Real_v2.1.9051.zip
- SHA256 51ebfff57028069d8331bc81efbb7e55d411860fe95fa69ad7833045270efd59
Overview
overview
8Static
static
5Real_v2.1.9051.zip
windows10-2004-x64
1Real_v2.1.9051.zip
windows11-ltsc_2024-x64
1Real_v2.1.9051.zip
windows10-2004-x64
1Real_v2.1.9051.zip
windows11-ltsc_2024-x64
1Real_v2.1.9051.exe
windows10-2004-x64
5mpclient.dll
windows10-2004-x64
8mpclient.dll
windows11-ltsc_2024-x64
8Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Real_v2.1.9051.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
Real_v2.1.9051.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
Real_v2.1.9051.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
Real_v2.1.9051.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
Real_v2.1.9051.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral6
Sample
mpclient.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral7
Sample
mpclient.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
300 seconds
General
- Target Real_v2.1.9051.zip
- Size 2.4MB
- Sample260728-srcqvazxbw
- SHA256 51ebfff57028069d8331bc81efbb7e55d411860fe95fa69ad7833045270efd59
- MD5 82de8b41a131dec930ef0f0bdf370b97
- SHA1 a3c011a7b25d3c4ec0b110662064b0022d3ff020
- SHA512 b5d46657d2bceff3867142573a17bba85900923a293ac2ef66adbdb5eabdea84a3d247d9c14e9d78b8b548d330999596dde6aa4807187be95543a2ffa536b93e
- SSDEEP 49152:THhTRaOAZrXxFbRg7IiOP66dJWHurSE9JqvhyqpCljT/1G+ZeFe/zP0hEb90se:dsOAZLxFbRg7QdsuWSqvhyWCljTM+ZeV
- TLSH T16BC533F97D63C087079C6C99AC07163412FB45B261DB2E248CFC47D71768C6ABAE1DA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack002/mpclient.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack002/mpclient.dll
File Explorer
-
Real_v2.1.9051.zip.zip 2.4MB
-
Real_v2.1.9051.zip.zip 2.4MB
-
Real_v2.1.9051.exe.exe 683KB
-
mpclient.dll.dll 4.6MB
Real_v2.1.9051.zip
- SHA256 8dbcfc57860df23d139e7238b49ae480d0c698e7a8e9a413c8dd3f0142ce1dc9
- MD5 55f0bd5f2961bc3df3daa5f267fb44c9
- SHA1 e0779d6a17b54db541bd41f150cd9f300ec8469c
- SHA512 845043e7781945f24d0c2dfe28f9112d77b9653470a687b56b5dbd1ab7a62fb06688e6883015245836640736ab449c89479e1a915afb9311654ada8e4b25552b
- SSDEEP 49152:VH/hROONzfgFXjbb32R7NmBIbJd40BOPWk2HYMMZ+VHcqsm3LSeoeeiSV:dmONsjbb32R7sBIRBrhYMMZIvbSheeRV
- TLSH T114C533C5BFCB81919AEF3462E983A36135CB6CF285A60C19CDE589D0B55D00168EFCE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Real_v2.1.9051.exe
- IMPHASH 7a6da7c5d1116b706b7932d3f11a50c9
- SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
- MD5 6669e10c960f6c2297bcd3d5a27412aa
- SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
- SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
- SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
- TLSH T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b5:4a:2b:77:f5:94:37:43:7c:5b:64:08:db:b0:59:cc:3d:1c:db:be:4a:3b:94:26:c5:c8:55:bf:49:e9:8a:ac
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 6, 2023
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:51:99:0a:2a:60:f6:35:67:60:00:00:00:00:04:51
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 8, 2023 - Aug 7, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d4:e4:e9:03:2f:c0:ac:69:ac:00:01:00:00:01:d4
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
21472
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
MpDlpService.pdb
advapi32
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
RegCloseKey
GetSecurityDescriptorSacl
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
CopySid
FreeSid
CheckTokenMembership
EventUnregister
EventRegister
EventWriteTransfer
ChangeServiceConfig2W
LookupPrivilegeValueW
AdjustTokenPrivileges
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatus
NotifyServiceStatusChangeW
StartServiceW
CreateProcessAsUserW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
GetLengthSid
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
OpenProcessToken
ChangeServiceConfigW
QueryServiceConfigW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
GetTokenInformation
ConvertSidToStringSidW
SetSecurityInfo
InitializeAcl
kernel32
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
RaiseException
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
InitializeCriticalSectionEx
DebugBreak
GetFileAttributesW
WaitForSingleObject
GetTickCount64
OutputDebugStringW
FormatMessageW
GetProcessTimes
ProcessIdToSessionId
LoadLibraryW
GetFileInformationByHandle
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ExpandEnvironmentStringsW
QueryDosDeviceW
CreateSemaphoreExW
HeapFree
ReleaseSemaphore
GetModuleHandleExW
ReleaseMutex
OpenSemaphoreW
CreateMutexExW
GetProcessHeap
CompareFileTime
lstrcmpW
DeleteFileW
FindClose
OpenProcess
SleepEx
CreateFileW
LocalFree
GetDriveTypeW
DeleteTimerQueueTimer
LCMapStringW
UnregisterWaitEx
