C:\Users\Administrator\Desktop\登录器源码53改版\Debug\rxjh.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-09_15bfc9ac3768bddea1977c35ef841a75_icedid.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-03-09_15bfc9ac3768bddea1977c35ef841a75_icedid.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-09_15bfc9ac3768bddea1977c35ef841a75_icedid
-
Size
17.2MB
-
MD5
15bfc9ac3768bddea1977c35ef841a75
-
SHA1
717be60c0d30bd47bd67b8b08386914497e15d74
-
SHA256
75a19accd0b05fb86863a99dacd754dc397930adb9221a72d9c99b98f5511d66
-
SHA512
055f71fc6394096464a14d3734f04718d4f580b422a0e9d08203f1fe8ea2090a7f7896177f18ca0c6542bd4790355e44477d3d6385d20dd9889fa40d60731d75
-
SSDEEP
196608:eFlOQvYKHEvjSz9Faxv/hd0LuFiCBIkQyYA:e1Luv/hd0LuFiCBIk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-09_15bfc9ac3768bddea1977c35ef841a75_icedid
Files
-
2024-03-09_15bfc9ac3768bddea1977c35ef841a75_icedid.exe windows:6 windows x86 arch:x86
a5ae720f008a6e5bf6ab9585d44ba8f5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLocalTime
SetFileTime
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SystemTimeToFileTime
GetFileInformationByHandle
CreateFileMappingA
OutputDebugStringA
GetModuleFileNameW
GetModuleHandleW
LoadLibraryW
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
GlobalSize
LocalFree
MulDiv
FormatMessageA
EncodePointer
GetCurrentThreadId
GetSystemDirectoryW
FreeLibrary
LoadLibraryExW
LoadLibraryA
GlobalDeleteAtom
lstrcmpW
GlobalAddAtomA
GlobalFindAtomA
GlobalGetAtomNameA
CompareStringA
SetThreadPriority
GetThreadPriority
SuspendThread
ResumeThread
FileTimeToLocalFileTime
FindClose
FindFirstFileA
FindNextFileA
SystemTimeToTzSpecificLocalTime
GetCurrentThread
GetVersionExA
lstrcmpA
SetEvent
CreateEventA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetAtomNameA
GetACP
GlobalFlags
SetErrorMode
InitializeCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalReAlloc
GetProfileIntA
VirtualProtect
GetThreadLocale
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetOEMCP
GetCPInfo
FlushFileBuffers
GetFullPathNameA
LockFile
SetEndOfFile
UnlockFile
GetVolumeInformationA
DuplicateHandle
GetHandleInformation
GetCurrentProcess
LoadLibraryExA
GetShortPathNameA
lstrcmpiA
MoveFileA
GetStringTypeExA
GetDiskFreeSpaceA
GetFileTime
GetTempFileNameA
ReplaceFileA
GetUserDefaultLCID
GetFileAttributesExA
GetFileSizeEx
GetWindowsDirectoryA
FindResourceExW
VerSetConditionMask
VerifyVersionInfoA
ResetEvent
PulseEvent
SearchPathA
Sleep
ReleaseSemaphore
ReleaseMutex
WaitForMultipleObjects
FileTimeToSystemTime
LocalLock
LocalUnlock
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
WaitForSingleObjectEx
CreateEventW
GetStartupInfoW
VirtualQuery
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleHandleExW
ExitProcess
GetSystemInfo
VirtualAlloc
HeapValidate
GetFullPathNameW
GetCommandLineA
ExitThread
FreeLibraryAndExitThread
HeapQueryInformation
QueryPerformanceFrequency
GetStdHandle
GetFileType
WriteConsoleW
SetStdHandle
SetFilePointerEx
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
GetFileAttributesExW
GetStringTypeW
GetDriveTypeW
GetTimeZoneInformation
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
CreateFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
LocalFileTimeToFileTime
GetFileAttributesA
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
RaiseException
DecodePointer
MoveFileExA
CopyFileA
FindResourceA
lstrlenA
lstrcpyA
FreeResource
GetTickCount
OpenProcess
CreateThread
GetCurrentProcessId
Beep
GetTempPathA
WriteFile
SetFileAttributesA
ReadFile
GetFileSize
CreateFileA
CreateDirectoryA
SetCurrentDirectoryA
CreateMutexA
WaitForSingleObject
CloseHandle
GetCommandLineW
WinExec
CreateProcessA
RemoveDirectoryA
DeleteFileA
GetModuleFileNameA
GetLogicalDrives
GetDriveTypeA
GetCurrentDirectoryA
