Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Overview
overview
3Static
static
9YqTY_z.zip
windows10-1703-x64
19YqTY_z.zip
windows7-x64
19YqTY_z.zip
windows10-2004-x64
1Console.exe
windows10-1703-x64
1Console.exe
windows7-x64
3Console.exe
windows10-2004-x64
1Foundation.dll
windows10-1703-x64
1Foundation.dll
windows7-x64
1Foundation.dll
windows10-2004-x64
1ZP.log
windows10-1703-x64
1ZP.log
windows7-x64
1ZP.log
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
9YqTY_z.zip
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
9YqTY_z.zip
Resource
win7-20221111-en
Behavioral task
behavioral3
Sample
9YqTY_z.zip
Resource
win10v2004-20221111-en
Behavioral task
behavioral4
Sample
Console.exe
Resource
win10-20220812-en
Behavioral task
behavioral5
Sample
Console.exe
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
Console.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
Foundation.dll
Resource
win10-20220812-en
Behavioral task
behavioral8
Sample
Foundation.dll
Resource
win7-20221111-en
Behavioral task
behavioral9
Sample
Foundation.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral10
Sample
ZP.log
Resource
win10-20220901-en
Behavioral task
behavioral11
Sample
ZP.log
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
ZP.log
Resource
win10v2004-20220812-en
Target
9YqTY_z.zip
Size
470KB
MD5
5f92005a9054c93f18411fddd01fda78
SHA1
d8e9bf2b23482303a84c2f3d4057bf5fb76ae8da
SHA256
2e124316c9e23953c097e1c30d8f99fcc07310ce09bdc52d5b277f5868433a86
SHA512
bfa448ccbed665c5362528691f5e013d2c3f079aac1a192676923275bed9ce3121bd3427f946c5ecd4123a2b19511906f04976b97b294182b7da93cc484f6374
SSDEEP
12288:J1lUPgrSV7Cod8lAy3ieRdgoa2rt3c/RjWDWC0fl91I:tgjVPd8VSeR+y2WWCiU
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PathCombineW
PathFileExistsW
PathIsDirectoryW
WinVerifyTrust
GetTempFileNameW
GetWindowsDirectoryW
lstrcpyW
GetFileAttributesW
MultiByteToWideChar
ReadFile
GetFileSize
WideCharToMultiByte
Sleep
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
lstrlenW
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetACP
FormatMessageW
OpenProcess
TerminateProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCommandLineW
GetTempPathW
LoadLibraryExW
lstrcmpiW
CreateThread
InterlockedIncrement
InterlockedDecrement
GetLocalTime
CopyFileW
DeleteFileW
ExitProcess
lstrlenA
GetCurrentProcessId
GetVersionExW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
InterlockedExchange
GetStartupInfoW
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetModuleFileNameW
CreateDirectoryW
SetLastError
IsBadReadPtr
GetModuleHandleW
LoadLibraryW
GetProcAddress
DeleteCriticalSection
InitializeCriticalSection
CreateEventW
GetTickCount
SwitchToFiber
DeleteFiber
CreateFiber
GetCurrentThreadId
SetEvent
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
RaiseException
CloseHandle
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
CreateFileW
OutputDebugStringW
GetLastError
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
FreeLibrary
GetSystemTimeAsFileTime
ShowWindow
FindWindowW
GetForegroundWindow
DestroyWindow
UpdateWindow
SetWindowRgn
GetClientRect
LoadCursorW
TranslateMessage
GetWindowLongW
InvalidateRect
EnumWindows
SetWindowPos
GetSystemMetrics
EndPaint
BeginPaint
ScreenToClient
GetWindowRect
IsWindowVisible
BringWindowToTop
DispatchMessageW
CloseWindow
DefWindowProcW
RegisterClassExW
CreateWindowExW
SetTimer
PostMessageW
SetWindowLongW
PeekMessageW
SendMessageTimeoutW
GetClassNameW
CharNextW
CharUpperW
GetMessageW
PostThreadMessageW
SendMessageW
LoadIconW
KillTimer
DestroyMenu
TrackPopupMenu
GetCursorPos
AppendMenuW
CreatePopupMenu
SetForegroundWindow
CreateDIBSection
SetDIBColorTable
SelectObject
CreateCompatibleDC
DeleteDC
GetObjectW
DeleteObject
CreateRoundRectRgn
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegQueryInfoKeyW
ShellExecuteW
SHGetFolderPathW
SHFileOperationW
Shell_NotifyIconW
CoTaskMemAlloc
CoTaskMemRealloc
CoRegisterClassObject
CoRevokeClassObject
CoInitialize
CoUninitialize
StringFromCLSID
CLSIDFromProgID
CoCreateInstance
CoTaskMemFree
CoGetObject
CreateStreamOnHGlobal
StringFromGUID2
SysFreeString
RegisterTypeLi
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
SysAllocStringLen
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
?close@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
??1locale@std@@QAE@XZ
?global@locale@std@@SA?AV12@ABV12@@Z
??0locale@std@@QAE@PBDH@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBEHXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?eof@ios_base@std@@QBE_NXZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
?is_open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
HttpQueryInfoW
InternetReadFile
InternetGetConnectedState
InternetOpenW
InternetCloseHandle
HttpEndRequestW
HttpAddRequestHeadersW
HttpSendRequestW
HttpOpenRequestW
InternetSetOptionW
InternetConnectW
InternetQueryOptionA
fflush
_controlfp_s
_invoke_watson
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
calloc
free
