c:\TEMP\tbb.2014_06_01T22_58_31+0400nntpat21-48_2\build\nntpat21-48_2vc10_64_mt_release\tbb.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1564840df4bafe43fbd6f39bb7347b3cdb0c61c19c1eb1fb064c3b23f0c0ee67_NeikiAnalytics.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1564840df4bafe43fbd6f39bb7347b3cdb0c61c19c1eb1fb064c3b23f0c0ee67_NeikiAnalytics.dll
Resource
win10v2004-20240611-en
General
-
Target
1564840df4bafe43fbd6f39bb7347b3cdb0c61c19c1eb1fb064c3b23f0c0ee67_NeikiAnalytics.exe
-
Size
428KB
-
MD5
a2d533c089059e1006f7a737d1e23aa0
-
SHA1
4557daa514ed5694909d34a1a962844f3895e9b0
-
SHA256
1564840df4bafe43fbd6f39bb7347b3cdb0c61c19c1eb1fb064c3b23f0c0ee67
-
SHA512
5278787abcf328d1b04cc3d6bf574543d126f1ef69014426ed8f28a282f4dfe60d6dd4813d82ecbac65953d2f01d3b9626234c16fd140e6252162d2452851491
-
SSDEEP
6144:k+lTY4CpZC7ir22Mt6ZvzJ8TXdtc1G/VOdZOkitPbCmdE4ndBMqIppqCzzaY4LET://FYFJOcEkZsn/MqIppXzzaYT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1564840df4bafe43fbd6f39bb7347b3cdb0c61c19c1eb1fb064c3b23f0c0ee67_NeikiAnalytics.exe
Files
-
1564840df4bafe43fbd6f39bb7347b3cdb0c61c19c1eb1fb064c3b23f0c0ee67_NeikiAnalytics.exe.dll windows:5 windows x64 arch:x64
9506d74404bf57e460ecacf91c81f273
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
SwitchToThread
CloseHandle
WaitForSingleObjectEx
SetEvent
GetProcAddress
GetModuleFileNameA
GetLastError
GetModuleHandleExA
FreeLibrary
LoadLibraryA
SetErrorMode
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
lstrcmpA
GetCurrentThreadId
GetEnvironmentVariableA
lstrcpynA
CreateSemaphoreW
ReleaseSemaphore
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
CreateEventA
QueryPerformanceFrequency
ResetEvent
SetLastError
QueryPerformanceCounter
Sleep
ResumeThread
FormatMessageA
GetCurrentThread
GetProcessAffinityMask
GetCurrentProcess
GetNativeSystemInfo
CreateEventW
DecodePointer
EncodePointer
RtlLookupFunctionEntry
RtlUnwindEx
RaiseException
RtlPcToFileHeader
HeapAlloc
HeapFree
ExitThread
CreateThread
GetModuleHandleW
ExitProcess
FlsSetValue
GetCommandLineA
WriteFile
GetStdHandle
GetModuleFileNameW
GetLocaleInfoW
FlsGetValue
FlsFree
FlsAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
FatalAppExitA
SetConsoleCtrlHandler
LoadLibraryW
SetHandleCount
GetFileType
GetStartupInfoW
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
WriteConsoleW
MultiByteToWideChar
SetFilePointer
SetStdHandle
CompareStringW
SetEnvironmentVariableA
LCMapStringW
GetStringTypeW
CreateFileW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
Exports
Exports
??0concurrent_queue_base@internal@tbb@@IEAA@_K@Z
??0concurrent_queue_base_v3@internal@tbb@@IEAA@_K@Z
??0concurrent_queue_iterator_base@internal@tbb@@IEAA@AEBVconcurrent_queue_base@12@@Z
??0concurrent_queue_iterator_base_v3@internal@tbb@@IEAA@AEBVconcurrent_queue_base_v3@12@@Z
??0concurrent_queue_iterator_base_v3@internal@tbb@@IEAA@AEBVconcurrent_queue_base_v3@12@_K@Z
??0pipeline@tbb@@QEAA@XZ
??1captured_exception@tbb@@UEAA@XZ
??1concurrent_queue_base@internal@tbb@@MEAA@XZ
