d:\DriverGeniusDev\drivergenius_en\trunk\product\win32\wdcupdate.pdb
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8590c2c172f7a5a75bbd02d67b9a19f0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
8590c2c172f7a5a75bbd02d67b9a19f0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
8590c2c172f7a5a75bbd02d67b9a19f0_NeikiAnalytics.exe
-
Size
658KB
-
MD5
8590c2c172f7a5a75bbd02d67b9a19f0
-
SHA1
454c837383cd5ccb520e5d9d92a8abacb1223d57
-
SHA256
15d8f3f3145ce5a029e9c23a3d3f314d4f3ad5d4d1cfe77ca0696471d267ffc6
-
SHA512
e87fb9d6f62671e3e653ea9f154a72996329771b835001f46d66d13ecd9d576c3679fa591afcd59bc4319e354b638d265766790272589d8db0873dd1b4cd1043
-
SSDEEP
6144:8xbxjObLHk5Qg2AswFNclX0Nw+FOCBXcbsAlDZu736KxJga5h6g4hlOBODozN6Mi:8ObLqjf2XRlDu5r2UFXLdieyS2
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8590c2c172f7a5a75bbd02d67b9a19f0_NeikiAnalytics.exe
Files
-
8590c2c172f7a5a75bbd02d67b9a19f0_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
0da92b07c787751efe7fbeebee216384
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
cactus
?ExtractFileName@Path@cactus@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z
duilib
?GetString@CPaintManagerUI@DuiLib@@SA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@PB_W@Z
?Close@CWindowWnd@DuiLib@@QAEXI@Z
??0CDuiString@DuiLib@@QAE@ABV01@@Z
??1CDuiString@DuiLib@@QAE@XZ
?ShowWindow@CWindowWnd@DuiLib@@QAEX_N0@Z
?SetDefaultFont@CPaintManagerUI@DuiLib@@QAEXPB_WH_N11@Z
?SetBkImage@CControlUI@DuiLib@@QAEXPB_W@Z
?PostMessageW@CWindowWnd@DuiLib@@QAEJIIJ@Z
?GetPlugins@CPaintManagerUI@DuiLib@@SAPAVCStdPtrArray@2@XZ
?GetAt@CStdPtrArray@DuiLib@@QBEPAXH@Z
??0CDuiString@DuiLib@@QAE@PB_WH@Z
?messageMap@WindowImplBase@DuiLib@@1UDUI_MSGMAP@2@B
?OnCreate@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
??BCWindowWnd@DuiLib@@QBEPAUHWND__@@XZ
?HandleMessage@WindowImplBase@DuiLib@@UAEJIIJ@Z
?CreateControl@WindowImplBase@DuiLib@@UAEPAVCControlUI@2@PB_W@Z
?MessageHandler@WindowImplBase@DuiLib@@UAEJIIJAA_N@Z
?Notify@WindowImplBase@DuiLib@@UAEXAAUtagTNotifyUI@2@@Z
?GetMessageMap@WindowImplBase@DuiLib@@MBEPBUDUI_MSGMAP@2@XZ
?GetStyle@WindowImplBase@DuiLib@@UAEJXZ
?HandleCustomMessage@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnMouseMove@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnLButtonUp@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnLButtonDown@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnSetFocus@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnKillFocus@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnKeyDown@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnSysCommand@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnChar@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnSize@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnMouseHover@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnMouseWheel@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnGetMinMaxInfo@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnNcHitTest@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnNcPaint@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnNcCalcSize@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnNcActivate@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnDestroy@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnClose@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?GetSizeBox@CPaintManagerUI@DuiLib@@QAEAAUtagRECT@@XZ
