NSGetModule
Static task
static1
Behavioral task
behavioral1
Sample
a1c4eae2c107468274167c53deb06bf5e3fb054f6db1bee5dcfd64b1ba72b538.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a1c4eae2c107468274167c53deb06bf5e3fb054f6db1bee5dcfd64b1ba72b538.dll
Resource
win10v2004-20220812-en
General
-
Target
a1c4eae2c107468274167c53deb06bf5e3fb054f6db1bee5dcfd64b1ba72b538
-
Size
564KB
-
MD5
6fed904bb396c8e2e1a1aa680f178ca3
-
SHA1
baa716a18cb7dd7820296753ea2ebe2aa4f4f71f
-
SHA256
a1c4eae2c107468274167c53deb06bf5e3fb054f6db1bee5dcfd64b1ba72b538
-
SHA512
0d0e400a5badb89e33efb8af8f5953d6525a0f51dca8c20192902d7c4beeac4175090a812c07941032178ad571c83b5af0f53deea22d4ad76ae55eafbfb78027
-
SSDEEP
12288:BWZpgyPxY9W3Z8v0Y4GPrXIh/trz1/MyJssNf1yA1KV:BWZpgexY9oZ8vT4GPrYh1rp/My+s6iu
Malware Config
Signatures
Files
-
a1c4eae2c107468274167c53deb06bf5e3fb054f6db1bee5dcfd64b1ba72b538.dll windows x86
a90dfdb6d2e8fad8c2e18fdf47fea2a4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
xpcom
?Replace@nsSubstring@@QAEXIIPBGI@Z
?Replace@nsSubstring@@QAEXIIABVnsSubstringTuple@@@Z
?SetLength@nsSubstring@@QAEXI@Z
?sEmptyBuffer@?$nsCharTraits@G@@2PBGB
?Adopt@nsSubstring@@QAEXPAGI@Z
?EqualsWithConversion@nsCString@@QBEHPBDHH@Z
?Init@nsPromiseFlatString@@AAEXABVnsAString@@@Z
?AppendInt@nsString@@QAEX_JH@Z
?AppendUTF16toUTF8@@YAXABVnsAString@@AAVnsACString@@@Z
?AppendInt@nsString@@QAEXHH@Z
NS_NewCStringInputStream
nsEscapeHTML2
?AppendASCIItoUTF16@@YAXABVnsACString@@AAVnsAString@@@Z
?Assign@nsSubstring@@QAEXABV1@@Z
?EmptyCString@@YAABVnsCString@@XZ
?AppendUTF8toUTF16@@YAXPBDAAVnsAString@@@Z
nsUnescape
?GetService@nsServiceManager@@SAIPBDABUnsID@@PAPAVnsISupports@@PAVnsIShutdownListener@@@Z
?FindCharInSet@nsCString@@QBEHPBDH@Z
?ToNewUnicode@@YAPAGABVnsAString@@@Z
?Assign@nsSubstring@@QAEXPBGI@Z
?Append@nsACString@@QAEXD@Z
nsEscape
?CompressWhitespace@nsCString@@QAEXHH@Z
?FindCharInSet@nsString@@QBEHPBGH@Z
?IsAscii@nsCRT@@SAHG@Z
?AppendASCIItoUTF16@@YAXPBDAAVnsAString@@@Z
?strncmp@nsCRT@@SAHPBG0I@Z
?RFindCharInSet@nsString@@QBEHPBGH@Z
?StripWhitespace@nsString@@QAEXXZ
?Equals@nsSubstring@@QBEHABV1@ABVnsStringComparator@@@Z
?AppendWithConversion@nsString@@QAEXPBDH@Z
?strlen@nsCRT@@SAIPBD@Z
?strlen@nsCRT@@SAIPBG@Z
?FindChar@nsSubstring@@QBEHGI@Z
?SetCapacity@nsSubstring@@QAEXI@Z
?Find@nsString@@QBEHPBDHHH@Z
