Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Static task
static1
Behavioral task
behavioral1
Sample
16ac36d24bf31633e2f273e162368eda961967463f67b2325e574d6d86307998_NeikiAnalytics.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
16ac36d24bf31633e2f273e162368eda961967463f67b2325e574d6d86307998_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
Target
16ac36d24bf31633e2f273e162368eda961967463f67b2325e574d6d86307998_NeikiAnalytics.exe
Size
1.7MB
MD5
d4f4c47c8668cb0d849a669d3bf539d0
SHA1
b2a8f6781d1ab77bd6a562850eb8f5d50ba1e6ed
SHA256
16ac36d24bf31633e2f273e162368eda961967463f67b2325e574d6d86307998
SHA512
bcbd91feb666f9fb49050893b0fba2898a02027f52e1e781084a561ecd279da162607bf1a6aacfc38660ab3fcb076710902ded4744652dd9a3b1d5d8e8aed9fd
SSDEEP
24576:0yAY1hb1cqZPLkQS56S9exzMyZM1XUAAP5dvcu/un9mR6P8eVo2tUxxQ:hXqQVS9eFMyZvAAPk6u9mRAHKrxu
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
libwaadbrowser.pdb
??1WaRegKey@@QEAA@XZ
?open@WaRegKey@@QEAAHPEAUHKEY__@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@K@Z
?get@WaRegKey@@QEAAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV23@_N@Z
?getCurrentEpochTime@WaTime@@YAHXZ
?instance@?$Singleton@VWaMemoryPoolManager@@@@SAPEAVWaMemoryPoolManager@@XZ
??0WaJson@@QEAA@$$QEAUObjectConstructor@0@@Z
??0WaJson@@QEAA@_N@Z
??0WaJson@@QEAA@$$QEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0WaJson@@QEAA@AEBV0@@Z
??4WaJson@@UEAAAEAV0@AEBV?$unordered_map@$$CBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@VWaJson@@Uwa_map_hasher@@Uwa_map_equal_to@@V?$wa_allocator@U?$pair@$$CBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@VWaJson@@@std@@@@@std@@@Z
??4WaJson@@UEAAAEAV0@AEBV?$vector@VWaJson@@V?$wa_allocator@VWaJson@@@@@std@@@Z
??4WaJson@@UEAAAEAV0@_N@Z
??4WaJson@@UEAAAEAV0@AEBH@Z
??4WaJson@@UEAAAEAV0@PEB_W@Z
??4WaJson@@UEAAAEAV0@AEBV0@@Z
??4WaJson@@UEAAAEAV0@$$QEAV0@@Z
??YWaJson@@UEAAAEAV0@AEBV0@@Z
??AWaJson@@UEBAAEBV0@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??AWaJson@@UEAAAEAV0@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??AWaJson@@UEBAAEBV0@PEB_W@Z
??AWaJson@@UEAAAEAV0@PEB_W@Z
??AWaJson@@UEBAAEBV0@_K@Z
??0WaRegKey@@QEAA@PEAUHKEY__@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??8WaJson@@UEBA_NAEBV0@@Z
??9WaJson@@UEBA_NAEBV0@@Z
??MWaJson@@UEBA_NAEBV0@@Z
?convert@WaJson@@UEAAXAEBW4WaJsonType@@@Z
?getObjKeyType@WaJson@@UEBA?AW4WaJsonType@@PEB_W@Z
?isObjKeyType@WaJson@@UEBA_NPEB_WAEBW4WaJsonType@@@Z
?clear@WaJson@@UEAAXXZ
?add@WaJson@@UEAAXV?$initializer_list@VWaJson@@@std@@@Z
?put@WaJson@@UEAAXV?$initializer_list@U?$pair@PEB_WVWaJson@@@std@@@std@@@Z
?put@WaJson@@UEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@$$QEAV1@@Z
?put@WaJson@@UEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV1@@Z
?get@WaJson@@UEBAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEA_N@Z
?get@WaJson@@UEBAHPEB_WAEA_N@Z
?get@WaJson@@UEBAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAH@Z
?Matches@WaRegex@@SA_NPEB_W0@Z
?epochToFileTime@WaTime@@YAHAEB_KAEAU_FILETIME@@@Z
?close@WaRegKey@@QEAAHXZ
?filetimeToEpoch@WaTime@@YAHAEBU_FILETIME@@AEA_K@Z
?revertFsRedirection@WaFileUtils@@SAHAEAPEAX@Z
?disableFsRedirection@WaFileUtils@@SAHAEAPEAX@Z
?get@WaJson@@UEBAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV23@@Z
?get@WaJson@@UEBA?AV1@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?getInt@WaJson@@UEBAHXZ
?uriDecode@WaStringUtils@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV23@@Z
?uriEncode@WaStringUtils@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV23@@Z
?key@WaRegKey@@QEBAPEAUHKEY__@@XZ
?getString@WaJson@@UEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?getBool@WaJson@@UEBA_NXZ
?dotGet@WaJson@@UEAAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEA_N@Z