?SetValue@CProgressUI@DuiLib@@QAEXH@Z
?GetCurSel@CTabLayoutUI@DuiLib@@QBEHXZ
?SelectItem@CTabLayoutUI@DuiLib@@QAE_NH@Z
?GetWidth@CDuiRect@DuiLib@@QBEHXZ
?GetHeight@CDuiRect@DuiLib@@QBEHXZ
??0CDuiRect@DuiLib@@QAE@XZ
?GetInstance@CPaintManagerUI@DuiLib@@SAPAUHINSTANCE__@@XZ
?LoadPlugin@CPaintManagerUI@DuiLib@@SA_NPB_W@Z
?SetStringLang@CPaintManagerUI@DuiLib@@SAXPB_W@Z
?LoadStringW@CPaintManagerUI@DuiLib@@SAXPB_W0@Z
?SetResourceDll@CPaintManagerUI@DuiLib@@SAXPAUHINSTANCE__@@@Z
?SetInstance@CPaintManagerUI@DuiLib@@SAXPAUHINSTANCE__@@@Z
?MessageLoop@CPaintManagerUI@DuiLib@@SAXXZ
?GetResourceID@WindowImplBase@DuiLib@@UBEPB_WXZ
?GetZIPFileName@WindowImplBase@DuiLib@@UBE?AVCDuiString@2@XZ
?GetResourceType@WindowImplBase@DuiLib@@UBE?AW4UILIB_RESOURCETYPE@2@XZ
?ResponseDefaultKeyEvent@WindowImplBase@DuiLib@@MAEJI@Z
?OnClick@WindowImplBase@DuiLib@@MAEXAAUtagTNotifyUI@2@@Z
?GetHWND@CWindowWnd@DuiLib@@QBEPAUHWND__@@XZ
?CenterWindow@CWindowWnd@DuiLib@@QAEXXZ
?SetIcon@CWindowWnd@DuiLib@@QAEXI@Z
?Create@CWindowWnd@DuiLib@@QAEPAUHWND__@@PAU3@PB_WKKHHHHPAUHMENU__@@@Z
?InitWindow@WindowImplBase@DuiLib@@UAEXXZ
?OnFinalMessage@WindowImplBase@DuiLib@@UAEXPAUHWND__@@@Z
?GetClassStyle@WindowImplBase@DuiLib@@UBEIXZ
?GetSuperClassName@CWindowWnd@DuiLib@@MBEPB_WXZ
??0WindowImplBase@DuiLib@@QAE@XZ
??1WindowImplBase@DuiLib@@UAE@XZ
?GetLangCount@CPaintManagerUI@DuiLib@@SAHXZ
?GetLangInfo@CPaintManagerUI@DuiLib@@SAPAUtagTLangInfo@2@H@Z
??BCDuiString@DuiLib@@QBEPB_WXZ
?FindControl@CPaintManagerUI@DuiLib@@QBEPAVCControlUI@2@PB_W@Z
wdcctrl
?Rotate@CDGRotateImgUI@@QAEX_N@Z
libcurl
curl_easy_cleanup
curl_easy_init
curl_slist_free_all
curl_easy_getinfo
curl_easy_setopt
curl_slist_append
curl_easy_perform
patchcore
ord340
kernel32
GetLocaleInfoA
GetACP
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedExchange
InterlockedCompareExchange
GetThreadLocale
GetProcessHeap
LocalFree
FormatMessageA
GetStartupInfoW
GetExitCodeThread
GetDiskFreeSpaceExW
GetCurrentProcessId
CreateThread
MoveFileW
GetLocalTime
TerminateProcess
ExpandEnvironmentStringsW
Module32FirstW
Module32NextW
OpenProcess
GetLogicalDriveStringsW
QueryDosDeviceW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
lstrlenA
CreateProcessW
MoveFileExW
GetPrivateProfileIntW
GetPrivateProfileStringW
SetFileAttributesW
FreeResource
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
lstrlenW
GetLastError
MultiByteToWideChar
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
CloseHandle
ReadFile
SetFilePointer
GetFileSize
CreateFileW
WriteFile
WideCharToMultiByte
GetModuleFileNameW
CreateDirectoryW
GetFileAttributesW
RemoveDirectoryW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
CopyFileW
GetSystemDirectoryW
GetCurrentProcess
GetProcAddress
GetModuleHandleW
Sleep
LoadLibraryW
SetEvent
GetCurrentThreadId
WaitForSingleObject
ResetEvent
CreateEventW
RaiseException
WritePrivateProfileStringW
CreateMutexW
InterlockedIncrement
InterlockedDecrement
MapViewOfFile
OpenFileMappingW
GetSystemDefaultLangID
MapViewOfFileEx
CreateFileMappingW
UnmapViewOfFile
FreeLibrary
GetTickCount
InitializeCriticalSection
user32
ShowWindow
CreateWindowExW
DefWindowProcW
LoadCursorW
RegisterClassExW
ScreenToClient
GetClientRect
IsZoomed
PtInRect
KillTimer
PostQuitMessage
DestroyWindow
IsWindow
IsWindowVisible
GetWindowLongW
SetWindowPos
GetWindowRect
