D:\源\TAIDA-A车间\MainControl-AOI\Debug\MainControl.pdb
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9902cf1a94232b3ea21bbb59686b0ab96ed29f79a16e25471f6bebaf27c52bf4.exe
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
9902cf1a94232b3ea21bbb59686b0ab96ed29f79a16e25471f6bebaf27c52bf4.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
9902cf1a94232b3ea21bbb59686b0ab96ed29f79a16e25471f6bebaf27c52bf4
-
Size
2.2MB
-
MD5
1135fd92361b4d4bd3e06d9368818e0f
-
SHA1
33aab5139a376234283f30d68ed0cf0340c4e729
-
SHA256
9902cf1a94232b3ea21bbb59686b0ab96ed29f79a16e25471f6bebaf27c52bf4
-
SHA512
31494fc69448f49759958a01587594cf19cc36ac1d4a41d941fb676ae4940a734cd710e5580ef7c157512ffe8f7303aad23931d5d4741cf011b9b78c9f4033ee
-
SSDEEP
49152:w5tbOUCv5jUGL/ZSiEKsaeiOfxNKhzDaOpeQGkwMAq17jmIGMVFvybHe2Ean2jY3:JUCx//ZSbHe26
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9902cf1a94232b3ea21bbb59686b0ab96ed29f79a16e25471f6bebaf27c52bf4
Files
-
9902cf1a94232b3ea21bbb59686b0ab96ed29f79a16e25471f6bebaf27c52bf4.exe windows:5 windows x86 arch:x86
7a270a8496ca5050837e7df49882e316
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mfc100ud
ord2273
ord9300
ord7232
ord2365
ord8762
ord2250
ord1441
ord934
ord15191
ord1451
ord1428
ord9358
ord9264
ord13931
ord16444
ord5851
ord2561
ord13532
ord13533
ord15964
ord8691
ord15970
ord10338
ord4347
ord4288
ord14016
ord8712
ord2080
ord16763
ord12908
ord15841
ord13525
ord8765
ord16157
ord16154
ord16159
ord16156
ord16158
ord16155
ord4053
ord6535
ord13198
ord13206
ord4993
ord9053
ord11324
ord13216
ord13167
ord13997
ord6343
ord11148
ord4670
ord2695
ord7542
ord991
ord11270
ord8374
ord4047
ord5528
ord13615
ord13951
ord296
ord2256
ord2207
ord9230
ord9684
ord5483
ord457
ord6887
ord4291
ord7004
ord1095
ord9352
ord5301
ord10317
ord7713
ord7553
ord10290
ord356
ord5051
ord871
ord14162
ord9746
ord9243
ord7790
ord15697
ord1348
ord3431
ord10073
ord957
ord1400
ord8138
ord3189
ord6538
ord291
ord15667
ord6487
ord3204
ord286
ord1434
ord5600
ord8561
ord4866
ord1462
ord9681
ord6977
ord13883
ord2043
ord14473
ord15883
ord11351
ord5232
ord1463
ord1460
ord14564
ord15463
ord4003
ord3883
ord3896
ord4004
ord4007
ord2045
ord508
ord1132
ord10305
ord357
ord14160
ord1681
ord11842
ord11856
ord3876
ord5796
ord6113
ord5066
ord269
ord299
ord3893
ord1064
ord1096
ord1062
ord13078
ord9973
ord13949
ord2254
ord4015
ord459
ord11938
ord12309
ord5113
ord5134
ord6114
ord13816
ord3097
ord4290
ord3590
ord3589
ord3340
ord3339
ord6879
ord14996
ord2965
ord10077
ord13122
ord10175
ord10149
ord4555
ord2599
ord417
ord369
ord444
ord1034
ord1084
ord7851
ord8218
ord8546
ord2707
ord292
ord3557
ord302
ord8566
ord3461
ord3460
ord14159
ord15281
ord15344
ord15658
ord14164
ord14411
ord4503
ord2767
ord4094
ord4071
ord5625
ord15367
ord8559
ord8891
ord9227
ord12597
ord1100
ord1449
ord3329
ord6881
ord15000
ord3480
ord3477
ord9045
ord2966
ord16747
ord16749
ord16748
ord16746
ord16750
ord16732
ord16659
ord16660
ord10064
ord13035
ord4037
ord12863
ord15963
ord9904
ord13168
ord4886
ord2744
ord4270
ord7719
ord11924
ord10196
ord3440
ord15144
ord13223
ord13221
ord1759
ord1766
ord1772
ord1770
ord1777
ord5341
ord5378
ord5349
ord5361
ord5357
ord5353
ord5383
ord5374
ord5345
ord5387
ord5366
ord5332
ord5336
ord5369
ord4897
ord16667
ord4884
ord3241
ord15965
ord8692
ord15971
ord7563
ord12638
ord14929
ord6560
ord2873
ord13071
ord4142
ord3553
ord3552
ord3439
ord13117
ord1730
ord1727
ord15571
ord1442
ord1094
ord13378
ord6489
ord3096
ord15981
ord455
ord14776
ord2555
ord8999
ord2204
ord7725
ord12561
ord11961
ord1340
ord4419
ord456
ord458
ord3895
ord12891
ord2480
ord1097
ord14708
ord4719
ord300
ord5926
ord1436
ord5692
ord14624
ord5797
ord7776
ord4102
ord5441
ord5520
ord15678
ord5217
ord6079
ord6340
ord10291
ord6049
ord6368
ord5695
ord5914
ord5672
ord8467
ord8468
ord8458
ord5912
ord9057
ord11153
ord10148
ord4673
ord2698
ord14235
ord359
ord351
ord406
ord463
ord1030
ord1028
ord1059
ord7823
ord8375
ord1674
ord267
ord270
ord1444
ord6506
ord15228
ord13842
ord3043
ord15459
ord10359
ord9052
ord862
ord7551
ord1029
ord1003
ord14191
ord2300
msvcr100d
_snprintf_s
_errno
_CrtDbgReport
wcscpy
_vsnprintf_s
_vsnwprintf_s
_snwprintf_s
wcsncpy_s
strcpy_s
calloc
_recalloc
_wcsicmp
memmove_s
malloc
_gmtime64_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
_invoke_watson
_controlfp_s
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_CRT_RTC_INITW
_initterm_e
_initterm
_CrtSetCheckCount
_wcmdln
_cexit
_XcptFilter
_exit
__wgetmainargs
_amsg_exit
