Static task
static1
Behavioral task
behavioral1
Sample
0e1d8e1fefb3e02055748a2c2462d3cb383381f56f9fec771ca1b563434b1877.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0e1d8e1fefb3e02055748a2c2462d3cb383381f56f9fec771ca1b563434b1877.exe
Resource
win10v2004-20230915-en
General
-
Target
0e1d8e1fefb3e02055748a2c2462d3cb383381f56f9fec771ca1b563434b1877
-
Size
952KB
-
MD5
058b569b201b53d11262ab321be5bac7
-
SHA1
4ffebab7fe5ba99e9be852ff8bfa41de2df5ac87
-
SHA256
0e1d8e1fefb3e02055748a2c2462d3cb383381f56f9fec771ca1b563434b1877
-
SHA512
0b23b61d3c4b2f59e6868511c092f5249fdaeeef8ed3fdc44bf30882a72bdb6fa1becad3cd77c0d1f5df6a95b8a19ea2e985094131b01117457cfe3ccb1f758c
-
SSDEEP
12288:dFieG+3I3NT1/kmZjvKxaQKwK1n5vnGY7crXnVm4yZ:WPJ9TJh9KA5n5PGnVmvZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e1d8e1fefb3e02055748a2c2462d3cb383381f56f9fec771ca1b563434b1877
Files
-
0e1d8e1fefb3e02055748a2c2462d3cb383381f56f9fec771ca1b563434b1877.exe windows:6 windows x64
6cd5461f99901a52b3ab638cca2931b4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleHandleW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
SetThreadExecutionState
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
LoadLibraryA
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
WideCharToMultiByte
MultiByteToWideChar
FormatMessageW
GetModuleHandleExW
InitializeCriticalSection
GetLastError
VerSetConditionMask
QueryPerformanceFrequency
GetTickCount
LoadLibraryExA
FreeLibrary
GetProcAddress
RtlCaptureContext
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
user32
RemovePropW
GetPropW
SetPropW
SetForegroundWindow
MsgWaitForMultipleObjects
ReleaseCapture
SetCapture
GetKeyState
GetActiveWindow
SetFocus
EmptyClipboard
GetCursorPos
SetClipboardData
CloseClipboard
OpenClipboard
IsZoomed
BringWindowToTop
IsIconic
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
SetWindowPos
MoveWindow
FlashWindow
SetLayeredWindowAttributes
GetLayeredWindowAttributes
WaitMessage
PostMessageW
SendMessageW
GetMessageTime
TrackMouseEvent
EnumDisplayMonitors
GetMonitorInfoW
EnumDisplayDevicesW
EnumDisplaySettingsExW
SetWindowTextW
ChangeDisplaySettingsExW
ReleaseDC
GetDC
MapVirtualKeyW
ToUnicode
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
UnregisterClassW
DefWindowProcW
UnregisterDeviceNotification
RegisterDeviceNotificationW
PeekMessageW
DispatchMessageW
TranslateMessage
ClientToScreen
ScreenToClient
WindowFromPoint
ClipCursor
SetRect
OffsetRect
PtInRect
GetWindowLongW
GetClassLongPtrW
LoadCursorW
DestroyIcon
LoadImageW
CreateIconIndirect
SystemParametersInfoW
MonitorFromWindow
GetRawInputData
RegisterRawInputDevices
GetRawInputDeviceInfoA
GetRawInputDeviceList
GetClientRect
GetWindowRect
AdjustWindowRectEx
SetCursorPos
EnumDisplaySettingsW
SetCursor
GetSystemMetrics
SystemParametersInfoA
GetClipboardData
SetWindowLongW
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
?_Xlength_error@std@@YAXPEBD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Xout_of_range@std@@YAXPEBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