?dotGet@WaJson@@UEAAHPEB_WAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?dotGet@WaJson@@UEAAHPEB_WAEA_N@Z
??1WaJson@@UEAA@XZ
??0WaJson@@QEAA@XZ
?GetVersion@WaOSUtils@@QEAAXPEAH0000@Z
?getSpecialFolder@WaFileUtils@@SAHAEBHAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?revertImpersonation@WaOSUtils@@QEAAHXZ
?impersonateCurrentUser@WaOSUtils@@QEAAHXZ
?instance@WaConfigurations@@SAPEAV1@XZ
?isRegistered@WaSelfProtection@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?registerModule@WaSelfProtection@@QEAAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??1WaSelfProtection@@QEAA@XZ
??0WaSelfProtection@@QEAA@XZ
??AWaJson@@UEAAAEAV0@_K@Z
?dotGet@WaJson@@UEAAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAH@Z
?dotGet@WaJson@@UEAAHPEB_WAEAH@Z
?dotGet@WaJson@@UEAAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV23@@Z
?dotGet@WaJson@@UEAAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV1@@Z
?dotGet@WaJson@@UEAAHPEB_WAEAV1@@Z
?dotAt@WaJson@@UEAAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEA_N@Z
?dotAt@WaJson@@UEAAHPEB_WAEA_N@Z
?dotAt@WaJson@@UEAAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAH@Z
?dotAt@WaJson@@UEAAHPEB_WAEAH@Z
?dotAt@WaJson@@UEAAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV23@@Z
?dotAt@WaJson@@UEAAHPEB_WAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?dotAt@WaJson@@UEAAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV1@@Z
?dotAt@WaJson@@UEAAHPEB_WAEAV1@@Z
?dotPut@WaJson@@UEAAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV1@@Z
?dotPut@WaJson@@UEAAHPEB_WAEBV1@@Z
?dotAdd@WaJson@@UEAAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV1@@Z
?dotAdd@WaJson@@UEAAHPEB_WAEBV1@@Z
?remove@WaJson@@UEAAXH@Z
?remove@WaJson@@UEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?remove@WaJson@@UEAAXPEB_W@Z
?contains@WaJson@@UEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?val@WaJson@@UEBAHAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?val@WaJson@@UEBAHAEAH@Z
?toCharPointer@WaJson@@UEBAXPEAPEA_W@Z
?first@WaJson@@UEAA?AV1@XZ
?removeRecursive@WaJson@@UEAAXPEB_W@Z
?_init@WaJson@@EEAAXXZ
?_set@WaJson@@EEAAXAEBV?$unordered_map@$$CBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@VWaJson@@Uwa_map_hasher@@Uwa_map_equal_to@@V?$wa_allocator@U?$pair@$$CBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@VWaJson@@@std@@@@@std@@@Z
?_set@WaJson@@EEAAXAEBV?$vector@VWaJson@@V?$wa_allocator@VWaJson@@@@@std@@@Z
?_set@WaJson@@EEAAX$$QEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?_set@WaJson@@EEAAXPEB_W@Z
?_set@WaJson@@EEAAX_N@Z
?_set@WaJson@@EEAAXAEBH@Z
?_toPrettyString@WaJson@@EEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@H_N@Z
?_encodeString@WaJson@@EEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV23@@Z
?_dotInsert@WaJson@@EEAAHPEB_WAEBV1@W4WaJsonType@@@Z
?_dotRetrieve@WaJson@@EEAAHPEB_WAEAV1@W4WaJsonType@@@Z
?allocate@WaMemoryPoolManager@@QEAAPEAX_K@Z
?deallocate@WaMemoryPoolManager@@QEAAX_KPEAX@Z
?bytesToWString@WaStringUtils@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEAEI_N@Z
?instance@?$Singleton@VWaOSUtils@@@@SAPEAVWaOSUtils@@XZ
?getType@WaJson@@UEBA?AW4WaJsonType@@XZ
?add@WaJson@@UEAAX$$QEAV1@@Z
?add@WaJson@@UEAAXAEBV1@@Z
?get@WaJson@@UEBAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV1@@Z
?get@WaJson@@UEBA?AV1@PEB_W@Z
?contains@WaJson@@UEBA_NPEB_W@Z
?val@WaJson@@UEBAHAEA_N@Z
?toString@WaJson@@UEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?toPrettyString@WaJson@@UEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?instance@WaCache@@SAPEAV1@XZ
?insert@WaCache@@QEAAHAEBW4WaCacheNamespace@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEB_WAEBVWaJson@@@Z
?get@WaCache@@QEAAHAEBW4WaCacheNamespace@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEB_WAEAVWaJson@@@Z
?replaceAll@WaStringUtils@@YAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV23@1@Z
