ord6279
ord3802
ord6277
ord3345
ord4967
ord1362
ord5175
ord1964
ord1656
ord1655
ord1599
ord5200
ord2537
ord2731
ord2835
ord4307
ord2714
ord2862
ord2540
ord2646
ord2533
ord3718
ord3719
ord3709
ord1207
ord2644
ord3949
ord4486
ord4262
ord2094
ord4100
ord6236
ord1883
ord572
ord656
ord591
ord3227
ord2991
ord5214
ord1568
ord1639
ord3171
ord4234
ord1547
ord2089
ord4098
ord1483
ord1931
ord2657
ord3875
ord1564
ord2370
ord3879
ord5873
ord354
ord416
ord605
ord651
ord5203
ord1280
ord1916
ord1248
ord1934
ord3210
ord3204
ord3761
ord266
ord4768
ord2168
ord2321
ord5833
ord310
ord4035
ord4353
ord501
ord709
ord4580
ord6065
ord1063
ord3182
ord3641
ord762
ord2933
ord299
ord6118
ord1489
ord2902
ord876
ord3397
ord304
ord784
ord3934
ord2469
ord297
ord2248
ord1122
ord1024
ord1054
ord6090
ord620
ord658
ord578
ord566
ord757
ord3333
ord4481
ord2838
ord5566
ord5213
ord5230
ord4568
ord3948
ord5226
ord5224
ord2931
ord1920
ord3832
ord5382
ord6219
ord5102
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord6278
ord4014
ord4038
ord3683
ord3230
ord4261
ord4238
ord1402
ord5915
ord1571
ord1641
ord2092
ord265
ord1187
ord1191
ord1903
ord1123
ord2164
ord1084
ord6067
ord1794
ord764
msvcr71
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
??0exception@@QAE@ABV0@@Z
wcscpy
_except_handler3
??0bad_cast@@QAE@PBD@Z
_CxxThrowException
memset
strlen
toupper
memcpy
??1exception@@UAE@XZ
_resetstkoflw
malloc
free
strstr
??0exception@@QAE@XZ
atoi
_itoa
strcpy
strcat
time
sprintf
strncpy
strncat
tolower
labs
strcmp
_ismbcdigit
memcmp
memchr
rand
srand
getenv
isdigit
_purecall
memmove
fclose
fopen
ftell
fseek
fwrite
_fmode
vsprintf
_vscprintf
??1type_info@@UAE@XZ
_controlfp
__dllonexit
_onexit
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
exit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_stat
wcslen
_setmbcp
__CxxFrameHandler
__set_app_type
__security_error_handler
fread
kernel32
HeapReAlloc
HeapDestroy
HeapSize
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoA
SizeofResource
FindResourceExA
DeviceIoControl
GetCurrentDirectoryA
GetFileAttributesA
ReleaseSemaphore
CreateSemaphoreA
OpenSemaphoreA
OpenEventA
ReadDirectoryChangesW
WaitForMultipleObjects
TerminateThread
SetThreadPriority
ResumeThread
SuspendThread
GetFullPathNameA
SetEvent
GetExitCodeThread
CreateThread
GetCurrentThreadId
FindResourceA
LoadResource
LockResource
SystemTimeToFileTime
GetFileTime
SetFileTime
InterlockedDecrement
FormatMessageA
GetTempPathA
VirtualQuery
OutputDebugStringA
CopyFileA
GetShortPathNameA
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
HeapFree
GetProcessHeap
HeapAlloc
ReadFile
CreateToolhelp32Snapshot
Process32First
Process32Next
Module32First
Module32Next
SetPriorityClass
GetPriorityClass
GetWindowsDirectoryA
GetFileSize
LoadLibraryExA
GetFileInformationByHandle
FileTimeToSystemTime
DeleteFileA
GetTickCount
FindFirstFileA
lstrcmpA
FindNextFileA
FindClose
GetLogicalDriveStringsA
GetSystemTime
CreateEventA
ResetEvent
EnterCriticalSection
CreateProcessA
LoadLibraryA
GetProcAddress
WaitForSingleObject
TryEnterCriticalSection
LeaveCriticalSection
FreeLibrary
ReleaseMutex
GetCommandLineA
ExitProcess
CreateMutexA
IsDebuggerPresent
GetDriveTypeA
GetVolumeInformationA
lstrcpyA
lstrcatA
GetTempFileNameA
CreateFileA
MoveFileExA
WriteFile
GetModuleHandleA
LocalFree
TerminateProcess
GetExitCodeProcess
OpenProcess
GetCurrentProcess
CloseHandle
GetModuleFileNameA
GetSystemDirectoryA
RaiseException
DeleteCriticalSection
InitializeCriticalSection
GetLastError
lstrlenA
lstrcmpiA
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetVersion
GetThreadLocale
GetLocaleInfoA
GetACP
GetVersionExA
InterlockedExchange
Sleep
user32
GetMessageA
TranslateMessage
DispatchMessageA
EnumChildWindows
GetDlgCtrlID
LoadImageA
SetWindowRgn
SetFocus
GetDC
ReleaseDC
GetDesktopWindow
MessageBoxA
CopyRect
GetSysColor
PtInRect
ShowWindow
SetWindowPos
AnimateWindow
RedrawWindow
MonitorFromRect
GetMonitorInfoA
IsWindowEnabled
