D:\_build\7\Model Studio CS\Source\bin\VS16\Release NCAD24\x64\ChatLibraryARX.pdb
Static task
static1
Behavioral task
behavioral1
Sample
506e979490b8fd2a2933c082be6489704204e1022463781b6c2c4630114ed853.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
506e979490b8fd2a2933c082be6489704204e1022463781b6c2c4630114ed853.dll
Resource
win10v2004-20240426-en
General
-
Target
506e979490b8fd2a2933c082be6489704204e1022463781b6c2c4630114ed853
-
Size
293KB
-
MD5
d261384397a340eca0c2eb328baa9079
-
SHA1
413a4bc65812a9f1da1829a83b740cfd31090261
-
SHA256
506e979490b8fd2a2933c082be6489704204e1022463781b6c2c4630114ed853
-
SHA512
c5758aaa84fcd02bc2501471520c5c8465c1c772976785cc900cd64b4ffe9b7a21873d9001c60c1f834d58d3cb213e5a7c0adc599b54b6403c44d56b6e0515d2
-
SSDEEP
3072:oCGpCLb/i4eMEmTAZ+W24pYZFRmyZWqFUZRpxF7ASnb+iEKcBEhP7:oCG0GDYTTW24KZFRjJ0Dx9As+i0KR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 506e979490b8fd2a2933c082be6489704204e1022463781b6c2c4630114ed853
Files
-
506e979490b8fd2a2933c082be6489704204e1022463781b6c2c4630114ed853.dll windows:6 windows x64 arch:x64
58d0c3768a6f0afadc1c845b0de950ff
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
mstudiodata
??0CXMLSchemaInStream@@QEAA@PEAVCXMLSchema@@@Z
?Close@CXMLOutStream@@UEAAXXZ
?EndTable@CXMLOutStream@@UEAAHXZ
?Flush@CXMLAttrs@@QEAAXXZ
?BeginTable@CXMLOutStream@@UEAAHPEB_WPEAVCXMLAttrs@@@Z
?AddAttr@CXMLAttrs@@QEAAXPEB_WH@Z
??1CXMLAttrs@@UEAA@XZ
??0CXMLAttrs@@QEAA@XZ
?Create@CXMLOutStream@@QEAAHPEB_W@Z
??1CXMLOutStream@@UEAA@XZ
??0CXMLOutStream@@QEAA@XZ
?SetParameter@CParamsOwner@@QEAAXPEB_WH00@Z
??0CMStudioObject@@QEAA@XZ
?getValue@CParam@@QEBAPEB_WXZ
?GetParameter@CParamsOwner@@QEBAPEAVCParam@@PEB_W@Z
??_VCMStudioObject@@SAXPEAX@Z
??2CMStudioObject@@SAPEAX_K@Z
??3CMStudioObject@@SAXPEAX@Z
??1CMStudioObject@@UEAA@XZ
??1CXMLSchema@@UEAA@XZ
??1CXMLSchemaInStream@@UEAA@XZ
?SetParameter@CParamsOwner@@QEAAXPEB_WAEBU_GUID@@00@Z
?AddParameter@CParamsOwner@@QEAAPEAVCParam@@PEB_W000@Z
??0CParamDef@@QEAA@PEB_W0W4EParamDefType@@_NHHHH@Z
?GetParameterValue@CParamsOwner@@QEBAPEB_WPEB_W0@Z
??1CParamsOwner@@UEAA@XZ
??0CParamsOwner@@QEAA@XZ
??1CParamDef@@UEAA@XZ
?AddCategory@CParamDef@@QEAAXPEB_WIIII@Z
?Close@CODBCStatement@@UEAAXXZ
?UpdateState@CODBCBindings@@QEAAXPEAX@Z
?UpdateParamState@CODBCBindings@@QEAAXPEAX@Z
?GetParamData@CODBCBinding@@QEAAXPEAX@Z
?UnbindColumns@CODBCBinder@@SAXPEAX@Z
?ResetParams@CODBCBinder@@SAXPEAX@Z
?Exec@CODBCStatement@@QEAAXPEA_J@Z
?Prepare@CODBCStatement@@QEAAXXZ
??_UCMStudioObject@@SAPEAX_K@Z
?ExecDirect@CODBCStatement@@QEAAXPEA_J@Z
?Create@CODBCStatement@@QEAAXAEBVCODBCSession@@PEB_W@Z
?FetchNext@CODBCStatement@@IEAA_NXZ
?LogErrorMsg@CCSException@@SAXPEB_W@Z
??1CODBCStatement@@UEAA@XZ
??0CODBCStatement@@QEAA@XZ
