main
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Keyscape.dll
Resource
win7-20230831-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Keyscape.dll
Resource
win10v2004-20230915-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
Keyscape.dll
-
Size
27.8MB
-
MD5
62ca14386f00ead5690d17d510434f7a
-
SHA1
e192ad1ec2381df27b06a7271ca148a5689f774a
-
SHA256
b6d8b0149f6ed218a4a58ad46cf3e7c16c7ee3f6f29f33c5f9024c39c9407de5
-
SHA512
4756dca11a6bc1b37f8f8a39662f036ad05448d55201c6b7344fb3e56ace847a1ee7d640fd092d27da1e0664efb8c596a10268dea9698b176b7410c46154b76d
-
SSDEEP
393216:Sl/mdgpEuY82gK/p99gKFwaJ2JTzEy32jJY4SwHTuJP5id7sDGaaowW1wQZGOo:FngnBJTztyJY/wHUx2AqXtW1wQbo
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Keyscape.dll
Files
-
Keyscape.dll.dll windows:6 windows x64
c01ce4c138ff4d77c82b22c7bf8447cd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
uxtheme
GetThemePartSize
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
IsAppThemed
GetWindowTheme
GetCurrentThemeName
GetThemeColor
DrawThemeBackground
CloseThemeData
OpenThemeData
DrawThemeParentBackground
DrawThemeText
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
GetEnvironmentStringsW
IsValidCodePage
FindFirstFileExW
FindFirstFileExA
GetTimeZoneInformation
MoveFileExW
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
SetFilePointerEx
ReadConsoleW
GetConsoleCP
PeekNamedPipe
GetDriveTypeW
HeapValidate
SetStdHandle
GetCommandLineW
GetCommandLineA
HeapQueryInformation
FreeLibraryAndExitThread
VirtualQuery
GetSystemInfo
SetConsoleMode
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ResetEvent
RtlLookupFunctionEntry
ExitProcess
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
RtlPcToFileHeader
OutputDebugStringW
GetStringTypeW
LCMapStringW
FormatMessageW
TryEnterCriticalSection
VirtualFree
VirtualAlloc
WinExec
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateSemaphoreA
WaitForMultipleObjects
ExitThread
CreateThread
ReleaseSemaphore
GetLocalTime
GetModuleHandleExA
FindNextFileW
FindFirstFileW
CreateFileW
CreateDirectoryW
K32GetModuleBaseNameA
SetProcessWorkingSetSize
VirtualUnlock
VirtualLock
GlobalMemoryStatusEx
HeapWalk
GetProcessHeaps
RemoveDirectoryW
DeleteFileW
QueryPerformanceFrequency
FindNextFileA
RtlCaptureContext
CreateEventW
SetConsoleCtrlHandler
WaitForSingleObjectEx
LocalUnlock
LocalLock
GetUserDefaultLCID
ReplaceFileA
GetDiskFreeSpaceA
Sleep
SearchPathA
GetProfileIntA
GetTempFileNameA
GetTempPathA
VerifyVersionInfoA
VerSetConditionMask
FindResourceExW
GetCurrentDirectoryA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcpyA
GetACP
SetErrorMode
SystemTimeToTzSpecificLocalTime
LocalFileTimeToFileTime
GetFileTime
GetFileSizeEx
GetFileAttributesExA
GetFileAttributesA
FileTimeToLocalFileTime
GetCPInfo
GetOEMCP
VirtualProtect
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GetVersionExA
GetCurrentThread
GlobalFlags
GetStringTypeExA
GetVolumeInformationA
MoveFileA
lstrcmpiA
GetShortPathNameA
LoadLibraryExA
GetCurrentProcess
DuplicateHandle
UnlockFile
SetEndOfFile
ReadFile
LockFile
GetFullPathNameA
GetFileSize
FlushFileBuffers
FindFirstFileA
FindClose
DeleteFileA
GlobalFindAtomA
GlobalAddAtomA
FindResourceA
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
FreeResource
GetSystemDirectoryW
EncodePointer
GetThreadLocale
FileTimeToSystemTime
GetAtomNameA
GlobalGetAtomNameA
lstrcmpA
CompareStringA
GetModuleHandleA
