Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
7fbe341749a5dabfce9ebc586b07ac8407491ffdbe6735a578749b6cb5bb7118.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
7fbe341749a5dabfce9ebc586b07ac8407491ffdbe6735a578749b6cb5bb7118.dll
Resource
win10v2004-20230220-en
Target
7fbe341749a5dabfce9ebc586b07ac8407491ffdbe6735a578749b6cb5bb7118
Size
5.2MB
MD5
a6934ae506b34efce98ad5037f3e7579
SHA1
4dcbdc317a36e3fd788888d1a23577cab9122258
SHA256
7fbe341749a5dabfce9ebc586b07ac8407491ffdbe6735a578749b6cb5bb7118
SHA512
fa21103ee3a047a862bbf7f76a456c6dc3d24b8dbbe7132807dd5534004c48df80039dc335c1f883e9c53c4728f690bc20f5eab4e52b4063ae613ad956716efc
SSDEEP
98304:hGR7Vi6BgABlWNbtS3Fl8lc2SjMvEmJxNmHFy:QaAB4lc281Hy
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetWindowsDirectoryW
DeleteFileW
SetFileAttributesW
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
ReadFile
GetFileTime
LockResource
GetSystemInfo
GlobalAlloc
lstrcatW
lstrcpyW
GetFileSizeEx
GetLogicalDriveStringsW
GetDiskFreeSpaceW
GetVolumeInformationW
DeviceIoControl
GlobalMemoryStatusEx
GetEnvironmentVariableW
FreeResource
IsBadReadPtr
IsBadWritePtr
IsBadStringPtrW
GetLocalTime
HeapReAlloc
HeapDestroy
HeapSize
GetPrivateProfileStructW
WritePrivateProfileStructW
WritePrivateProfileStringW
GetPrivateProfileIntW
lstrcpynW
LocalAlloc
GetComputerNameW
GetFullPathNameA
CreateFileA
HeapCompact
QueryPerformanceCounter
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
UnlockFileEx
GetSystemTimeAsFileTime
FormatMessageA
GetFileAttributesA
HeapCreate
HeapValidate
FlushFileBuffers
LockFileEx
CreateFileMappingA
GetDiskFreeSpaceA
GetVersionExA
GetTempPathA
AreFileApisANSI
DeleteFileA
TerminateThread
CreateThread
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
FlushInstructionCache
RaiseException
GetLastError
SetLastError
EnterCriticalSection
DecodePointer
DeleteCriticalSection
GetCurrentThreadId
Sleep
GlobalFree
InterlockedIncrement
EncodePointer
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
IsDebuggerPresent
RemoveDirectoryW
GetCurrentDirectoryW
GetTempPathW
CopyFileW
GetSystemDirectoryW
SetFileTime
InterlockedDecrement
GetTickCount
CloseHandle
FreeLibrary
LoadLibraryW
GetProcAddress
OutputDebugStringA
GetCommandLineW
SetErrorMode
FindResourceW
LoadResource
SetUnhandledExceptionFilter
LoadLibraryExW
GetModuleHandleW
SizeofResource
GetModuleFileNameW
MultiByteToWideChar
InterlockedExchange
lstrcmpiW
LocalFree
GetLongPathNameW
MoveFileW
SetEvent
CreateEventW
WaitForMultipleObjects
SetCurrentDirectoryW
WaitForSingleObject
ReadDirectoryChangesW
CreateFileW
GetOverlappedResult
ResetEvent
GetDriveTypeW
SwitchToThread
GetVersionExW
VirtualProtect
WriteProcessMemory
HeapAlloc
HeapFree
GetProcessHeap
MulDiv
CompareStringW
lstrlenW
GlobalLock
GlobalUnlock
WideCharToMultiByte
GetACP
FindFirstFileW
GetCurrentProcess
GetFileAttributesExW
GetShortPathNameW
FindClose
FindNextFileW
FormatMessageW
InterlockedExchangeAdd
GetCurrentProcessId
CreateProcessW
GetExitCodeProcess
GetFileAttributesW
LoadLibraryA
