Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
Zoom.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Zoom.exe
Resource
win10v2004-20220901-en
Target
Zoom.exe
Size
347KB
MD5
d6bf3c6b33cc7cda73dfd3d4d59bb6dd
SHA1
cb9a2095f4c9bda7659e77d9aca5144d5a0c73db
SHA256
46debd0ad429a533812544813777041a53e6778b725cb42411fbd73095568f2e
SHA512
5b7081452621ab31b157443e7f83329adb0ea332747fc3fda4f41a1fe0ead3e53760ce5a92de12cc786c48e12e58979bdde3b5c46e77797975f2b89efecd6c1c
SSDEEP
3072:hFh9/vWCnyJVmt/RyFFmkf/xR6l4DenG+oR/ClP9b/gLwziCMW3jmc7xS:TD/vWC8S/UYqRaR9bYLw5Zzdk
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
SERIALNUMBER=1005828-9,CN=Meloche Business Solutions Inc.,O=Meloche Business Solutions Inc.,L=Pickering,ST=Ontario,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=1005828-9,CN=Meloche Business Solutions Inc.,O=Meloche Business Solutions Inc.,L=Pickering,ST=Ontario,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetModuleInformation
GetModuleFileNameExW
EnumProcessModules
ord9
ord7
?GetZoomAppPropData@Cmm@@YAPAVIZoomAppPropData@zoom_data@@XZ
CmmMQ_GetService
?CreateAppContext@Cmm@@YAPAVISSBAppContext@1@ABV?$CStringT@_W@1@HH@Z
?NotifyClientDataTermed@Cmm@@YAXXZ
?IsPTProcess@Cmm@@YAHXZ
?GetSwitchValueASCII@CommandLine@Cmm@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z
?ForCurrentProcess@CommandLine@Cmm@@SAPAV12@XZ
?DestroyDefaultMessageLoop@ZoomWorkerFactory@Cmm@@SAXXZ
?GetSpecialDirectory@CFileName@Cmm@@QAEXW4SpecialFolder@12@H@Z
?SetProcessType@Cmm@@YAXW4PROCESS_TYPE@@@Z
?DestroyAppContext@Cmm@@YAXPAVISSBAppContext@1@@Z
?Empty@?$CStringT@D@Cmm@@QAEXXZ
?empty@?$CStringT@D@Cmm@@QBE_NXZ
??0?$CStringT@D@Cmm@@QAE@XZ
??0?$CStringT@D@Cmm@@QAE@PB_W@Z
??0?$CStringT@D@Cmm@@QAE@ABV?$CStringT@_W@1@@Z
??1?$CStringT@D@Cmm@@UAE@XZ
??4?$CStringT@D@Cmm@@QAEAAV01@PBD@Z
??4?$CStringT@D@Cmm@@QAEAAV01@ABV01@@Z
?c_str@?$CStringT@D@Cmm@@QBEPBDXZ
?empty@?$CStringT@_W@Cmm@@QBE_NXZ
??0?$CStringT@_W@Cmm@@QAE@XZ
??0?$CStringT@_W@Cmm@@QAE@PB_W@Z
??0?$CStringT@_W@Cmm@@QAE@PBD@Z
??1?$CStringT@_W@Cmm@@UAE@XZ
??4?$CStringT@_W@Cmm@@QAEAAV01@PB_W@Z
??4?$CStringT@_W@Cmm@@QAEAAV01@ABV01@@Z
??Y?$CStringT@_W@Cmm@@QAEAAV01@PB_W@Z
??Y?$CStringT@_W@Cmm@@QAEAAV01@ABV01@@Z
?c_str@?$CStringT@_W@Cmm@@QBEPB_WXZ
?GetBuffer@?$CStringT@_W@Cmm@@QAEPA_WI@Z
?IsEmpty@?$CStringT@_W@Cmm@@QBEHXZ
?SetLength@?$CStringT@_W@Cmm@@QAEXI@Z
??1CFileName@Cmm@@UAE@XZ
?GetModuleFileNameW@CFileName@Cmm@@QAEXPAUHINSTANCE__@@@Z
?GetName@CFileName@Cmm@@QBEPB_WXZ
??0CFileName@Cmm@@QAE@XZ
??B?$CStringT@_W@Cmm@@QBEPB_WXZ
??Y?$CStringT@_W@Cmm@@QAEAAV01@PBD@Z