GetProcAddress
GetModuleHandleA
WideCharToMultiByte
FindResourceW
SizeofResource
LockResource
LoadResource
MultiByteToWideChar
SetLastError
CreateSemaphoreA
GetLastError
user32
CreateCaret
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
WindowFromPoint
ChildWindowFromPoint
ChildWindowFromPointEx
SetParent
FindWindowA
FindWindowExA
GetLastActivePopup
LoadCursorA
LoadCursorW
DlgDirListA
DlgDirSelectExA
DlgDirListComboBoxA
DlgDirSelectComboBoxExA
ArrangeIconicWindows
NotifyWinEvent
DrawEdge
DrawFrameControl
LoadMenuW
LoadMenuIndirectA
CreateMenu
CreatePopupMenu
CheckMenuItem
EnableMenuItem
ModifyMenuA
DeleteMenu
InsertMenuItemA
GetMenuItemInfoA
SetMenuItemInfoA
GetMenuDefaultItem
SetMenuDefaultItem
DrawIcon
DrawTextA
DrawTextExA
GrayStringA
DrawStateA
GetTabbedTextExtentA
WindowFromDC
ExcludeUpdateRgn
ScrollDC
SetMenuContextHelpId
GetMenuContextHelpId
GetSysColorBrush
DrawFocusRect
FillRect
FrameRect
InvertRect
CheckMenuRadioItem
LoadBitmapA
IntersectRect
GetKeyNameTextA
MapVirtualKeyA
ReleaseCapture
LoadAcceleratorsA
TranslateAcceleratorA
GetWindowThreadProcessId
GetMenuBarInfo
UnpackDDElParam
ReuseDDElParam
GetMessageA
TranslateMessage
SystemParametersInfoA
IsRectEmpty
WaitMessage
GetDialogBaseUnits
RealChildWindowFromPoint
SetRect
GetAsyncKeyState
TrackMouseEvent
LoadImageW
CopyImage
GetClipboardFormatNameA
CharUpperA
CharNextA
CopyAcceleratorTableA
UnionRect
LoadAcceleratorsW
MessageBeep
DrawIconEx
SetLayeredWindowAttributes
EnumDisplayMonitors
CloseClipboard
SetClipboardData
EmptyClipboard
SetClassLongA
SetCursorPos
CopyIcon
RegisterClipboardFormatA
UpdateLayeredWindow
MonitorFromPoint
GetComboBoxInfo
GetKeyboardLayout
IsCharLowerA
MapVirtualKeyExA
GetKeyboardState
ToAsciiEx
CreateAcceleratorTableA
DestroyAcceleratorTable
GetDoubleClickTime
CharUpperBuffA
IsClipboardFormatAvailable
EnumChildWindows
DefFrameProcA
DefMDIChildProcA
TranslateMDISysAccel
SubtractRect
MonitorFromRect
InSendMessage
MsgWaitForMultipleObjectsEx
GetTabbedTextExtentW
SetClipboardViewer
GetClipboardOwner
OpenClipboard
GetNextDlgTabItem
GetNextDlgGroupItem
IsZoomed
BringWindowToTop
IsIconic
IsWindowVisible
OpenIcon
ShowOwnedPopups
FlashWindow
PostThreadMessageA
GetWindowContextHelpId
DrawAnimatedRects
DrawCaption
IsDialogMessageA
SetWindowTextA
ScrollWindowEx
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextA
SetDlgItemTextA
GetDlgItemInt
SetDlgItemInt
MoveWindow
ShowWindow
GetMonitorInfoA
MonitorFromWindow
WinHelpA
GetScrollInfo
SetScrollInfo
LoadIconW
LoadIconA
UnhookWindowsHookEx
SetWindowsHookExA
GetWindow
GetTopWindow
GetClassNameA
GetClassLongA
PtInRect
EqualRect
MapWindowPoints
ScreenToClient
GetWindowRect
GetClientRect
GetWindowTextLengthA
GetWindowTextA
RemovePropA
GetPropA
SetPropA
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
EndPaint
BeginPaint
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetKeyState
SetFocus
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsChild
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
CallWindowProcA
DefWindowProcA
GetMessageTime
GetMessagePos
DispatchMessageA
RegisterWindowMessageA
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetParent
SetRectEmpty
SendDlgItemMessageA
MapDialogRect
TabbedTextOutA
RemoveMenu
AppendMenuA
InsertMenuA
GetMenuItemCount
GetMenuItemID
GetMenuState
GetMenuStringA
IsMenu
SetActiveWindow
IsWindowEnabled
EnableWindow
GetActiveWindow
GetDlgItem
EndDialog
CreateDialogIndirectParamA
DestroyWindow
SetWindowPos
GetWindowDC
ReleaseDC
SetWindowRgn
LoadImageA
PeekMessageA
SendMessageA
PostMessageA
PostQuitMessage
LoadMenuA
DestroyMenu
GetSubMenu
TrackPopupMenuEx
GetDC
SetCursor
GetSysColor
CopyRect
InflateRect
OffsetRect
DestroyCursor
DestroyIcon
CreateIconIndirect
GetIconInfo
IsWindow
RedrawWindow
GetWindowLongA