ExpandEnvironmentStringsW
CreateMutexW
ReleaseMutex
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
OpenProcess
QueryDosDeviceW
TryEnterCriticalSection
InitializeCriticalSection
ResumeThread
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemTime
GetFullPathNameW
GetTempFileNameW
MoveFileExW
CreateDirectoryW
GetKeyState
CloseClipboard
EmptyClipboard
GetActiveWindow
OpenClipboard
UnregisterHotKey
RegisterHotKey
PostMessageW
LoadIconW
IsWindow
CheckMenuRadioItem
SetMenuDefaultItem
IsDialogMessageW
CreateDialogParamW
CreateIconFromResourceEx
CreateIconFromResource
GetMessageExtraInfo
RegisterRawInputDevices
GetLastActivePopup
AttachThreadInput
GetForegroundWindow
GetWindowThreadProcessId
wsprintfW
MessageBoxW
CreateMenu
GetClipboardData
RegisterClipboardFormatW
SetClipboardData
DrawIconEx
MonitorFromRect
WaitMessage
GetUpdateRect
AppendMenuW
CreatePopupMenu
InsertMenuW
UnionRect
MonitorFromPoint
IsMenu
GetMenuItemID
WindowFromPoint
GetCursor
TrackPopupMenuEx
LoadStringW
UpdateLayeredWindow
GetWindowTextLengthW
SetRectEmpty
GetCapture
DrawFocusRect
UpdateWindow
GetDlgCtrlID
RemovePropW
SetPropW
SetRect
UnregisterClassW
GetSysColor
GetPropW
PostThreadMessageW
EqualRect
TrackMouseEvent
GetAsyncKeyState
GetScrollPos
GetMenuStringW
GetMenuState
GetMenuItemCount
GetRawInputData
GetMessageA
SetCapture
DrawTextW
GetDC
InflateRect
IntersectRect
IsWindowUnicode
DispatchMessageA
ReleaseCapture
IsWindowVisible
SetWindowPlacement
SetTimer
PostQuitMessage
KillTimer
IsZoomed
GetSubMenu
DeleteMenu
GetMenuItemInfoW
GetWindowPlacement
LoadMenuW
DestroyMenu
SetMenuItemInfoW
IsRectEmpty
GetCursorPos
DestroyIcon
FindWindowW
GetFocus
SetDlgItemTextW
CharLowerBuffW
GetKeyboardLayout
MapVirtualKeyExW
GetKeyNameTextW
ClientToScreen
SetCursor
GetDlgItemInt
SetWindowRgn
ScreenToClient
GetWindowDC
MsgWaitForMultipleObjects
SetForegroundWindow
GetParent
SetFocus
PtInRect
SetDlgItemInt
OffsetRect
BringWindowToTop
GetWindowTextW
ReleaseDC
MonitorFromWindow
GetDlgItem
EndDialog
RedrawWindow
ShowWindow
MapWindowPoints
GetMonitorInfoW
MoveWindow
EndPaint
RegisterWindowMessageW
FillRect
BeginPaint
InvalidateRect
CallWindowProcW
GetWindow
IsWindowEnabled
EnableWindow
EnumWindows
SendMessageTimeoutW
DestroyWindow
GetMessageW
CharNextW
TranslateMessage
PeekMessageW
DefWindowProcW
DispatchMessageW
CopyRect
GetClientRect
LoadCursorW
GetClassInfoExW
RegisterClassExW
DialogBoxParamW
SetWindowLongW
SendMessageW
IsIconic
SetWindowTextW
SetClassLongW
GetWindowLongW
GetWindowRect
FindWindowExW
GetSystemMetrics
SetWindowPos
GetClassNameW
CreateWindowExW
GetDesktopWindow
SystemParametersInfoW
CreateCompatibleBitmap
CreateSolidBrush
BitBlt
DeleteDC
SelectObject
CreateCompatibleDC
StretchDIBits
GetObjectW
DeleteObject
SetViewportOrgEx
CreateRectRgn
CreatePen
ExtTextOutW
SetBkColor
SetROP2
SetDCPenColor
SetArcDirection
SetBrushOrgEx
Polyline
FillRgn
CreateBitmap
CreatePolygonRgn
SetBkMode
SetTextColor
EnumFontFamiliesExW
CreateFontIndirectW
LineTo
MoveToEx
RestoreDC
SaveDC
StretchBlt
GetStockObject
