Static task
static1
Behavioral task
behavioral1
Sample
shadPS4.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
shadPS4.exe
Resource
win10v2004-20240802-en
General
-
Target
shadPS4.exe
-
Size
19.2MB
-
MD5
b577875ef7171fe5276e3bb70d5f04ee
-
SHA1
5a4771c96ba8debc8567e94c8536adb47ea18f40
-
SHA256
c6524ea4173e366a10768b5eb4dddfc2b1b31dab3ab2cb3d670809bc93a94bf0
-
SHA512
ea3abde5d7642e12d884ac31e75db422f5154baec25bfd73c600ebb746fbdcd105b8606fd0c817493cc2163742dca891b7dc36d652dc1217b9d5067e4b5755ea
-
SSDEEP
98304:Wp8ndKzOroAb0TiHyjPteX1+1xLmMvolouMuMKe5qKRGkAc1V8F:Wp9OEsu2GPLmdxj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource shadPS4.exe
Files
-
shadPS4.exe.exe windows:6 windows x64 arch:x64
4e13e38e801cea3d6d49ae735cc4e44f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
GetCurrentDirectoryW
GetEnvironmentVariableA
GetStdHandle
SetEnvironmentVariableA
api-ms-win-core-console-l2-1-0
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
GetHandleInformation
api-ms-win-core-memory-l1-1-7
CreateFileMapping2
api-ms-win-core-localization-l1-2-0
FormatMessageA
FormatMessageW
GetLocaleInfoA
GetLocaleInfoEx
GetLocaleInfoW
api-ms-win-core-heap-l2-1-0
GlobalAlloc
GlobalFree
LocalFree
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
SetErrorMode
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
VerSetConditionMask
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-processthreads-l1-1-0
CreateThread
ExitProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetProcessTimes
GetThreadPriority
OpenProcessToken
OpenThread
QueueUserAPC
ResumeThread
SetThreadPriority
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
api-ms-win-core-processthreads-l1-1-3
SetThreadDescription
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualFree
VirtualFreeEx
VirtualProtect
api-ms-win-core-memory-l1-1-6
MapViewOfFile3
VirtualAlloc2
api-ms-win-core-memory-l1-1-5
UnmapViewOfFile2
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetTickCount
GlobalMemoryStatusEx
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
accept
bind
closesocket
freeaddrinfo
getaddrinfo
gethostname
htonl
htons
inet_ntop
inet_pton
listen
ntohl
ntohs
recv
send
sendto
setsockopt
socket
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
AcquireSRWLockShared
CreateEventA
CreateEventW
CreateWaitableTimerExW
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
ResetEvent
SetEvent
SetWaitableTimer
SetWaitableTimerEx
SleepEx
TryAcquireSRWLockExclusive
TryEnterCriticalSection
WaitForSingleObject
WaitForSingleObjectEx
api-ms-win-core-io-l1-1-0
CreateIoCompletionPort
DeviceIoControl
GetOverlappedResult
GetQueuedCompletionStatus
PostQueuedCompletionStatus
api-ms-win-core-synch-l1-2-1
CreateSemaphoreW
WaitForMultipleObjects
kernel32
CompareStringA
CreateSemaphoreA
CreateWaitableTimerA
GetSystemPowerStatus
GlobalLock
GlobalSize
GlobalUnlock
MulDiv
SetThreadExecutionState
VerifyVersionInfoW
rpcrt4
UuidCreate
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryA
LoadLibraryW
api-ms-win-core-errorhandling-l1-1-1
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
user32
AdjustWindowRectEx
AttachThreadInput
BeginPaint
CallNextHookEx
CallWindowProcW
ChangeDisplaySettingsExW
ClientToScreen
ClipCursor
CloseClipboard
CreateIconFromResource
CreateIconIndirect
CreateWindowExA
CreateWindowExW
DefWindowProcW
DestroyCursor
DestroyIcon
DestroyWindow
DialogBoxIndirectParamW
DispatchMessageW
DrawTextW
EmptyClipboard
EnableWindow
EndDialog
EndPaint
EnumDisplayDevicesW
EnumDisplayMonitors
EnumDisplaySettingsW
FillRect
FlashWindowEx
GetAsyncKeyState
GetClassInfoExW
GetClientRect
GetClipCursor
GetClipboardData
GetClipboardFormatNameA