?TryStringToGuid@CGUIDHelper@@SA_NPEB_WAEAU_GUID@@@Z
?BindItem@CODBCColumnBinder@@SAXPEAXAEAVCODBCBindings@@FFF_KF0_JPEAW4ODBCStatus@@FPEA_J@Z
??0CODBCException@@QEAA@PEB_W@Z
??1CCSException@@UEAA@XZ
?LoadArray@CXMLStreamableObject@@MEAAHAEAVCXMLSchemaInStream@@P6AHPEAV1@0HPEB_W2AEAVCXMLAttrs@@@Z@Z
?InitSchema@CXMLSchema@@IEAAXPEAUtagXMLTypedef@1@H@Z
?LoadFromXMLStream@CXMLStreamableObject@@QEAAHAEAVCXMLSchemaInStream@@@Z
?GetAttr@CXMLAttrs@@QEBA_NPEB_WAEAH@Z
?Open@CXMLSchemaInStream@@QEAAHPEB_WAEAVCXMLAttrs@@@Z
mstproject.nrx
?ShowDummies@CCSProjectModel@@QEAAX_NAEBV?$CIndirectArray@VCLibObjectInfo@@@@PEAV?$CSortedArray@V?$CIndexRecord@HVNcDbObjectId@@@@@@@Z
??0СCSProjectDBStateReactor@@QEAA@XZ
??1СCSProjectDBStateReactor@@UEAA@XZ
?GetPalettePtr@CMSProjectPalette@@SAPEAV1@XZ
?GlobalInst@CCSProjectModel@@SAAEAV1@XZ
?GetActiveDocument@CCSProjectModel@@QEAAPEAVCViewDocument@1@XZ
?GetEntInfo@CViewDocument@CCSProjectModel@@QEBAPEAVCDocEntityInfo@2@U_GUID@@_N@Z
mstudiodb
?LogoutCurrentUser@CLibDatabase@@QEAAXXZ
??0CProjectSettingsObject@@QEAA@XZ
??1CProjectSettingsObject@@UEAA@XZ
?DefaultParamFileWasModified@CProjectSettingsObject@@UEAAXPEB_W@Z
?TryLoadDefaultParamsFromDb@CProjectSettingsObject@@UEAAPEAVCParamsDefault@@PEB_W@Z
?GetThisClass@CToolbarOwnerWnd@@SAPEAUCRuntimeClass@@XZ
?GetThisMessageMap@CToolbarOwnerWnd@@KAPEBUAFX_MSGMAP@@XZ
?InitializeToolbar@CToolbarOwnerWnd@@IEAAHAEAVCToolBarCtrl@@AEAVCImageList@@AEBVCRect@@HHH@Z
?LoginCurrentUser@CLibDatabase@@QEAAXJ@Z
?AddChatMessage@CLibDatabase@@QEAAHPEB_WH@Z
?GetLibraryObjectIdByGUID@CLibDatabase@@QEAAJAEBU_GUID@@@Z
?GetGraphicsData@CLibDatabase@@QEAAXPEB_WAEAV?$CIndirectArray@UCObjectGraphicsData@@@@@Z
?GetTooltipStringById@CToolbarOwnerWnd@@MEAAXIAEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
??0CLibDatabase@@QEAA@PEAVCParamDefs@@@Z
?SetFileParameters@CLibDatabase@@QEAAXPEBVCLibFileInfo@@AEBVCParamsOwner@@@Z
?GetFileByID@CLibDatabase@@QEAAPEAVCLibFileInfo@@J@Z
?CreateFileW@CLibDatabase@@QEAAJPEB_WJJ@Z
?SetFileContents@CLibDatabase@@QEAA_NJPEAXH@Z
?GetFileTypeByFileName@CLibDatabase@@QEAAJPEB_W@Z
?UpdateDbParameter@CLibDatabase@@QEAA_NPEAVCParamDef@@@Z
??1CLibDatabase@@UEAA@XZ
?GetFileParameters@CLibDatabase@@QEAA_NPEBVCLibFileInfo@@AEAVCParamsOwner@@PEAV?$CIndirectArray@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@@@Z
?GetFileByUID@CLibDatabase@@QEAAPEAVCLibFileInfo@@PEB_W@Z
?ConnectInternal@CLibDatabase@@QEAA_NPEB_W000H_N1@Z
?GetFileContents@CLibDatabase@@QEAAHJPEAEH@Z
?GetNewMessagessCount@CLibDatabase@@QEAAHXZ
?GetChatMessagesUnsafe@CLibDatabase@@QEAAHHAEAV?$CIndirectArray@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@@H@Z
?GetPersonsListAll@CLibDatabase@@QEAAHAEAV?$CIndirectArray@VCPersonInfo@@@@@Z