io_cm
?isEnd@FileReader@io_cm@cg_66rpg@@QEAA_NXZ
fileExist
io_cm_to_utf8
io_cm_set_log_level
log_cm
io_cm_home_path
??1FileWriter@io_cm@cg_66rpg@@QEAA@XZ
?fileClose@FileWriter@io_cm@cg_66rpg@@QEAAXXZ
?writeString@FileWriter@io_cm@cg_66rpg@@QEAAXPEBD@Z
?writeInt@FileWriter@io_cm@cg_66rpg@@QEAAXH@Z
??0FileWriter@io_cm@cg_66rpg@@QEAA@PEBD_N1@Z
resourceExist
unload
load
error_cm
io_cm_ctow
addStorageFromResource
loadResource
?readString@FileReader@io_cm@cg_66rpg@@QEAAXXZ
?readInt@FileReader@io_cm@cg_66rpg@@QEAAHXZ
?readLine@FileReader@io_cm@cg_66rpg@@QEAAPEADXZ
??0FileReader@io_cm@cg_66rpg@@QEAA@PEBD_N@Z
?content@FileReader@io_cm@cg_66rpg@@QEAAPEBDXZ
getFile
io_cm_from_utf8
addStorage
getFilesCount
loadStorage
removeStorage
?readByte@FileReader@io_cm@cg_66rpg@@QEAAXHPEAE@Z
??1FileReader@io_cm@cg_66rpg@@QEAA@XZ
curl_cm
curl_cm_set_debug_level
curl_cm_set_callback
curl_cm_set_need_save
curl_cm_unload
curl_cm_request
curl_cm_set_js_callback
curl_cm_set_caller
curl_cm_set_save
curl_cm_set_callback_1
curl_cm_load
curl_cm_update
curl_cm_set_request_type
curl_cm_add_param
curl_cm_set_data_type
curl_cm_requests
curl_cm_add_header
curl_cm_new_package
curl_cm_set_url
v8_cm
?v8_cm_callback@v8_cm@cg_66rpg@@YAHV?$Local@VValue@v8@@@v8@@00@Z
?v8_cm_to_float@v8_cm@cg_66rpg@@YAMHPEBDM@Z
?v8_cm_callback_delete@v8_cm@cg_66rpg@@YAXH@Z
?v8_cm_splice@v8_cm@cg_66rpg@@YAPEBDHHPEBD@Z
?v8_cm_equals@v8_cm@cg_66rpg@@YA_NHH@Z
?v8_cm_valid@v8_cm@cg_66rpg@@YA_NV?$Local@VValue@v8@@@v8@@@Z
?v8_cm_callback_invoke@v8_cm@cg_66rpg@@YAXHPEBDHW4V8_CM_DATA_TYPE@12@@Z
?v8_cm_to_string@v8_cm@cg_66rpg@@YAPEBDV?$Local@VValue@v8@@@v8@@PEBD_N@Z
?v8_cm_to_string@v8_cm@cg_66rpg@@YAPEBDHPEBD_N@Z
?v8_cm_unbind@v8_cm@cg_66rpg@@YAXH@Z
?v8_cm_callback_add@v8_cm@cg_66rpg@@YAXHMH@Z
?v8_cm_callback_add@v8_cm@cg_66rpg@@YAXHPEBDHW4V8_CM_DATA_TYPE@12@H@Z
?v8_cm_length@v8_cm@cg_66rpg@@YAHH@Z
?v8_cm_callback_clear@v8_cm@cg_66rpg@@YAXH@Z
?v8_cm_bind@v8_cm@cg_66rpg@@YAHV?$Local@VValue@v8@@@v8@@@Z
?v8_cm_bind@v8_cm@cg_66rpg@@YAHHPEBD@Z
?v8_cm_load@v8_cm@cg_66rpg@@YAXXZ
?v8_cm_to_float@v8_cm@cg_66rpg@@YAMV?$Local@VValue@v8@@@v8@@PEBDM@Z
?v8_cm_callback@v8_cm@cg_66rpg@@YAHV?$Local@VValue@v8@@@v8@@@Z
?v8_cm_is_array@v8_cm@cg_66rpg@@YA_NV?$Local@VValue@v8@@@v8@@@Z
?v8_cm_is_array@v8_cm@cg_66rpg@@YA_NH@Z
?v8_cm_is_function@v8_cm@cg_66rpg@@YA_NV?$Local@VValue@v8@@@v8@@@Z
?v8_cm_is_number@v8_cm@cg_66rpg@@YA_NV?$Local@VValue@v8@@@v8@@@Z
?v8_cm_load_js@v8_cm@cg_66rpg@@YAXPEBD_N@Z
?v8_cm_valid@v8_cm@cg_66rpg@@YA_NH@Z
?v8_cm_to_bool@v8_cm@cg_66rpg@@YA_NV?$Local@VValue@v8@@@v8@@PEBD@Z
?v8_cm_to_bool@v8_cm@cg_66rpg@@YA_NHPEBD@Z
?v8_cm_ret@v8_cm@cg_66rpg@@YAXAEBV?$FunctionCallbackInfo@VValue@v8@@@v8@@PEBD_N@Z
?v8_cm_ret@v8_cm@cg_66rpg@@YAXAEBV?$FunctionCallbackInfo@VValue@v8@@@v8@@H@Z
?v8_cm_ret@v8_cm@cg_66rpg@@YAXAEBV?$FunctionCallbackInfo@VValue@v8@@@v8@@N@Z
?v8_cm_length@v8_cm@cg_66rpg@@YAHV?$Local@VValue@v8@@@v8@@@Z
?v8_cm_reload@v8_cm@cg_66rpg@@YAXXZ
?v8_cm_bind@v8_cm@cg_66rpg@@YAHHH@Z