SetWindowLongA
GetFocus
MessageBoxA
AdjustWindowRectEx
wsprintfA
GetSystemMetrics
GetCursorPos
CallNextHookEx
CreateIconFromResource
UnregisterClassA
GetDesktopWindow
SetWindowContextHelpId
EnableScrollBar
ShowScrollBar
LockWindowUpdate
ValidateRgn
InvalidateRgn
ValidateRect
InvalidateRect
GetWindowRgn
GetUpdateRgn
GetUpdateRect
GetDCEx
SetForegroundWindow
GetForegroundWindow
UpdateWindow
DragDetect
GetSystemMenu
DrawMenuBar
HiliteMenuItem
KillTimer
SetTimer
SetCapture
GetOpenClipboardWindow
ChangeClipboardChain
SendNotifyMessageA
GetClipboardViewer
CloseWindow
gdi32
GetViewportOrgEx
GetWindowExtEx
GetWindowOrgEx
InvertRgn
MaskBlt
PlgBlt
OffsetRgn
PatBlt
Pie
PaintRgn
PolyPolygon
PtInRegion
PtVisible
RectInRegion
RectVisible
Rectangle
ResetDCA
RealizePalette
RoundRect
ResizePalette
SetBitmapBits
SetBoundsRect
SetPaletteEntries
SetPixelV
StretchBlt
SetRectRgn
UpdateColors
PlayEnhMetaFile
GdiComment
GetTextMetricsA
AngleArc
PolyPolyline
GetCurrentObject
GetCharABCWidthsFloatA
GetCharABCWidthsA
GetCharWidthFloatA
GetWorldTransform
GetColorAdjustment
CreateHalftonePalette
StartDocA
EndDoc
CreateDCA
GetDeviceCaps
CloseMetaFile
CreateMetaFileA
CloseEnhMetaFile
CreateEnhMetaFileA
ExtTextOutA
AnimatePalette
Arc
Chord
CreateBitmapIndirect
GetTextExtentPoint32A
CreateDiscardableBitmap
CreateDIBPatternBrushPt
CreateEllipticRgn
CreateEllipticRgnIndirect
GetViewportExtEx
CreateFontA
CreateHatchBrush
CreateICA
CreatePalette
CreatePen
CreatePenIndirect
CreatePolyPolygonRgn
CreatePatternBrush
CreateRectRgnIndirect
CreateRoundRectRgn
CreateSolidBrush
DrawEscape
Ellipse
EnumObjects
EqualRgn
Escape
ExtEscape
ExtCreateRegion
ExtFloodFill
FillRgn
FloodFill
FrameRgn
CombineRgn
CreateRectRgn
DeleteObject
GetDIBits
SelectObject
GetObjectA
BitBlt
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
GetPixel
GetStockObject
SetBkColor
SetPixel
SetTextColor
StartPage
GetTextColor
GetTextAlign
GetTextCharacterExtra
GetStretchBltMode
GetRgnBox
GetCharacterPlacementA
GetROP2
GetAspectRatioFilterEx
GetBkColor
GetBkMode
GetBitmapBits
GetRegionData
GetPolyFillMode
GetPaletteEntries
GetOutlineTextMetricsA
GetObjectType
GetBitmapDimensionEx
GetBoundsRect
GetBrushOrgEx
GetCharWidthA
CreateFontIndirectA
GetFontLanguageInfo
GetNearestPaletteIndex
GetNearestColor
GetMapMode
GetGraphicsMode
GetGlyphOutlineA
GetFontData
CreateBrushIndirect
CopyMetaFileA
GetTextExtentPoint32W
GetTextExtentPointA
DeleteMetaFile
SetDIBColorTable
GetTextCharsetInfo
EnumFontFamiliesA
CreateDIBitmap
GetSystemPaletteEntries
EnumFontFamiliesExA
StretchDIBits
CreateDIBSection
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
PolylineTo
PolyBezierTo
MoveToEx
SetArcDirection
SelectClipPath
PolyDraw
ArcTo
SetColorAdjustment
ModifyWorldTransform
SetWorldTransform
EnumMetaFile
PlayMetaFileRecord
SetTextJustification
SetTextAlign
SetTextCharacterExtra
SetStretchBltMode
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetGraphicsMode
SetMapperFlags
SetBkMode
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
PlayMetaFile
OffsetClipRgn
LineTo
IntersectClipRect
GetClipRgn
GetClipBox
ExcludeClipRect
UnrealizeObject
GetKerningPairsA
GetTextFaceA
SetBrushOrgEx
SetBitmapDimensionEx
PolyBezier
Polyline
Polygon
LPtoDP
DPtoLP
CreatePolygonRgn
TextOutA
GetArcDirection
GetMiterLimit
ExtCreatePen
WidenPath
StrokePath
StrokeAndFillPath
SetMiterLimit
PathToRegion
GetPath
FlattenPath
FillPath
EndPath
CloseFigure
BeginPath
AbortPath
SetAbortProc
AbortDoc
EndPage
GetCurrentPositionEx
advapi32
RegCloseKey
IsTextUnicode
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegQueryValueA
RegOpenKeyExW
SetFileSecurityA
GetFileSecurityA
RegEnumValueA
RegEnumKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegSetValueA
shell32
SHAddToRecentDocs
CommandLineToArgvW