mstudioui
?GetYesNoVariants@CSettingsObject@@KAPEBQEB_WXZ
?GetSettingsFileName@CSettingsObject@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@_N@Z
?OnCustomEditOption@CSettingsObject@@UEAA_NHPEAXPEAVCWnd@@PEAVCParamDef@@AEAVCParamsOwner@@@Z
?GetDefaultParamsDlgData@CSettingsObject@@UEAA_NHAEAVCDefaultParamsDlgData@@@Z
?GetToolPaletteFilePath@CSettingsObject@@UEAA_NAEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?OnBeforeInit@CSettingsObject@@UEAA_NXZ
?GetToolbarButtonSize@CMStudioEnv@@SAHXZ
??0CIMGMenu@@QEAA@PEAVCWnd@@PEAVCImageList@@_N@Z
??1CIMGMenu@@UEAA@XZ
?AddCommand@CIMGMenu@@QEAAXHPEB_WHK_N@Z
?Track@CIMGMenu@@QEAAHAEBVCPoint@@I@Z
csurs.nrx
?GetStringResourcesInstance@CURSPaletteBase@@MEAAPEAUHINSTANCE__@@XZ
?CommandEnded@CURSPaletteBase@@UEAAXPEB_W@Z
?DocumentSaved@CURSPaletteBase@@UEAAHPEB_W@Z
?DocumentBecameCurrent@CURSPaletteBase@@UEAAHAEAV?$NcArray@VNcDbObjectId@@V?$HostObjectsAllocator@VNcDbObjectId@@@@@@@Z
?TrackModelSelection@CURSPaletteBase@@UEAAHAEAV?$NcArray@VNcDbObjectId@@V?$HostObjectsAllocator@VNcDbObjectId@@@@@@@Z
?OnSetActive@CURSPaletteBase@@UEAAXXZ
?Save@CURSPaletteBase@@UEAAHPEAUIUnknown@@@Z
?Load@CURSPaletteBase@@UEAAHPEAUIUnknown@@@Z
?GetPalette@CURSControlCenter@@SAPEAVCURSPaletteBase@@PEB_W0@Z
??1CURSPaletteBase@@UEAA@XZ
??0CURSPaletteBase@@QEAA@PEB_W@Z
?GetThisMessageMap@CURSPaletteBase@@KAPEBUAFX_MSGMAP@@XZ
?GetThisClass@CURSPaletteBase@@SAPEAUCRuntimeClass@@XZ
?ursPickfirstSelectItems@@YAXAEBV?$NcArray@VNcDbObjectId@@V?$HostObjectsAllocator@VNcDbObjectId@@@@@@@Z
?setViewTo@@YAXAEBV?$NcArray@VNcDbObjectId@@V?$HostObjectsAllocator@VNcDbObjectId@@@@@@_NN1@Z
?ursGetDescription@@YAHPEAVNcDbObject@@AEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H@Z
?GetObjectGUID@CCSXDataHelper@@SA?AU_GUID@@PEBVNcDbObject@@PEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?getSelObjectsList@@YAHAEAV?$NcArray@VNcDbObjectId@@V?$HostObjectsAllocator@VNcDbObjectId@@@@@@PEB_W1_N21@Z
?RemovePalette@CURSControlCenter@@SAXPEB_WPEAVCURSPaletteBase@@@Z
?AddPalette@CURSControlCenter@@SA_NPEB_WPEAVCURSPaletteBase@@@Z
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
mfc140u
ord1424
ord6313
ord528
ord5907
ord6603
ord2187
ord3089
ord2475
ord12782
ord3149
ord8507
ord4335
ord12706
ord2212
ord2514
ord4357
ord13199
ord1667
ord2921
ord489
ord1121
ord6006
ord3952
ord12240
ord1670
ord2415
ord3951
ord2431
ord9068
ord5237
ord2316
ord13864
ord1089
ord446
ord7882
ord5245
ord4343
ord4722
ord2703
ord13136
ord7394
ord8901
ord2697
ord13397
ord6000
ord3071
ord3307
ord3308
ord11085
ord11813
ord11854
ord6285
ord5755
ord10704
ord8731
ord1631
ord3726
ord4511
ord14027
ord8451
ord2350
ord2346
ord6262
ord1430
ord964
ord2149
ord12563
ord8409
ord12600