?ToLower@nsCRT@@SADD@Z
?strdup@nsCRT@@SAPAGPBG@Z
?NS_NewByteArrayInputStream@@YAIPAPAVnsIByteArrayInputStream@@PADK@Z
?Realloc@nsMemory@@SAPAXPAXI@Z
?Mid@nsString@@QBEIAAV1@II@Z
?Find@nsString@@QBEHABV1@HH@Z
?AppendWithConversion@nsCString@@QAEXPBGH@Z
?RFind@nsString@@QBEHPBGHH@Z
?SetLength@nsAString@@QAEXI@Z
?StripChars@nsCString@@QAEXPBD@Z
?Clone@nsMemory@@SAPAXPBXI@Z
?CopyUTF8toUTF16@@YAXABVnsACString@@AAVnsAString@@@Z
?strncmp@nsCRT@@SAHPBD0I@Z
?NS_NewStorageStream@@YAIIIPAPAVnsIStorageStream@@@Z
nsEscapeHTML
?DumpStatistics@nsTraceRefcntImpl@@SAIW4StatisticsType@1@PAU_iobuf@@@Z
?ResetStatistics@nsTraceRefcntImpl@@SAXXZ
?CreateInstance@nsComponentManager@@SAIABUnsID@@PAVnsISupports@@0PAPAX@Z
?RemoveElementsAt@nsVoidArray@@QAEHHH@Z
?Init@nsPromiseFlatCString@@AAEXABVnsCSubstring@@@Z
?strtok@nsCRT@@SAPADPADPBDPAPAD@Z
?EmptyString@@YAABVnsString@@XZ
?AppendWithConversion@nsCString@@QAEXABVnsAString@@@Z
?FindCharInSet@nsString@@QBEHPBDH@Z
??1nsPrintfCString@@QAE@XZ
??0nsPrintfCString@@QAA@PBDZZ
?ToNewUTF8String@@YAPADABVnsAString@@PAI@Z
?NS_CreateServicesFromCategory@@YAIPBDPAVnsISupports@@0@Z
?Assign@nsAString@@QAEXPBG@Z
?AssignWithConversion@nsCString@@QAEXPBGH@Z
?Assign@nsACString@@QAEXPBDI@Z
??1nsHashtable@@UAE@XZ
?DestroyMonitor@nsAutoMonitor@@SAXPAUPRMonitor@@@Z
?IndexOf@nsVoidArray@@QBEHPAX@Z
??0nsHashtable@@QAE@IH@Z
?NewMonitor@nsAutoMonitor@@SAPAUPRMonitor@@PBD@Z
?Reset@nsHashtable@@QAEXP6AHPAVnsHashKey@@PAX1@Z1@Z
?CopyASCIItoUTF16@@YAXABVnsACString@@AAVnsAString@@@Z
?Equals@nsCSubstring@@QBEHPBDABVnsCStringComparator@@@Z
?AssignWithConversion@nsString@@QAEXPBDH@Z
NS_NewByteInputStream
?RFindInReadable@@YAHABVnsACString@@AAV?$nsReadingIterator@D@@1ABVnsCStringComparator@@@Z
?HashString@@YAIABVnsACString@@@Z
??0nsCStringHashKey@@QAE@PBVnsACString@@@Z
??1nsCStringHashKey@@QAE@XZ
?EnsureMutable@nsSubstring@@IAEXXZ
??_7nsDefaultStringComparator@@6B@
?ToNewUnicode@@YAPAGABVnsACString@@@Z
?Enumerate@nsHashtable@@QAEXP6AHPAVnsHashKey@@PAX1@Z1@Z
??0nsDeque@@QAE@PAVnsDequeFunctor@@@Z
?Push@nsDeque@@QAEAAV1@PAX@Z
?PeekFront@nsDeque@@QAEPAXXZ
?ToNewCString@@YAPADABVnsAString@@@Z
?PopFront@nsDeque@@QAEPAXXZ
?InsertCStringAt@nsCStringArray@@QAEHABVnsACString@@H@Z
??1nsDeque@@QAE@XZ
?Clear@nsCStringArray@@UAEXXZ
?SizeTo@nsVoidArray@@UAEHH@Z
?Compact@nsCStringArray@@UAEXXZ