GetTextExtentPoint32W
PatBlt
EndDoc
StartDocW
CreateDCW
GetDeviceCaps
StartPage
EndPage
SetWorldTransform
GetWorldTransform
SetGraphicsMode
SelectClipRgn
ExtCreatePen
GetTextExtentPointW
CreateDIBSection
CreatePatternBrush
SetBitmapBits
GetBitmapBits
SetDIBColorTable
GetTextColor
SetStretchBltMode
SetDCBrushColor
GetOpenFileNameW
PageSetupDlgW
GetSaveFileNameW
ChooseColorW
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegQueryInfoKeyW
SystemFunction036
RegEnumValueW
GetUserNameW
RegOpenCurrentUser
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ShellExecuteW
ShellExecuteExW
CommandLineToArgvW
SHGetSettings
SHGetDesktopFolder
ord190
ord155
DragAcceptFiles
SHGetFileInfoW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHChangeNotify
SHFileOperationW
ord2
ord645
SHBrowseForFolderW
ord644
Shell_NotifyIconW
DragFinish
DragQueryFileW
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CreateStreamOnHGlobal
RevokeDragDrop
RegisterDragDrop
ReleaseStgMedium
OleDuplicateData
CoInitializeSecurity
CoUninitialize
CoInitialize
DoDragDrop
VarBstrCmp
VariantChangeType
VariantInit
VariantClear
SysAllocString
VarUI4FromStr
SysFreeString
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
??0_Locinfo@std@@QAE@HPBD@Z
??1_Locinfo@std@@QAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
??1_Container_base12@std@@QAE@XZ
??Bid@locale@std@@QAEIXZ
?_BADOFF@std@@3_JB
?_Xruntime_error@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?uncaught_exception@std@@YA_NXZ
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?global@locale@std@@SA?AV12@ABV12@@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Xout_of_range@std@@YAXPBD@Z
SHDeleteKeyW
StrCmpIW
PathFindFileNameW
PathRemoveFileSpecW
ImageList_ReplaceIcon
ImageList_Draw
ImageList_SetImageCount
ImageList_Remove
ImageList_Create
ImageList_GetImageInfo
ImageList_Replace
ImageList_Destroy
InitCommonControlsEx
ImageList_GetIcon
_TrackMouseEvent
ImageList_GetIconSize
AlphaBlend
??3@YAXPAX@Z
memmove
free
??_V@YAXPAX@Z
_purecall
??2@YAPAXI@Z
wcsncpy
swprintf_s
_recalloc
sprintf
memmove_s
wcsncpy_s
malloc
wcsstr
memcpy_s
?terminate@@YAXXZ
_beginthreadex
wcsncmp
_resetstkoflw
wcscat_s
wcscpy_s
_wtoi
wcstok
ldiv
rand
srand
_time64
_vsnwprintf
_errno
wcschr
towlower
towupper
_wcsnicmp
fputc
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
_unlock_file
ungetc
strstr
fgetpos
_fseeki64
fflush
fgetc
fsetpos
setvbuf
_lock_file
fwrite
fclose
strchr
memchr
tolower
toupper
_mktime64
_localtime64
_stricmp
_splitpath_s
_wcsicmp
_vswprintf_c_l
_except1
swscanf_s
calloc
wcsrchr
wcstoul
isalnum
round
_wcsupr
_nextafter
_wtof
_snwprintf_s
_localtime64_s
strncmp
qsort
_msize
_endthreadex
rand_s
realloc
sprintf_s
_dtest
modf
__iob_func
atoi
strtok
_wcsdup
fread
ftell
fseek
exit
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
printf
_vswprintf
vfprintf
_snprintf
memcpy
memset
_CxxThrowException
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__CxxFrameHandler3
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
