[fXd��j�s�c�S�NbŐ�E!���8�n�f<�ڥס��x�]A��J��;����u�Mo-u�u͐�e� u�������_Y_�D /�x��~#ѭ�^�F��h�����ع���@��GL��n��N�0��J�D�(���Μ�@���>��F��ŭL�H�[=��M���l�g|J�ȍ��D��<.�}2���jIJj�/�>�.���x�,JA�>-=�䕜*��y���� �~�`�e襟i�~á!4��*�Ă7�x��DP�����HYu����6��]�.�ٴ�-B(D* �t����¦rZ����g��t�X���);����GV�|�J {���k&�E�f��.�=�1�|gx�`�U.���پ�֟� 7m"r7�$Ӵ37N.�9��Ag�[�.�t:dr =)�����:�� ��p&9~$�w"���FH�^�_��Bbr�1�G kX��O]T_�P�.�S!�7���ȶ�OȂ9�1�zD�����-��`����+�v ��uXn�z�G9�"ˎ�/4�E]���^���\�H<�WJ�6�����PMH��X���u�>�uCҺ�,(��Iā\~�������)��C���:C@hgc��Qd�ȞX���z� ��V uO���ص5B�&h���� nS_l]�=�wNlT��v\M�!� -�]��ER����U��u���m�|s[ը� ~W�(�L�R�9���v`�[J�r���D �jRlZU� �Ն�$���<8:�>��E �x��k��.�yb�H�l�8?y|]��̶�K�������yYpzu��Ad����ǵO~�;��І�t�#��z�wہ�dq2K���'YrT��)+QW��|����3��s'����s$�,U�� |�WOG�ima����(��p�Xc ���� �^�=�#�.Gz��'x ���������jVd�ғ��_�࠷� 3p��g;L�{~<��� ��+��-P'%��:�-� �`�de�Ƹ���+z���7G�',���s-�>c����3n�u�d��C���]O�Z���@o��"վYCzI�7��d��j���. |�����.�&u9��;�V��[lp�.F�"�z0��o'W�[ەJg%��|+�ǯ�ˋe傭;HB�L�U!rヱ"|���J-1z"�J��H nU.Q{)O>2VB����B�l��߳�;]����2�}?�6�8J��߆�#C�t��0 �����������aN�&g� 8�M���MR vҕw��&}W&7�aSK�2��4.$! ��U�X�]�d96�|8~�(/��-Fj�ꩾ�Z��Z�*�<J�?�H���n�%� � Ś�-U�"����~�r����9���߆����V����P��d��;�W���Bǘ~��Z���Pz�������[�u���ߓw�Z�oY�2����++�9�g�.Ys�Z;�P�Ho�����?���"�N����Nw�ęRd��[\��������ى<�,�a� ���3����R1�6���7�J����T�6)l1��E/P�(p~���W�U+��7��H��5C�9���i�B(�]ـ;�#$�����nyFll�Z_�߁�%tS�%�2h~NP1r!���>8�y�� �Ҷu��^/*�*!�W�������GH�ˤp:�'O�#�f�=*���F�����D�yb��h������#�� ^���ƍD�J c�*���J/��g�(�됈z���s9\�y�+�N��.@u���+�0غ���O�=Z�V�[k@�x2Ĉ0�u���{�o�\ 3$� q�����ԩ�$ X��)*����<f�r�����I�婩��w�p�`}�\�٫A�d*��.aB9����jTL��I�h�*x���DF���{1��⛆��̧)5!��Y�v��]I�$����r�q]���)�{���G�B��i���J���m5�N7T� �9\�;XJ*�m��Wq�@X��~BR��McT�H�T�w$�(� �EL Pof ��Њo0�ʵNG��Ox"})+v$�RB)��pRk������p�}���L��������1s si�ijdΠI��ٺ�j?c*be�<������D��1�'ȌC�Fq+���T �ժ���q���@���{o�s�"���u���*/��M����.��B`��֭;z�W�l¢Eg�ܢͬ�w=#���w}��I�]��^�l�J�&��<� �>' '�����^���(�����)m�]Pz}z����@�r�� ��Ի�����}Dz�R�k7�jhF`z�ݐteޖ��?��C@�������G��@x� ��v0�������d��R�����+�ZN��kP���̯!