فضي ابيض.rar
- SHA256 11181132cefbab11fec4f051cedd061a259f3f772cea677420b1dec61f616def
Password
1
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
فضي ابيض/فضي ابيض/Creative EAX Setting.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
فضي ابيض/فضي ابيض/Guna.UI2.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
فضي ابيض/فضي ابيض/VoicemeeterRemote.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target فضي ابيض.rar
- Size 998KB
- Sample260623-vm5l6set9l
- SHA256 11181132cefbab11fec4f051cedd061a259f3f772cea677420b1dec61f616def
- MD5 8c0ebaf21bbf7c80816b25586997c08f
- SHA1 36790dc9f801964e7133d08fe6bc1b645c483712
- SHA512 41bf9641b817b02377d8cf3a1989658f4aa81189a69d33b9b0ddc3fbbd87da76fbedb5aaf1780ee1ee63a1d965223ebdaf2d577ebd3dcea23e433d1932bfe130
- SSDEEP 24576:Vw8jpfD0lilamwrsxZ05VT6MDuMM3yQkzaYWiA:VZ9lpwrsxkprxMiQkmY8
- TLSH T1E625237C25C5110BC82EB1C5AC158A9EF7C7C78086FB5B877E78E293E9444928D89B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/فضي ابيض/فضي ابيض/Creative EAX Setting.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/فضي ابيض/فضي ابيض/Guna.UI2.dll
File Explorer
-
فضي ابيض.rar.rar 998KB
-
فضي ابيض/فضي ابيض/.vs/Creative EAX Setting/FileContentIndex/c5bb16d9-1768-4eaa-8190-7c9e4d451ccc.vsidx179B
-
فضي ابيض/فضي ابيض/.vs/Creative EAX Setting/v18/.suo5KB
-
فضي ابيض/فضي ابيض/Creative EAX Setting.exe.exe 352KB
-
فضي ابيض/فضي ابيض/Guna.UI2.dll.dll 2.1MB
-
فضي ابيض/فضي ابيض/VoicemeeterRemote.dll.dll 156KB
فضي ابيض/فضي ابيض/.vs/Creative EAX Setting/FileContentIndex/c5bb16d9-1768-4eaa-8190-7c9e4d451ccc.vsidx
- SHA256 88b78fab3fa0ed9577b8b29f4210eeb9628d280498162dc050633d326fd66d27
- MD5 6653fb584aa8944bbda4395365b98814
- SHA1 d605c8820f5b5e8a874caf1b804cfa4fa4ca1f65
- SHA512 eb43d7c553410fb8ec37f883ec7cf22636347a6fa82b5d6ed350a170199ac137d424d2f3e4546a8b6ff4375a2622124f553efa0efad5f9a13c3b20c9b9412064
- TLSH T143C01249E860984FD82731B183A7C2BC0FA95411C420E78B4EC149847C509D917D7607
- MD5 SHA1 SHA512 TLSH
فضي ابيض/فضي ابيض/.vs/Creative EAX Setting/v18/.suo
- SHA256 9049776d7413d08ad20118cc77a0b079f39eef3fad9a11f989346003da9e3586
- MD5 87298d845b3f444583a4e21e9c853492
- SHA1 79f700df259a3058b4e6f511d523a2070ff0bc72
- SHA512 0c3dd5dfcf9809e11663eba626f2b0791de59eeada6a71496b01ffa7bc21b8c40676cf3a63fe4d9eb6789fdffcc31bf8aa03255bb843587739a7e24368ac00c0
- SSDEEP 12:rlR7F295iMrjQeyrjXCaF2JXHOhrrjQeyrjECqRTPaLbqTdg77KzJqdAOvbHVMC6:ro9TXQdXK2XQdX8NGOmrDWCc4hCXtC
- TLSH T1F1B103813662D621E1650F759C35F9A5563D7C21EDC0E25B3682BB4F4A329D0A802F33
- MD5 SHA1 SHA512 SSDEEP TLSH
فضي ابيض/فضي ابيض/Creative EAX Setting.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 68002a1b71695cf5466960b82a2f37ca09d5a7f3d65027a77f63c153bb8110e0
- MD5 9a4c6d1ef6e898bd80eeba589522ccd0
- SHA1 8c86df779c92cfceb394c327b3426c9bb9999d19
- SHA512 7ccd64ac89644cc7d0576ccfca1b30b557af98440a1af26d499d5847a5261930a4d3ce2ecc24d79481d6889ccf000a04f93a94a8ee555d6bf81d40614a77616b
- SSDEEP 6144:vZaU2cfwntq+Ma7QReRooYLzin9csjuFYLzin9/Mt+LfRAybdBCeYLzin9:QUletX7hXcs9xKFcs9kt+dvBjcs9
- TLSH T1B374CFE933786F16CB3E67F2165361C197F3980738B0DA4A1DCD30CA4766B884646AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1
Minor OS version
0
Major OS version
4
Entry point
332750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
317KB
Virtual Size
316KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
فضي ابيض/فضي ابيض/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
- MD5 58459aefb74d5ff786b9efb982d44eab
- SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
- SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
- SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
- TLSH T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
1
PE Signature issue
Digest
0c:8b:14:20:bc:10:db:d0:29:b9:4e:67:9d:b2:a6:c7:df:c3:b3:87
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 18, 2025
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Minor OS version
0
Major OS version
4
Entry point
2188846
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
فضي ابيض/فضي ابيض/VoicemeeterRemote.dll
- IMPHASH f88eca84e5bd78d6db1efaf50cfb9972
- SHA256 5d85a8e00c714a707a65671936fb49611f4e7751a9065c618804ed5ca47872cb
- MD5 79b4ef6b17d0a8bb825437773c1d8e3f
- SHA1 255fbeb8ad45faad93afeac2afa2cb7e7d78d079
- SHA512 0c76b45b3c311f34de0087755d63e7966edf24ad77360897475854ff66421ce55e93f35a78ea10f15cce8ccc505618d12dd6114eabc89b73a1e468f5b16799f9
- SSDEEP 3072:+cvA+X1yaikOLqMvbJl1rvVygoP5UG7GjSVX:PYH1rtyrQjS5
- TLSH T1E6F3AF1376D240F6D5813EBD14E7373BEF3AAA5648668E438B98DD521C31352BB2620F
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
1
Digest