wcsnlen
wcsrchr
memcpy
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
strnlen
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_except_handler4_common
?terminate@@YAXXZ
ferror
_mkdir
fopen
abs
exit
_resetstkoflw
_purecall
clock
malloc
wcsncpy_s
wcscat_s
_wcslwr_s
sprintf
strcat
strcpy_s
sprintf_s
wcschr
wcsncpy
wcscpy
_invalid_parameter_noinfo
fclose
_wfopen
fseek
ftell
fread
fwrite
memcmp
wcstol
_vswprintf
memmove
??3@YAXPAX@Z
??_V@YAXPAX@Z
_wtol
__CxxFrameHandler3
strcpy
atoi
strncpy
memset
strchr
_wtoi
_CxxThrowException
_wcsicmp
wcsstr
wcslen
memcpy_s
memmove_s
_vscwprintf
vswprintf_s
wcscpy_s
swprintf_s
??2@YAPAXI@Z
_beginthreadex
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
strlen
_recalloc
?Append@FdeString@fde@@QAEAAV12@PB_W@Z
??0FdeString@fde@@QAE@PB_W@Z
?AnsiString@FdeString@fde@@QBEPBDI@Z
??5fde@@YAAAVLogger@0@AAV10@W4FdeFlushLog@0@@Z
??0FdeRunnable@fde@@QAE@XZ
??1FdeRunnable@fde@@UAE@XZ
?stopLogging@fde@@YAXXZ
?startLogging@fde@@YAXPB_W@Z
??1FdeString@fde@@UAE@XZ
??1Logger@fde@@UAE@XZ
??0Logger@fde@@QAE@W4FdeLogLevel@1@PBD1K@Z
?FormatString@FdeString@fde@@SA?AV12@PB_WZZ
??BFdeString@fde@@QBEPB_WXZ
?AppendFormat@FdeString@fde@@QAAXPB_WZZ
?enableLogging@fde@@YAX_N@Z
GdipCloneImage
GdipAlloc
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipFree
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipDrawImageRectI
GdipCloneBitmapArea
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipDrawString
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipCreateFromHDC
GdipReleaseDC
GdiplusShutdown
GdipDisposeImage
GdiplusStartup
GdipBitmapUnlockBits
GetModuleBaseNameW
EnumProcesses
EnumProcessModules
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
lstrlenA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCommandLineA
HeapAlloc
HeapFree
RtlUnwind
Sleep
RaiseException
HeapSize
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
VirtualAlloc
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetCurrentProcess
FlushFileBuffers
SetFilePointer
WriteFile
GlobalFindAtomW
LoadLibraryA
GetVersionExA
InterlockedIncrement
FormatMessageW
GlobalFlags
GetModuleHandleA
WritePrivateProfileStringW
SetErrorMode
lstrlenW
TlsFree
GlobalFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalUnlock
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
InterlockedDecrement
GetCurrentProcessId
GetLastError
SetLastError
GlobalAddAtomW
CloseHandle
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
FindResourceW
LoadResource
LockResource
SizeofResource
InterlockedExchange
GlobalLock
lstrcmpW
GlobalAlloc
FreeLibrary
IsBadReadPtr
LocalFree
LocalAlloc
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
GetProcAddress
ExitProcess
ReadFile
GetFileSize
OpenFile
IsDebuggerPresent
GlobalMemoryStatusEx
GetFileType
GetSystemInfo
DestroyMenu
LoadCursorW
GetSysColorBrush
ShowWindow
RegisterWindowMessageW
LoadIconW
WinHelpW
GetCapture
GetClassLongW
SetPropW
GetPropW
RemovePropW
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
DefWindowProcW
CallWindowProcW
CopyRect
GetMenu
SetWindowLongW
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetMenuItemID
GetSubMenu
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameW
PtInRect
GetWindowTextW
MessageBoxW
MessageBoxA
SetWindowTextW
GetSysColor
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
PostQuitMessage
PostMessageW
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuW
SendMessageW
GetParent
GetFocus
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageW
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageW
TranslateMessage
GetMenuItemCount
UnregisterClassW
UnhookWindowsHookEx
GetWindowThreadProcessId
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
SetCursor
SetWindowsHookExW
CallNextHookEx
GetMessageW
DeleteDC
GetStockObject
GetDeviceCaps
SelectObject
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
CreateBitmap
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
SetViewportOrgEx
DocumentPropertiesW
OpenPrinterW
ClosePrinter
RegSetValueExW
RegCreateKeyExW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
PathFindFileNameW
PathFindExtensionW
VariantClear
VariantChangeType
VariantInit
??0FdeRunnable@fde@@QAE@ABV01@@Z
??0FdeRunnable@fde@@QAE@XZ
??0FdeString@fde@@QAE@ABV01@@Z
??0FdeString@fde@@QAE@PB_W@Z
??0Logger@fde@@QAE@ABV01@@Z
??0Logger@fde@@QAE@W4FdeLogLevel@1@PBD1K@Z
??1FdeRunnable@fde@@UAE@XZ
??1FdeString@fde@@UAE@XZ
??1Logger@fde@@UAE@XZ
??4FdeRunnable@fde@@QAEAAV01@ABV01@@Z
??4FdeString@fde@@QAEAAV01@ABV01@@Z
??4Logger@fde@@QAEAAV01@ABV01@@Z
??5fde@@YAAAVLogger@0@AAV10@W4FdeFlushLog@0@@Z
??BFdeString@fde@@QBEPB_WXZ
??_7FdeRunnable@fde@@6B@
??_7FdeString@fde@@6B@
??_7Logger@fde@@6B@
?AnsiString@FdeString@fde@@QBEPBDI@Z
?Append@FdeString@fde@@QAEAAV12@PB_W@Z
?AppendFormat@FdeString@fde@@QAAXPB_WZZ
?FormatString@FdeString@fde@@SA?AV12@PB_WZZ
?enableLogging@fde@@YAX_N@Z
?startLogging@fde@@YAXPB_W@Z
?stopLogging@fde@@YAXXZ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