??8?$CStringT@_W@Cmm@@QBE_NABV01@@Z
?GetModuleLoader@Cmm@@YAPAVICmmModuleLoader@1@XZ
?GetModuleRegistry@Cmm@@YAPAVICmmModuleRegistry@1@XZ
??1CCmmArchiveObjHelper@Cmm@@QAE@XZ
??0CCmmArchiveObjHelper@Cmm@@QAE@PBD@Z
?FreeMsg@CCmmMessageHelper@Cmm@@YAXPAVCmmMQ_Msg@2@@Z
?FlatternToMsg@CCmmMessageHelper@Cmm@@YAPAVCmmMQ_Msg@2@PAVCCmmArchiveObjHelper@2@H@Z
??1CSBMBMessage_NotifyNetworkStateChanged@@UAE@XZ
?Set_Flag@CSBMBMessage_NotifyNetworkStateChanged@@QAEXABI@Z
?Set_State@CSBMBMessage_NotifyNetworkStateChanged@@QAEXABI@Z
??0CSBMBMessage_NotifyNetworkStateChanged@@QAE@XZ
??1CSBMBMessage_NotifyAppInActive@@UAE@XZ
?Set_Reason@CSBMBMessage_NotifyAppInActive@@QAEXABV?$CStringT@D@Cmm@@@Z
??0CSBMBMessage_NotifyAppInActive@@QAE@XZ
??1CSBMBMessage_NotifyAppActive@@UAE@XZ
?Set_Reason@CSBMBMessage_NotifyAppActive@@QAEXABV?$CStringT@D@Cmm@@@Z
??0CSBMBMessage_NotifyAppActive@@QAE@XZ
?cmm_str_convert@@YAIHPADIPB_WI@Z
?SetMinLogLevel@logging@@YAXH@Z
?BaseInitLoggingImpl_built_with_NDEBUG@logging@@YA_NPB_WW4LoggingDestination@1@W4LogLockingState@1@W4OldFileDeletionState@1@W4LogEncryptPolicy@1@K@Z
cmm_fs_rmdirs
?GetAppContext@Cmm@@YAPAVISSBAppContext@1@XZ
?Assign@?$CStringT@_W@Cmm@@QAEXPB_WI@Z
?SetLength@?$CStringT@D@Cmm@@QAEXI@Z
?size@?$CStringT@D@Cmm@@QBEIXZ
??0?$CStringT@D@Cmm@@QAE@PBD@Z
?ToTimeT@Time@Cmm@@QBE_JXZ
??H?$CStringT@D@Cmm@@QBE?AV01@PBD@Z
??Y?$CStringT@D@Cmm@@QAEAAV01@PBD@Z
??Y?$CStringT@D@Cmm@@QAEAAV01@ABV01@@Z
?GetBuffer@?$CStringT@D@Cmm@@QAEPADI@Z
?GetZoomClientData@Cmm@@YAPAVIZoomClientData@zoom_data@@XZ
?find@?$CStringT@_W@Cmm@@QBEIPB_WI@Z
?length@?$CStringT@_W@Cmm@@QBEIXZ
??0?$CStringT@_W@Cmm@@QAE@ABV01@@Z
??0?$CStringT@_W@Cmm@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??4?$CStringT@_W@Cmm@@QAEAAV01@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?GetSecond@CTime@Cmm@@QBEHXZ
?GetMinute@CTime@Cmm@@QBEHXZ
?GetHour@CTime@Cmm@@QBEHXZ
?GetDay@CTime@Cmm@@QBEHXZ
?GetMonth@CTime@Cmm@@QBEHXZ
?GetYear@CTime@Cmm@@QBEHXZ
?GetTickCount@CTime@Cmm@@SA?AV12@XZ
??_7CmmLogGC@Cmm@@6B@
?ResetAppData@CmmLogGC@Cmm@@UAEHH@Z
?Init@CommandLine@Cmm@@SAXHPBQBD@Z
??8?$CStringT@_W@Cmm@@QBE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?GetMsiPkgVersion@Cmm@@YA?AV?$CStringT@_W@1@ABV21@@Z
?StringToUInt@Cmm@@YAHABV?$CStringT@_W@1@AAI@Z
CmmMQ_TermService
CmmMQ_InitService
?GetCurrentVersion@Cmm@@YAXAAV?$CStringT@D@1@@Z
?GetExePkgVersion@Cmm@@YA?AV?$CStringT@_W@1@ABV21@@Z
?ClearAllPackageDefines@CCmmArchiveService@Cmm@@SAXXZ
?IsNewerVersion@Cmm@@YAHABV?$CStringT@D@1@0@Z
?size@?$CStringT@_W@Cmm@@QBEIXZ