ResumeThread
SuspendThread
SetThreadPriority
CreateEventA
SetEvent
FormatMessageA
MulDiv
GlobalSize
WideCharToMultiByte
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleFileNameA
LocalFree
LocalReAlloc
LocalAlloc
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GetModuleHandleExW
GetModuleFileNameW
SetLastError
OutputDebugStringA
FlushConsoleInputBuffer
GlobalMemoryStatus
LoadLibraryW
FreeLibrary
GetCurrentProcessId
QueryPerformanceCounter
MultiByteToWideChar
GetModuleHandleW
GetCurrentThreadId
GetFileType
GetStdHandle
RtlVirtualUnwind
SystemTimeToFileTime
CopyFileA
LoadLibraryA
SetFileAttributesW
GetProcAddress
GetWindowsDirectoryA
GetSystemDirectoryA
GetTickCount
GetSystemTime
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
WriteFile
SetFileTime
SetFilePointer
SetFileAttributesA
GetFileInformationByHandle
GetDiskFreeSpaceExA
CreateFileA
CreateMutexA
WaitForSingleObject
ReleaseMutex
CloseHandle
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
WriteConsoleW
TzSpecificLocalTimeToSystemTime
GetFileAttributesExW
GetConsoleMode
user32
LoadCursorW
InvertRect
HideCaret
EnableScrollBar
MessageBeep
GetIconInfo
DrawIconEx
LoadImageA
IsRectEmpty
DrawFocusRect
WindowFromPoint
ReleaseCapture
SetCapture
GetNextDlgGroupItem
GetDialogBaseUnits
KillTimer
SetTimer
DeleteMenu
SetCursor
ShowOwnedPopups
LoadImageW
InvalidateRect
TrackMouseEvent
IntersectRect
MapDialogRect
GetAsyncKeyState
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamA
PostQuitMessage
OffsetRect
SetRectEmpty
CopyImage
SystemParametersInfoA
InflateRect
GetMenuItemInfoA
DestroyMenu
FillRect
GetWindowDC
TabbedTextOutA
GrayStringA
DrawTextExA
DrawTextA
RealChildWindowFromPoint
GetDesktopWindow
ClientToScreen
CharUpperA
DestroyIcon
IsDialogMessageA
SetWindowTextA
ScrollWindowEx
SendDlgItemMessageA
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextA
SetDlgItemTextA
GetDlgItemInt
SetDlgItemInt
MoveWindow
ShowWindow
GetMonitorInfoA
MonitorFromWindow
WinHelpA
GetScrollInfo
SetScrollInfo
LoadIconW
LoadIconA
GetWindow
GetTopWindow
GetClassNameA
GetClassLongPtrA
GetClassLongA
SetWindowLongPtrA
GetWindowLongPtrA
SetWindowLongA
PtInRect
EqualRect
CopyRect
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
GetWindowRect
GetClientRect
RemovePropA
GetPropA
InSendMessage
MonitorFromRect
NotifyWinEvent
SetFocus
GetDlgCtrlID
SetPropA
ShowScrollBar
CreatePopupMenu
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetMenuDefaultItem
MapVirtualKeyA
GetKeyNameTextA
SetLayeredWindowAttributes
EnumDisplayMonitors
SetClassLongPtrA
SetWindowRgn
SetParent
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateA
DrawEdge
DrawFrameControl
GetDlgItem
SetWindowLongPtrW
GetWindowTextW
AppendMenuW
CreateWindowExW
SendMessageW
GetCursor
GetUpdateRgn
DrawTextW
GetMessageExtraInfo
GetClipboardData
wsprintfA
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
UnregisterClassA
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
GetDC
ReleaseDC
UnhookWindowsHookEx
SendMessageA
EnableWindow
IsWindowEnabled
MessageBoxA
GetWindowLongA
GetParent
GetWindowThreadProcessId
GetLastActivePopup
GetMenuStringA
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuA
AppendMenuA
RemoveMenu
GetMessageA
TranslateMessage
DispatchMessageA
PeekMessageA
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExA
CallNextHookEx
GetSystemMetrics
GetSysColor
GetSysColorBrush
LoadCursorA
GetWindowTextA
GetWindowTextLengthA
GetFocus
CheckMenuItem
DestroyWindow
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoA
LoadBitmapW
RegisterWindowMessageA
GetMessagePos
GetMessageTime
PostMessageA
DefWindowProcA
CallWindowProcA
RegisterClassA
GetClassInfoA
GetClassInfoExA
CreateWindowExA
IsWindow
IsZoomed
LoadMenuW
GetSystemMenu
BringWindowToTop
SetCursorPos
CopyIcon
FrameRect
DrawIcon
UnionRect
UpdateLayeredWindow
MonitorFromPoint
LoadAcceleratorsA
TranslateAcceleratorA
LoadMenuA
InsertMenuItemA
GetMenuBarInfo
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
PostThreadMessageA
WaitMessage
GetKeyboardLayout
IsCharLowerA
MapVirtualKeyExA
GetKeyboardState
ToAsciiEx
LoadAcceleratorsW
CreateAcceleratorTableA
DestroyAcceleratorTable
CopyAcceleratorTableA
SetRect
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuA
RegisterClipboardFormatA
CharUpperBuffA
IsClipboardFormatAvailable
GetUpdateRect
EnumChildWindows
DrawMenuBar
GetTabbedTextExtentW
GetTabbedTextExtentA
GetDCEx
DestroyCursor
GetWindowRgn
WindowFromDC
SendNotifyMessageA
CreateMenu
IsMenu
IsChild
SubtractRect
TranslateMDISysAccel
DefMDIChildProcA
GetScrollRange
DefFrameProcA
gdi32
CreateRectRgn
CreateSolidBrush
DeleteDC
Escape
ExcludeClipRect
GetClipBox
GetClipRgn
GetCurrentPositionEx
GetObjectType
GetPixel
GetStockObject
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
OffsetClipRgn
PlayMetaFile
PtVisible
RectVisible
RestoreDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkMode
SetMapperFlags
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextAlign
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
StartDocA
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
ExtCreatePen
MoveToEx
TextOutA
ExtTextOutA
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateFontIndirectA
GetTextExtentPoint32A
CreatePatternBrush
CreateRectRgnIndirect
GetMapMode
PatBlt
SetRectRgn
DPtoLP
GetTextMetricsA
EnumFontFamiliesExA
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
GetCurrentObject
CreateFontA
GetCharWidthA
StretchDIBits
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
CloseMetaFile
CreateMetaFileA
DeleteMetaFile
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextExtentPointA
GetTextExtentPoint32W
GetTextFaceA
CreatePen
CreateHatchBrush
CreateDIBPatternBrushPt
CreateCompatibleDC
BitBlt
GetObjectA
SetTextColor
SetBkColor
CreateBitmap
CreateDCA
CopyMetaFileA
GetObjectW
GetDIBits
GetRegionData
CreateFontIndirectW
GetDeviceCaps
DeleteObject
CombineRgn
SaveDC
CreateCompatibleBitmap
winspool.drv
DocumentPropertiesA
ClosePrinter
OpenPrinterA
GetJobA
advapi32
SetFileSecurityA
RegEnumValueA
GetUserNameA
RegQueryValueExA
RegSetValueExA
RegOpenKeyExW
RegEnumKeyExA
RegDeleteValueA
RegQueryValueA
RegOpenKeyExA
RegEnumKeyA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueA
RegCloseKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
GetFileSecurityA
shell32
ShellExecuteA
SHAddToRecentDocs
SHGetFileInfoA
ExtractIconA
SHGetFolderPathA
SHGetPathFromIDListA
SHCreateItemFromParsingName
ShellExecuteExA
SHAppBarMessage
SHBrowseForFolderA
SHGetMalloc
DragFinish
DragQueryFileA
SHGetDesktopFolder
SHGetSpecialFolderLocation
ole32
CoRevokeClassObject
CoRegisterClassObject
CoGetClassObject
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
OleQueryCreateFromData
OleQueryLinkFromData
CoGetMalloc
OleIsRunning
GetRunningObjectTable
CreateOleAdviseHolder
CreateDataAdviseHolder
