E:\scnf\bin\Win32\Release\sdiskfinder.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-28_c071bf2ebc045338c0dd5a2941b4ebbf_icedid_vidar.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-28_c071bf2ebc045338c0dd5a2941b4ebbf_icedid_vidar.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-03-28_c071bf2ebc045338c0dd5a2941b4ebbf_icedid_vidar
-
Size
4.8MB
-
MD5
c071bf2ebc045338c0dd5a2941b4ebbf
-
SHA1
849507656cbdd676f90e7fde839850fd4df3cad8
-
SHA256
a86b27a6e0eb604a6eaa735307ecb6ebf18f099d5de8ca7624e4b320f9d3eb2d
-
SHA512
76720a0eb58e9b6135fb339f50548e3e9cae3a7047b9f0b5fa2ed8045b0f26adce7fe1a6344a16a5f61c548c1a8ed98c72bf04a39b17e37dbba5b86a04593df7
-
SSDEEP
98304:gKAmRDf05eRFl/jb+sjiD3s6Nryo8fmKfIbvDVUQCZQBYda3E1Q:gKtO5eRv+EDAryDfF44ZQBYda3K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-28_c071bf2ebc045338c0dd5a2941b4ebbf_icedid_vidar
Files
-
2024-03-28_c071bf2ebc045338c0dd5a2941b4ebbf_icedid_vidar.exe windows:6 windows x86 arch:x86
c7d430fbae773ae613ba226aff9f94ba
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
psapi
GetModuleFileNameExW
EnumProcesses
kernel32
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
CreateTimerQueueTimer
DeleteTimerQueueTimer
HeapQueryInformation
SetThreadStackGuarantee
VirtualAlloc
VirtualQuery
SetStdHandle
GetFileType
GetStdHandle
GetProcessHeap
InitOnceExecuteOnce
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
TerminateProcess
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
FatalAppExitA
SetConsoleCtrlHandler
GetTimeZoneInformation
GetTimeFormatEx
GetDateFormatEx
GetUserDefaultLocaleName
LCMapStringEx
IsValidLocaleName
EnumSystemLocalesEx
GetConsoleMode
ReadConsoleW
GetStringTypeW
GetUserDefaultLCID
ReleaseSemaphore
CreateSemaphoreExW
InitializeSListHead
InterlockedPopEntrySList
RaiseException
InterlockedFlushSList
QueryDepthSList
SwitchToThread
UnregisterWaitEx
ChangeTimerQueueTimer
GetNumaHighestNodeNumber
RegisterWaitForSingleObject
GetConsoleCP
SetFilePointerEx
OutputDebugStringW
SetEnvironmentVariableA
DebugBreak
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FreeLibraryAndExitThread
GetCurrentProcessorNumber
GetLogicalProcessorInformation
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
UnregisterWait
WriteConsoleW
SetCurrentDirectoryW
GetThreadPriority
WaitForMultipleObjectsEx
FlushProcessWriteBuffers
SignalObjectAndWait
ReplaceFileW
GetTempFileNameW
GetExitCodeThread
lstrlenW
lstrlenA
InitializeCriticalSectionEx
SetErrorMode
GetWindowsDirectoryW
GetModuleHandleExW
DecodePointer
EncodePointer
LocalUnlock
SetFileTime
SetFileAttributesW
LocalFileTimeToFileTime
GetFileTime
InterlockedPushEntrySList
LocalLock
GetUserDefaultUILanguage
FindResourceExW
GetProfileIntW
SearchPathW
VerifyVersionInfoW
VerSetConditionMask
GetStringTypeExW
MoveFileW
lstrcmpiW
DuplicateHandle
GetVolumeInformationW
GetShortPathNameW
GetCurrentDirectoryW
GlobalFlags
GetThreadLocale
GetAtomNameW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LocalAlloc
VirtualProtect
lstrcpyW
GlobalGetAtomNameW
CompareStringEx
GlobalFindAtomW
InitializeCriticalSectionAndSpinCount
GlobalAddAtomW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetLocaleInfoEx
GetThreadPreferredUILanguages
CompareStringA
ApplicationRecoveryFinished
ApplicationRecoveryInProgress
RegisterApplicationRestart
RegisterApplicationRecoveryCallback
lstrcmpW
lstrcmpA
GlobalDeleteAtom
LoadLibraryExW
GetVersionExW
InterlockedExchange
ResumeThread
SuspendThread
SetThreadPriority
FreeResource
GetModuleHandleA
GetVersion
OutputDebugStringA
MulDiv
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GetCurrentThread
GetThreadTimes
QueryPerformanceFrequency
SetLastError
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ExitThread
GetDriveTypeW
InterlockedCompareExchange