ord7167
ord973
ord1440
ord1700
ord10769
ord878
ord1369
ord554
ord1454
ord886
ord6549
ord12762
ord12967
ord361
ord1055
ord13761
ord14220
ord357
ord6250
ord4030
ord8501
ord8063
ord8468
ord3170
ord3276
ord12443
ord4510
ord2006
ord6588
ord7412
ord3776
ord6569
ord1402
ord5592
ord287
ord2414
ord13577
ord13580
ord8441
ord4086
ord6361
ord3803
ord2479
ord13999
ord4949
ord306
ord311
ord1034
ord4947
ord1671
ord7551
ord4721
ord2903
ord8161
ord286
ord280
ord296
ord4946
ord265
ord8449
ord1163
ord542
ord266
ord4181
ord1503
ord1489
ord1033
ord1491
ord8900
ord9946
ord7922
ord5227
ord7450
ord7461
ord7460
ord5916
ord5062
ord5229
ord5083
ord5582
ord5339
ord9041
ord5552
ord5363
ord5080
ord11850
ord3172
ord3278
ord3279
ord3812
ord11806
ord2629
ord5723
ord13354
ord11406
ord6631
ord14217
ord7651
ord14211
ord2967
ord4352
ord9384
ord4360
ord4828
ord4767
ord4752
ord4814
ord4859
ord4782
ord4837
ord4853
ord4794
ord4800
ord4806
ord4788
ord4843
ord4776
ord8826
ord3164
ord4095
ord6002
ord290
ord8452
ord285
ord5709
ord6320
ord3756
ord2270
ord1439
ord1149
ord1501
ord4656
ord1053
ord6251
ord8817
ord3056
ord4078
ord1057
ord6258
ord8819
ord3058
ord4081
ord8439
ord2906
ord3746
ord6724
ord990
ord11940
ord11944
ord13513
ord3173
ord8947
ord10691
ord6729
ord11902
ord8656
ord1755
ord1734
ord1748
ord1171
ord1722
ord14209
ord11625
ord3718
ord11771
ord8830
ord11415
ord11414
ord5451
ord9979
ord9975
ord9977
ord9978
ord9976
ord14360
ord2698
ord7913
ord3209
ord3212
ord7386
ord13401
ord3713
kernel32
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
FindResourceW
GetVersionExW
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleW
WaitForSingleObjectEx
TerminateProcess
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetCurrentProcess
InitializeSListHead
GetSystemTimeAsFileTime
EnterCriticalSection
DeleteCriticalSection
GetCurrentProcessId
CreateEventW
CloseHandle
ResumeThread
TerminateThread
SetEvent
WaitForSingleObject
ResetEvent
GetTempPathW
GetTempFileNameW
CreateFileW
WriteFile
OutputDebugStringW
LoadResource
LockResource
GetLastError
SizeofResource
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
lstrcpynW
GetPrivateProfileIntW
GetModuleFileNameW
VirtualQuery
GetCurrentThreadId
user32
LoadIconW
ClientToScreen
GetSysColor
IsWindowVisible
IsWindow
GetSysColorBrush
UpdateWindow
PostMessageW
InflateRect
GetCursorPos
EnableWindow
MonitorFromPoint
CopyRect
GetSystemMetrics
GetClientRect
GetDesktopWindow
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetClipboardData
CreatePopupMenu
AppendMenuW
CreateMenu
FindWindowW
ReleaseDC
GetDC
SendMessageW
SystemParametersInfoW
FillRect
GetWindowRect
GetMonitorInfoW
LoadStringW
gdi32
GetObjectW
GetBkColor
CreateFontIndirectW
GetTextExtentPoint32W
shell32
ShellExecuteW