ShellExecuteA
Shell_NotifyIconA
SHGetSpecialFolderPathA
SHAppBarMessage
SHBrowseForFolderA
SHGetMalloc
DragAcceptFiles
DragQueryFileA
DragFinish
SHGetFileInfoA
ShellExecuteExA
ExtractIconA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetDesktopFolder
ole32
OleInitialize
OleRun
OleSetClipboard
OleFlushClipboard
OleIsCurrentClipboard
DoDragDrop
OleGetClipboard
CoLockObjectExternal
CoRevokeClassObject
RevokeDragDrop
CoRegisterMessageFilter
StgIsStorageILockBytes
WriteClassStm
GetHGlobalFromILockBytes
OleUninitialize
CreateItemMoniker
OleCreate
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleCreateLinkToFile
OleCreateFromFile
OleSave
OleSaveToStream
OleSetContainedObject
OleIsRunning
OleLockRunning
OleGetIconOfClass
OleSetMenuDescriptor
CoGetMalloc
StgCreateDocfile
StgOpenStorage
StgIsStorageFile
CreateFileMoniker
OleLoad
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleRegGetMiscStatus
OleRegEnumVerbs
GetClassFile
OleQueryLinkFromData
OleQueryCreateFromData
CreateDataAdviseHolder
CreateOleAdviseHolder
GetRunningObjectTable
CoRegisterClassObject
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
PropVariantCopy
CoInitializeEx
StringFromGUID2
CoDisconnectObject
CLSIDFromProgID
CLSIDFromString
CoCreateGuid
OleDraw
CreateStreamOnHGlobal
SetConvertStg
OleRegGetUserType
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
CreateBindCtx
CoTreatAsClass
WriteClassStg
ReadClassStg
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
CoUninitialize
CoCreateInstance
CoInitialize
CoFreeUnusedLibraries
RegisterDragDrop
CreateGenericComposite
msimg32
TransparentBlt
AlphaBlend
GradientFill
comctl32
_TrackMouseEvent
shlwapi
PathFindFileNameA
PathRemoveExtensionA
PathRemoveFileSpecW
PathIsUNCA
PathStripToRootA
StrFormatKBSizeA
PathFindExtensionA
uxtheme
IsAppThemed
IsThemeBackgroundPartiallyTransparent
DrawThemeParentBackground
DrawThemeText
GetThemeColor
GetCurrentThemeName
GetWindowTheme
GetThemeSysColor
DrawThemeBackground
CloseThemeData
OpenThemeData
GetThemePartSize
oledlg
ord3
ord4
ord5
ord9
ord7
ord6
ord8
urlmon
URLDownloadToFileA
winmm
PlaySoundA
wininet
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
DeleteUrlCacheEntry
InternetConnectA
InternetOpenA
InternetCloseHandle
InternetOpenUrlA
ws2_32
select
send
recv
ntohs
sendto
setsockopt
shutdown
recvfrom
socket
gethostbyname
WSAStartup
WSACleanup
accept
bind
closesocket
connect
ioctlsocket
getpeername
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
listen
WSASetLastError
WSAGetLastError
WSAAsyncSelect
gdiplus
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCreateBitmapFromFile
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFileICM
oleacc
CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow
imm32
ImmReleaseContext
ImmGetContext
ImmGetOpenStatus
winspool.drv
DocumentPropertiesA
ClosePrinter
GetJobA
OpenPrinterA
oleaut32
SysAllocStringByteLen
SysAllocStringLen
VariantInit
VariantClear
VariantChangeType
SysAllocString
SafeArrayGetDim
SafeArrayGetElemsize
LoadTypeLi
LoadRegTypeLi
RegisterTypeLi
SysStringLen
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayAllocDescriptor
SafeArrayAllocData
SysStringByteLen
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayRedim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayCopy
SafeArrayPtrOfIndex
VariantCopy
VarDateFromStr
SysFreeString
VarCyFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromDec
VarDecFromStr
OleCreateFontIndirect
SafeArrayCreateVector
SafeArrayCreate
Sections
.text Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 786KB - Virtual size: 786KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 33KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10.5MB - Virtual size: 10.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