??1concurrent_queue_base_v3@internal@tbb@@MEAA@XZ
??1concurrent_queue_iterator_base@internal@tbb@@IEAA@XZ
??1concurrent_queue_iterator_base_v3@internal@tbb@@IEAA@XZ
??1concurrent_vector_base_v3@internal@tbb@@IEAA@XZ
??1filter@tbb@@UEAA@XZ
??1pipeline@tbb@@UEAA@XZ
??1task_group_context@tbb@@QEAA@XZ
??_7pipeline@tbb@@6B@
?NFS_Allocate@internal@tbb@@YAPEAX_K0PEAX@Z
?NFS_Free@internal@tbb@@YAXPEAX@Z
?NFS_GetLineSize@internal@tbb@@YA_KXZ
?acquire@scoped_lock@queuing_mutex@tbb@@QEAAXAEAV23@@Z
?acquire@scoped_lock@queuing_rw_mutex@tbb@@QEAAXAEAV23@_N@Z
?add_filter@pipeline@tbb@@QEAAXAEAVfilter@2@@Z
?advance@concurrent_queue_iterator_base@internal@tbb@@IEAAXXZ
?advance@concurrent_queue_iterator_base_v3@internal@tbb@@IEAAXXZ
?allocate@allocate_additional_child_of_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
?allocate@allocate_child_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
?allocate@allocate_continuation_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
?allocate@allocate_root_proxy@internal@tbb@@SAAEAVtask@3@_K@Z
?allocate@allocate_root_with_context_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
?allocate_closure_v3@internal@tbb@@YAPEAX_K@Z
?allocate_via_handler_v3@internal@tbb@@YAPEAX_K@Z
?assertion_failure@tbb@@YAXPEBDH00@Z
?assign@concurrent_queue_base_v3@internal@tbb@@IEAAXAEBV123@@Z
?assign@concurrent_queue_iterator_base@internal@tbb@@IEAAXAEBV123@@Z
?assign@concurrent_queue_iterator_base_v3@internal@tbb@@IEAAXAEBV123@@Z
?call_itt_notify_v5@internal@tbb@@YAXHPEAX@Z
?cancel_group_execution@task_group_context@tbb@@QEAA_NXZ
?capture_fp_settings@task_group_context@tbb@@QEAAXXZ
?change_group@task@tbb@@QEAAXAEAVtask_group_context@2@@Z
?clear@captured_exception@tbb@@QEAAXXZ
?clear@pipeline@tbb@@QEAAXXZ
?deallocate_via_handler_v3@internal@tbb@@YAXPEAX@Z
?default_num_threads@task_scheduler_init@tbb@@SAHXZ
?destroy@captured_exception@tbb@@UEAAXXZ
?destroy@task@tbb@@QEAAXAEAV12@@Z
?destroy@task_base@internal@interface5@tbb@@SAXAEAVtask@4@@Z
?detach@tbb_thread_v3@internal@tbb@@QEAAXXZ
?downgrade_to_reader@scoped_lock@queuing_rw_mutex@tbb@@QEAA_NXZ
?free@allocate_additional_child_of_proxy@internal@tbb@@QEBAXAEAVtask@3@@Z
?free@allocate_child_proxy@internal@tbb@@QEBAXAEAVtask@3@@Z
?free@allocate_continuation_proxy@internal@tbb@@QEBAXAEAVtask@3@@Z
?free@allocate_root_proxy@internal@tbb@@SAXAEAVtask@3@@Z
?free@allocate_root_with_context_proxy@internal@tbb@@QEBAXAEAVtask@3@@Z
?free_closure_v3@internal@tbb@@YAXPEAX@Z
?get_initial_auto_partitioner_divisor@internal@tbb@@YA_KXZ
?handle_perror@internal@tbb@@YAXHPEBD@Z
?hardware_concurrency@tbb_thread_v3@internal@tbb@@SAIXZ
?init@task_group_context@tbb@@IEAAXXZ
?initialize@task_scheduler_init@tbb@@QEAAXH@Z
?initialize@task_scheduler_init@tbb@@QEAAXH_K@Z
?inject_token@pipeline@tbb@@AEAAXAEAVtask@2@@Z
?internal_abort@concurrent_queue_base_v3@internal@tbb@@IEAAXXZ
?internal_acquire@scoped_lock@mutex@tbb@@AEAAXAEAV23@@Z
?internal_acquire@scoped_lock@recursive_mutex@tbb@@AEAAXAEAV23@@Z
