korkamk.rar
- SHA256 c2a0512c0300624348edae5360c4fc52449dd2b0149c2705d688d3dd0701e4a5
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
korkamk.rar
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
korkamk.rar
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
General
- Target korkamk.rar
- Size 39.2MB
- Sample261113-y1ymkags21
- SHA256 c2a0512c0300624348edae5360c4fc52449dd2b0149c2705d688d3dd0701e4a5
- MD5 5f72403da77cdd75e3a07593c8af0922
- SHA1 f9737da296a58d97a48c5fff374d9ef6f2b28343
- SHA512 7390327b8c9a41bdd5e5f0864740cadc684095d4d85e3db190eecc6d5191115ee69102cc7670e593cf0d4415c80c82b4e5b9d34340da4a327e5d2a228066222a
- SSDEEP 786432:XL9xZKo3+vwEbgvyHKQOz4MJZjzQ4l111cRl8sknXN6:XLld+v5jHqzPfnxl11126hn96
- TLSH T1FE973347B2BC3051D37E960AE19DC9636F0590B1319E78BF075A3A1F2B5A67C806DCAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/VMProtectSDK64.dll unpack001/elsy.dll unpack001/korkamk.exe
File Explorer
-
korkamk.rar.rar 39.2MB
-
VMProtectSDK64.dll.dll 116KB
-
aura.obj199KB
-
elsy.dll.dll 12.5MB
-
korkamk.exe.exe 39.0MB
VMProtectSDK64.dll
- IMPHASH 1851ff453adce0cef5274e320d5bed3c
- SHA256 af82c309ace1ce81c23aa190c65f4eaa4e2e668e227175e66b0637b56f546796
- MD5 724d8234d574846b6ee2262a2977650d
- SHA1 b3fb659ddb3306e23342a0232b9b85e924ae36d5
- SHA512 3ea5ed4fb38986098d19221e5dbf4f48a0ccf5c912235bfdc160bb949721c298e904bbaa1070beb67cb9cfdabb0163a7a51e593f37e2bc03c69b7200c3967e83
- SSDEEP 3072:xmcqYHq7Aiytzg2ScpvgJcG5sqYX6UmHRlBS:80Hq7AiyegZgJZSX+xH
- TLSH T1F6C36C57B3E540BBE1B6C679C8634A55D3B678150B24DBAF07A402162F233D18E3AF72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
8864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
IsDebuggerPresent
GetLocalTime
GetTickCount
GetModuleFileNameW
GetPrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetStringTypeW
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleCP
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW
RaiseException
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Name
.text
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=241, version=40116,
count=124, id=243, version=40116,
count=14, id=242, version=40116,
count=7, id=259, version=24123,
count=20, id=261, version=24123,
count=17, id=260, version=24123,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=90, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
aura.obj
- SHA256 cd84c67a3d4f8cf1e4b9761fdf911695ca48ea5b30bafb6629fb613dd975fbe2
- MD5 6c0a1f76c2e42f911e3982928b90281d
- SHA1 58c5ec150a2875a5eeb6f45332ec6d8b9d1a48e8
- SHA512 8a85363b1a3fa897e4a09eed4e2fa7f9379067020a3ad77c2d708ff53664f6324f26f932beb6a0197d9cab758185f019ffb8961309da417b592df2dcba80253f
- SSDEEP 1536:DWPQaGyrKT/2N5u0ObYnj3CCby9tPbOBpyLoOP6SK:DWoe5Bybc
- TLSH T1E414BDD58C8C8959E7F94C80786D2AF151C9763E2FCEECC09E743C4E8A7D4AA64CA744
- MD5 SHA1 SHA512 SSDEEP TLSH
elsy.dll
- IMPHASH 718661ddc80323b181dc4870b500f086
- SHA256 6e021694aab6226b29fa505bedf33bc8a7500d3b20a32e66753bf615be428a95
- MD5 dabab5bd9bafeb7b50b2dec50fac5057
- SHA1 1f5c735e3c3292244287058e0338119405d237ce
- SHA512 b3158b16e65a92f5bec9f48b48b5e59740224c50d9331210501a7905c39c9dee5579fe8dc6d85de3c508c3dfd48e91d3f2031bf3fb28df8069c67e6d4a90506c
- SSDEEP 393216:g26jd2lS6Yzg98QL6qLoW51BnZx6eElqsxH:a2DlP6ql57ZxREEsxH
- TLSH T182D6DF41FD63EA1AF3DFDA3CC0727B16C9AB30F7EB6298A969DCC0D5195D2600095923
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
770432
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\7\Desktop\all my s\antigral latest10\x64\Release\gooo\elsy.pdb