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
CreateFileA
GetFileSize
SetFilePointer
MapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
UnlockFile
LockFile
UnlockFileEx
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
LoadLibraryW
FormatMessageW
HeapDestroy
GetFileAttributesA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
FlushFileBuffers
GetTempPathW
HeapSize
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingW
GetDiskFreeSpaceA
GetFileAttributesExW
GetVersionExA
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
ResetEvent
SetEvent
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
CopyFileW
GetSystemInfo
OpenProcess
GetStartupInfoW
TerminateThread
CreateThread
InterlockedDecrement
InterlockedIncrement
Sleep
CreateEventW
InitializeCriticalSection
DeviceIoControl
FileTimeToSystemTime
FileTimeToLocalFileTime
CompareFileTime
GetProcAddress
GetTickCount
GetCurrentThreadId
GetCurrentProcess
GetLastError
GetFileSizeEx
GetDiskFreeSpaceExW
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
WideCharToMultiByte
MultiByteToWideChar
FindResourceW
GlobalAlloc
SizeofResource
LockResource
LoadResource
GetModuleHandleW
GetModuleFileNameW
UnmapViewOfFile
ExitProcess
CreateMutexW
WaitForSingleObject
ReleaseMutex
CloseHandle
DeleteFileW
GetCommandLineW
CreateTimerQueue
user32
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
GetMenuDefaultItem
InSendMessage
UnionRect
EnableScrollBar
UpdateLayeredWindow
DrawIconEx
DrawStateW
DrawFrameControl
DrawEdge
SetRect
EnumDisplayMonitors
SetLayeredWindowAttributes
CopyAcceleratorTableW
SendNotifyMessageW
WaitMessage
UnregisterClassW
GetDialogBaseUnits
RealChildWindowFromPoint
GetSysColorBrush
MapDialogRect
SendDlgItemMessageA
DrawFocusRect
GetMenuItemInfoW
IsClipboardFormatAvailable
GetIconInfo
CopyImage
MessageBeep
KillTimer
SetTimer
CharUpperW
TrackMouseEvent
IsRectEmpty
InflateRect
RegisterClipboardFormatW
MonitorFromPoint
SystemParametersInfoW
DeleteMenu
ModifyMenuW
GetSystemMenu
GetSystemMetrics
GetAsyncKeyState
IsZoomed
IsMenu
ReuseDDElParam
UnpackDDElParam
GetMenuBarInfo
LoadImageW
IntersectRect
SetRectEmpty
InsertMenuItemW
DestroyMenu
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
IsIconic
NotifyWinEvent
SetWindowRgn
DestroyAcceleratorTable
WindowFromPoint
LoadMenuW
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
GetTopWindow
GetClassNameW
GetClassLongW
EqualRect
MapWindowPoints
AdjustWindowRectEx
CreateAcceleratorTableW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
SetForegroundWindow
GetForegroundWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
GetMenu
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsChild
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
RegisterWindowMessageW
FillRect
EndPaint
BeginPaint
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
UnhookWindowsHookEx
GetLastActivePopup
GetWindowThreadProcessId
UpdateWindow
MessageBoxW
SendMessageW
EnableWindow
AppendMenuW
SetCursor
ShowOwnedPopups
CallNextHookEx
SetWindowsHookExW
GetCursorPos
ValidateRect
DispatchMessageW
TranslateMessage
GetMessageW
SetActiveWindow
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
DestroyWindow
IsDialogMessageW
GetWindow
SetWindowLongW
GetWindowLongW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
ScrollWindowEx
IsWindowEnabled
SetFocus
GetDlgCtrlID
SendDlgItemMessageW
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextW
SetDlgItemTextW
CharUpperBuffW
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SetClassLongW
SetCursorPos
ChangeWindowMessageFilter
OpenClipboard
CloseClipboard
SetClipboardData
CopyIcon
FrameRect
GetDoubleClickTime
PostThreadMessageW
GetNextDlgGroupItem
CreateMenu
GetWindowRgn
GetUpdateRect
SubtractRect
DrawIcon