comctl32
_TrackMouseEvent
ImageList_ReplaceIcon
shlwapi
ord214
ole32
ReleaseStgMedium
OleDuplicateData
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleSetContainedObject
OleCreateStaticFromData
CreateStreamOnHGlobal
StringFromIID
CoTaskMemFree
IIDFromString
nrxdbgate
??0CNcExtensionModule@@QEAA@XZ
?ncdbOpenNcDbObject@@YA?AW4ErrorStatus@Nano@@AEAPEAVNcDbObject@@VNcDbObjectId@@W4OpenMode@NcDb@@PEBVNcRxClass@@_N@Z
?append@?$NcArray@VNcDbObjectId@@V?$HostObjectsAllocator@VNcDbObjectId@@@@@@QEAAHAEBVNcDbObjectId@@@Z
??A?$NcArray@VNcDbObjectId@@V?$HostObjectsAllocator@VNcDbObjectId@@@@@@QEAAAEAVNcDbObjectId@@H@Z
?deleteNcRxClass@@YAXPEAVNcRxClass@@@Z
?ncrxBuildClassHierarchy@@YAXXZ
?isNull@NcDbObjectId@@QEBA_NXZ
?DetachInstance@CNcExtensionModule@@QEAAXXZ
?ncutPrintf@@YAHPEB_WZZ
?objectId@NcDbObject@@QEBA?AVNcDbObjectId@@XZ
??0?$NcArray@VNcDbObjectId@@V?$HostObjectsAllocator@VNcDbObjectId@@@@@@QEAA@HH@Z
?AttachInstance@CNcExtensionModule@@QEAAHPEAUHINSTANCE__@@@Z
??1?$NcArray@VNcDbObjectId@@V?$HostObjectsAllocator@VNcDbObjectId@@@@@@QEAA@XZ
?close@NcDbObject@@QEAA?AW4ErrorStatus@Nano@@XZ
?desc@NcDbEntity@@SAPEAVNcRxClass@@XZ
docbar
?GetMinimumSize@hostUiPalette@@UEAAHAEAVCSize@@@Z
?OnKillActive@hostUiPalette@@UEAAHXZ
?Create@hostUiPalette@@UEAAHPEAVhostUiPaletteSet@@@Z
?GetMaximumSize@hostUiPalette@@UEAAHAEAVCSize@@@Z
nrxhostgate
?ncedRegFunc@@YAHP6AHXZH@Z
?ncedDefun@@YAHPEB_WF@Z
?GetCommandStack@@YAPEAVNcEdCommandStack@@XZ
?ncadErrorStatusText@@YAPEB_WW4ErrorStatus@Nano@@@Z
?ncedGetFunCode@@YAHXZ
gdiplus
GdipCreateHBITMAPFromBitmap
GdipGetFamily
GdipDeleteFont
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilySansSerif
GdipGetGenericFontFamilyMonospace
GdipGetFamilyName
GdipCreateFromHDC
GdipGetImageHeight
GdipGetImageWidth
GdipSaveImageToStream
GdipGetImageRawFormat
GdipDrawImageRectI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipFree
GdipCreateBitmapFromFile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
__std_type_info_destroy_list
memmove
memset
__current_exception
__std_exception_destroy
__std_exception_copy
__std_terminate
wcsrchr
_CxxThrowException
__RTDynamicCast
__C_specific_handler
memcpy
api-ms-win-crt-convert-l1-1-0
_itow_s
_wtoi
_wtof
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll
terminate
_cexit
_initialize_narrow_environment
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-string-l1-1-0
wcscpy_s
wcscat_s
api-ms-win-crt-heap-l1-1-0
free
Exports
Exports
ncrxEntryPoint
Sections
.text Size: 93KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
NRXOBJ Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
NRXCMD Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
NDSSYMBO Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