Static task
static1
Behavioral task
behavioral1
Sample
89c35d9a4d236a4602e81d7a08dfd785ae502f2f7099041f63943ada113ca895.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
89c35d9a4d236a4602e81d7a08dfd785ae502f2f7099041f63943ada113ca895.exe
Resource
win10v2004-20231215-en
General
-
Target
89c35d9a4d236a4602e81d7a08dfd785ae502f2f7099041f63943ada113ca895
-
Size
9.6MB
-
MD5
946a784d1370b77b99e9edd7c4eda40d
-
SHA1
548a32a7def293daaf3daaf9f9b7248ca3e62e82
-
SHA256
89c35d9a4d236a4602e81d7a08dfd785ae502f2f7099041f63943ada113ca895
-
SHA512
af07004279d32a2cbf59347f93fcd0a6261642c630890f7ab6480e957fd1a5dc8bc4d75ce8ab6f55ab0a07898115bc016bcb1a88e9b51b2950d2092d9204860d
-
SSDEEP
98304:HohhYyYAxjV2kkBoCwiVzT/A9XWKFTqk2FfkvhLoHGMhgVwOHwQy:HoptTH1zifhTQy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 89c35d9a4d236a4602e81d7a08dfd785ae502f2f7099041f63943ada113ca895
Files
-
89c35d9a4d236a4602e81d7a08dfd785ae502f2f7099041f63943ada113ca895.exe windows:6 windows x86 arch:x86
8c151f6300ff370d683c44a439e9a4bf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLogicalDriveStringsA
CreateThread
GetHandleInformation
IsBadCodePtr
VirtualQuery
GetFullPathNameA
FindNextFileA
K32GetModuleFileNameExA
K32GetProcessImageFileNameA
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateDirectoryA
GetLocalTime
SetFileAttributesA
MultiByteToWideChar
GetModuleFileNameA
ReadProcessMemory
Module32First
Module32Next
CreateFileA
GetFileSize
WriteConsoleW
HeapQueryInformation
HeapSize
PeekConsoleInputA
ReadConsoleInputW
GetNumberOfConsoleInputEvents
SetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
ReadConsoleW
GetFileSizeEx
GetConsoleMode
ReadFile
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
FindFirstFileA
FindClose
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
UnlockFileEx
LockFileEx
HeapCompact
CreateProcessW
FlushFileBuffers
SetStdHandle
FreeLibraryAndExitThread
ResumeThread
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetModuleHandleExW
ExitProcess
MoveFileA
GetPrivateProfileStringA
lstrlenA
GlobalFree
CreateMutexA
ReleaseMutex
DeleteFileA
GetCurrentDirectoryA
GetTickCount
GetCurrentDirectoryW
TerminateThread
K32GetModuleInformation
GetModuleHandleA
K32QueryWorkingSetEx
VerifyVersionInfoW
VirtualProtect
VirtualAlloc
VerSetConditionMask
Sleep
LoadLibraryA
GetProcAddress
WTSGetActiveConsoleSessionId
UnregisterWait
RegisterWaitForSingleObject
OpenProcess
GetCurrentThread
GetCurrentProcessId
OpenThread
GetDriveTypeW
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
RtlUnwind
RaiseException
InterlockedFlushSList
InterlockedPushEntrySList
K32GetMappedFileNameA
GetComputerNameA
GetThreadTimes
FlushViewOfFile
GetStdHandle
ExpandEnvironmentStringsW
ResetEvent
SetConsoleCtrlHandler
GetACP
GetExitCodeProcess
GenerateConsoleCtrlEvent
GetProcessTimes
MoveFileW
GetSystemTime
GetFileType
CreateProcessA
SystemTimeToFileTime
SetEnvironmentVariableA
SetCurrentDirectoryW
DeleteFileW
GetFileAttributesExW
SetFileAttributesW
SetCurrentDirectoryA
GetVersion
DuplicateHandle
GetFileAttributesW
GetEnvironmentVariableA
CreatePipe
SetEnvironmentVariableW
SetFileTime
RemoveDirectoryW
FindNextFileW
GetFullPathNameW
GetFileAttributesExA
FindFirstFileW
CreateDirectoryW
SetErrorMode
LoadLibraryExA
CreateEventA
TlsFree
TlsGetValue
GetProcessHeap
HeapAlloc
TlsAlloc
SetEvent
WaitForSingleObject
SetLastError
HeapFree
TlsSetValue
SetEndOfFile
IsDBCSLeadByte
OutputDebugStringW
GetConsoleCP
GetConsoleOutputCP
GetFileInformationByHandle
GetModuleFileNameW
WaitNamedPipeW
CreateFileW
PeekNamedPipe
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
InitializeSListHead
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
GetLocaleInfoEx
LocalFree