?GrowArrayBy@nsVoidArray@@MAEHH@Z
??0nsCStringKey@@QAE@ABVnsCString@@@Z
?Get@nsHashtable@@QAEPAXPAVnsHashKey@@@Z
??0nsCStringKey@@QAE@PBDHW4Ownership@0@@Z
??1nsCStringKey@@UAE@XZ
?HashCode@nsCStringKey@@UBEIXZ
?Equals@nsCStringKey@@UBEHPBVnsHashKey@@@Z
?Clone@nsCStringKey@@UBEPAVnsHashKey@@XZ
?Write@nsCStringKey@@UBEIPAVnsIObjectOutputStream@@@Z
??1nsObjectHashtable@@UAE@XZ
??0nsObjectHashtable@@QAE@P6APAXPAVnsHashKey@@PAX1@Z1P6AH011@Z1IH@Z
?Put@nsHashtable@@QAEPAXPAVnsHashKey@@PAX@Z
?Find@nsCString@@QBEHPBDHHH@Z
?NS_NewAtom@@YAPAVnsIAtom@@PBD@Z
?NS_NewArrayEnumerator@@YAIPAPAVnsISimpleEnumerator@@ABVnsCOMArray_base@@@Z
?strcmp@nsCRT@@SAHPBD0@Z
?RFindChar@nsCString@@QBEHGHH@Z
?Sort@nsVoidArray@@QAEXP6AHPBX0PAX@Z1@Z
?Trim@nsCString@@QAEXPBDHHH@Z
?CountChar@nsCSubstring@@QBEID@Z
?Equals@nsACString@@QBEHABV1@@Z
?Equals@nsCSubstring@@QBEHABVnsACString@@@Z
?InsertObjectAt@nsCOMArray_base@@IAEHPAVnsISupports@@H@Z
??1nsCOMArray_base@@IAE@XZ
??0nsVoidArray@@QAE@H@Z
?PL_DHashStubEnumRemove@@YA?AW4PLDHashOperator@@PAUPLDHashTable@@PAUPLDHashEntryHdr@@IPAX@Z
PL_DHashStringKey
?IsUTF8@@YAHABVnsACString@@@Z
?IsASCII@@YAHABVnsAString@@@Z
?LossyCopyUTF16toASCII@@YAXABVnsAString@@AAVnsACString@@@Z
?Assign@nsAString@@QAEXABV1@@Z
?Append@nsACString@@QAEXABVnsCSubstringTuple@@@Z
?Equals@nsSubstring@@QBEHPBG@Z
?CopyUTF16toUTF8@@YAXABVnsAString@@AAVnsACString@@@Z
?Equals@nsCSubstring@@QBEHABVnsACString@@ABVnsCStringComparator@@@Z
?Replace@nsAString@@QAEXIIABV1@@Z
?Length@nsAString@@QBEIXZ
?CaseInsensitiveFindInReadable@@YAHABVnsACString@@AAV?$nsReadingIterator@D@@1@Z
?Rebind@nsDependentSubstring@@QAEXABVnsSubstring@@II@Z
?Append@nsAString@@QAEXG@Z
?GetReadableBuffer@nsAString@@IBEIPAPBG@Z
??4nsAdoptingCString@@QAEAAV0@ABV0@@Z
?NS_ProxyRelease@@YAIPAVnsIEventTarget@@PAVnsISupports@@H@Z
?SetCharAt@nsCString@@QAEHGI@Z
?ReplaceChar@nsCString@@QAEXDD@Z
?Assign@nsCSubstring@@QAEXABVnsCSubstringTuple@@@Z
?ReplaceSubstring@nsCString@@QAEXPBD0@Z
nsUnescapeCount
?NS_NewOutputStreamReadyEvent@@YAIPAPAVnsIOutputStreamCallback@@PAV1@PAVnsIEventTarget@@@Z
?NS_NewInputStreamReadyEvent@@YAIPAPAVnsIInputStreamCallback@@PAV1@PAVnsIEventTarget@@@Z
?NS_NewInputStreamTee@@YAIPAPAVnsIInputStream@@PAV1@PAVnsIOutputStream@@@Z
?IsAsciiSpace@nsCRT@@SAHG@Z
?Equals@nsCSubstring@@QBEHPBD@Z
?Rebind@nsDependentCSubstring@@QAEXABVnsACString@@II@Z