GetHGlobalFromILockBytes
OleGetIconOfClass
OleSetContainedObject
OleSaveToStream
OleSave
OleLoad
OleCreateFromFile
OleCreateLinkToFile
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
OleCreate
WriteClassStm
CreateItemMoniker
CreateGenericComposite
StgCreateDocfileOnILockBytes
OleRegEnumVerbs
OleRegGetMiscStatus
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateILockBytesOnHGlobal
CreateFileMoniker
StgIsStorageFile
StgOpenStorageOnILockBytes
StgOpenStorage
StgCreateDocfile
OleLockRunning
OleSetMenuDescriptor
PropVariantCopy
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
CreateStreamOnHGlobal
CoInitializeEx
CoCreateGuid
CoInitialize
CoUninitialize
CLSIDFromString
CoCreateInstance
CoDisconnectObject
StringFromGUID2
SetConvertStg
OleRegGetUserType
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
WriteClassStg
ReadClassStg
CreateBindCtx
CoTreatAsClass
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
CoRegisterMessageFilter
CLSIDFromProgID
OleRun
oleaut32
SafeArrayDestroyData
SysStringByteLen
SysAllocStringByteLen
LoadTypeLi
LoadRegTypeLi
RegisterTypeLi
SysStringLen
SysAllocString
VariantInit
VarDecFromStr
VarBstrFromDec
VarBstrFromDate
VarBstrFromCy
VarCyFromStr
VarDateFromStr
VariantChangeType
VariantCopy
VariantClear
SafeArrayPtrOfIndex
SafeArrayCopy
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayRedim
SafeArrayDestroy
SysAllocStringLen
SafeArrayDestroyDescriptor
SafeArrayCreate
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SysReAllocStringLen
SysFreeString
shlwapi
PathRemoveExtensionA
PathIsUNCA
PathStripToRootA
PathFindExtensionA
PathRemoveFileSpecW
StrFormatKBSizeA
PathFindFileNameA
ws2_32
WSAStartup
oleacc
LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject
gdiplus
GdipSetSmoothingMode
GdipSetPixelOffsetMode
GdipSetTextRenderingHint
GdipSetPageUnit
GdipGetDpiY
GdipDrawLine
GdipDrawLines
GdipDrawRectangle
GdipDrawEllipse
GdipDrawPolygon
GdipDrawPath
GdipFillRectangle
GdipFillPolygon
GdipFillEllipse
GdipFillPath
GdipSetClipRectI
GdipGetFontHeightGivenDPI
GdipDrawString
GdipGetDC
GdipCreateHBITMAPFromBitmap
GdipResetPath
GdipClosePathFigure
GdipAddPathArcI
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipSetCompositingQuality
GdipGetImageWidth
GdipCloneBitmapAreaI
GdipSetPenDashStyle
GdipSetPenColor
GdipSetPenWidth
GdipDeletePen
GdipCreatePen1
GdipSetSolidFillColor
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArc
GdipDeletePath
GdipCreatePath
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipGetImageHeight
GdipReleaseDC
GdipCreateBitmapFromFileICM
GdipStringFormatGetGenericTypographic
GdipCreateBitmapFromStreamICM
msimg32
TransparentBlt
AlphaBlend
imm32
ImmGetContext
ImmGetOpenStatus
ImmReleaseContext
winmm
midiInGetNumDevs
midiInReset
midiInGetDevCapsA
midiInGetErrorTextA
timeGetTime
PlaySoundA
midiInStop
midiInStart
midiInAddBuffer
midiInUnprepareHeader
midiInPrepareHeader
midiInClose
midiInOpen
oledlg
ord8
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
wininet
InternetCheckConnectionA
Exports
Exports
Sections
.text Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11.4MB - Virtual size: 12.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 430KB - Virtual size: 429KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 139KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.giats Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