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
memchr
atoi
printf
system
exit
_write
_lseek
_sopen_s
rename
_unlink
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
free
_localtime64_s
strrchr
_close
memcmp
_wassert
_purecall
memcpy_s
srand
rand
sqrt
strstr
strcpy
sprintf_s
_mktime64
_time64
memmove
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
wcslen
memcpy
_CrtDbgReportW
_invalid_parameter
_wtof
_ftime64
wcscpy_s
memset
_wtoi
__CxxFrameHandler3
strlen
strcmp
?what@exception@std@@UBEPBDXZ
kernel32
OutputDebugStringA
OpenEventA
LocalFileTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
MulDiv
GetCurrentThreadId
GetPrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetCurrentDirectoryW
GetLogicalDriveStringsW
MultiByteToWideChar
Sleep
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryW
GetLastError
CreateMutexW
TerminateProcess
UnmapViewOfFile
GetCurrentProcess
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FindClose
FindFirstFileW
SetEvent
PurgeComm
SetCommState
BuildCommDCBW
GetSystemInfo
OutputDebugStringW
SetCommTimeouts
CreateFileW
CloseHandle
CreateEventW
ResetEvent
GetCommMask
WaitForMultipleObjects
ClearCommError
WaitCommEvent
LocalFree
FormatMessageW
GetOverlappedResult
WriteFile
ReadFile
CreateThread
lstrcpyW
EncodePointer
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
IsDebuggerPresent
RaiseException
lstrlenA
DecodePointer
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsProcessorFeaturePresent
HeapFree
HeapAlloc
GetProcessHeap
VirtualQuery
SetCommMask
VirtualAlloc
MapViewOfFile
CreateFileMappingA
GetCurrentThread
OpenFileMappingA
lstrlenW
GetCommState
WideCharToMultiByte
user32
SetRectEmpty
EqualRect
SetRect
OffsetRect
IntersectRect
UnionRect
PtInRect
IsRectEmpty
InflateRect
CopyRect
SubtractRect
wsprintfW
SetForegroundWindow
ShowWindow
SetCursorPos
mouse_event
keybd_event
GetSystemMetrics
FindWindowA
SwitchToThisWindow
SendMessageW
MessageBoxW
SetWindowLongW
LoadImageW
GetCursorPos
gdi32
GetStockObject
advapi32
RevertToSelf
SetThreadToken
RegCloseKey
RegOpenKeyExW
RegEnumValueW
OpenThreadToken
shell32
SHGetPathFromIDListW
SHGetMalloc
SHBrowseForFolderW
comctl32
InitCommonControlsEx
oleaut32
SysAllocString
SysAllocStringByteLen
SysStringLen
SysFreeString
CreateErrorInfo
SetErrorInfo
VariantInit
VariantChangeType
VariantClear
GetErrorInfo
msvcp100d
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z
?eof@ios_base@std@@QBE_NXZ
?_Getpfirst@_Container_base12@std@@QBEPAPAU_Iterator_base12@2@XZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?good@ios_base@std@@QBE_NXZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?width@ios_base@std@@QAE_J_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0_Container_base12@std@@QAE@XZ
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_BADOFF@std@@3_JB
?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Debug_message@std@@YAXPB_W0I@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?widen@?$ctype@_W@std@@QBE_WD@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Incref@facet@locale@std@@QAEXXZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??Bid@locale@std@@QAEIXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE_W_W@Z
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setf@ios_base@std@@QAEHHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??3@YAXPAXABU_DebugHeapTag_t@std@@PADH@Z
??2@YAPAXIABU_DebugHeapTag_t@std@@PADH@Z
?_DebugHeapTag_func@std@@YAABU_DebugHeapTag_t@1@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
ws2_32
ntohs
setsockopt
inet_addr
WSAAsyncSelect
connect
recv
send
shutdown
accept
InetNtopW
gethostname
closesocket
htons
WSAGetLastError
socket
WSACleanup
bind
listen
gethostbyname
inet_ntoa
WSAStartup
libxl
xlCreateBookW
mysqlcppconn
?get_driver_instance@mysql@sql@@YAPAVMySQL_Driver@12@XZ
??0SQLString@sql@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1SQLString@sql@@QAE@XZ
??0SQLString@sql@@QAE@QBD@Z
??BSQLString@sql@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getSQLState@SQLException@sql@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getErrorCode@SQLException@sql@@QBEHXZ
wininet
InternetOpenW
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
Sections
.textbss Size: - Virtual size: 900KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 202KB - Virtual size: 201KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 82KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 106KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