G:\work_place\winapp\client_sdk\PPCS_ClientUI\output\release\Kingfisher.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-01_d2755f25b0b2cf5e9ec81229f8b0b991_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-01_d2755f25b0b2cf5e9ec81229f8b0b991_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-01_d2755f25b0b2cf5e9ec81229f8b0b991_mafia
-
Size
4.1MB
-
MD5
d2755f25b0b2cf5e9ec81229f8b0b991
-
SHA1
9e67e94768e6382542f815db93afd530c27dd3e5
-
SHA256
fa9cd3e34956e2c203fb498baefda873b9d505707b959423ebdedba5d6d5800e
-
SHA512
72b0d00525754128c7a9e88b5e59de7d10b968c3e421d440f90504de0b10a35ea8b672351bca616d1ffb6dd67bab2972c7f7b2037a433cb0d28e492391ee178d
-
SSDEEP
98304:N/f48niwMbmiwBBN8KrJGy0BQ4MgA4H2ywwKbQGcfo7Jn4D5LCZDz5FG3jp1ZsB3:N/f48Ar88KNyZjBo+DB7l1ZGnMxhrgsk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-01_d2755f25b0b2cf5e9ec81229f8b0b991_mafia
Files
-
2024-06-01_d2755f25b0b2cf5e9ec81229f8b0b991_mafia.exe windows:5 windows x86 arch:x86
a944dc67e7e8a501f20cb70cef5f9b01
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
libfbp2p
SEP2P_DelDevFromUser
SEP2P_SetUserAuth
SEP2P_ModifyDevAlias
SEP2P_Login
SEP2P_Logout
SEP2P_AddUser
SEP2P_GetDevList
SEP2P_ChgUserPwd
SEP2P_GetUserList
SEP2P_AddDevToUser
SEP2P_ForbidDev
SEP2P_GetUserInfo
SEP2P_NetworkDetect
SEP2P_DelUser
ipcnetmanager
_IPCNetSetDeviceInfoInLAN@4
_IPCNetSetLanSettingResultCallback@4
_IPCNetSearchDevice@4
_IPCNetPlaybackSeekR@12
_IPCNetPausePlaybackR@12
_IPCNetStopGetFileFromDevice@16
_IPCNetStartPlaybackR@12
_IPCNetSetPlaybackAudioVideoDataCallBack@8
_IPCNetStopPlaybackR@8
_IPCNetGetAPIVersion@4
_IPCNetPutTalkData@12
_IPCNetChangeDevPwdR@12
_IPCNetDeInitial@0
_IPCNetSetSnapshotCallBack@8
_IPCNetGetFileFromDevice@16
_IPCNetStopVideoR@12
_IPCNetStartVideoR@16
_IPCNetDeviceServicePutAvData@32
_IPCNetRebootDeviceInLAN@4
_IPCNetStartIPCNetSession@12
IPCNetLog
_IPCNetStopIPCNetSession@4
_IPCNetWaitDeviceWiFiConnected@4
_IPCNetSetDebugLog@8
_IPCNetInitializeArea@8
_IPCNetGetAudioSoundModeFromeStr@4
_IPCNetGetAudioEncTypeFromStr@4
_IPCNetFinishLocalRecord@4
_IPCNetPutLocalRecordVideoFrame@24
_IPCNetStartRecordLocalVideo@28
_IPCNetPutLocalRecordAudioFrame@24
_IPCNetSendFileToDevice@16
_IPCNetSetFileTransferProgressCallback@8
_IPCNetSendBinaryDataR@20
_IPCNetSendJsonCmdR@16
_IPCNetReleaseCmdResource@12
_IPCNetSleep@4
_IPCNetStopSearchDevice@0
_IPCNetStopAudioR@12
_IPCNetGetIPCNetSessionStatus@4
_IPCNetStartAudioR@12
winmm
waveOutClose
waveOutWrite
waveOutReset
waveOutUnprepareHeader
waveOutOpen
waveOutGetNumDevs
waveOutPrepareHeader
mciGetErrorStringA
mciSendCommandA
PlaySoundA
avcodec-55
av_free_packet
av_init_packet
avcodec_alloc_context3
avcodec_close
avcodec_decode_audio4
avcodec_decode_video2
avcodec_find_decoder
avcodec_open2
avcodec_register_all
avpicture_alloc
avformat-55
av_register_all
avutil-52
av_buffer_create
av_frame_alloc
av_frame_free
av_free
av_freep
av_get_default_channel_layout
av_log
av_mallocz
av_samples_get_buffer_size
swresample-0
swr_alloc
swr_alloc_set_opts
swr_convert
swr_free
swr_init
swscale-2
sws_freeContext
sws_getContext
sws_scale
d3dvideorender
ord1
ord3
dsound
ord7
ord10
kernel32
GetACP
GetCurrentDirectoryA
GetFileAttributesExA
SetFileAttributesA
LocalFileTimeToFileTime
SetFileTime
GetFileAttributesA
GetFileSizeEx
GetFileTime
SetErrorMode
GetTempFileNameA
GetTempPathA
GetWindowsDirectoryA
GetNumberFormatA
InitializeCriticalSectionAndSpinCount
GetProfileIntA
SearchPathA
VirtualProtect
GetUserDefaultLCID
ReplaceFileA