DestroyCursor
GetDCEx
GetComboBoxInfo
EnumChildWindows
IsCharLowerW
MapVirtualKeyExW
GetTabbedTextExtentW
HideCaret
InvertRect
RemovePropW
WindowFromDC
SetMenuItemBitmaps
SetMenuDefaultItem
LockWindowUpdate
LoadBitmapW
MessageBoxA
DestroyIcon
PostMessageW
PostQuitMessage
IsWindow
IsWindowVisible
GetFocus
GetClientRect
EmptyClipboard
GetWindowRect
GetSysColor
OffsetRect
GetDesktopWindow
GetParent
SetParent
LoadCursorW
LoadIconW
PeekMessageW
GetCapture
SetCapture
ReleaseCapture
GetDC
ReleaseDC
CopyRect
GetMessagePos
GetKeyState
CreatePopupMenu
DrawTextW
InvalidateRect
RedrawWindow
ClientToScreen
ScreenToClient
PtInRect
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
RemoveMenu
GetKeyNameTextW
MapVirtualKeyW
CheckMenuItem
EnableMenuItem
GetMenuCheckMarkDimensions
SetMenuItemInfoW
ShowWindow
MoveWindow
SetWindowPos
GetDlgItem
SetDlgItemInt
GetDlgItemInt
gdi32
CreateFontIndirectW
GetMapMode
SetRectRgn
DPtoLP
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
CreateEllipticRgn
Ellipse
GetBkColor
CreatePolygonRgn
Polygon
CreateDIBSection
GetRgnBox
OffsetRgn
GetCharWidthW
StretchDIBits
GetDIBits
RealizePalette
SetPixel
StretchBlt
SetDIBColorTable
GetCurrentObject
EnumFontFamiliesExW
GetWindowOrgEx
FillRgn
FrameRgn
GetBoundsRect
CombineRgn
LPtoDP
GetViewportOrgEx
CreatePalette
GetPaletteEntries
ExtFloodFill
SetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
RoundRect
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextFaceW
CloseMetaFile
CreateMetaFileW
DeleteMetaFile
SetPixelV
SetTextColor
SetTextCharacterExtra
SetStretchBltMode
CreateRoundRectRgn
GetTextMetricsW
GetTextColor
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
PolylineTo
PolyBezierTo
ExtTextOutW
TextOutW
MoveToEx
ExtCreatePen
SetArcDirection
SelectClipPath
PolyDraw
ArcTo
StartDocW
SetColorAdjustment
ModifyWorldTransform
SetWorldTransform
EnumMetaFile
PlayMetaFileRecord
SetTextJustification
BitBlt
SelectObject
PtInRegion
PatBlt
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetGraphicsMode
SetMapperFlags
SetBkMode
SetBkColor
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
PlayMetaFile
OffsetClipRgn
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetCurrentPositionEx
GetClipRgn
GetClipBox
ExcludeClipRect
Escape
DeleteDC
CreateRectRgn
CreatePatternBrush
CreateHatchBrush
CreateDIBPatternBrushPt
CreateBitmap
GetDeviceCaps
CreateDCW
CopyMetaFileW
Polyline
GetObjectW
Rectangle
GetTextExtentPoint32W
DeleteObject
CreateSolidBrush
CreateRectRgnIndirect
CreatePen
CreateFontW
CreateCompatibleDC
CreateCompatibleBitmap
SetTextAlign
msimg32
TransparentBlt
AlphaBlend
winspool.drv
OpenPrinterW
ClosePrinter
GetJobW
DocumentPropertiesW
advapi32
GetFileSecurityW
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteValueW
CryptGenRandom
CryptAcquireContextA
RegSetValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyW
RegCreateKeyExW
RegCloseKey
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
DuplicateTokenEx
CreateProcessAsUserW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegDeleteKeyW
SetFileSecurityW
shell32
SHAppBarMessage
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
ord71
ShellExecuteW
SHFileOperationW
ShellExecuteExW
SHGetFileInfoW
SHGetDesktopFolder
SHGetSpecialFolderLocation
ExtractIconW
SHGetKnownFolderPath
SHAddToRecentDocs
SHCreateItemFromParsingName
CommandLineToArgvW
DragFinish
DragQueryFileW
InitNetworkAddressControl
SHGetSpecialFolderPathW
SHCreateDirectoryExW
Shell_NotifyIconW
shlwapi
PathFileExistsW
PathFindExtensionW
PathFindFileNameW
PathRemoveExtensionW
UrlUnescapeW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
PathRemoveFileSpecW
uxtheme
IsThemeBackgroundPartiallyTransparent
DrawThemeParentBackground
DrawThemeTextEx
BufferedPaintInit
GetWindowTheme