��M:i ���h�!2淒�|�Ѽ�A�t:�0���ͻDd���ɖ����%�K��#p��\/����6*�j=^ �^q�Y��� ڤ���R�m��\����O1�$dQy���r��{�O?�����Q��Ƹ`���q{��E.��C���hڗ�.��Z�b��qS<q��gbH ���%�h�R�^y�4*���V<�~~������(����T̴����l���H�D+�T�����庯\�F���,�}AC���L���O��;b����*�N�ųU����C��sZB����''5�V�M��_�=�073�>�v�MS3E�u����.C��㢍��`�h"�m�������&���.�A�a{�����#� ̻M��_���ߝ *Yd1���^��LjU��V���hZUٯ���U��T�l�F�4��*"�se�P��*u.�_X ���qU0#��H��w��'^���L�Z�@����s>�%���a�#�=ԐqU���+�C�gh~��>�Q��`V��o�z��nx��w��% T�;Ϸ�W������ ei���EMŝٗ���������3*��o�K+[ے�fC���F1\fn���۳����c�X20߲G{O��W$k<_�ؘbӘX��uԗ�o~T���F���mȗ����.f�f�ؒT�������t�}��[O4���-O�.����rBTu5>9�b
Static task
static1
Behavioral task
behavioral1
Sample
ME3+18Tr-LNG/No DVD/ME3+19Tr_LNG.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ME3+18Tr-LNG/No DVD/ME3+19Tr_LNG.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ME3+18Tr-LNG/RELOADED/ME3+18Tr-LNG.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
ME3+18Tr-LNG/RELOADED/ME3+18Tr-LNG.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
ME3+18Tr-LNG/Retail DVD/ME3+18Tr-LNG.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
ME3+18Tr-LNG/Retail DVD/ME3+18Tr-LNG.exe
Resource
win10v2004-20240802-en
General
-
Target
ba8b62563658e107723236cbc4e9277b_JaffaCakes118
-
Size
6.8MB
-
MD5
ba8b62563658e107723236cbc4e9277b
-
SHA1
f9d684dc6d7f11347cf1c4fc557ec0f086d43de0
-
SHA256
b470e5d63a07d7569849ae1e64307d78bb701f420324ba0b0b53a45e68cddf28
-
SHA512
a5ff1d5d481c9577ddf83bc5fbdb29ab4e9c0a5c244028aa9887753ed8eff6c3ddb1fb92b5a5329212346c1b636b78a5254aa474c8b8dd50fb1c8cd8c6c916a6
-
SSDEEP
98304:JGHq+4vBodPkH6UHMt18dwyVzP1u4kSnrAfHPlvi+CrHa4e+7LSdsZ6aOaVgVpvi:J9vqsst1CzkSns6zrHa417LSQOaUp6
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/ME3+18Tr-LNG/No DVD/ME3+19Tr_LNG.exe unpack001/ME3+18Tr-LNG/RELOADED/ME3+18Tr-LNG.exe unpack001/ME3+18Tr-LNG/Retail DVD/ME3+18Tr-LNG.exe
Files
-
ba8b62563658e107723236cbc4e9277b_JaffaCakes118.zip
-
ME3+18Tr-LNG/No DVD/ME3+19Tr-LNG - I.N.F.O.txt
-
ME3+18Tr-LNG/No DVD/ME3+19Tr_LNG.exe.exe windows:4 windows x86 arch:x86
0291ca739e6e54156c106fe726d8b23a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrToAnsi
kernel32
HeapAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutUnprepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
ME3+18Tr-LNG/RELOADED/ME3+18Tr-LNG - I.N.F.O.txt
-
ME3+18Tr-LNG/RELOADED/ME3+18Tr-LNG.exe.exe windows:4 windows x86 arch:x86
4baf40104d4c87721840ec297822d986
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrCopy
kernel32
LoadResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
MessageBoxA
Exports
Exports
�����&!��y@Ԯ�"�D e�4����-]�i�g#r�}���t�����z0�zԇw�-e(������u��UNB�_T��N�%\���W�81��_���i��ƅ�p�R��챓$E6=z\JQ�B��Qo����9V��n���CB���c�:��UyG�e�,��?Q�.�b��U϶8�Jg.���ʍ9v����Y>�=�>�]�6HX���S��4j0�S�R�$c��p�#^U�B6�L/�����f�Fۖ�15��ͫe/�#�v�����B��J�R.�@�s�F"K�m�k���'Σ�PO���b+�'dW��.ٲG�ί���,���M��כr`2�4ѝ,c9�"��L�"]\;�R����@]���ٳnDg|NxMO�̴S���9}s�0d�!��d!�21j������ K�R�?������T��K@�p�ޫg�oZF��-C�H�C����9&�@U�6ȸ&�&F� �9���|h�}/7�a�PC>!x�<���Q ��RO\�2�Gd}vݽ�����#sx�]�x�OGZQU,0�}�q� )�1ǡ��#�'�Z��s�����Q1��������A��|�˔u�L�ҏ�Ϝ�{=pdG��2�P��յ@�p�0���U7���E)L���*��;͛�&��V����k{ ���r��_�[�H�]{���)B����W��t$r�Uϫ7Z�M��aswcѯN��.����B�jj�U�fr)���T� �]��P`�7�ē4e$ M����5���GY����KC��h���=b�{������^�gp9�>�e}oa�������hR5f%J�6ј����e��q�+BQ2���/R����lٟ��?,�Q;�A!�F<��[NFg8i�O�N��p�<���x�%lYW�e7Q���Մ��[�7~1F�N܂Ffۖҿ��� ^�7߸1�~�o_h8OrQ�d?���aĴm�J�63�Z�\ ����WP�]ڀp���oŻ�sga��-�� 1�4F�pn�o����Ik�7#�2�%��D�9Ţ���G��bۤ�)8a���#�^��誙ީ�4�.��oҟ����zW篫v�9a��D�x�L�gT����})P/��ǎ�1S���A5��uD��ul'�O�A,P������=��Z�3f�̵����6<�Vc%�<���G�B��Zw��X��w8�ꘃ:Gtю`b�O��#�<�e ʝw�b���r�*��}0�g�������ٿ�^��fwP_ n��'��1�I9=��T�-{�Ҭ��2-�NqR�;��/J�i��T�Tg�����jv��jwP��LH�|�����-`�Ikl��v�%[S�ˬs����("֎�9F���6����}���Y���@�o�<�OE�4i�T � ,a��4}B"���i�_y,i��rX�s}rI�p�X��r ���Kʏe�:<�h g8r�c��tP�q��v}�e������yr� W3�ж���BJQ,тGF%�oC/��#�Ѓ�k����N�#FN�_��1��L4E9{U��t��"�5�UH��έ��KY�BF._���5[�;��Uu$��Fk��$S�Hm�E�p�f����S,��p"�hS��d�Z�����v-M��jT"��>��W������#Ei�[�hi"wq�&�j��+�����X����.��ݷf�<'��ET��:���Xh��jb���J�2t��ɰ��hI_�Nx����cպ!t�8�:��sC9�-^���D�6[���\�dWs��.�� �ԪPz&��4v�KF�Ԛ)s�(�B�� ���m�C]������i9BGs�-L��2z��XQ��{y?z�����vs?)