GetDiskFreeSpaceA
FindResourceExW
FindNextFileA
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
ExitProcess
GetCommandLineA
HeapSetInformation
GetStartupInfoW
HeapReAlloc
RtlUnwind
RaiseException
SetStdHandle
GetFileType
ExitThread
HeapQueryInformation
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStdHandle
FatalAppExitA
HeapCreate
HeapDestroy
IsProcessorFeaturePresent
GetTimeZoneInformation
IsValidCodePage
SetConsoleCtrlHandler
GetLocaleInfoW
GetConsoleCP
GetConsoleMode
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetDriveTypeW
GetStringTypeW
CompareStringW
WriteConsoleW
EnumSystemLocalesA
IsValidLocale
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcessHeap
CreateFileW
SetEnvironmentVariableA
TerminateThread
GetOEMCP
WaitForMultipleObjects
InterlockedCompareExchange
CreateEventW
CreateSemaphoreW
ReleaseSemaphore
GetProcessAffinityMask
FindClose
SystemTimeToFileTime
FileTimeToSystemTime
GetCPInfo
GlobalFlags
lstrcpyA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalReAlloc
TlsGetValue
InterlockedIncrement
GetAtomNameA
GetPrivateProfileIntA
GetCurrentThread
GetUserDefaultUILanguage
GetCurrentProcessId
FindResourceA
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetVersionExA
CompareStringA
LoadLibraryW
lstrcmpW
CopyFileA
GlobalSize
FormatMessageA
lstrlenW
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoA
lstrcmpA
GetModuleHandleW
MulDiv
GlobalHandle
SuspendThread
ResumeThread
SetThreadPriority
GetCurrentProcess
SetPriorityClass
WritePrivateProfileStringA
OutputDebugStringA
GetPrivateProfileStringA
FreeLibrary
GlobalFree
LocalFree
LocalUnlock
LocalLock
LocalAlloc
CreateProcessA
GetModuleFileNameA
GlobalUnlock
GlobalLock
GlobalAlloc
ActivateActCtx
GetProcAddress
GetModuleHandleA
InterlockedDecrement
LoadLibraryA
DeactivateActCtx
SetLastError
CreateDirectoryA
GetLocalTime
GetTickCount
DeleteFileA
WinExec
Sleep
lstrlenA
MultiByteToWideChar
GetLastError
InterlockedExchange
SetEvent
WaitForSingleObjectEx
CloseHandle
CreateEventA
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
CreateThread
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
MoveFileA
CreateFileA
lstrcmpiA
GetThreadLocale
GetStringTypeExA
FileTimeToLocalFileTime
ResetEvent
FindFirstFileA
HeapAlloc
user32
DestroyAcceleratorTable
SetClassLongA
DrawIconEx
DrawEdge
DrawFrameControl
CopyAcceleratorTableA
ToAsciiEx
GetKeyboardLayout
GetKeyboardState
LoadAcceleratorsW
CreateAcceleratorTableA
SetCursorPos
BringWindowToTop
LockWindowUpdate
InvertRect
HideCaret
GetIconInfo
CopyImage
LoadImageA
GetNextDlgGroupItem
LoadImageW
RegisterClipboardFormatA
FrameRect
TranslateAcceleratorA
InsertMenuItemA
LoadAcceleratorsA
GetMenuBarInfo
LoadMenuA
ReuseDDElParam
UnpackDDElParam
CopyIcon
CharUpperBuffA
PostThreadMessageA
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
InSendMessage
CreateMenu
IsClipboardFormatAvailable
SendNotifyMessageA
GetUpdateRect
GetDoubleClickTime
IsCharLowerA
MapVirtualKeyExA
SubtractRect
DestroyCursor
MapDialogRect
EnumChildWindows
WindowFromDC
GetWindowRgn
GetDCEx
GetTabbedTextExtentW
GetTabbedTextExtentA
DestroyIcon
WaitMessage
UnregisterClassA
GetMenuDefaultItem
SetMenuDefaultItem
IsMenu
MonitorFromPoint
UpdateLayeredWindow
EnableScrollBar
UnionRect
IsRectEmpty
IsZoomed
GetAsyncKeyState
NotifyWinEvent
MessageBeep
ReleaseCapture
WindowFromPoint
SetCapture
KillTimer
SetTimer
RedrawWindow
SetWindowRgn
OffsetRect
GetDialogBaseUnits
RealChildWindowFromPoint
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