_except_handler4_common
__clean_type_info_names_internal
_strdup
__RTDynamicCast
_libm_sse2_atan_precise
_libm_sse2_cos_precise
_libm_sse2_exp_precise
_libm_sse2_log10_precise
_libm_sse2_log_precise
_libm_sse2_pow_precise
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
ceil
floor
sscanf
CryptBinaryToStringW
mixerOpen
waveInStart
waveInUnprepareHeader
mixerGetControlDetailsW
waveInReset
waveInAddBuffer
waveInOpen
mixerGetLineInfoA
mixerClose
waveInPrepareHeader
mixerGetLineInfoW
mixerGetDevCapsW
mixerGetControlDetailsA
mixerSetControlDetails
waveInClose
waveOutOpen
waveOutUnprepareHeader
waveOutGetDevCapsA
waveInGetNumDevs
waveOutSetVolume
waveOutReset
waveOutRestart
waveOutGetVolume
waveOutPause
waveOutWrite
waveOutClose
mixerGetLineControlsW
waveOutGetNumDevs
waveOutPrepareHeader
mciSendCommandW
waveInGetDevCapsA
GdipGetImageRawFormat
GdipDeleteBrush
GdipGetFontCollectionFamilyList
GdipCloneBrush
GdipSetImageAttributesColorMatrix
GdipDrawImageRectRectI
GdipMeasureString
GdipGetFamilyName
GdipSetStringFormatLineAlign
GdipGetImagePalette
GdipSetTextRenderingHint
GdipDeleteFont
GdipGetImageGraphicsContext
GdipGetFontCollectionFamilyCount
GdipSetStringFormatAlign
GdipGraphicsClear
GdipDeleteFontFamily
GdipCreateSolidFill
GdipDisposeImageAttributes
GdipCreateFont
GdipRotateWorldTransform
GdipResetWorldTransform
GdipCreateImageAttributes
GdipDrawString
GdipGetImagePaletteSize
GdipTranslateWorldTransform
GdipCreateFontFamilyFromName
GdipGetFontHeight
GdipSetInterpolationMode
GdipFillRectangleI
GdipCloneFontFamily
GdipImageRotateFlip
GdipCreateStringFormat
GdipSetPixelOffsetMode
GdipDeleteStringFormat
GdipCreateFromHWND
GdipNewInstalledFontCollection
GdipSaveImageToFile
GdipSetPenColor
GdipDrawLineI
GdipCreatePen1
GdipGetDC
GdipReleaseDC
GdipDrawLinesI
GdipCreateHBITMAPFromBitmap
GdipDrawImagePointRectI
GdipDrawImageI
GdipFillRectangle
GdipDrawRectangleI
GdipSetClipRectI
GdipSetCompositingMode
GdipCreateBitmapFromStream
GdipLoadImageFromFile
GdipCreateBitmapFromResource
GdipSetSmoothingMode
GdipSetImageAttributesColorKeys
GdipCreateBitmapFromHBITMAP
GdipCreateFontFromLogfontW
GdipGetPropertyItem
GdipBitmapUnlockBits
GdipGetPropertyItemSize
GdipBitmapLockBits
GdipSetPropertyItem
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
GdipGetRegionHRgn
GdipScaleWorldTransform
GdipCreateMatrix
GdipGetClip
GdipGetMatrixElements
GdipSaveGraphics
GdipGetClipBoundsI
GdipDeleteRegion
GdipTransformPointsI
GdipGetWorldTransform
GdipCreateRegion
GdipDeleteMatrix
GdipRestoreGraphics
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipGetImageWidth
GdipCloneImage
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdipDeleteGraphics
GdipGetImagePixelFormat
GdipGetImageHeight
GdipCloneBitmapAreaI
GdipFree
GdipDrawImageRectRect
GdipDeletePen
ImageEnumerateCertificates
ImageRemoveCertificate
ImmDisableIME
ImmAssociateContext
ImmGetVirtualKey
CreateImageFileMgr
ImageExplorerMain
ImageLoaderMain
ImageUpdateMain
ImageViewerMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