MultiByteToWideChar
WideCharToMultiByte
FormatMessageA
GetModuleFileNameW
GetSystemDirectoryW
HeapSetInformation
CreateProcessW
CreateDirectoryW
ReadFile
FindFirstFileW
GetFileSizeEx
CreateTimerQueueTimer
FindNextFileW
WriteFile
RegisterWaitForSingleObject
SetEnvironmentVariableW
SetFilePointerEx
LoadLibraryExW
FileTimeToSystemTime
GetLocalTime
GetSystemTime
DeviceIoControl
HeapAlloc
GetFinalPathNameByHandleW
WriteConsoleW
SetEndOfFile
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapSize
CompareStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetFileType
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileExW
HeapReAlloc
GetOEMCP
GetACP
IsValidCodePage
FreeLibraryAndExitThread
ExitThread
CreateThread
GetCommandLineW
GetCommandLineA
ExitProcess
GetStdHandle
GetCPInfo
LCMapStringEx
DecodePointer
InitOnceComplete
InitOnceBeginInitialize
GetLocaleInfoEx
SetErrorMode
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetStringTypeW
VirtualLock
mpclient
MpConfigUninitialize
MpClientUtilExportFunctions
MpFreeMemory
MpAllocMemory
MpConfigRegisterForNotifications
MpConfigGetValue
MpConfigOpen
MpConfigUnregisterNotifications
MpConfigClose
MpConfigGetValueAlloc
MpConfigSetValue
MpConfigInitialize
wtsapi32
WTSQueryUserToken
ntdll
RtlUnwind
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlNtStatusToDosError
NtQueryInformationProcess
RtlGetVersion
crypt32
CertVerifyCertificateChainPolicy
ole32
CreateBindCtx
CoSetProxyBlanket
CoTaskMemFree
CoCreateInstance
rpcrt4
RpcImpersonateClient
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcBindingInqAuthClientW
RpcStringFreeW
RpcServerRegisterAuthInfoW
RpcServerUseProtseqW
RpcRevertToSelf
RpcServerInqBindings
RpcEpRegisterW
RpcServerRegisterIfEx
RpcBindingVectorFree
RpcEpUnregister
RpcServerUnregisterIf
NdrServerCallAll
NdrServerCall2
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
ExpandEnvironmentStringsForUserW
wintrust
WTHelperGetProvSignerFromChain
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAcquireContext
WinVerifyTrust
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
WTHelperProvDataFromStateData
CryptCATAdminEnumCatalogFromHash
urlmon
MkParseDisplayNameEx
Name
.text
Size
464KB
Virtual Size
461KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
152KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=37, id=260, version=32595,
count=229, id=261, version=32595,
count=23, id=259, version=32595,
count=31, id=257, version=32595,
count=434, id=1, productName=Unmarked objects,
count=10, id=126, version=50727,
count=175, id=265, version=32595,
count=1, id=255, version=32595,
count=1, id=258, version=32595,
mpclient.dll
- IMPHASH d8b31f8c03e0c76ff245ed05a15ffe6c
- SHA256 9010ae2157f06053bfd2de15548b252fab3b2c121c73805032b6b34dc3a61684
- MD5 69083090926961dc51128ad347b9d3d6
- SHA1 936241541db46929028fba1f9347a7255c4851b4
- SHA512 c71e2bd162892040803891a66ab821bbc82a428ef937b7fd47d7b2aae9824130a0dd4c33c07ff0c074ffcd0ea76ef8242b96366966167550f8f299ff682d416a
- SSDEEP 49152:5SEQWxzHd+jEOkaAPHmZx/M9zMSzCh5cxNS5bE4RJ8MIHzE98cF2ANdZHybHcKWt:55X7Pmz8itb8MIHzEj2A3cHw7mj4
- TLSH T174268D07BCE16965C05AA33189B64202BB7CBC19273233D72E51EABA3F777D18A35744
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
1b:73:fa:49:93:eb:03:61:81:1c:c2:bf:6c:df:60:66:41:a3:2e:04
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=pro.su,O=U0wVRpmU,L=STbR8cU,ST=mlOWy,C=US
Chains
Jul 27, 2026
CN=pro.su,O=U0wVRpmU,L=STbR8cU,ST=mlOWy,C=US
Subject
CN=pro.su,O=U0wVRpmU,L=STbR8cU,ST=mlOWy,C=US
Serial Number
36:e9:e5:ac:d0:bc:9e:7a
Issuer
CN=pro.su,O=U0wVRpmU,L=STbR8cU,ST=mlOWy,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth
Timespan
Jul 28, 2026 - Jul 28, 2027
Minor OS version
1
Major OS version
6
Entry point
4944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
AddVectoredContinueHandler
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
GetConsoleMode
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetThreadContext
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
PostQueuedCompletionStatus
RaiseFailFastException
ResumeThread
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_errno
_initterm
_lock
_unlock
abort
calloc
fputc
free
fwrite
localeconv
malloc
memcpy
memset
realloc
strerror
strlen
strncmp
vfprintf
wcslen
MpAllocMemory
MpClientUtilExportFunctions
MpConfigClose
MpConfigGetValue
MpConfigGetValueAlloc
MpConfigInitialize
MpConfigOpen
MpConfigRegisterForNotifications
MpConfigSetValue
MpConfigUninitialize
MpConfigUnregisterNotifications
MpFreeMemory
_cgo_dummy_export
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
137KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
297KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/92
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