LoadCursorA
GetSysColorBrush
ShowOwnedPopups
SetCursor
PostQuitMessage
GetMessageA
ValidateRect
SystemParametersInfoA
DestroyMenu
GetMenuItemInfoA
CharUpperA
MapVirtualKeyA
GetKeyNameTextA
IntersectRect
InflateRect
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
TabbedTextOutA
GetWindowThreadProcessId
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ScrollWindowEx
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
IsWindowVisible
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
GetParent
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
PtInRect
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcA
GetMenu
GetWindow
GetClassNameA
LoadBitmapW
UpdateWindow
DrawStateA
GetMenuState
GetMenuStringA
GetMenuItemID
InsertMenuA
GetMenuItemCount
RemoveMenu
SetRect
ShowCaret
GetKeyState
SetParent
EnableMenuItem
ModifyMenuA
CheckMenuItem
CreatePopupMenu
DeleteMenu
DrawIcon
GetSystemMetrics
IsIconic
DrawFocusRect
FillRect
GetSysColor
CopyRect
wvsprintfA
ReleaseDC
GetDesktopWindow
wsprintfA
DispatchMessageA
TranslateMessage
PeekMessageA
MsgWaitForMultipleObjects
GetFocus
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
PostMessageA
SetWindowPos
SetWindowLongA
GetSubMenu
LoadMenuW
GetWindowRect
ScreenToClient
GetCursorPos
GetDC
AppendMenuA
GetSystemMenu
LoadIconW
EndDialog
FindWindowExA
MessageBoxA
DrawTextA
GetClientRect
InvalidateRect
GetWindowLongA
SendMessageA
EnableWindow
CallWindowProcA
LoadCursorW
gdi32
GetClipBox
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
LineTo
MoveToEx
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
GetLayout
SetLayout
SetArcDirection
SetColorAdjustment
SelectClipRgn
GetClipRgn
CreateRectRgn
SelectClipPath
GetViewportExtEx
GetWindowExtEx
GetPixel
StartDocA
PtVisible
RectVisible
CreateBitmap
SetBkColor
SetTextColor
GetStockObject
CreateSolidBrush
CreateDCA
CopyMetaFileA
TextOutA
ExtTextOutA
Escape
SetMapMode
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
CreateDIBPatternBrushPt
CreatePatternBrush
SelectPalette
PlayMetaFileRecord
GetObjectType
GetDeviceCaps
PlayMetaFile
ExtCreatePen
CreateHatchBrush
RestoreDC
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
CreateDIBitmap
GetTextMetricsA
EnumFontFamiliesA
GetTextCharsetInfo
CreateRoundRectRgn
GetCharWidthA
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetROP2
SetViewportOrgEx
SetPolyFillMode
GetCurrentObject
CreatePolygonRgn
GetBkColor
CreateEllipticRgn
Polyline
Ellipse
Polygon
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
OffsetRgn
GetRgnBox
GetDIBits
SetPixel
Rectangle
RoundRect
EnumFontFamiliesExA
ExtFloodFill
SetPaletteEntries
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextAlign
GetTextFaceA
GetTextExtentPointA
GetTextExtentPoint32W
CreateMetaFileA
CloseMetaFile
DeleteMetaFile
SetPixelV
CreateFontIndirectA
SaveDC
GetTextColor
CreateRectRgnIndirect
GetTextExtentPoint32A
SetBkMode
SetStretchBltMode
StretchDIBits
CreatePen
BitBlt
GetDIBColorTable
StretchBlt
CreateCompatibleBitmap
CreateDIBSection
GetObjectA
CreateCompatibleDC
SetDIBColorTable
SelectObject
DeleteDC
CreateFontA
EnumMetaFile
DeleteObject
msimg32
TransparentBlt
AlphaBlend
comdlg32
GetFileTitleA
winspool.drv
GetJobA
OpenPrinterA
DocumentPropertiesA
ClosePrinter
advapi32
RegEnumKeyA
RegSetValueA
RegQueryValueExA
GetFileSecurityA
SetFileSecurityA
RegEnumKeyExA
RegEnumValueA
RegQueryValueA
RegCloseKey
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExW
RegOpenKeyExA
shell32
SHGetFileInfoA