??H?$CStringT@_W@Cmm@@QBE?AV01@PB_W@Z
??H?$CStringT@_W@Cmm@@QBE?AV01@ABV01@@Z
??Y?$CStringT@_W@Cmm@@QAEAAV01@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??9?$CStringT@_W@Cmm@@QBE_NPB_W@Z
??9?$CStringT@_W@Cmm@@QBE_NABV01@@Z
?Format@?$CStringT@_W@Cmm@@QAAXPB_WZZ
??4?$CStringT@_W@Cmm@@QAEAAV01@$$QAV01@@Z
??1PolicyContext_s@zpref@@QAE@XZ
??1CSBMBMessage_NotifyAppEvent@@UAE@XZ
?Set_Param@CSBMBMessage_NotifyAppEvent@@QAEXABV?$CStringT@_W@Cmm@@@Z
?Set_EventID@CSBMBMessage_NotifyAppEvent@@QAEXABI@Z
??0CSBMBMessage_NotifyAppEvent@@QAE@XZ
??1CSBMBMessage_NotifyBeforeTerm@@UAE@XZ
?Set_AppName@CSBMBMessage_NotifyBeforeTerm@@QAEXABV?$CStringT@D@Cmm@@@Z
??0CSBMBMessage_NotifyBeforeTerm@@QAE@XZ
??1CSBMBMessage_NotifyAfterInit@@UAE@XZ
?Set_AppName@CSBMBMessage_NotifyAfterInit@@QAEXABV?$CStringT@D@Cmm@@@Z
??0CSBMBMessage_NotifyAfterInit@@QAE@XZ
??1CSBMBMessage_TermThread@@UAE@XZ
?Set_AppName@CSBMBMessage_TermThread@@QAEXABV?$CStringT@D@Cmm@@@Z
??0CSBMBMessage_TermThread@@QAE@XZ
??1CSBMBMessage_InitThread@@UAE@XZ
?Set_AppName@CSBMBMessage_InitThread@@QAEXABV?$CStringT@D@Cmm@@@Z
??0CSBMBMessage_InitThread@@QAE@XZ
??0?$CStringT@_W@Cmm@@QAE@$$QAV01@@Z
??0PolicyContext_s@zpref@@QAE@XZ
?GetModuleFilePath@CFileName@Cmm@@QAEXPAUHINSTANCE__@@@Z
?CreatePolicyProvider@zpref@@YAPAVIPolicyProvider@1@ABUPolicyContext_s@1@@Z
?DestoryPolicyProvider@zpref@@YAXXZ
?GetZoomAccountManager@Cmm@@YAPAVIZoomAccountManager@zoom_data@@XZ
?cmm_str_convert@@YAIHPA_WIPBDI@Z
?Now@Time@Cmm@@SA?AV12@XZ
??H?$CStringT@D@Cmm@@QBE?AV01@D@Z
?SetSupportHighContrast@CHighContrast@DuiLib@@QAEX_N@Z
?Instance@CHighContrast@DuiLib@@SAPAV12@XZ
?SetAwarenessMode@CHighDpi@DuiLib@@SA_NW4DPIAwareMode@CDpiAwarenessMode@2@@Z
?InitHdpi@CHighDpi@DuiLib@@SAHXZ
?UnInitHdpi@CHighDpi@DuiLib@@SAXXZ
?ReleaseAllPictures@CZPPictureMgr@UIBase@@QAEXXZ
?_ZPUIImgMgr@UIBase@@3VCZPPictureMgr@1@A
ZAccTermModule
ZAccInitModule
?destroy@mem_log_file@ssb@@SAXXZ
?update_log_destination@mem_log_file@ssb@@QAEHI@Z
util_uninit
??1thread_mutex_recursive@ssb@@QAE@XZ
mlog_reg
mlog_unreg
?instance@mem_log_file@ssb@@SAPAV12@I@Z
util_init
destroy_mlog_mgr
??0thread_mutex_recursive@ssb@@QAE@XZ
enable_logger
RAND_bytes
ResetEvent
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
WaitForSingleObjectEx
UnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
HeapFree
CreateFileW
GetFileAttributesW
OpenProcess
GetLastError
CloseHandle
HeapAlloc
GetProcAddress
VerSetConditionMask
GetProcessHeap
VerifyVersionInfoW
LoadLibraryExW
InitializeCriticalSectionEx
CreateDirectoryW
SetErrorMode
GetPrivateProfileStringW