GetKeyState
SetCursor
DestroyCursor
ScreenToClient
CreatePopupMenu
AppendMenuA
GetParent
EnumWindows
GetWindowThreadProcessId
GetWindow
GetWindowTextA
DrawTextA
ClientToScreen
GetPropA
DefWindowProcA
DestroyIcon
RemovePropA
DestroyWindow
LoadCursorA
RegisterClassA
CreateWindowExA
SetPropA
KillTimer
GetWindowRect
PostQuitMessage
UpdateWindow
TrackPopupMenu
ModifyMenuA
DestroyMenu
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
SetTimer
LoadIconA
SystemParametersInfoA
SetForegroundWindow
wsprintfA
IsWindowVisible
FindWindowA
LoadMenuA
GetSubMenu
SendMessageA
CharLowerBuffA
EnableWindow
CharLowerA
FillRect
PostMessageA
InvalidateRect
GetClassNameA
GetCursorPos
gdi32
DeleteDC
GetPixel
GetStockObject
ExtCreateRegion
CreateCompatibleDC
GetObjectA
CreateCompatibleBitmap
DeleteObject
CreateSolidBrush
BitBlt
CreateRectRgnIndirect
CreateFontIndirectA
SelectObject
SetTextColor
SetBkMode
SetBkColor
TextOutA
advapi32
RegOpenKeyExA
OpenProcessToken
SetNamedSecurityInfoA
RegQueryValueExA
RegOpenKeyA
AdjustTokenPrivileges
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegCloseKey
RegDeleteValueA
ControlService
StartServiceA
DeleteService
OpenSCManagerA
CreateServiceA
OpenServiceA
CloseServiceHandle
RegSetValueA
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
RegEnumKeyExA
RegEnumValueA
InitiateSystemShutdownA
RegCreateKeyExA
RegQueryValueExW
RegCreateKeyW
RegCreateKeyA
RegOpenKeyExW
RegSetValueExW
RegSetValueExA
LookupPrivilegeValueA
shell32
ShellExecuteA
Shell_NotifyIconA
ExtractIconA
SHGetSpecialFolderPathA
SHAppBarMessage
comctl32
ImageList_Create
_TrackMouseEvent
ImageList_ReplaceIcon
shlwapi
StrStrIA
PathRemoveExtensionA
PathFindFileNameA
PathIsDirectoryA
ole32
CoCreateInstance
CoInitialize
CoInitializeEx
CoFreeUnusedLibraries
StringFromGUID2
CoCreateGuid
CoUninitialize
oleaut32
SysAllocStringLen
SysStringLen
VariantInit
SysAllocString
SysFreeString
VariantClear
msvcp71
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
?_Incref@facet@locale@std@@QAEXXZ
?_Register@facet@locale@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1locale@std@@QAE@XZ
?rdbuf@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPAV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?is_open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@V312@@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?eof@ios_base@std@@QBE_NXZ
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAJ@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?width@ios_base@std@@QBEHXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?eof@?$char_traits@D@std@@SAHXZ
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?to_char_type@?$char_traits@D@std@@SADABH@Z
?is@?$ctype@D@std@@QBE_NFD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?width@ios_base@std@@QAEHH@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
??Bid@locale@std@@QAEIXZ
?id@?$ctype@D@std@@2V0locale@2@A
??0_Lockit@std@@QAE@H@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?flags@ios_base@std@@QBEHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
hjengine
hj_cvdfree
hj_build
hj_free
hj_cvdverify
hj_cvdhead
hj_load
hj_scanfile
psapi
EnumProcessModules
EnumProcesses
GetModuleFileNameExA
GetModuleBaseNameA
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
wininet
InternetConnectA
FindFirstUrlCacheEntryA
InternetSetFilePointer
FindCloseUrlCache
FindNextUrlCacheEntryA
InternetReadFile
InternetErrorDlg
InternetCloseHandle
HttpSendRequestA
InternetSetOptionA
HttpQueryInfoA
InternetOpenUrlA
InternetOpenA
InternetQueryOptionA
HttpOpenRequestA
ws2_32
inet_addr
htons
ntohl
WSACleanup
inet_ntoa
gethostbyname
gethostname
WSAStartup
ntohs
htonl
Sections
.text Size: 236KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 136KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 3B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12.0MB - Virtual size: 12.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