UpdateLoader.zip
- SHA256 75409502dd5c1a2cfbba01879c8f18a4f8e1fdef047b7aa92ed6e3d83d1eb0bc
Behavioral task
behavioral1
Sample
UpdateLoader/BthMtpContextHandler.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
UpdateLoader/BthpanContextHandler.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
UpdateLoader/Loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
UpdateLoader/Loader.exe
Resource
win11-20260513-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
UpdateLoader/bthpanapi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target UpdateLoader.zip
- Size 124KB
- Sample260615-m5vwpacz4k
- SHA256 75409502dd5c1a2cfbba01879c8f18a4f8e1fdef047b7aa92ed6e3d83d1eb0bc
- MD5 35bfd9b253e6b8cf49b4ce823ef05e02
- SHA1 c06892b407b6f4a35583f092df14a9d2d1fdc2b2
- SHA512 2cba82a200f50697ecf1ade250e8209294f5ecdad43ab7665f6b405bd6850f71fd06e2628844e9bfda23733d1442dad277588dccb8438f69bcdba9f88dfe7508
- SSDEEP 3072:HyuaEn5kLDdNmAvygWRrfcNCvvBkXvWpJ4ebuZ08ObUtf:H4E5aNmYygWRVvkvWP4anbUx
- TLSH T17FC312EC6B67C624CCB3346E5948A8A78228EAC35C0665BA0FD141EB0CF63CFDD55930
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
njrat
Version
-
<- NjRAT 0.7d Horror Edition ->
Botnet
-
Victim
C2
-
63.176.170.12:1337
Mutex
-
dbae904fde8f2aa44f306dda3a3b78b9
Attributes
-
reg_key
dbae904fde8f2aa44f306dda3a3b78b9
-
splitter
Y262SUCZ4UJJ
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/UpdateLoader/BthMtpContextHandler.dll unpack001/UpdateLoader/BthpanContextHandler.dll unpack001/UpdateLoader/Loader.exe unpack001/UpdateLoader/bthpanapi.dll
File Explorer
-
UpdateLoader.zip.zip 124KB
-
UpdateLoader/BthMtpContextHandler.dll.dll 52KB
-
UpdateLoader/BthpanContextHandler.dll.dll 204KB
-
UpdateLoader/Loader.exe.exe 55KB
-
UpdateLoader/bthpanapi.dll.dll 56KB
UpdateLoader/BthMtpContextHandler.dll
- IMPHASH 2566a36f0a698844682a8a82baa49e5f
- SHA256 4ffad3183133ff3490f396838d86ce0c64a672337333d00aadcbf49984728a5a
- MD5 220fa4a0391316bea0bfe5210f9c01e9
- SHA1 f3d9d093c9e3a98775c2ddb451550b5592c0ddf0
- SHA512 205739d245212de265f6d52665a8ddf44979e6e171a6b7d1842ae59a2e6ec2b74947f772d17308baa588bb8841c02a86ac9fb8a0be9dc17777b3c32e71a9099d
- SSDEEP 1536:ChZ35oO8HHR+I4n44hbyyTt10B1O8EtDW92xQu0:yZefHHR+IgRbx8ya92yj
- TLSH T192332B7D96AC18B5F27712BD85A30A20E632742A171186DF716C836D1F3A7E05E38BD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
19760
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
BthMtpContextHandler.pdb
msvcrt
??1type_info@@UEAA@XZ
__CxxFrameHandler4
_lock
_CxxThrowException
__dllonexit
_unlock
_onexit
_initterm
_amsg_exit
_XcptFilter
__C_specific_handler
_callnewh
malloc
free
vswprintf_s
_vscwprintf
memmove_s
memcpy_s
?terminate@@YAXXZ
memset
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableFlags
UnregisterTraceGuids
TraceMessage
GetTraceEnableLevel
api-ms-win-core-com-l1-1-0
CoTaskMemFree
PropVariantClear
CoTaskMemAlloc
CoCreateInstance
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
api-ms-win-core-libraryloader-l1-2-0
LoadResource
LockResource
FindResourceExW
SizeofResource
DisableThreadLibraryCalls
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer
api-ms-win-core-heap-l1-1-0
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
shlwapi
SHStrDupW
ord158
ord199
ord219
user32
UnregisterClassA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=36, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=28900,
count=13, id=260, version=28900,
count=95, id=1, productName=Unmarked objects,