?create@WaJsonFactory@@SAHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAVWaJson@@@Z
?CaptureAll@WaRegex@@SAHPEB_W0AEAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@@Z
?getUserTokensByProcessName@WaOSUtils@@QEAAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV?$vector@PEAXV?$allocator@PEAX@std@@@3@@Z
?getTempDir@WaFileUtils@@SAHAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0WaJson@@QEAA@W4WaJsonType@@@Z
??0WaJson@@QEAA@AEBH@Z
??0WaJson@@QEAA@PEB_W@Z
?isType@WaJson@@UEBA_NAEBW4WaJsonType@@@Z
?at@WaJson@@UEBA?AV1@_K@Z
?put@WaJson@@UEAAXPEB_W$$QEAV1@@Z
?put@WaJson@@UEAAXPEB_WAEBV1@@Z
?get@WaJson@@UEBAHPEB_WAEAH@Z
?get@WaJson@@UEBAHPEB_WAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?toPrettyCharPointer@WaJson@@UEBAXPEAPEA_W@Z
?size@WaJson@@UEBA_KXZ
?get@WaJson@@UEBAHPEB_WAEAV1@@Z
?keys@WaJson@@UEBA?AV?$set@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@XZ
?fileContents@WaFileUtils@@SAHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV23@_NHHAEB_N2@Z
?fileExists@WaFileUtils@@SAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_NAEB_N@Z
?directoryExists@WaFileUtils@@SAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_NAEB_N@Z
?directoryContents@WaFileUtils@@SAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAVWaJson@@H_NAEB_N@Z
?getAppDataForActiveUsers@WaFileUtils@@SAHAEAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@@Z
?ensurePathEnding@WaStringUtils@@YAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?evaluateResult@WaCallTree@@SAHH@Z
?instance@WaCallTree@@SAPEAV1@AEBVid@thread@std@@@Z
??0WaFileInfo@@QEAA@XZ
??1WaFileInfo@@QEAA@XZ
?getLastModifiedTime@WaFileInfo@@QEAAHPEB_WAEAHAEB_N@Z
?instance@WaDebugInfo@@SAPEAV1@XZ
?writeToFile@WaDebugInfo@@QEAAHAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_NW4LOG_LEVEL@1@V?$set@W4LOG_COMPONENT@WaDebugInfo@@U?$less@W4LOG_COMPONENT@WaDebugInfo@@@std@@V?$allocator@W4LOG_COMPONENT@WaDebugInfo@@@4@@3@11@Z
?create@WaJsonFactory@@SAHPEB_WAEAVWaJson@@@Z
wa_getHeap
GetThreadTimes
WriteConsoleW
ReadConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
GetFileType
GetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetDateFormatW
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
InterlockedFlushSList
LoadLibraryExW
RtlUnwindEx
RtlPcToFileHeader
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
EncodePointer
GetStringTypeW
GetCurrentThread
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
GetTimeFormatW
ResetEvent
GetCurrentThreadId
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
AreFileApisANSI
HeapCreate
HeapFree
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
GetFileAttributesW
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
HeapReAlloc
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
LockFileEx
GetFileSize
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
FileTimeToSystemTime
ReadFile
LocalFree
LocalAlloc
FindClose
FindNextFileW
LoadLibraryW
GetProcAddress
FreeLibrary
GetLastError
DeleteFileW
GetTickCount
CopyFileW
MoveFileW
GetFileSizeEx
VirtualFree
WriteFile
VirtualAlloc
SetFilePointer
CreateFileW
CloseHandle
FlushFileBuffers
InitializeCriticalSectionEx
RaiseException
DecodePointer
DeleteCriticalSection
CompareFileTime
WaitForSingleObject
CreateEventW
SetEvent
CreateThread
FindFirstFileW
WTSFreeMemory
WTSEnumerateSessionsW
WTSQuerySessionInformationW
SHDeleteKeyW
CryptUnprotectData
CryptProtectData
wsprintfW
ConvertSidToStringSidW
LookupAccountNameW
CoCreateInstance
CoUninitialize
CoInitializeEx
SHGetFolderPathW
SHFileOperationW
FindCloseUrlCache
FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
InternetSetCookieW
FindFirstUrlCacheEntryW
wa_adbrowser_free
wa_adbrowser_init
wa_adbrowser_invoke
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