��$HE2��T�s��Ԗc24 Y�U�o�`���Ć�T�А�*�r�$}��-�n�nL���[x�=���<Rp�X�.��J.ּ�=�H�밯��tRp��II����b��U�\=9�M�\����s���Agڠ/�2n��1F��cP����5`�v���[]����9tm3�奷Q3�0' %Em��٤!-��tqź��{t_�$�is_ljw��������ز9'�LO�����<����S����N��6U|��j)�7�'P*�s\�Zݺeuc9ũ��l��Y� �6�ꆄ���"#�S5��\;d\o�0I�`�GoI���Тb�n��R�^��q��!�L�����ba�}eEWo��%Z���b��Q�CEnR�Ja蝹'l?�Y�6��hR��wF������Y��gn���~^��y��%�t[���꧐�h�ӳ���A$��[�����%�R���qy��<� �}e�u�KI�̖���Ҝl�����.G�4".��rã��;5��{.�����2���w!��C��% ���3��`�@/J�������-sl��N#|ғ�������-�!s�H�����T��l�R��_(��QY�wEC`:�/AOR���v�A�@�Y�з��_��i���O�Uon��`;���\Ea����L&����N��ɕ.l�0*���L�f������Cc�ͯ�R��`������81��!����+5Z>�9l���m��8��4��� ��$��㯦�[��AJ�=�T�]a�YZ�l�":|��c]��с@�2v͕��l�J��k�q�����\� �)�g��!��n�^���n�+�)'�Oc4�<:�f ���e��Ĝ���"�v<��o�X��[r� ����?���%��{S��[2�U*�_M��]�L�qiɫ'x![l̂D ���kE���������;��[�7i1�������H���˸KX��<_MR&ź�N��~�@�w��o�Q�|`�;hdz�Z����-�B<��@��~9ᛄ{��2l��Z�P������FNҘ6 �Py�9��Pfʼnoq������Zp"����K�����̹�����~��c���H���E�d�a��2"h���ho ː�k�@���AY�X�E�xD�AZ�c�(%r?8����tY�q�6)�'?���p+^�� `"6�)n@�� �)�"sS���Z�k\�w"��
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
ME3+18Tr-LNG/Retail DVD/ME3+18Tr-LNG - I.N.F.O.txt
-
ME3+18Tr-LNG/Retail DVD/ME3+18Tr-LNG.exe.exe windows:4 windows x86 arch:x86
30fb383263f41316b44e49134d09e4c4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaFreeObj
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutUnprepareHeader
user32
MessageBoxA
Exports
Exports
)&���q>�d��$���|��B�u�M�&�Q��y�pS���gt���E�����I�4cQi���~�Ԃj�5W� �C�8�X�|� ��u��p�|�?;W����'l��f2����k���J<`�.Z�S�9[�L���D�L���{�&��_�Aͼ,�@*������jk#��+B�gM��F��M�p^0�����R��k��G9��e^�c>��r���P��JU����Q3�aỶ�y�@�N��F�� R�^��.��M@����.�+Fژ�>��己\l��Y�8Lm*�LO;Ş'���$%���D�aՆ�>�����9�z�ۜ�XT��=�����d�5�|�Ræ��8�Sԅ:�0��L {�"��=x� S�� ,Q{B����ńl��`�����������]EZzQ������N=�rL.���������{���ZM�-� v���Y�'j�1������D>�05�g��:�__�|�rN�_���U��y��t��4�[�'t�.4�ȫ����HV����t�����l1�e{G?框��P4R^=���A�E�j��;a��Ʈ1}zpΐ�L�T�B�m�t���N�҇E��m���� t���FYa���V�@Ւ��� ��=2�ȓ(L��56 �n���}�MR}����w�YI��]sYd|�C]�����^�§T*��p���?2I_+�)0�^J�Hh���Rc� 9��X����ΝJ�S% L�> H]��Sw�2"���9�Z9����3�� ?vm�3�X����n�wbb0�#��.