InvalidateRect
MoveWindow
FindWindowW
FindWindowExW
ExitWindowsEx
GetWindowThreadProcessId
SetForegroundWindow
SendMessageW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
GetWindowRgn
GetParent
UnregisterClassA
EnumWindows
PostMessageW
gdi32
DeleteDC
SelectObject
DeleteObject
CreateRectRgn
PtInRegion
CreateCompatibleDC
CreateDIBSection
advapi32
SetSecurityDescriptorDacl
OpenSCManagerW
OpenServiceW
StartServiceW
CloseServiceHandle
RegOpenKeyExA
RegQueryValueExA
InitializeSecurityDescriptor
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SystemTimeToVariantTime
VariantTimeToSystemTime
msvcp80
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?width@ios_base@std@@QAEHH@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?eof@?$char_traits@D@std@@SAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBEHXZ
?length@?$char_traits@D@std@@SAIPBD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??0?$allocator@_W@std@@QAE@XZ
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
??0?$allocator@_W@std@@QAE@ABV01@@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
?max_size@?$allocator@_W@std@@QBEIXZ
??_D?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W0@Z
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z
?to_int_type@?$char_traits@_W@std@@SAGAB_W@Z
?thousands_sep@?$numpunct@_W@std@@QBE_WXZ
?grouping@?$numpunct@_W@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??1locale@std@@QAE@XZ
??8locale@std@@QBE_NABV01@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?good@ios_base@std@@QBE_NXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?classic@locale@std@@SAABV12@XZ
??0locale@std@@QAE@XZ
?to_char_type@?$char_traits@_W@std@@SA_WABG@Z
??1_Lockit@std@@QAE@XZ
?_Register@facet@locale@std@@QAEXXZ
?_Incref@facet@locale@std@@QAEXXZ
?_Getcat@?$numpunct@_W@std@@SAIPAPBVfacet@locale@2@@Z
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
??Bid@locale@std@@QAEIXZ
?id@?$numpunct@_W@std@@2V0locale@2@A
??0_Lockit@std@@QAE@H@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEPADXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
msvcr80
fclose
_wfopen_s
??_V@YAXPAX@Z
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
__CxxFrameHandler3
strlen
ftell
fseek
strerror
tolower
memset
_wcsicmp
wcslen
memcpy_s
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
memmove_s
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
wcschr
wcspbrk
_wcslwr_s
wcscmp
_wtol
wcsncpy
wcstok
wcsstr
iswspace
wcscpy_s
vsprintf_s
_vscwprintf
vswprintf_s
free
wcsncpy_s
malloc
_waccess
_beginthreadex
??0exception@std@@QAE@ABQBDH@Z
memcpy
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
_wtoi
strtol
_local_unwind4
_wrename
fwrite
_wcsnicmp
ceil
wcstol
calloc
_recalloc
_vscprintf
_vswprintf
setlocale
_wfopen
rand
srand
wcscat
wcscat_s
sqrt
_wtof
_wtoi64
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_wcslwr
wcsrchr
shlwapi
PathFileExistsW
ws2_32
WSACleanup
WSAStartup
inet_ntoa
closesocket
gethostbyname
inet_addr
socket
psapi
GetModuleFileNameExW
zlib
uncompress
iphlpapi
IcmpSendEcho
IcmpCloseHandle
IcmpCreateFile
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
Sections
.text Size: 332KB - Virtual size: 329KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 88KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 216KB - Virtual size: 216KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE