Behavioral task
behavioral1
Sample
d6c5410b2d9e45c08deaabe2c3e09c65.exe
Resource
win7-20240221-en
General
-
Target
d6c5410b2d9e45c08deaabe2c3e09c65.exe
-
Size
5.7MB
-
MD5
d6c5410b2d9e45c08deaabe2c3e09c65
-
SHA1
e7fd29cf3488283bb7b43a31f965b9849c2d55cf
-
SHA256
f9e3c1a6284370cd7b6f8cb5a54d4d5f639a6fe0eb6c9a293d350e6505a3df75
-
SHA512
3f4a0ba92a7509a2d84aac0fc4d2c8d80144ccc090c664276acb85db487585419f268bb3b27652cdb88010d72ef5bdf66bf56fbfbdf6f4b4a2b2569cb2c3f325
-
SSDEEP
98304:rdl0LfzHWvOWzAWG6JgBhbwvU4yBSlT+5fge0RMpxkp:rAzHWvNAWG6k4U4yBWq5fWMpI
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule sample family_zgrat_v1 -
Zgrat family
Files
-
d6c5410b2d9e45c08deaabe2c3e09c65.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
15:09:3a:44:68:a4:45:48:bb:52:b8:4b:44:6b:04:41Certificate
IssuerCN=Honor Studio,OU=Honor Studio,O=Creted by Honor Studio,L=ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„,ST=Made in,C=GreekNot Before24-02-2024 10:04Not After23-07-2026 00:00SubjectCN=Honor Studio,OU=Honor Studio,O=Creted by Honor Studio,L=ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„ワℯ⃯ㄯㄯㄯワ⃯ㄯℯℯワ⃯⃯⃯⃯ㄯℯ⃯ㄯℯℯワ⃯⃯ワ⃯⃯ㄯ⃯ㄯワℯ⃯⃯⃯℮ℯワㄯㄯワワℯ⃯⃯⃯ㄯㄯヮ⃮⃯ワワㄯℯℯℯㄯワℯℯㄯℯ⃯ℯ⃯ㄯ⃯ワワㄮℯℯワㄯ⃯ℯℯℯ⃯ℯℯℯ⃯℮ℯ⃮ℯ⃯ワ⃯ワㄯ⃯ワㄯワㄯℯㄯ⃯ㄯワ⃯ワワℯ⃯ℯℯ⃯ℯワℯㄯ⃯ㄯワㄯℯワℯワ⃯ㄯℯ⃯ワℯワワㄯヮ⃯⃯ワℯℯℯℯㄯℯℯワㄯㄯワワワㄯ⃯ℯㄯワ℮ワ⃯ㄯ⃯⃯ワℯワℯℯ℮⃯⃯⃮⃯ㄯㄯㄯワℯℯ⃮ワㄯ⃯ワ⃯ℯワ⃯⃯ℯワℯℯワℯℯ⃮ㄯℯㄯㄯ⃯ㄯℯワ⃯ℯヮワ⃯ㄯ℮⃯ワ⃯⃯ワワℯワ℮ワワℯㄯ⃯⃯ワㄯℯℯワワヮℯℯ⃯⃯ワワ⃯⃯⃯ℯℯㄯℯ⃯⃯ㄯ℮⃯⃯ワℯㄯ⃯⃯ワℯㄯㄯㄯ⃯ワワワℯã„,ST=Made in,C=Greek39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03-05-2023 00:00Not After02-08-2034 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
b5:34:bb:f8:d7:42:16:f9:e2:32:06:c6:5b:62:bf:46:a2:35:b8:09:d8:39:40:da:49:2c:aa:a3:eb:c2:60:61Signer
Actual PE Digestb5:34:bb:f8:d7:42:16:f9:e2:32:06:c6:5b:62:bf:46:a2:35:b8:09:d8:39:40:da:49:2c:aa:a3:eb:c2:60:61Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
bitsoftteamfrendly.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 147KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