GetClipboardSequenceNumber
GetCursorPos
GetDC
GetDesktopWindow
GetDlgItem
GetDoubleClickTime
GetFocus
GetForegroundWindow
GetKeyState
GetKeyboardLayout
GetKeyboardState
GetMenu
GetMessageExtraInfo
GetMessageTime
GetMessageW
GetMonitorInfoW
GetPropW
GetQueueStatus
GetRawInputBuffer
GetRawInputData
GetRawInputDeviceInfoA
GetRawInputDeviceList
GetSystemMetrics
GetUpdateRect
GetWindowLongPtrW
GetWindowLongW
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
IntersectRect
InvalidateRect
IsClipboardFormatAvailable
IsIconic
IsZoomed
KillTimer
LoadCursorW
LoadIconW
MapVirtualKeyW
MessageBoxA
MsgWaitForMultipleObjects
OpenClipboard
PeekMessageW
PostMessageW
PostThreadMessageW
PtInRect
RegisterClassExA
RegisterClassExW
RegisterClassW
RegisterClipboardFormatW
RegisterDeviceNotificationW
RegisterRawInputDevices
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
RemovePropW
ScreenToClient
SendMessageA
SendMessageW
SetActiveWindow
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetLayeredWindowAttributes
SetParent
SetPropW
SetRectEmpty
SetTimer
SetWindowLongPtrW
SetWindowLongW
SetWindowPos
SetWindowRgn
SetWindowTextW
SetWindowsHookExW
ShowWindow
SystemParametersInfoA
SystemParametersInfoW
ToUnicode
TrackMouseEvent
TranslateMessage
UnhookWindowsHookEx
UnregisterClassA
UnregisterClassW
UnregisterDeviceNotification
ValidateRect
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
??0facet@locale@std@@IEAA@_K@Z
??0ios_base@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??1facet@locale@std@@MEAA@XZ
??1ios_base@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Winerror_map@std@@YAHH@Z
?_XGetLastError@std@@YAXXZ
?_Xbad_alloc@std@@YAXXZ
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xruntime_error@std@@YAXPEBD@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?classic@locale@std@@SAAEBV12@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?clear@ios_base@std@@QEAAXH@Z
?fail@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$numpunct@D@std@@2V0locale@2@A
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uncaught_exceptions@std@@YAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
_Cnd_broadcast
_Cnd_destroy_in_situ
_Cnd_do_broadcast_at_thread_exit
_Cnd_init_in_situ
_Cnd_signal
_Cnd_timedwait
_Cnd_wait
_Mtx_lock
_Mtx_unlock
_Query_perf_counter
_Query_perf_frequency
_Thrd_hardware_concurrency
_Thrd_id
_Thrd_join
_Thrd_yield
_Xtime_get_ticks
msvcp140_atomic_wait
__std_atomic_notify_all_direct
__std_atomic_wait_direct
__std_calloc_crt
__std_free_crt
__std_tzdb_delete_current_zone
__std_tzdb_delete_leap_seconds
__std_tzdb_delete_sys_info
__std_tzdb_delete_time_zones
__std_tzdb_get_current_zone
__std_tzdb_get_leap_seconds
__std_tzdb_get_sys_info
__std_tzdb_get_time_zones
api-ms-win-core-console-l1-1-0
GetConsoleMode
WriteConsoleW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-processthreads-l1-1-2
GetSystemTimes
advapi32
GetUserNameA
LookupPrivilegeValueA
api-ms-win-core-memory-l1-1-1
GetLargePageMinimum
api-ms-win-security-base-l1-1-0
AdjustTokenPrivileges
api-ms-win-core-console-l1-2-0
AttachConsole
api-ms-win-core-processthreads-l1-1-1
GetThreadTimes
IsProcessorFeaturePresent
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
Sleep
SleepConditionVariableSRW
WakeAllConditionVariable
api-ms-win-core-file-l1-1-0
CreateDirectoryW
CreateFileA
CreateFileW
DeleteFileW
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
GetFileTime
GetFullPathNameW
GetLogicalDrives
ReadFile
RemoveDirectoryW
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
WriteFile
winmm
timeBeginPeriod
timeEndPeriod
ole32
OleInitialize
OleUninitialize
RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop
api-ms-win-core-wow64-l1-1-0
IsWow64Process
setupapi
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiGetDeviceInstanceIdA
SetupDiGetDeviceRegistryPropertyA
shell32
CommandLineToArgvW
DragAcceptFiles
DragFinish
DragQueryFileW
SHBrowseForFolderW
SHGetFolderPathW
SHGetPathFromIDListW
ShellExecuteW
gdi32
BitBlt
ChoosePixelFormat
CombineRgn
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateFontIndirectW
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
DescribePixelFormat
GetDIBits
GetDeviceCaps
GetICMProfileW
GetPixelFormat
GetTextExtentPoint32A
GetTextMetricsW
SelectObject
SetPixelFormat
SwapBuffers
api-ms-win-core-libraryloader-l1-2-2
EnumResourceNamesW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-core-file-l1-2-2
AreFileApisANSI
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-file-l2-1-0
CreateHardLinkW
CreateSymbolicLinkW
GetFileInformationByHandleEx
MoveFileExW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-com-l1-1-0
CLSIDFromString
CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoUninitialize
PropVariantClear
oleaut32
SysFreeString
imm32
ImmAssociateContext
ImmGetCandidateListW
ImmGetCompositionFontW
ImmGetCompositionStringW
ImmGetContext
ImmGetIMEFileNameA
ImmNotifyIME
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionStringW
ImmSetCompositionWindow
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
vcruntime140
_CxxThrowException
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
__intrinsic_setjmp
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
_purecall
memchr
memcmp
memcpy
memmove
memset
strchr
strrchr
strstr
wcsstr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
localeconv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vsscanf
_chsize_s
_fileno
_fseeki64
_ftelli64
_get_osfhandle
_get_stream_buffer_pointers
_isatty
_set_fmode
_wfopen_s
_wfsopen
fclose
fflush
fgetc
fgetpos
fgets
fopen
fputc
fputs
fread
freopen
fseek
fsetpos
ftell
fwrite
puts
setvbuf
ungetc
api-ms-win-crt-time-l1-1-0
__daylight
__timezone
_time64
_tzset
api-ms-win-crt-heap-l1-1-0
_aligned_free
_aligned_malloc
_callnewh
_set_new_mode
calloc
free
malloc
realloc
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
_beginthreadex
_c_exit
_cexit
_configure_narrow_argv
_crt_atexit
_endthreadex
_errno
_exit
_fpreset
_get_initial_narrow_environment
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
abort
exit
signal
terminate
api-ms-win-crt-math-l1-1-0
__setusermatherr
_dclass
_dsign
_dtest
_fdclass
_fdsign
_fdtest
_ldsign
_ldtest
acos
acosf
asin
asinf
atan
atan2
atan2f
atanf
ceil
ceilf
cos
cosf
exp
exp2
expf
floor
floorf
fmod
fmodf
frexp
log
log10
log10f
log2
logf
lround
lroundf
modf
modff
pow
powf
round
roundf
scalbn
scalbnf
sin
sinf
sqrt
sqrtf
tan
tanf
trunc
truncf
api-ms-win-crt-convert-l1-1-0
_i64toa
_itoa
_itoa_s
_ltoa
_ui64toa
_ultoa
atof
atoi
mbstowcs
strtod
strtol
strtoll
strtoul
strtoull
wcstol
wcstombs
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_stat64i32
_unlock_file
api-ms-win-crt-string-l1-1-0
_strdup
_strrev
isgraph
islower
isupper
strcat
strcmp
strcpy
strcpy_s
strlen
strncmp
strncpy
strnlen
tolower
wcscmp
wcslen
wcsncmp
wcsnlen
api-ms-win-crt-utility-l1-1-0
qsort
rand
srand
Sections
.text Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11.1MB - Virtual size: 11.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 223KB - Virtual size: 223KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.retplne Size: 512B - Virtual size: 36B
.tls Size: 512B - Virtual size: 506B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 401KB - Virtual size: 401KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