�E�F�O�U�n �.�����k� ���ȱ�!_��I*H]��h�&QF���W���W$x�6[4_8�A���,!)�' ��� �MG�����&Z@*ʞ֡Z�X��.�:�!���z~�_��A.��I�q77��i�\��P�p{�N��^��]2�� ���1\�މ��8��?�ٴ� I�R6r���^��������lR>��f�$v�T��L�ߜ²hQ��q�_���?(>P'Q��J m�ɟP���Ε�����h;(8q}��Y�0J�/��?�_"��`�ɉ�Pxk9�LN�y�zlc��lC-� � �]��4��a�����ׅ(a9=��Y�S�H.�)..�y��ps�+�Gz�D4�q��`��p�R��B��LP����LѣhL�����y)�b�~_G!��d�����n� P(�D�:J��K�_���7a�V<�!-k�'���i����~�!��F�%.�$��6'���Ec��S�qv���nB�6B<�Y{�Q�r����l|]����g����8�Y��1h�����p{�'Re��s?�zTC����R�fX��J�/p7W΅��q\_�-����]�8o w�]�kh���ݔ$f �Q#W�FO<�k�fШ�ۯ11���:2u ����¦�T<2tNO��˨#r#b����'������x���ZR0�����7JP� �#�9�a�5#���r'V����<��!p�Vp2�Y��J��+�~Q>�6R�9$D$�.������*��a8�ה���Ҹ�ӌ�C�I��=`��u�ĚpFGg�lGC�ͺJ�����¯U�z��^�w�h6��MR�K��V��;җX�,�/#��B3�>�|C��q7�E���ךh������w��eJ\L�YZ*�A��Z��ۙÓ�d���w`]���N��] P���`��x��)Ҽ��!2�y�;Q�K1D �b�.����m&f$�L����hr����xu���u�[o]𢭜%�@Z��;�ɂ6UNJ�����~}:��C����������������h{{�V�@<u��A��B�s]㒞�"������=�u�V�zc��"Y�����ӿ��e��7�в=���d�4M���ڍ���.�e�S��'�VL*��z����&��|�[�$�����4�N�b�L��� ��7��x�����4�̲���Z{�3᩻%���~U��hea�Dz�"9��M�}u�IL���bL:�Vv6�teX�d��KE�IH˙�7�����Da�=RpU(���72� m�p���~J�7��l%����5��Q'N��v��"�O,qtJx1��N���#������[jJ)u5C?į������9��'`މ����N��Ո�*Ѐ�^�l��S�=)�xI�9J�'�G�"^GZ:���Y��Y� I��i77�����Lz(���ì���7��J�yqH�lz��,��Rb�1���IX��U"��cW�oNMU��t:asB�c �Q�6�@G��f���r��vat�<�P�sy��J�[�����1F���|dj������Q;ĪgNN�}kU��k�����n����H���bA$���+���<�7u�-gSC�`b�=�:/i�����Fu�2a5W���vo��ELw�O��,��y�ڌ�tbJZ��X}���Q��]��ګW=c�U��"�n���n�w}�*��������\�&�(��T/B�ڸ��,#�.2N�� ������{d5�ⵥ�Z�� ōU����h��,�j��`]g(Vr��"��7�r���>v�~bjfkc|�;�r~�E�5���E�G�k�c���3:��C��1-o��D������;|��*O��7����9�:Ʈo���X�D��';˄|h��r�ժ��yQ� �x����(BB��1uv��<���a�S]̐� ną����ܽ��9�6�V �d���0|zR�ir����!�������S�`QK�ҹ�*�t��P�M�[�6�A�WET0��Z��$�o��L7+'3������m �P�dM��-|� 鰉���e�A�{0�Fb@���,�>Gլ���qp�ie3T�Z3�_��ʶ��&�d����й�T�ʕ,�Aj7J�4y-�ّe�����p���3�:��vj�g�a=�u<���? �L�q� ۛ~D�!��}s��9�wA -"D�'24��*U�����w PvJ�m�J��v�7�� �M*�!s��~�@R����r�,9>�v���,�?�@�.O?����̢s����N5����
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE