28d10ed6_.zip
- SHA256 d0f6ff7cc827359d435e6450a1ffaf54720975d46ba3a5c568856e131179a8ac
Behavioral task
behavioral1
Sample
libtcmalloc_minimal.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
libtcmalloc_minimal.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
樱桃播放器.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral4
Sample
樱桃播放器.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 28d10ed6_.zip
- Size 32.4MB
- Sample260703-e7znnabv4z
- SHA256 d0f6ff7cc827359d435e6450a1ffaf54720975d46ba3a5c568856e131179a8ac
- MD5 f59eca1f79d7784ec93767962adcceaa
- SHA1 7f43a1aff72447bd769dfd80f6204bc09ba26f04
- SHA512 c430a66ca9bfb2781fd36278eab82df29c93167a780d1275531c8dfe1490d96fcba623d11550bb067518c74492c53afdbe9ecb019d80eef4d8d458363fa809a3
- SSDEEP 786432:43eqA8OjFDsyMZ+fIYe/3Z7q/TZe8L8QXhETODVsgY8G4ApqgihtIYSV:4uj/sQIYcZ7qLZe8oQXhDVsTUeq38V
- TLSH T131773385A5F1AA47EDF29D11575C4EEE018B497EB7FA40FA222897A8CF84EF4005F134
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/libtcmalloc_minimal.dll vmprotect - DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/libtcmalloc_minimal.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/libtcmalloc_minimal.dll
File Explorer
-
28d10ed6_.zip.zip 32.4MB
-
libtcmalloc_minimal.dll.dll 32.3MB
-
使用说明.txt160B
-
樱桃播放器.exe.exe 1.4MB
libtcmalloc_minimal.dll
- IMPHASH 52c46e82ff2aab5175587317371ff75f
- SHA256 760bfe0b357f2a8b7e2d871c0aebdc3b1748087444203e129c82da12a2543b06
- MD5 bedbc61cc3eaad49c6895d886f29fb02
- SHA1 275b7c048b01881618b50063667e352c2c9a8272
- SHA512 8bbc6c00f2149142390305064a8cd67119ae91934309f0dc434d224f1101e2595406cab91d22e331f3d70fb3bb42b678ff744f071c7bd90a84b7f01c59156f20
- SSDEEP 786432:obmhPeBofEYgcw25rMOEBlvLi6y33N9V/mr1ed:wWPeIgcJEBR26ytw
- TLSH T14A7733AA1100B2F1DDE4A6BC85577B3D5C5DCD85F8ACCE97F8AEBA5EB831E500468034
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
67668453
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
kernel32
GetVersion
LockResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
AdjustWindowRectEx
gdi32
PtVisible
winmm
PlaySoundA
winspool.drv
ClosePrinter
comdlg32
GetSaveFileNameA
advapi32
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromString
oleaut32
UnRegisterTypeLi
comctl32
_TrackMouseEvent
ws2_32
recv
_tcmalloc
Name
.text
Size
Virtual Size
758KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
30.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
335KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp0
Size
Virtual Size
592KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp1
Size
32.1MB
Virtual Size
32.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
260B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
207KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=44, id=19, version=8022,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=152, version=20115,
count=69, id=171, productName=VS2010 build 30319, version=30319,
count=46, id=158, productName=VS2010 build 30319, version=30319,
count=186, id=170, productName=VS2010 build 30319, version=30319,
count=661, id=1, productName=Unmarked objects,
count=23, id=19, version=8034,
count=18, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=104, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=84, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=46, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=33, productName=Unmarked objects (old),
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 Beta 1 [10.0] build 20506, version=20506,
count=1, id=157, productName=VS2010 build 30319, version=30319,
使用说明.txt
- SHA256 521bf6981a06adfdf4b77834d981a9e81aad139a669dcd4b2165e61ab5ed8c41
- MD5 a05639248b509cf4c51316bfb2c4595a
- SHA1 2fc5cba0d624c18ad50b94df5cb73a18f18803a2
- SHA512 de41db59ff126b946c1ffbf6ba57140afeb21146124bb3bed752e69f141400bd45f339b3db87efc32ee5d0899e741fccfdb347510545ef3cab44b750e41451fc
- TLSH T16FC04C429B69EE86A1431320AB682CA09189BE78B574B62A9586D7B765D85038102C1E
- MD5 SHA1 SHA512 TLSH
樱桃播放器.exe
- IMPHASH 0447a2a8db5cc2065178717b2246b28b
- SHA256 d62f68ac002ae90a2b7dcb154ff4cce3a05171a6714028c4b8eb3094e4520c4a
- MD5 7263fdf4d8521a0f45b7bc743218a4b8
- SHA1 ab35b84d5428bccb285f3c0374b3588702ceb311
- SHA512 6cd19899f082c4a2967c71cbfadb4dd9446e0fc1a215a0b41ee25552dc50fb463c789ba5ebb0ab1ce43f133d0d20a69a031d3a8499fd5655757e4f515211b24f
- SSDEEP 24576:Q+Wfrwc2hjiBfddEcGW0vs+6qvgNzTQIrUPopzFv73OZNUq8I8RmO:Wfrw8du/s+xoNzTrrUPUhvJq8DRmO
- TLSH T1C7659D317BD9813AE9A322319878AB5F593EB9641F7892DB93840E5D0D70BC25F3431B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d0:49:36:c3:3a:cb:9a:fa:e7:7d:39:fa:da:8c:9d:50:db:d7:6c:42:ca:ff:5a:26:ff:28:bb:38:be:3c:e2:7a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Hangzhou Shunwang Technology Co.\,Ltd,OU=QC Department,O=Hangzhou Shunwang Technology Co.\,Ltd,L=Hangzhou,ST=Zhejiang,C=CN
Chains
Jul 17, 2018
CN=Hangzhou Shunwang Technology Co.\,Ltd,OU=QC Department,O=Hangzhou Shunwang Technology Co.\,Ltd,L=Hangzhou,ST=Zhejiang,C=CN
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
PE Signature issue
Digest
72:bc:e9:9d:cb:18:4d:af:29:ee:7f:bb:08:19:8e:6a:73:69:8d:73
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Hangzhou Shunwang Technology Co.\,Ltd,OU=QC Department,O=Hangzhou Shunwang Technology Co.\,Ltd,L=Hangzhou,ST=Zhejiang,C=CN
Chains
Jul 17, 2018
CN=Hangzhou Shunwang Technology Co.\,Ltd,OU=QC Department,O=Hangzhou Shunwang Technology Co.\,Ltd,L=Hangzhou,ST=Zhejiang,C=CN
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Jan 28, 2028
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=Hangzhou Shunwang Technology Co.\,Ltd,OU=QC Department,O=Hangzhou Shunwang Technology Co.\,Ltd,L=Hangzhou,ST=Zhejiang,C=CN
Serial Number
15:8f:14:6c:36:58:92:d4:0b:f3:24:c3:38:fc:27:83
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 27, 2017 - Dec 27, 2018
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=Hangzhou Shunwang Technology Co.\,Ltd,OU=QC Department,O=Hangzhou Shunwang Technology Co.\,Ltd,L=Hangzhou,ST=Zhejiang,C=CN
Serial Number
4a:52:7a:b0:33:d3:94:a4:6c:8d:ef:40:4c:20:da:3c
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 1, 2018 - Jan 1, 2019
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=GlobalSign TSA for Advanced - G2
Serial Number
0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Issuer
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2018 - Mar 18, 2029
Subject
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:31:89:c6:50:04
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 2, 2011 - Mar 29, 2029
Minor OS version
1
Major OS version
5
Entry point
616797
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\slave\workspace\tightvnc\Release\BarRemoteSrv.pdb
kernel32
DecodePointer
EncodePointer
ExitProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineW
HeapSetInformation
GetStartupInfoW
HeapFree
GetSystemTimeAsFileTime
GetStdHandle
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
InterlockedExchange
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
InterlockedDecrement
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
QueryPerformanceCounter
GetTickCount
HeapAlloc
RaiseException
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetModuleFileNameW
WideCharToMultiByte
RtlUnwind
HeapReAlloc
MultiByteToWideChar
SetFilePointer
GetConsoleCP
GetConsoleMode
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleW
FlushFileBuffers
InterlockedExchangeAdd
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
ReadFile
GetNamedPipeInfo
CancelIo
WriteFile
LocalAlloc
DisconnectNamedPipe
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
DuplicateHandle
DeviceIoControl
CreatePipe
SetHandleInformation
ReleaseMutex
ResumeThread
GetLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
DeleteFileW
FindNextFileW
RemoveDirectoryW
FindClose
MoveFileW
SetFileTime
CreateDirectoryW
GetLogicalDriveStringsW
SetErrorMode
FindFirstFileW
GetFileSizeEx
GlobalUnlock
GlobalAlloc
GlobalLock
GetVersionExW
GetComputerNameW
WaitForMultipleObjects
CreateEventW
TerminateProcess
GetExitCodeProcess
SetEvent
CreateProcessW
WaitForSingleObject
FormatMessageW
LocalFree
InterlockedIncrement
LoadLibraryW
ProcessIdToSessionId
GetLastError
CreateMutexW
CloseHandle
GetCurrentThreadId
CreateFileW
GetCurrentProcess
SetUnhandledExceptionFilter
GetModuleHandleW
GetCurrentProcessId
Sleep
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LockResource
LoadResource
FindResourceW
FreeResource
FreeLibrary
OpenThread
OpenProcess
GetOverlappedResult
CreateNamedPipeW
ConnectNamedPipe
CreateThread
SetNamedPipeHandleState
CompareStringW
GetProcAddress
GetStringTypeW
SetEnvironmentVariableA
user32
IsClipboardFormatAvailable
MessageBoxW
LoadIconW
SetMenuDefaultItem
RemoveMenu
GetCursorPos
LoadMenuW
VkKeyScanExW
MapVirtualKeyW
GetKeyState
GetKeyboardLayout
ToUnicodeEx
EnumDisplayMonitors
GetThreadDesktop
OpenInputDesktop
OpenDesktopW
SendMessageW
MapWindowPoints
MoveWindow
FindWindowW
LockWorkStation
ExitWindowsEx
SetProcessWindowStation
CloseWindowStation
OpenWindowStationW
SystemParametersInfoW
DestroyWindow
GetMessageW
PostQuitMessage
TranslateMessage
IsDialogMessageW
CreateWindowExW
RegisterClassW
DefWindowProcW
DispatchMessageW
SetTimer
KillTimer
GetDlgItem
TrackPopupMenu
RegisterWindowMessageW
PostMessageW
GetSubMenu
SetForegroundWindow
GetWindow
GetWindowThreadProcessId
GetSystemMetrics
GetWindowLongW
GetForegroundWindow
SendInput
GetWindowRect
UnhookWindowsHookEx
SetWindowsHookExW
PostThreadMessageW
PeekMessageW
WaitMessage
CallNextHookEx
SetClipboardViewer
CloseDesktop
OpenClipboard
ChangeClipboardChain
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
GetDC
GetClassNameW
FindWindowExW
GetWindowInfo
GetCursorInfo
GetIconInfo
DrawIconEx
IsWindowVisible
EnumWindows
ChangeDisplaySettingsExW
EnumDisplayDevicesW
IsWindow
CreateDialogParamW
EndDialog
SetWindowLongW
SetClassLongW
DialogBoxParamW
SetWindowTextW
ShowWindow
GetWindowTextW
InvalidateRect
SetFocus
DestroyIcon
GetClientRect
EnumChildWindows
UnregisterClassW
ChangeDisplaySettingsW
GetUserObjectInformationW
SetThreadDesktop
psapi
GetModuleFileNameExW
libtcmalloc_minimal
_tcmalloc
ws2_32
gethostname
htons
ntohs
gethostbyname
getpeername
connect
select
getsockname
shutdown
setsockopt
inet_ntoa
bind
socket
inet_addr
WSAStartup
WSACleanup
ntohl
htonl
WSAGetLastError
closesocket
listen
recv
__WSAFDIsSet
accept
send
advapi32
RegDeleteValueW
SetServiceStatus
ImpersonateNamedPipeClient
RegOpenKeyExW
ReportEventW
DeregisterEventSource
RegisterEventSourceW
SetEntriesInAclW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertStringSidToSidW
CopySid
GetTokenInformation
RevertToSelf
ImpersonateLoggedOnUser
DuplicateToken
SetSecurityInfo
SetTokenInformation
CreateProcessAsUserW
ControlService
QueryServiceStatusEx
StartServiceW
ChangeServiceConfig2W
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
RegSetValueExW
RegCloseKey
RegDeleteKeyW
RegOpenKeyW
RegQueryValueExW
RegCreateKeyExW
RegEnumKeyW
RegCreateKeyW
DuplicateTokenEx
OpenThreadToken
OpenProcessToken
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
shell32
ShellExecuteA
Shell_NotifyIconW
SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteExW
ord680
CommandLineToArgvW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
comctl32
InitCommonControlsEx
gdi32
GetCurrentObject
ExtEscape
CreateDCW
GetBitmapBits
CreateCompatibleDC
SelectObject
DeleteObject
CreateDIBSection
DeleteDC
BitBlt
GetObjectW
GetDIBits
Name
.text
Size
754KB
Virtual Size
753KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
546KB
Virtual Size
545KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=66, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=26, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=154, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=221, productName=VS2013 UPD4 build 31101, version=31101,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=338, id=1, productName=Unmarked objects,
count=370, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,