?Append@nsACString@@QAEXPBDI@Z
?IsAsciiAlpha@nsCRT@@SAHG@Z
?IsAsciiDigit@nsCRT@@SAHG@Z
?IsAscii@nsCRT@@SAHPBDI@Z
?strncmp@nsCRT@@SAHPBD0H@Z
?Equals@nsCSubstring@@QBEHABV1@ABVnsCStringComparator@@@Z
?IsASCII@@YAHABVnsACString@@@Z
?SetCapacity@nsACString@@QAEXI@Z
?strcmp@nsCRT@@SAHPBG0@Z
?AppendUTF8toUTF16@@YAXABVnsACString@@AAVnsAString@@@Z
?Alloc@nsMemory@@SAPAXI@Z
?Length@nsACString@@QBEIXZ
?free@nsCRT@@SAXPAD@Z
?Replace@nsCSubstring@@QAEXIIABVnsACString@@@Z
?Replace@nsCSubstring@@QAEXIIABVnsCSubstringTuple@@@Z
?EnsureMutable@nsCSubstring@@IAEXXZ
?Append@nsACString@@QAEXABV1@@Z
?Assign@nsACString@@QAEXPBD@Z
??_7nsDefaultCStringComparator@@6B@
?StringBeginsWith@@YAHABVnsACString@@0ABVnsCStringComparator@@@Z
??1nsGetInterface@@QAE@XZ
?FindCharInReadable@@YAHDAAV?$nsReadingIterator@D@@ABV1@@Z
??_7nsCaseInsensitiveCStringComparator@@6B@
?FindInReadable@@YAHABVnsACString@@AAV?$nsReadingIterator@D@@1ABVnsCStringComparator@@@Z
??0nsGetInterface@@QAE@PAVnsISupports@@PAI@Z
?GetReadableBuffer@nsACString@@IBEIPAPBD@Z
?NS_AsyncCopy@@YAIPAVnsIInputStream@@PAVnsIOutputStream@@PAVnsIEventTarget@@W4nsAsyncCopyMode@@IP6AXPAXI@Z4@Z
??0nsCreateInstanceByCID@@QAE@ABUnsID@@PAVnsISupports@@PAI@Z
?NS_GetProxyForObject@@YAIPAVnsIEventQueue@@ABUnsID@@PAVnsISupports@@HPAPAX@Z
?NS_NewThread@@YAIPAPAVnsIThread@@PAVnsIRunnable@@IW4PRThreadState@@W4PRThreadPriority@@W4PRThreadScope@@@Z
?strdup@nsCRT@@SAPADPBD@Z
?Equals@nsCSubstring@@QBEHABV1@@Z
PL_DestroyEvent
?ToNewCString@@YAPADABVnsACString@@@Z
?LossyAppendUTF16toASCII@@YAXPBGAAVnsACString@@@Z
?Rebind@nsDependentCSubstring@@QAEXABVnsCSubstring@@II@Z
PL_GetEventOwner
?Free@nsMemory@@SAXPAX@Z
NS_GetServiceManager
?strncasecmp@nsCRT@@SAHPBD0I@Z
?strcasecmp@nsCRT@@SAHPBD0@Z
??0nsVoidArray@@QAE@XZ
?AppendUTF16toUTF8@@YAXPBGAAVnsACString@@@Z
?ParseString@nsCStringArray@@QAEXPBD0@Z
??0nsCStringArray@@QAE@XZ
?CStringAt@nsCStringArray@@QBEPAVnsCString@@H@Z
?StripWhitespace@nsCString@@QAEXXZ
?RemoveElement@nsVoidArray@@QAEHPAX@Z
?ToInteger@nsCString@@QBEHPAHI@Z
??1nsAString@@QAE@XZ
??1nsCStringArray@@UAE@XZ
?sCanonicalVTable@nsObsoleteAString@@2PBXB
PL_HandleEvent
?FindChar@nsCSubstring@@QBEHDI@Z
?ToLowerCase@@YAXAAVnsCSubstring@@@Z
?NS_EscapeURL@@YAHPBDHFAAVnsACString@@@Z
?Init@nsPromiseFlatCString@@AAEXABVnsACString@@@Z
?Mid@nsCString@@QBEIAAV1@II@Z
?Assign@nsCSubstring@@QAEXABVnsACString@@@Z
?Assign@nsACString@@QAEXABVnsCSubstringTuple@@@Z
?SetCapacity@nsCSubstring@@QAEXI@Z
?NS_NewPipe2@@YAIPAPAVnsIAsyncInputStream@@PAPAVnsIAsyncOutputStream@@HHIIPAVnsIMemory@@@Z
?Assign@nsCSubstring@@QAEXABV1@@Z
?SetLength@nsCSubstring@@QAEXI@Z
?Assign@nsACString@@QAEXABV1@@Z
??1nsGetServiceByCID@@QAE@XZ
PL_InitEvent
??0nsGetServiceByCID@@QAE@ABUnsID@@PAVnsISupports@@PAI@Z
?NS_NewISupportsArray@@YAIPAPAVnsISupportsArray@@@Z
?NS_NewArrayEnumerator@@YAIPAPAVnsISimpleEnumerator@@PAVnsISupportsArray@@@Z
PL_DHashTableRawRemove
PL_DHashTableInit
PL_DHashAllocTable
PL_DHashFreeTable
PL_DHashVoidPtrKeyStub
PL_DHashMoveEntryStub
PL_DHashFinalizeStub
PL_DHashTableFinish
??0nsAutoVoidArray@@QAE@XZ
PL_DHashTableEnumerate
?EnumerateForwards@nsVoidArray@@QAEHP6AHPAX0@Z0@Z
?ElementAt@nsVoidArray@@QBEPAXH@Z
PL_DHashTableOperate
??1nsVoidArray@@UAE@XZ
?InsertElementAt@nsVoidArray@@QAEHPAXH@Z
??0nsGetWeakReference@@QAE@PAVnsISupports@@PAI@Z
??0nsQueryReferent@@QAE@PAVnsIWeakReference@@PAI@Z
?NS_ErrorAccordingToNSPR@@YAIXZ
?Append@nsACString@@QAEXPBD@Z
?SetLength@nsACString@@QAEXI@Z
?assign_from_qi_with_error@nsCOMPtr_base@@QAEXABVnsQueryInterfaceWithError@@ABUnsID@@@Z
?AppendInt@nsCString@@QAEXHH@Z
?assign_from_qi@nsCOMPtr_base@@QAEXVnsQueryInterface@@ABUnsID@@@Z
?assign_with_AddRef@nsCOMPtr_base@@QAEXPAVnsISupports@@@Z
?Assign@nsCSubstring@@QAEXPBDI@Z
?Replace@nsCSubstring@@QAEXIIPBDI@Z
??0nsCreateInstanceByContractID@@QAE@PBDPAVnsISupports@@PAI@Z
??1nsSupportsWeakReference@@IAE@XZ
??0nsSupportsWeakReference@@QAE@XZ
?GetWeakReference@nsSupportsWeakReference@@UAGIPAPAVnsIWeakReference@@@Z
??1nsGetServiceByContractID@@QAE@XZ
?assign_from_helper@nsCOMPtr_base@@QAEXABVnsCOMPtr_helper@@ABUnsID@@@Z
?NS_NewGenericModule2@@YAIPAUnsModuleInfo@@PAPAVnsIModule@@@Z
?Adopt@nsCSubstring@@QAEXPADI@Z
?sEmptyBuffer@?$nsCharTraits@D@@2PBDB
??1nsACString@@QAE@XZ
?sCanonicalVTable@nsObsoleteACString@@2PBXB
??0nsGetServiceByContractID@@QAE@PBDPAVnsISupports@@PAI@Z
NS_NewStringInputStream
?Compare@@YAHABVnsACString@@0ABVnsCStringComparator@@@Z
?AppendInt@nsCString@@QAEX_JH@Z
??1nsCOMPtr_base@@QAE@XZ
nspr4
PR_ExitMonitor
PR_AtomicDecrement
PR_Malloc
PR_Close
PR_Seek
PR_FileDesc2NativeHandle
PR_Available
PR_Read
PR_Write
PR_Sync
PR_Free