13:66:36:5a:25:0b:71:6a:b7:25:77:01:32:d2:54:d0:a9:df:36:cd:27:58:52:f7:07:15:6b:65:4f:68:9e:ae
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=423 734 177,CN=BUREL VINCENT Entrepreneur individuel,O=BUREL VINCENT Entrepreneur individuel,STREET=21 avenue des Marguerites,L=Eymet,ST=Dordogne,C=FR,1.3.6.1.4.1.311.60.2.1.3=#13024652,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Dec 11, 2025
SERIALNUMBER=423 734 177,CN=BUREL VINCENT Entrepreneur individuel,O=BUREL VINCENT Entrepreneur individuel,STREET=21 avenue des Marguerites,L=Eymet,ST=Dordogne,C=FR,1.3.6.1.4.1.311.60.2.1.3=#13024652,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
SERIALNUMBER=423 734 177,CN=BUREL VINCENT Entrepreneur individuel,O=BUREL VINCENT Entrepreneur individuel,STREET=21 avenue des Marguerites,L=Eymet,ST=Dordogne,C=FR,1.3.6.1.4.1.311.60.2.1.3=#13024652,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=423 734 177,CN=BUREL VINCENT Entrepreneur individuel,O=BUREL VINCENT Entrepreneur individuel,STREET=21 avenue des Marguerites,L=Eymet,ST=Dordogne,C=FR,1.3.6.1.4.1.311.60.2.1.3=#13024652,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
SERIALNUMBER=423 734 177,CN=BUREL VINCENT Entrepreneur individuel,O=BUREL VINCENT Entrepreneur individuel,STREET=21 avenue des Marguerites,L=Eymet,ST=Dordogne,C=FR,1.3.6.1.4.1.311.60.2.1.3=#13024652,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
02:63:b9:b0:fb:b3:01:be:bb:d1:47:f4
Issuer
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 21, 2025 - Jul 22, 2027
Subject
CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE
Serial Number
84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4
Issuer
CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 15, 2025 - Jan 10, 2037
Subject
CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE
Serial Number
83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f
Issuer
CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 16, 2025 - Jul 16, 2041
Subject
CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
76:53:fe:b9:3d:d9:e7:e9:26:32:ac:d6:0a:be:ac:38
Issuer
CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2020 - Mar 18, 2045
Minor OS version
0
Major OS version
4
Entry point
58027
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcess
VirtualFree
VirtualAlloc
QueryPerformanceFrequency
DeviceIoControl
CreateEventA
GetModuleHandleA
GetProcAddress
LoadLibraryA
FreeLibrary
OpenFile
GetModuleFileNameA
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
TerminateProcess
RtlUnwind
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
CloseHandle
SetFilePointer
GetLastError
LCMapStringW
LCMapStringA
GetOEMCP
CreateFileW
WriteFile
GetCurrentThread
SetThreadPriority
CreateThread
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetTickCount
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
Sleep
UnmapViewOfFile
GetACP
GetCPInfo
ExitProcess
GetVersion
GetCommandLineA
HeapFree
HeapReAlloc
HeapAlloc
InterlockedIncrement
InterlockedDecrement
user32
CharLowerBuffA
advapi32
RegEnumKeyA
RegOpenKeyExW
RegEnumKeyW
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyW
RegQueryValueExA
RegOpenKeyA
RegCloseKey
shell32
ShellExecuteA
ole32
CoInitialize
CoCreateInstance
CLSIDFromString
CoUninitialize
CoTaskMemFree
PropVariantClear
setupapi
SetupDiGetDeviceInterfaceAlias
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiOpenDeviceInterfaceRegKey
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
winmm
timeBeginPeriod
waveInGetDevCapsW
waveInGetNumDevs
waveOutGetDevCapsW
timeEndPeriod
waveOutGetNumDevs
VBVMR_AudioCallbackRegister
VBVMR_AudioCallbackStart
VBVMR_AudioCallbackStop
VBVMR_AudioCallbackUnregister
VBVMR_GetLevel
VBVMR_GetMidiMessage
VBVMR_GetParameterFloat
VBVMR_GetParameterStringA
VBVMR_GetParameterStringW
VBVMR_GetVoicemeeterType
VBVMR_GetVoicemeeterVersion
VBVMR_Input_GetDeviceDescA
VBVMR_Input_GetDeviceDescW
VBVMR_Input_GetDeviceNumber
VBVMR_IsParametersDirty
VBVMR_Login
VBVMR_Logout
VBVMR_MacroButton_GetStatus
VBVMR_MacroButton_IsDirty
VBVMR_MacroButton_SetStatus
VBVMR_Output_GetDeviceDescA
VBVMR_Output_GetDeviceDescW
VBVMR_Output_GetDeviceNumber
VBVMR_RunVoicemeeter
VBVMR_SendMidiMessage
VBVMR_SetParameterFloat
VBVMR_SetParameterStringA
VBVMR_SetParameterStringW
VBVMR_SetParameters
VBVMR_SetParametersW
Name
.text
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=14, version=7299,
count=1, productName=Unmarked objects (old),
count=19, id=19, version=8034,
count=207, id=1, productName=Unmarked objects,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=143, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,