winhttp
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpReceiveResponse
bcrypt
BCryptHashData
BCryptCreateHash
BCryptVerifySignature
BCryptDestroyKey
BCryptImportKeyPair
BCryptFinishHash
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptDestroyHash
BCryptDecrypt
BCryptGenRandom
kernel32
FindFirstFileExW
HeapReAlloc
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetVolumeInformationA
IsDebuggerPresent
CloseHandle
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
WaitForSingleObject
Sleep
ExitProcess
CreateThread
GetSystemTimeAsFileTime
VirtualAlloc
VirtualProtect
VirtualQuery
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
LoadLibraryA
LoadLibraryW
GetComputerNameA
GetTickCount64
RtlCaptureContext
CreateDirectoryA
FindClose
FindFirstFileA
FindNextFileA
GetFileAttributesW
Beep
AddVectoredExceptionHandler
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
GetTickCount
GlobalUnlock
GlobalLock
CopyFileA
WideCharToMultiByte
GlobalAlloc
GlobalFree
FindNextFileW
FreeLibrary
GetConsoleOutputCP
WriteFile
FlushFileBuffers
GetFileType
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
LoadLibraryExW
HeapFree
HeapAlloc
UnhandledExceptionFilter
RtlVirtualUnwind
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
ReadFile
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetLastError
InterlockedFlushSList
RtlLookupFunctionEntry
RtlUnwindEx
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlUnwind
GetProcessHeap
SetStdHandle
CreateFileW
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
GetCPInfo
LCMapStringEx
HeapSize
SetEndOfFile
WriteConsoleW
MultiByteToWideChar
DecodePointer
EncodePointer
GetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetStringTypeW
WakeAllConditionVariable
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
user32
GetCursorPos
wsprintfA
ClipCursor
SetWindowLongPtrW
GetAsyncKeyState
ScreenToClient
CallWindowProcW
GetDesktopWindow
LoadCursorW
ClientToScreen
SetCursor
SetCursorPos
GetClientRect
GetForegroundWindow
IsWindowUnicode
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetMessageExtraInfo
TrackMouseEvent
EmptyClipboard
SetClipboardData
GetSystemMetrics
GetClipboardData
CallNextHookEx
OpenClipboard
CloseClipboard
shell32
SHGetFolderPathA
d3d11
D3D11CreateDeviceAndSwapChain
winmm
mciSendStringW
imm32
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
CheckHwidBinding
GetSessionToken
InitProtection
MertdOirf__
ValidateLicense
VerifyIntegrity
Name
.text
Size
976KB
Virtual Size
975KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
768KB
Virtual Size
767KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
10.7MB
Virtual Size
10.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.offline
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=181, id=261, version=35222,
count=48, id=260, version=35222,
count=31, id=259, version=35222,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=84, id=261, version=35721,
count=23, id=257, version=35222,
count=217, id=1, productName=Unmarked objects,
count=9, id=261, version=36260,
count=4, id=259, version=36260,
count=1, id=256, version=36260,
count=1, id=255, version=36260,
count=1, id=151,
count=1, id=258, version=36260,
korkamk.exe
- IMPHASH dd9b470fc50af5de9e321db26e7d139c
- SHA256 0a64d43aeba0ece0450be43b7ae80358aa3433c15ebf33fac7378e10c1f05e5b
- MD5 2728ea7c8d0b615a97fa7bc12a4a2286
- SHA1 b58dabce2f5bf3c89deec0b30af8d7fc7aed904c
- SHA512 da99cd6d2af058af3117990c9e19839a53608b5d14884db38efe7b3422c29294c9b88ba5bc873f172efb0f885d5b3bb3fa248b22f9b7eb71e8fc00afdef0b36b
- SSDEEP 786432:XDSH4uCqM3nqqNWiGPhUsmQPUugGkfk+hvyCl/Lc0Xy+F:XDghF8UbmQ/gZhvyClzca
- TLSH T10B9723E752E562E4C4C30534A68F13D755C064BEC6EE89292AC75C033924DBB8E8EDB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
29848923
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
virtdisk
DetachVirtualDisk
GetVirtualDiskPhysicalPath
CreateVirtualDisk
AttachVirtualDisk
iphlpapi
GetAdaptersInfo
advapi32
QueryServiceConfigW
GetUserNameA
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceStatus
OpenSCManagerA
OpenProcessToken
OpenServiceA
CreateServiceW
CloseServiceHandle
DeleteService
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
QueryServiceStatusEx
OpenServiceW
ControlService
EnumServicesStatusExW
StartServiceW
OpenSCManagerW
crypt32
CryptUnprotectData
CryptStringToBinaryA
bcrypt
BCryptFinishHash
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptVerifySignature
BCryptGetProperty
BCryptDestroyKey
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptImportKeyPair
BCryptHashData
BCryptCreateHash
BCryptDecrypt
BCryptGenerateSymmetricKey
BCryptSetProperty
kernel32
GetEnvironmentStringsW
FindNextFileW
FindFirstFileExW
HeapReAlloc
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetStdHandle
GetVolumeInformationA
Sleep
CreateThread
SetConsoleOutputCP
ReadFile
GetLogicalDrives
FindFirstFileA
SetConsoleTitleA
WriteFile
DeviceIoControl
FindNextFileA
GetTempPathW
GetEnvironmentVariableA
FindClose
FreeEnvironmentStringsW
CreateFileW
OpenProcess
CreateToolhelp32Snapshot
GetTempPathA
GetTickCount64
GetLastError
Process32NextW
CreateFileA
LoadLibraryA
DeleteFileA
DeleteFileW
Process32FirstW
CloseHandle
GetLocalTime
GetProcAddress
LocalFree
GetFileSize
ExitProcess
ReadProcessMemory
GetCurrentProcessId
CreateProcessW
WideCharToMultiByte
GetConsoleWindow
GetSystemTimeAsFileTime
GetTempFileNameA
GetDriveTypeW
VirtualQueryEx
GetComputerNameA
FlushFileBuffers
GetFullPathNameW
GetLongPathNameW
SuspendThread
ResumeThread
GetModuleHandleA
MultiByteToWideChar
GetThreadContext
GetThreadTimes
VirtualProtect
GetCurrentProcess
TerminateProcess
RtlUnwind
Thread32First
GetCurrentThread
Module32FirstW
Module32NextW
IsDebuggerPresent
CheckRemoteDebuggerPresent
CompareStringW
LoadLibraryExW
HeapFree
GetConsoleMode
GetConsoleOutputCP
HeapAlloc
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
HeapSize
WriteConsoleW
SetEndOfFile
WaitForSingleObject
Thread32Next
GetFileType
SetFilePointerEx
GetFileSizeEx
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetCommandLineW
GetCommandLineA
GetModuleFileNameW
GetModuleHandleExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
IsProcessorFeaturePresent
FreeLibrary
user32
GetClassNameW
GetTopWindow
GetDC
ReleaseDC
ShowWindow
GetSystemMetrics
GetWindow
gdi32
SelectObject
DeleteObject
SetStretchBltMode
DeleteDC
GetDIBits
StretchBlt
CreateCompatibleDC
CreateCompatibleBitmap
winhttp
WinHttpReadData
WinHttpSetOption
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpSendRequest
WinHttpConnect
WinHttpReceiveResponse
WinHttpOpen
WinHttpQueryDataAvailable
Name
.text
Size
Virtual Size
352KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.G1>
Size
Virtual Size
23.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.+q^
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.iSF
Size
39.0MB
Virtual Size
39.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
268B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