CreateSymbolicLinkW
GetFileInformationByHandleEx
GetModuleHandleW
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
InitOnceExecuteOnce
InitializeSRWLock
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTempPathW
SetFileInformationByHandle
InitializeCriticalSectionEx
GetStringTypeW
GetCurrentThreadId
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FormatMessageA
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
SetFilePointer
WinExec
SetUnhandledExceptionFilter
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetSystemInfo
OutputDebugStringA
AllocConsole
GlobalAlloc
QueryDosDeviceA
SetFilePointerEx
GetCurrentProcess
GetLastError
CloseHandle
IsBadReadPtr
GetFileAttributesA
user32
GetKeyboardLayout
GetKeyboardLayoutNameA
LoadCursorA
AdjustWindowRectEx
GetWindowRect
SetWindowTextA
GetMenu
RegisterClassA
CharPrevExA
CharNextExA
GetWindowLongA
UpdateWindow
SetFocus
MoveWindow
DestroyWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
TranslateMessage
DispatchMessageA
SetWinEventHook
UnhookWinEvent
GetWindowModuleFileNameA
PeekMessageA
GetDC
MessageBoxA
LoadStringA
BeginPaint
OffsetRect
SetRect
ReleaseDC
SetTimer
KillTimer
IsWindowUnicode
FillRect
GetClientRect
InvalidateRect
EndPaint
CloseClipboard
GetClipboardData
CharNextW
CharPrevA
SendMessageW
DefWindowProcW
UnregisterClassW
RegisterClassExW
CreateWindowExW
LoadImageW
GetMessageA
IsWindow
SetWindowLongA
SetWindowLongW
GetWindowThreadProcessId
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetRawInputData
RegisterRawInputDevices
PostQuitMessage
SendMessageA
FlashWindowEx
SetWindowPos
GetAsyncKeyState
GetCursorPos
ScreenToClient
FindWindowA
LoadIconA
DestroyIcon
SystemParametersInfoA
GetKeyState
ShowCursor
SetCursor
DestroyCursor
LoadImageA
SetCursorPos
ClientToScreen
ShowWindow
GetCapture
SetCapture
ReleaseCapture
CreatePopupMenu
DestroyMenu
InsertMenuA
TrackPopupMenu
SetForegroundWindow
ChangeDisplaySettingsA
GetSystemMetrics
OpenClipboard
gdi32
CreateDIBSection
GetTextExtentPoint32A
SetDIBitsToDevice
SetBkMode
DeleteDC
CreateCompatibleDC
TextOutW
SetTextColor
SetBkColor
SelectObject
GetTextExtentPoint32W
GetCharABCWidthsFloatW
CreateFontIndirectA
GetStockObject
EnumFontFamiliesExA
CreateSolidBrush
StretchBlt
PatBlt
DeleteObject
TextOutA
advapi32
RegOpenKeyExA
CryptAcquireContextA
RegCreateKeyA
RegSetValueA
RegDeleteKeyA
RegCreateKeyExA
RegFlushKey
RegQueryValueA
RegSetValueExA
RegLoadKeyA
RegQueryInfoKeyA
RegEnumValueA
RegDeleteValueA
RegConnectRegistryA
RegSaveKeyA
RegEnumKeyExA
CryptReleaseContext
RegCreateKeyExW
RegSetValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityInfo
SetKernelObjectSecurity
RegCloseKey
CryptGenRandom
RegQueryValueExA
RegQueryValueExW
RegOpenKeyExW
shell32
Shell_NotifyIconA
SHGetSpecialFolderPathA
ShellExecuteW
ShellExecuteA
ole32
CoGetClassObject
OleInitialize
OleUninitialize
OleSetContainedObject
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SafeArrayGetLBound
SafeArrayGetUBound
SysStringLen
SysAllocString
SafeArrayCreate
SafeArrayDestroy
SafeArrayAccessData
VariantInit
VariantClear
SysFreeString
winmm
timeGetDevCaps
timeGetTime
timeEndPeriod
timeBeginPeriod
wtsapi32
WTSSendMessageA
netapi32
Netbios
imm32
ImmIsIME
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetIMEFileNameA
ImmGetConversionStatus
ImmSetConversionStatus
ImmGetOpenStatus
ImmNotifyIME
ImmGetCandidateListW
devil
ilLoad
ilConvertImage
ilCopyPixels
ilEnable
ilGenImages
ilShutDown
ilSave
ilSetPixels
ilTexImage
ilInit
ilDeleteImages
ilBindImage
ilGetInteger
ilOriginFunc
libconfig++
?getPath@SettingException@libconfig@@QBEPBDXZ
??4Setting@libconfig@@QAEAAV01@AB_J@Z
??4Setting@libconfig@@QAEAAV01@PBD@Z