SHAddToRecentDocs
ExtractIconA
SHGetDesktopFolder
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHAppBarMessage
DragFinish
DragQueryFileA
ShellExecuteExA
ShellExecuteA
SHBrowseForFolderA
SHGetMalloc
comctl32
InitCommonControlsEx
ImageList_ReplaceIcon
_TrackMouseEvent
ImageList_GetIconSize
ImageList_Create
ImageList_GetImageCount
ImageList_Destroy
ImageList_AddMasked
ImageList_Remove
ImageList_GetIcon
ImageList_DrawEx
shlwapi
PathIsDirectoryA
PathFindExtensionW
PathFindExtensionA
PathFileExistsA
PathIsUNCA
PathStripToRootA
PathRemoveExtensionA
PathRemoveFileSpecW
PathFindFileNameA
ole32
OleIsCurrentClipboard
OleFlushClipboard
DoDragDrop
StgCreateDocfile
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
CreateFileMoniker
StgOpenStorage
StgIsStorageFile
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
CLSIDFromProgID
OleGetClipboard
RegisterDragDrop
CoRegisterMessageFilter
CoRevokeClassObject
CoRegisterClassObject
CoGetClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateDataAdviseHolder
CreateOleAdviseHolder
CoGetMalloc
GetRunningObjectTable
OleIsRunning
OleQueryLinkFromData
OleQueryCreateFromData
OleRun
OleRegGetMiscStatus
OleRegEnumVerbs
CreateGenericComposite
CreateItemMoniker
OleGetIconOfClass
OleCreateLinkToFile
OleCreateFromFile
OleSetContainedObject
GetHGlobalFromILockBytes
OleLoad
OleCreate
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
OleSetClipboard
CoDisconnectObject
CLSIDFromString
StringFromGUID2
CoCreateGuid
CoInitializeEx
CoCreateInstance
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CreateStreamOnHGlobal
CoTaskMemFree
CoUninitialize
CoInitialize
OleSaveToStream
WriteClassStm
OleSave
StgCreateDocfileOnILockBytes
PropVariantCopy
RevokeDragDrop
CoLockObjectExternal
OleSetMenuDescriptor
oleaut32
SafeArrayDestroyDescriptor
SysStringLen
SysReAllocStringLen
SafeArrayDestroyData
VarBstrFromDec
VarDecFromStr
VarCyFromStr
SafeArrayDestroy
SafeArrayUnlock
VarBstrFromCy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
VarDateFromStr
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysFreeString
OleLoadPicture
SafeArrayLock
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCreate
SysAllocString
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
VarBstrFromDate
SafeArrayCopy
oledlg
ord8
gdiplus
GdipGetImageHeight
GdipGetImageWidth
GdipGetImagePaletteSize
GdipGetImagePalette
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromScan0
GdipCloneImage
GdipCreateBitmapFromFileICM
GdipFree
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdiplusShutdown
GdiplusStartup
GdipSaveImageToFile
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromHBITMAP
GdipDrawImageRectI
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromFile
GdipCreateFromHDC
GdipAlloc
GdipSetInterpolationMode
GdipDisposeImage
ws2_32
ntohl
inet_addr
send
ntohs
inet_ntoa
gethostbyname
gethostname
ioctlsocket
accept
__WSAFDIsSet
select
listen
WSAGetLastError
recv
WSAStartup
recvfrom
htonl
htons
setsockopt
sendto
bind
socket
closesocket
oleacc
CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow
imm32
ImmGetOpenStatus
ImmReleaseContext
ImmGetContext
Sections
.text Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 572KB - Virtual size: 571KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 39KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 272KB - Virtual size: 271KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 216KB - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