count=9, id=257, version=28900,
count=9, id=261, version=28900,
count=1, id=256, version=28900,
count=8, id=264, version=28900,
count=1, id=255, version=28900,
count=1, id=258, version=28900,
UpdateLoader/BthpanContextHandler.dll
- IMPHASH 7a12c29a5ce8613c8d499d0959080336
- SHA256 f8230a66edcb343e542ab4b4b0dfd3156db77c2ec35ea9d81633a97f64899e57
- MD5 1e345a3fb5bbc97aa6cccd3f42231d56
- SHA1 ce6b1cb0a2806b10c2d374d02dc3e17238950c82
- SHA512 d24163a878ccf919b23ed802b3136ee9636ed3207ce0bb0a633af5d36dac811ceeb65febf4d28ad18474b8ae16db6484db8482439b1a377f402980f058de9dda
- SSDEEP 3072:cVmpAo67bIMgA6LLFqKuVTeDvP5A11Ix8Z+EUN3S63dvSXNI0JMm:cVmKN77g5Fq7TeD0Z5UMNIe
- TLSH T13514B3DA7E78106AF065547482934A37972E7C211BC213DB21E4B2A9EF332E8ED3D750
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
78816
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
BthpanContextHandler.pdb
msvcrt
__C_specific_handler
wcscpy_s
free
wcscat_s
wcsncpy_s
_vsnwprintf
memcpy_s
_vsnprintf_s
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
malloc
_purecall
memmove_s
??_V@YAXPEAX@Z
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
__CxxFrameHandler4
??1type_info@@UEAA@XZ
_errno
realloc
??3@YAXPEAX@Z
memset
advapi32
FreeSid
OpenThreadToken
OpenProcessToken
DuplicateToken
GetTokenInformation
EqualSid
AllocateAndInitializeSid
TraceMessage
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
kernel32
HeapReAlloc
HeapSize
GetCurrentThread
GetCurrentProcess
CreateSemaphoreExW
VirtualFree
VirtualAlloc
LoadLibraryExA
EncodePointer
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
DecodePointer
HeapDestroy
LockResource
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
EnterCriticalSection
LeaveCriticalSection
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
CloseHandle
ReleaseMutex
ReleaseSemaphore
ReleaseSRWLockExclusive
WaitForSingleObjectEx
AcquireSRWLockExclusive
FormatMessageW
GetCurrentThreadId
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
OutputDebugStringW
SetLastError
SetEvent
WaitForSingleObject
OpenSemaphoreW
FreeLibrary
lstrcmpiW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
CreateEventW
QueueUserWorkItem
Sleep
LocalFree
InitOnceBeginInitialize
GetCurrentProcessId
CreateMutexExW
InitOnceComplete
ole32
PropVariantClear
CoTaskMemRealloc
CoMarshalInterThreadInterfaceInStream
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoGetInterfaceAndReleaseStream
oleaut32
VarUI4FromStr
shell32
SHGetItemFromObject
shlwapi
ord16
StrToInt64ExW
SHStrDupW
ord158
user32
UnregisterClassA
SendDlgItemMessageW
SendMessageW
LoadIconW
InsertMenuItemW
DestroyMenu
SetWindowLongPtrW
CreateDialogParamW
DestroyWindow
MessageBoxW
ShowWindow
MsgWaitForMultipleObjects
DispatchMessageW
PeekMessageW
CreatePopupMenu
SetCursor
CharNextW
LoadStringW
LoadCursorW
bthpanapi
BluetoothCloseNetworkHandle
BluetoothCreateNetworkHandle
BluetoothGetIncompleteConnectedNetworkHandle
BluetoothGetNetworkAddress
BluetoothConnectToNetwork
BluetoothDuplicateNetworkHandle
BluetoothGetNetworkStatus
BluetoothDisconnectFromNetwork
rasapi32
RasEnumConnectionsW
RasEnumEntriesW
RasGetEntryPropertiesW
RasHangUpW
ext-ms-win-bluetooth-apis-l1-1-0
BluetoothGetDeviceInfo
ext-ms-win-bluetooth-apis-internal-l1-1-0
BluetoothFindFirstServiceEx
BluetoothFindFirstClassId
BluetoothFindNextClassId
BluetoothFindNextService
BluetoothFindClassIdClose
rasdlg
RasDialDlgW
devobj
DevObjCreateDeviceInfoList
DevObjEnumDeviceInfo
DevObjGetDeviceProperty
DevObjDestroyDeviceInfoList