?internal_acquire@scoped_lock@spin_mutex@tbb@@AEAAXAEAV23@@Z
?internal_acquire_reader@spin_rw_mutex@tbb@@CAXPEAV12@@Z
?internal_acquire_reader@spin_rw_mutex_v3@tbb@@AEAAXXZ
?internal_acquire_writer@spin_rw_mutex@tbb@@CA_NPEAV12@@Z
?internal_acquire_writer@spin_rw_mutex_v3@tbb@@AEAA_NXZ
?internal_assign@concurrent_vector_base@internal@tbb@@IEAAXAEBV123@_KP6AXPEAX1@ZP6AX2PEBX1@Z5@Z
?internal_assign@concurrent_vector_base_v3@internal@tbb@@IEAAXAEBV123@_KP6AXPEAX1@ZP6AX2PEBX1@Z5@Z
?internal_capacity@concurrent_vector_base@internal@tbb@@IEBA_KXZ
?internal_capacity@concurrent_vector_base_v3@internal@tbb@@IEBA_KXZ
?internal_clear@concurrent_vector_base@internal@tbb@@IEAAXP6AXPEAX_K@Z_N@Z
?internal_clear@concurrent_vector_base_v3@internal@tbb@@IEAA_KP6AXPEAX_K@Z@Z
?internal_compact@concurrent_vector_base_v3@internal@tbb@@IEAAPEAX_KPEAXP6AX10@ZP6AX1PEBX0@Z@Z
?internal_condition_variable_notify_all@internal@interface5@tbb@@YAXAEATcondvar_impl_t@123@@Z
?internal_condition_variable_notify_one@internal@interface5@tbb@@YAXAEATcondvar_impl_t@123@@Z
?internal_condition_variable_wait@internal@interface5@tbb@@YA_NAEATcondvar_impl_t@123@PEAVmutex@3@PEBVinterval_t@tick_count@3@@Z
?internal_construct@critical_section_v4@internal@tbb@@QEAAXXZ
?internal_construct@mutex@tbb@@AEAAXXZ
?internal_construct@queuing_mutex@tbb@@QEAAXXZ
?internal_construct@queuing_rw_mutex@tbb@@QEAAXXZ
?internal_construct@reader_writer_lock@interface5@tbb@@AEAAXXZ
?internal_construct@recursive_mutex@tbb@@AEAAXXZ
?internal_construct@scoped_lock@reader_writer_lock@interface5@tbb@@AEAAXAEAV234@@Z
?internal_construct@scoped_lock_read@reader_writer_lock@interface5@tbb@@AEAAXAEAV234@@Z
?internal_construct@spin_mutex@tbb@@QEAAXXZ
?internal_construct@spin_rw_mutex_v3@tbb@@AEAAXXZ
?internal_copy@concurrent_vector_base@internal@tbb@@IEAAXAEBV123@_KP6AXPEAXPEBX1@Z@Z
?internal_copy@concurrent_vector_base_v3@internal@tbb@@IEAAXAEBV123@_KP6AXPEAXPEBX1@Z@Z
?internal_current_slot@task_arena_base@internal@interface7@tbb@@KAHXZ
?internal_decrement_ref_count@task@tbb@@AEAA_JXZ
?internal_destroy@mutex@tbb@@AEAAXXZ
?internal_destroy@reader_writer_lock@interface5@tbb@@AEAAXXZ
?internal_destroy@recursive_mutex@tbb@@AEAAXXZ
?internal_destroy@scoped_lock@reader_writer_lock@interface5@tbb@@AEAAXXZ
?internal_destroy@scoped_lock_read@reader_writer_lock@interface5@tbb@@AEAAXXZ
?internal_destroy_condition_variable@internal@interface5@tbb@@YAXAEATcondvar_impl_t@123@@Z
?internal_downgrade@spin_rw_mutex@tbb@@CAXPEAV12@@Z
?internal_downgrade@spin_rw_mutex_v3@tbb@@AEAAXXZ
?internal_empty@concurrent_queue_base_v3@internal@tbb@@IEBA_NXZ
?internal_enqueue@task_arena_base@internal@interface7@tbb@@IEBAXAEAVtask@4@_J@Z
?internal_execute@task_arena_base@internal@interface7@tbb@@IEBAXAEAVdelegate_base@234@@Z
?internal_finish_clear@concurrent_queue_base_v3@internal@tbb@@IEAAXXZ
?internal_grow_by@concurrent_vector_base@internal@tbb@@IEAA_K_K0P6AXPEAX0@Z@Z
?internal_grow_by@concurrent_vector_base_v3@internal@tbb@@IEAA_K_K0P6AXPEAXPEBX0@Z2@Z
?internal_grow_predicate@hash_map_segment_base@internal@tbb@@QEBA_NXZ
?internal_grow_to_at_least@concurrent_vector_base@internal@tbb@@IEAAX_K0P6AXPEAX0@Z@Z
?internal_grow_to_at_least@concurrent_vector_base_v3@internal@tbb@@IEAAX_K0P6AXPEAXPEBX0@Z2@Z
?internal_grow_to_at_least_with_result@concurrent_vector_base_v3@internal@tbb@@IEAA_K_K0P6AXPEAXPEBX0@Z2@Z
?internal_initialize@task_arena_base@internal@interface7@tbb@@IEAAXXZ
?internal_initialize_condition_variable@internal@interface5@tbb@@YAXAEATcondvar_impl_t@123@@Z
?internal_itt_releasing@spin_rw_mutex@tbb@@CAXPEAV12@@Z
?internal_pop@concurrent_queue_base@internal@tbb@@IEAAXPEAX@Z
?internal_pop@concurrent_queue_base_v3@internal@tbb@@IEAAXPEAX@Z
?internal_pop_if_present@concurrent_queue_base@internal@tbb@@IEAA_NPEAX@Z
?internal_pop_if_present@concurrent_queue_base_v3@internal@tbb@@IEAA_NPEAX@Z
?internal_push@concurrent_queue_base@internal@tbb@@IEAAXPEBX@Z
?internal_push@concurrent_queue_base_v3@internal@tbb@@IEAAXPEBX@Z
?internal_push_back@concurrent_vector_base@internal@tbb@@IEAAPEAX_KAEA_K@Z
?internal_push_back@concurrent_vector_base_v3@internal@tbb@@IEAAPEAX_KAEA_K@Z
?internal_push_if_not_full@concurrent_queue_base@internal@tbb@@IEAA_NPEBX@Z
?internal_push_if_not_full@concurrent_queue_base_v3@internal@tbb@@IEAA_NPEBX@Z
?internal_release@scoped_lock@mutex@tbb@@AEAAXXZ
?internal_release@scoped_lock@recursive_mutex@tbb@@AEAAXXZ
?internal_release@scoped_lock@spin_mutex@tbb@@AEAAXXZ
?internal_release_reader@spin_rw_mutex@tbb@@CAXPEAV12@@Z
?internal_release_reader@spin_rw_mutex_v3@tbb@@AEAAXXZ
?internal_release_writer@spin_rw_mutex@tbb@@CAXPEAV12@@Z
?internal_release_writer@spin_rw_mutex_v3@tbb@@AEAAXXZ
?internal_reserve@concurrent_vector_base@internal@tbb@@IEAAX_K00@Z
?internal_reserve@concurrent_vector_base_v3@internal@tbb@@IEAAX_K00@Z
?internal_resize@concurrent_vector_base_v3@internal@tbb@@IEAAX_K00PEBXP6AXPEAX0@ZP6AX210@Z@Z
?internal_set_capacity@concurrent_queue_base@internal@tbb@@IEAAX_J_K@Z
?internal_set_capacity@concurrent_queue_base_v3@internal@tbb@@IEAAX_J_K@Z
?internal_set_ref_count@task@tbb@@AEAAXH@Z
?internal_size@concurrent_queue_base@internal@tbb@@IEBA_JXZ
?internal_size@concurrent_queue_base_v3@internal@tbb@@IEBA_JXZ
?internal_start@tbb_thread_v3@internal@tbb@@AEAAXP6AIPEAX@Z0@Z
?internal_swap@concurrent_vector_base_v3@internal@tbb@@IEAAXAEAV123@@Z
?internal_terminate@task_arena_base@internal@interface7@tbb@@IEAAXXZ
?internal_throw_exception@concurrent_queue_base_v3@internal@tbb@@IEBAXXZ
?internal_throw_exception@concurrent_vector_base_v3@internal@tbb@@IEBAX_K@Z
?internal_try_acquire@scoped_lock@mutex@tbb@@AEAA_NAEAV23@@Z
?internal_try_acquire@scoped_lock@recursive_mutex@tbb@@AEAA_NAEAV23@@Z
?internal_try_acquire@scoped_lock@spin_mutex@tbb@@AEAA_NAEAV23@@Z
?internal_try_acquire_reader@spin_rw_mutex@tbb@@CA_NPEAV12@@Z
?internal_try_acquire_reader@spin_rw_mutex_v3@tbb@@AEAA_NXZ
?internal_try_acquire_writer@spin_rw_mutex@tbb@@CA_NPEAV12@@Z
?internal_try_acquire_writer@spin_rw_mutex_v3@tbb@@AEAA_NXZ
?internal_upgrade@spin_rw_mutex@tbb@@CA_NPEAV12@@Z