IsAppThemed
GetThemePartSize
GetCurrentThemeName
GetThemeColor
DrawThemeBackground
CloseThemeData
OpenThemeData
EndBufferedPaint
BeginBufferedPaint
BufferedPaintUnInit
GetThemeSysColor
dwmapi
DwmSetWindowAttribute
DwmExtendFrameIntoClientArea
DwmIsCompositionEnabled
DwmDefWindowProc
ole32
CoRevokeClassObject
StgCreateDocfileOnILockBytes
CreateGenericComposite
CreateItemMoniker
CoUninitialize
CoCreateInstance
CoInitialize
StringFromCLSID
CoTaskMemAlloc
CoTaskMemFree
CoTreatAsClass
CreateBindCtx
ReadClassStg
WriteClassStg
WriteFmtUserTypeStg
ReadFmtUserTypeStg
OleDuplicateData
ReleaseStgMedium
OleRegGetUserType
SetConvertStg
CoCreateGuid
StringFromGUID2
CoDisconnectObject
CLSIDFromString
OleSetMenuDescriptor
OleLockRunning
StgCreateDocfile
StgOpenStorage
StgOpenStorageOnILockBytes
StgIsStorageFile
CreateFileMoniker
CreateILockBytesOnHGlobal
OleGetClipboard
OleSetClipboard
OleFlushClipboard
OleIsCurrentClipboard
CreateStreamOnHGlobal
DoDragDrop
CLSIDFromProgID
CoRegisterMessageFilter
CoInitializeEx
CoRegisterClassObject
CoGetClassObject
GetRunningObjectTable
CreateOleAdviseHolder
CreateDataAdviseHolder
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
OleRegEnumVerbs
OleRegGetMiscStatus
CoGetMalloc
OleIsRunning
OleQueryCreateFromData
OleQueryLinkFromData
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
PropVariantCopy
OleRun
GetHGlobalFromILockBytes
OleGetIconOfClass
OleSetContainedObject
OleSaveToStream
OleSave
OleLoad
OleCreateFromFile
OleCreateLinkToFile
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
OleCreate
WriteClassStm
oleaut32
SysStringByteLen
SysAllocStringLen
VariantInit
VariantClear
VariantChangeType
LoadTypeLi
LoadRegTypeLi
RegisterTypeLi
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayCreate
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayRedim
SysAllocStringByteLen
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayCopy
SafeArrayPtrOfIndex
SetErrorInfo
VariantCopy
VarDateFromStr
VarCyFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromDec
VarDecFromStr
SysStringLen
SysFreeString
SysAllocString
SafeArrayGetDim
GetErrorInfo
CreateErrorInfo
oledlg
OleUIBusyW
urlmon
URLDownloadToFileW
gdiplus
GdipDeleteGraphics
GdipSetInterpolationMode
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageRectI
GdipCreateFromHDC
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
iphlpapi
GetAdaptersInfo
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
wtsapi32
WTSFreeMemory
WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSQueryUserToken
oleacc
CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject
imm32
ImmGetContext
ImmReleaseContext
ImmGetOpenStatus
wininet
HttpOpenRequestW
GopherGetAttributeW
GopherOpenFileW
GopherFindFirstFileW
GopherCreateLocatorW
FtpCommandW
FtpGetCurrentDirectoryW
FtpSetCurrentDirectoryW
FtpRemoveDirectoryW
FtpCreateDirectoryW
FtpOpenFileW
FtpRenameFileW
FtpDeleteFileW
FtpPutFileW
FtpGetFileW
FtpFindFirstFileW
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetSetOptionExW
InternetQueryOptionW
InternetFindNextFileW
InternetQueryDataAvailable
InternetWriteFile
HttpAddRequestHeadersW
InternetReadFile
InternetOpenUrlW
InternetConnectW
InternetCloseHandle
InternetOpenW
InternetCanonicalizeUrlW
InternetCrackUrlW
HttpSendRequestW
HttpSendRequestExW
HttpEndRequestW
HttpQueryInfoW
InternetSetCookieW
InternetGetCookieW
InternetErrorDlg
InternetSetFilePointer
winmm
PlaySoundW
propsys
PSGetPropertyDescriptionListFromString
Sections
.text Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 777KB - Virtual size: 777KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 101KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 229KB - Virtual size: 229KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