DevObjGetClassDevs
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
80KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=28900,
count=16, id=260, version=28900,
count=211, id=1, productName=Unmarked objects,
count=25, id=257, version=28900,
count=14, id=261, version=28900,
count=1, id=256, version=28900,
count=14, id=264, version=28900,
count=1, id=255, version=28900,
count=1, id=258, version=28900,
UpdateLoader/Loader.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8d0b0be3fe34cab2f83649ed46a208e17536d598d04de73597d3f0ea4a35cb1b
- MD5 f35b3b25eb6767fc6cf9f1a16464d2a9
- SHA1 78885e86a0680e9c1d00216ffb01f27397f2e6ea
- SHA512 c7678b95fd114c5466a2cedbebfab192b853c7d93c379ad5c9af8c20f5b1ad91341e6271385b6eebe29fd3c58d66b6e102718fb1924c39fd27c63233ce062654
- SSDEEP 1536:GBWdMDncNS9yqNOdDvwsNMDVXExI3pmmm:1dMDnNUqYdDvwsNMDVXExI3pm
- TLSH T160431744BFEA4A05E2BD8F3468F645150634BA63E532EB1F48D668DB17327C58C80FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
61982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UpdateLoader/bthpanapi.dll
- IMPHASH d4ad5f8e99edb538a128294cdae6cbc8
- SHA256 ebb8ac77dcb848333ba50eeb410c3e4e5dc71761ba64150a11e9c35351dcb438
- MD5 e7fdf1728737d62012c7f7c5c3ce940e
- SHA1 5ba3b08a6958605b24d552627111e5c732b90bd9
- SHA512 38d1e89761a6c6a49f7d38e3a3010d56adb5ad97786b113100d4b5a33d95743810ed9003ab530e8cabe5be36e5a7b7dbedb8e93ec11d6f9a456d87c082c42894
- SSDEEP 768:8jdqzQ5xLlOsxzux4dohNIn+141y3SX9bCrSzl0qj5etlE4:BQ5xZBzsMn1SWb4Sz+qj5Glf
- TLSH T152434A6EA7A41075E0A2427C86630E52EA73F47817625BDF51F0C2AD0F673E05B39BC6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
18976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
bthpanapi.pdb
msvcrt
_CxxThrowException
__CxxFrameHandler3
memcpy
??1type_info@@UEAA@XZ
_onexit
__CxxFrameHandler4
__dllonexit
memmove
_lock
__C_specific_handler
_initterm
free
_amsg_exit
_XcptFilter
_callnewh
_unlock
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_purecall
??3@YAXPEAX@Z
malloc
memset
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
WinSqmIncrementDWORD
kernel32
CloseHandle
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
SetEvent
CreateEventW
DisableThreadLibraryCalls
advapi32
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
GetTraceLoggerHandle
ole32
CoWaitForMultipleHandles
PropVariantClear
CoUninitialize
CoTaskMemFree
CoInitializeEx
CoCreateInstance
iphlpapi
GetIfTable2
GetIfEntry2
FreeMibTable
NotifyIpInterfaceChange
CancelMibChangeNotify2
ext-ms-win-bluetooth-apis-l1-1-0
BluetoothGetDeviceInfo
BluetoothCloseNetworkHandle
BluetoothConnectToNetwork
BluetoothCreateNetworkHandle
BluetoothDisconnectFromNetwork
BluetoothDuplicateNetworkHandle
BluetoothFindFirstNetwork
BluetoothFindNetworkClose
BluetoothFindNextNetwork
BluetoothGetIncompleteConnectedNetworkHandle
BluetoothGetNetworkAddress
BluetoothGetNetworkAvailableRoles
BluetoothGetNetworkContainerId
BluetoothGetNetworkInterfaceId
BluetoothGetNetworkName
BluetoothGetNetworkStatus
BluetoothRegisterNetworkNotifications
BluetoothUnregisterNetworkNotifications
Name
.text
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
452B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=260, version=28900,
count=4, id=259, version=28900,
count=63, id=1, productName=Unmarked objects,
count=13, id=257, version=28900,
count=9, id=261, version=28900,
count=1, id=256, version=28900,
count=7, id=264, version=28900,
count=1, id=255, version=28900,
count=1, id=258, version=28900,