?v8_cm_run@v8_cm@cg_66rpg@@YAXXZ
?v8_cm_regist_method@v8_cm@cg_66rpg@@YAXPEBDP6AXAEBV?$FunctionCallbackInfo@VValue@v8@@@v8@@@Z@Z
?v8_cm_is_object@v8_cm@cg_66rpg@@YA_NV?$Local@VValue@v8@@@v8@@@Z
?v8_cm_is_object@v8_cm@cg_66rpg@@YA_NH@Z
?v8_cm_to_int@v8_cm@cg_66rpg@@YAHV?$Local@VValue@v8@@@v8@@PEBDH@Z
?v8_cm_to_int@v8_cm@cg_66rpg@@YAHHPEBDH@Z
?v8_cm_decode_js@v8_cm@cg_66rpg@@YAX_N@Z
?v8_cm_callback@v8_cm@cg_66rpg@@YAHPEBD@Z
ffmpeg_cm
ffmpeg_cm_load
ffmpeg_cm_unload
ffmpeg_cm_seek
ffmpeg_cm_is_audio
ffmpeg_cm_get_audio_channel
ffmpeg_cm_get_audio_time
ffmpeg_cm_delete
ffmpeg_cm_get_audio_frame_data
ffmpeg_cm_get_audio_sample_bits
ffmpeg_cm_get_audio_buffer_size
ffmpeg_cm_read_audio_frame
ffmpeg_cm_get_audio_sample_rate
ffmpeg_cm_new_with_memory
openal_cm
openal_cm_is_finish
openal_cm_reset
openal_cm_new
openal_cm_pause
openal_cm_need_data
openal_cm_unqueue_buffer
openal_cm_send_buffer
openal_cm_play
openal_cm_set_sampleRate
openal_cm_unload
openal_cm_load
openal_cm_set_volumn
spine
?getDuration@Animation@spine@@QEAAMXZ
??0Atlas@spine@@QEAA@PEBDH0PEAVTextureLoader@1@_N@Z
??1Atlas@spine@@UEAA@XZ
?getPages@Atlas@spine@@QEAAAEAV?$Vector@PEAVAtlasPage@spine@@@2@XZ
?getHeight@SkeletonData@spine@@QEAAMXZ
??1SkeletonJson@spine@@UEAA@XZ
?readSkeletonData@SkeletonJson@spine@@QEAAPEAVSkeletonData@2@PEBD@Z
?getInstance@SpineExtension@spine@@SAPEAV12@XZ
??0AnimationStateData@spine@@QEAA@PEAVSkeletonData@1@@Z
??0SkeletonClipping@spine@@QEAA@XZ
?getName@Animation@spine@@QEAAAEBVString@2@XZ
?getWidth@SkeletonData@spine@@QEAAMXZ
?getX@SkeletonData@spine@@QEAAMXZ
?getAnimations@SkeletonData@spine@@QEAAAEAV?$Vector@PEAVAnimation@spine@@@2@XZ
?getSkins@SkeletonData@spine@@QEAAAEAV?$Vector@PEAVSkin@spine@@@2@XZ
?findAnimation@SkeletonData@spine@@QEAAPEAVAnimation@2@AEBVString@2@@Z
?getBounds@Skeleton@spine@@QEAAXAEAM000AEAV?$Vector@M@2@@Z
?computeWorldVertices@RegionAttachment@spine@@QEAAXAEAVBone@2@PEAM_K2@Z
?getBlendMode@SlotData@spine@@QEAA?AW4BlendMode@2@XZ
??0SkeletonJson@spine@@QEAA@PEAVAtlas@1@@Z
?getColor@MeshAttachment@spine@@QEAAAEAVColor@2@XZ
?getTriangles@MeshAttachment@spine@@QEAAAEAV?$Vector@G@2@XZ
?getUVs@MeshAttachment@spine@@QEAAAEAV?$Vector@M@2@XZ
??1String@spine@@UEAA@XZ
?update@AnimationState@spine@@QEAAXM@Z
?getWorldVerticesLength@VertexAttachment@spine@@QEAA_KXZ
?computeWorldVertices@VertexAttachment@spine@@QEAAXAEAVSlot@2@_K1PEAM11@Z
?rtti@RegionAttachment@spine@@2VRTTI@2@B
?getAttachment@Slot@spine@@QEAAPEAVAttachment@2@XZ
?getDarkColor@Slot@spine@@QEAAAEAVColor@2@XZ
?getColor@Slot@spine@@QEAAAEAVColor@2@XZ
?updateWorldTransform@Skeleton@spine@@QEAAXXZ
?getBone@Slot@spine@@QEAAAEAVBone@2@XZ
??1Skeleton@spine@@UEAA@XZ
??0Skeleton@spine@@QEAA@PEAVSkeletonData@1@@Z
?getData@Slot@spine@@QEAAAEAVSlotData@2@XZ
??0Color@spine@@QEAA@AEBV01@@Z
??4Color@spine@@QEAAAEAV01@AEBV01@@Z
??1Color@spine@@UEAA@XZ
??0Color@spine@@QEAA@XZ
??1SpineObject@spine@@UEAA@XZ
??3SpineObject@spine@@SAXPEAX@Z
??2SpineObject@spine@@SAPEAX_K@Z
??0SpineObject@spine@@QEAA@XZ