?internal_upgrade@spin_rw_mutex_v3@tbb@@AEAA_NXZ
?internal_wait@task_arena_base@internal@interface7@tbb@@IEBAXXZ
?is_group_execution_cancelled@task_group_context@tbb@@QEBA_NXZ
?is_malloc_used_v3@internal@tbb@@YA_NXZ
?is_owned_by_current_thread@task@tbb@@QEBA_NXZ
?itt_load_pointer_v3@internal@tbb@@YAPEAXPEBX@Z
?itt_load_pointer_with_acquire_v3@internal@tbb@@YAPEAXPEBX@Z
?itt_set_sync_name_v3@internal@tbb@@YAXPEAXPEB_W@Z
?itt_store_pointer_with_release_v3@internal@tbb@@YAXPEAX0@Z
?join@tbb_thread_v3@internal@tbb@@QEAAXXZ
?lock@reader_writer_lock@interface5@tbb@@QEAAXXZ
?lock_read@reader_writer_lock@interface5@tbb@@QEAAXXZ
?move@captured_exception@tbb@@UEAAPEAV12@XZ
?move_v3@internal@tbb@@YAXAEAVtbb_thread_v3@12@0@Z
?name@captured_exception@tbb@@UEBAPEBDXZ
?note_affinity@task@tbb@@UEAAXG@Z
?observe@task_scheduler_observer_v3@internal@tbb@@QEAAX_N@Z
?priority@task_group_context@tbb@@QEBA?AW4priority_t@2@XZ
?process_item@thread_bound_filter@tbb@@QEAA?AW4result_type@12@XZ
?register_pending_exception@task_group_context@tbb@@QEAAXXZ
?release@scoped_lock@queuing_mutex@tbb@@QEAAXXZ
?release@scoped_lock@queuing_rw_mutex@tbb@@QEAAXXZ
?reset@task_group_context@tbb@@QEAAXXZ
?resize@affinity_partitioner_base_v3@internal@tbb@@AEAAXI@Z
?run@pipeline@tbb@@QEAAX_K@Z
?run@pipeline@tbb@@QEAAX_KAEAVtask_group_context@2@@Z
?runtime_warning@internal@tbb@@YAXPEBDZZ
?self@task@tbb@@SAAEAV12@XZ
?set@captured_exception@tbb@@QEAAXPEBD0@Z
?set_assertion_handler@tbb@@YAP6AXPEBDH00@ZP6AX0H00@Z@Z
?set_end_of_input@filter@tbb@@IEAAXXZ
?set_priority@task_group_context@tbb@@QEAAXW4priority_t@2@@Z
?spawn_and_wait_for_all@task@tbb@@QEAAXAEAVtask_list@2@@Z
?terminate@task_scheduler_init@tbb@@QEAAXXZ
?thread_get_id_v3@internal@tbb@@YA?AVid@tbb_thread_v3@12@XZ
?thread_sleep_v3@internal@tbb@@YAXAEBVinterval_t@tick_count@2@@Z
?thread_yield_v3@internal@tbb@@YAXXZ
?throw_bad_last_alloc_exception_v4@internal@tbb@@YAXXZ
?throw_exception_v4@internal@tbb@@YAXW4exception_id@12@@Z
?try_acquire@scoped_lock@queuing_mutex@tbb@@QEAA_NAEAV23@@Z
?try_acquire@scoped_lock@queuing_rw_mutex@tbb@@QEAA_NAEAV23@_N@Z
?try_lock@reader_writer_lock@interface5@tbb@@QEAA_NXZ
?try_lock_read@reader_writer_lock@interface5@tbb@@QEAA_NXZ
?try_process_item@thread_bound_filter@tbb@@QEAA?AW4result_type@12@XZ
?unlock@reader_writer_lock@interface5@tbb@@QEAAXXZ
?upgrade_to_writer@scoped_lock@queuing_rw_mutex@tbb@@QEAA_NXZ
?what@bad_last_alloc@tbb@@UEBAPEBDXZ
?what@captured_exception@tbb@@UEBAPEBDXZ
?what@improper_lock@tbb@@UEBAPEBDXZ
?what@invalid_multiple_scheduling@tbb@@UEBAPEBDXZ
?what@missing_wait@tbb@@UEBAPEBDXZ
?what@user_abort@tbb@@UEBAPEBDXZ
TBB_runtime_interface_version
__TBB_machine_cmpswp1
__TBB_machine_cmpswp2
__TBB_machine_fetchadd1
__TBB_machine_fetchadd2
__TBB_machine_fetchstore1
__TBB_machine_fetchstore2
__TBB_machine_is_in_transaction
__TBB_machine_pause
__TBB_machine_try_lock_elided
__TBB_machine_unlock_elided
Sections
.text Size: 274KB - Virtual size: 274KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