DeleteFileW
GetTempFileNameW
CreateEventW
GetCurrentProcessId
GetModuleHandleW
GetModuleFileNameW
FindFirstFileW
SetLastError
FindNextFileW
GetCurrentProcess
WriteFile
ExpandEnvironmentStringsW
DeviceIoControl
SetFilePointer
FindClose
GetModuleHandleA
CreateToolhelp32Snapshot
Process32NextW
OutputDebugStringW
CreateFileA
Process32FirstW
DeleteCriticalSection
CreateDirectoryA
GetTempPathW
GetWindowsDirectoryW
MoveFileExW
FreeLibrary
SetDllDirectoryW
MoveFileW
VirtualProtect
EnterCriticalSection
ReleaseSemaphore
TerminateProcess
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
FlushFileBuffers
ResumeThread
SetEvent
CreateThread
CreateSemaphoreW
FlushInstructionCache
VirtualQuery
IsWindow
GetUserObjectInformationA
MessageBoxW
GetProcessWindowStation
DefWindowProcW
DestroyWindow
CreateWindowExW
UnregisterClassW
ShowWindow
GetClassInfoW
RegisterClassW
SetFocus
UpdateWindow
PostMessageW
SendMessageW
FindWindowW
RegOpenKeyExW
RegEnumKeyExW
RegGetValueW
CheckTokenMembership
FreeSid
OpenProcessToken
AllocateAndInitializeSid
GetUserNameW
DuplicateToken
RegQueryValueExW
GetTokenInformation
RegCloseKey
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
ShellExecuteW
SHGetFolderPathA
CoUninitialize
CoCreateInstance
CoInitialize
CoInitializeEx
SysFreeString
SysAllocString
PathRemoveFileSpecW
PathAddBackslashW
PathRemoveBackslashW
PathAppendW
PathIsRelativeW
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?get_adaptor_mac_addr@net_adaptors_t@ssb@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?enum_netadaptors@net_adaptors_t@ssb@@SAPAV12@XZ
?release@net_adaptors_t@ssb@@SAXAAPAV12@@Z
GdiplusShutdown
GdiplusStartup
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust
CertGetNameStringW
memcmp
memcpy
memmove
memset
_CxxThrowException
_except_handler4_common
__current_exception_context
__current_exception
wcschr
wcsstr
_purecall
__std_exception_copy
__std_exception_destroy
__std_terminate
__CxxFrameHandler3
towupper
strcat_s
_strnicmp
wcscat_s
_wcsicmp
strnlen
towlower
free
malloc
_set_new_mode
_callnewh
_wstat64i32
_exit
_configure_wide_argv
_c_exit
_set_app_type
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_initialize_wide_environment
_seh_filter_exe
_get_wide_winmain_command_line
_cexit
_controlfp_s
signal
_set_abort_behavior
_initterm
_crt_atexit
_register_onexit_function
_initialize_onexit_table
exit
terminate
_initterm_e
_itow_s
__p__commode
__stdio_common_vswprintf
_set_fmode
_putenv
getenv
__setusermatherr
_configthreadlocale
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