??1SkeletonClipping@spine@@UEAA@XZ
??1AnimationStateData@spine@@UEAA@XZ
?getName@Skin@spine@@QEAAAEBVString@2@XZ
?getAnimationTime@TrackEntry@spine@@QEAAMXZ
??0SkeletonBinary@spine@@QEAA@PEAVAtlas@1@@Z
??1SkeletonBinary@spine@@UEAA@XZ
?readSkeletonData@SkeletonBinary@spine@@QEAAPEAVSkeletonData@2@PEBEH@Z
??0AnimationState@spine@@QEAA@PEAVAnimationStateData@1@@Z
??1AnimationState@spine@@UEAA@XZ
?setAnimation@AnimationState@spine@@QEAAPEAVTrackEntry@2@_KPEAVAnimation@2@_N@Z
?getY@SkeletonData@spine@@QEAAMXZ
?getColor@RegionAttachment@spine@@QEAAAEAVColor@2@XZ
?getUVs@RegionAttachment@spine@@QEAAAEAV?$Vector@M@2@XZ
?getDrawOrder@Skeleton@spine@@QEAAAEAV?$Vector@PEAVSlot@spine@@@2@XZ
?getColor@Skeleton@spine@@QEAAAEAVColor@2@XZ
?rtti@MeshAttachment@spine@@2VRTTI@2@B
?rtti@ClippingAttachment@spine@@2VRTTI@2@B
?clipStart@SkeletonClipping@spine@@QEAA_KAEAVSlot@2@PEAVClippingAttachment@2@@Z
?clipEnd@SkeletonClipping@spine@@QEAAXXZ
?clipEnd@SkeletonClipping@spine@@QEAAXAEAVSlot@2@@Z
?clipTriangles@SkeletonClipping@spine@@QEAAXPEAMPEAG_K02@Z
?isClipping@SkeletonClipping@spine@@QEAA_NXZ
?getCurrent@AnimationState@spine@@QEAAPEAVTrackEntry@2@_K@Z
?getClippedVertices@SkeletonClipping@spine@@QEAAAEAV?$Vector@M@2@XZ
?getClippedTriangles@SkeletonClipping@spine@@QEAAAEAV?$Vector@G@2@XZ
?getClippedUVs@SkeletonClipping@spine@@QEAAAEAV?$Vector@M@2@XZ
?isExactly@RTTI@spine@@QEBA_NAEBV12@@Z
??0String@spine@@QEAA@PEBD_N@Z
?apply@AnimationState@spine@@QEAA_NAEAVSkeleton@2@@Z
freetype
FT_Get_Glyph
FT_Done_Glyph
FT_Glyph_To_Bitmap
FT_Stroker_New
FT_Set_Char_Size
FT_Get_Char_Index
FT_New_Face
FT_Stroker_Set
FT_Glyph_StrokeBorder
FT_Init_FreeType
FT_Done_Face
FT_Load_Glyph
FT_Bitmap_Done
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
__std_exception_copy
__std_terminate
strstr
memset
memcmp
memchr
memmove
memcpy
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_errno
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
terminate
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_register_onexit_function
_crt_atexit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__stdio_common_vsscanf
ferror
fclose
fseek
__p__commode
fgetc
fwrite
fopen_s
ungetc
feof
_set_fmode
fread
__stdio_common_vsprintf_s
api-ms-win-crt-string-l1-1-0
strncmp
strcmp
strncpy
strcspn
strspn
api-ms-win-crt-heap-l1-1-0
malloc
free
realloc
calloc
_callnewh
_set_new_mode
api-ms-win-crt-time-l1-1-0
_ftime64
api-ms-win-crt-convert-l1-1-0
strtoul
atof
strtol
api-ms-win-crt-math-l1-1-0
ldexp
powf
__setusermatherr
sinf
cosf
cos
ceilf
atan
sqrtf
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
gdi32
SwapBuffers
SetPixelFormat
DescribePixelFormat
ChoosePixelFormat
CreateDIBSection
DeleteObject
CreateRectRgn
CreateBitmap
SetDeviceGammaRamp
GetDeviceGammaRamp
GetDeviceCaps
DeleteDC
CreateDCW
shell32
DragFinish
DragQueryPoint
DragQueryFileW
DragAcceptFiles
Sections
.text Size: 424KB - Virtual size: 423KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 236KB - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