??4Setting@libconfig@@QAEAAV01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??ASetting@libconfig@@QBEAAV01@PBD@Z
??ASetting@libconfig@@QBEAAV01@H@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAA_J@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?add@Setting@libconfig@@QAEAAV12@W4Type@12@@Z
?add@Setting@libconfig@@QAEAAV12@PBDW4Type@12@@Z
?getLength@Setting@libconfig@@QBEHXZ
??0Config@libconfig@@QAE@XZ
??1Config@libconfig@@UAE@XZ
?readFile@Config@libconfig@@QAEXPBD@Z
?writeFile@Config@libconfig@@QAEXPBD@Z
?getRoot@Config@libconfig@@QBEAAVSetting@2@XZ
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
imagehlp
GetTimestampForLoadedLibrary
EnumerateLoadedModules
StackWalk
granny2
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannySetLogCallback@4
_GrannyGetMaterialTextureByType@8
_GrannyFindMatchingMember@16
_GrannyConvertSingleObject@20
_GrannyGetSourceSkeleton@4
_GrannySetModelClock@8
_GrannyFreeCompletedModelControls@4
_GrannySampleModelAnimationsAccelerated@20
_GrannyUpdateModelMatrix@20
_GrannyNewLocalPose@4
_GrannyFreeLocalPose@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyInstantiateModel@4
_GrannyFreeModelInstance@4
_GrannyNewMeshBinding@12
_GrannyFreeMeshBinding@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFindBoneByName@12
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyGetSourceModel@4
_GrannyFindTrackGroupForModel@12
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyBeginControlledAnimation@8
_GrannyEndControlledAnimation@4
_GrannySetTrackGroupTarget@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
GrannyPNT332VertexType
_GrannyGetFileInfo@4
_GrannySetTrackGroupLOD@16
_GrannyFreeControlIfComplete@4
mss32
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_update_3D_position@8
_AIL_auto_update_3D_position@8
_AIL_mem_free_lock@4
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
speedtreert
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
??1CSpeedTreeRT@@QAE@XZ
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
??3CSpeedTreeRT@@SAXPAX@Z
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?DeleteTransientData@CSpeedTreeRT@@QAEXXZ
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
??2CSpeedTreeRT@@SAPAXI@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
dinput8
DirectInput8Create
ws2_32
socket
send
closesocket
__WSAFDIsSet
setsockopt
select
recv
gethostname
gethostbyname
WSAGetLastError
WSAStartup
ioctlsocket
WSACleanup
htonl
connect
ntohs
ntohl
inet_addr
htons
ddraw
DirectDrawCreate
d3dx9_43
D3DXVec3TransformCoord
D3DXVec3Normalize
D3DXQuaternionRotationYawPitchRoll
D3DXPlaneNormalize
D3DXQuaternionRotationAxis
D3DXMatrixRotationZ
D3DXMatrixRotationY
D3DXCreateTextureFromFileInMemoryEx
D3DXVec3Transform
D3DXMatrixTranspose
D3DXGetFVFVertexSize
D3DXCreateTexture
D3DXCreateCylinder
D3DXCreateMatrixStack
D3DXMatrixOrthoOffCenterRH
D3DXMatrixOrthoRH
D3DXMatrixPerspectiveFovRH
D3DXMatrixLookAtRH
D3DXMatrixDeterminant
D3DXVec2Normalize
D3DXMatrixScaling
D3DXVec3Unproject
D3DXVec3Project
D3DXVec4Transform
D3DXMatrixRotationAxis
D3DXVec3TransformNormal
D3DXMatrixRotationX
D3DXCreateSphere
D3DXLoadSurfaceFromSurface
D3DXMatrixRotationQuaternion
D3DXMatrixTranslation
D3DXMatrixInverse
D3DXMatrixRotationYawPitchRoll
D3DXQuaternionMultiply
D3DXMatrixMultiply
d3d9
Direct3DCreate9
resource
PythonPlayerSettingsModuleLibRegisterFunctions
PythonPlayerSettingsModuleLibRegisterVariables
LoadGameNPC
RegisterSkill
GetHorsePathNameByMode
LoadPythonPlayerSettingsModuleLibrary
iphlpapi
GetAdaptersInfo
Sections
.text Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 454KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 287KB - Virtual size: 287KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