PR_DestroyLock
PR_DestroyCondVar
PR_Unlock
PR_WaitCondVar
PR_NotifyAllCondVar
PR_Lock
PR_NotifyCondVar
PR_SecondsToInterval
PR_IntervalNow
PR_CreateThread
PR_NewCondVar
PR_NewLock
PR_smprintf
PR_smprintf_free
PR_ImplodeTime
PR_FormatTime
PR_FloorLog2
PR_Calloc
PR_LocalTimeParameters
LL_MaxInt
LL_MinInt
PR_snprintf
PR_GMTParameters
PR_ExplodeTime
PR_FormatTimeUSEnglish
PR_ParseTimeString
LL_Zero
PR_GetUniqueIdentity
PR_GetDefaultIOMethods
PR_CreateIOLayerStub
PR_PushIOLayer
PR_GetSocketOption
PR_GetLayersIdentity
PR_Send
PR_IsNetAddrType
PR_InitializeNetAddr
PR_GetAddrInfoByName
PR_FreeAddrInfo
PR_NewMonitor
PR_Wait
PR_DestroyMonitor
PR_EnterMonitor
PR_Notify
PR_AtomicIncrement
PR_EnumerateAddrInfo
PR_htons
PR_GetCanonNameFromAddrInfo
PR_GetSystemInfo
PR_ConnectContinue
PR_NetAddrToString
PR_Connect
PR_Recv
PR_Now
PR_Accept
PR_ntohs
PR_OpenTCPSocket
PR_SetSocketOption
PR_Bind
PR_Listen
PR_GetSockName
PR_SetNetAddr
PR_WaitForPollableEvent
PR_GetError
PR_NewLogModule
PR_NewPollableEvent
PR_MillisecondsToInterval
PR_Poll
PR_GetCurrentThread
PR_LogPrint
PR_SetPollableEvent
PR_DestroyPollableEvent
PR_StringToNetAddr
PR_ConvertIPv4AddrToIPv6
PR_ntohl
PR_htonl
PR_sscanf
plc4
PL_strcasecmp
PL_strncasecmp
PL_strndup
PL_strchr
PL_strstr
PL_strfree
PL_strdup
PL_strncpyz
PL_strnstr
PL_strncpy
PL_Base64Decode
PL_strlen
PL_strcasestr
PL_strcmp
PL_Base64Encode
plds4
PL_HashString
PL_CompareStrings
PL_HashTableDestroy
PL_HashTableRemove
PL_HashTableLookup
PL_NewHashTable
PL_HashTableAdd
mozz
ord23
ord19
ord21
ord20
ord22
kernel32
GlobalMemoryStatus
GetVersionExA
LoadLibraryA
GetProcAddress
IsDBCSLeadByte
DisableThreadLibraryCalls
SetEndOfFile
advapi32
QueryServiceStatus
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenSCManagerA
OpenServiceA
msvcp71
?_Nomemory@std@@YAXXZ
msvcr71
strtoul
tolower
realloc
atol
strstr
strrchr
memmove
strcpy
strncpy
srand
rand
memchr
toupper
strlen
malloc
free
strchr
atoi
memcmp
strcmp
memset
memcpy
??_V@YAXPAX@Z
_purecall
??3@YAXPAX@Z
isdigit
isalpha
log
sprintf
fclose
strcspn
calloc
sscanf
_callnewh
_initterm
_adjust_fdiv
__CppXcptFilter
_except_handler3
__dllonexit
_onexit
strncmp
Exports
Exports
Sections
.text Size: 324KB - Virtual size: 320KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 888B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE