Yeni klasör.rar
- SHA256 b019f39f83f17429e622d7dfa50b4a2777d3aa6fa0c78774baba3531c6c99e64
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Yeni klasör/forevercheats.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral2
Sample
Yeni klasör/injector.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
General
- Target Yeni klasör.rar
- Size 152KB
- Sample260727-mls8radk2v
- SHA256 b019f39f83f17429e622d7dfa50b4a2777d3aa6fa0c78774baba3531c6c99e64
- MD5 e0103823663e9709f5e558039a250071
- SHA1 cddefb49438548b78945b9940c39ede08bd4bc11
- SHA512 c67e721cd2894255f5afb803b6e320b09f4c49169aa166d503687e69107145c2d936fdf83b6b12115939f458dcbf881445bfa28bea4baf340959ff7e28a9d781
- SSDEEP 3072:emRL4PMOC1qQv0kYFAAt8+4YMho+yZL3lxL+kAIFzMHq:eH9fe0ke+YMq+yZzKkAItWq
- TLSH T1A3E31260BD0F4A12C6F6E9B0203CDAAE6106D33DF46F23B4A25F425CBD5667B3019D1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Yeni klasör/injector.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Yeni klasör/forevercheats.dll
File Explorer
-
Yeni klasör.rar.rar 152KB
-
Yeni klasör/forevercheats.dll.dll 423KB
-
Yeni klasör/injector.exe.exe 23KB
Yeni klasör/forevercheats.dll
- IMPHASH 2bd6b483c0104db20ac460c160a9a23c
- SHA256 3b8be171321515c3f62c4bb605d3eb15bea2a1c41af2b005b58f6af34d971c1d
- MD5 961ef6abc42cc59a3fb27bfe792480e0
- SHA1 2da3d4ec571b1522de288e4e34bae3bb0b521fba
- SHA512 61a41bfa62cb2bd7c28327d401bb5c20ec43d48b00e5c7016e847b086a5f2ce961cf40ed7a105cfc838dc7b8213c6b2ac8399eeb5632110979878a0cbf8c7c1d
- SSDEEP 12288:nTUU6nrsUoGvobg1V6CZ4myBnDnpynmcmnEA/QK:ngTnZ6CZ4m+nD0nwEA/QK
- TLSH T1F1945C1DD291026CE077F5B46AB38512FA71384D0379A9DB57D098B91F2ABD4A33FE02
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
9a:f2:93:a7:d9:25:ae:d8:b3:b4:d6:fc:26:44:5d:f4:32:5e:94:02:13:3d:9a:d6:c9:28:64:c6:0e:55:9f:49
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN
Chains
Jul 24, 2026
CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN
Subject
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
Serial Number
47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN
Serial Number
36:ea:f6:1d:c3:95:f6:30:41:f4:24:7d:ae:76:ab:7e
Issuer
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 9, 2016 - Aug 12, 2018
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
313600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\ıkıkıııkıık\Desktop\valorant src\Private\forevercheats\x64\Release\forevercheats.pdb
kernel32
GetModuleHandleA
Sleep
DisableThreadLibraryCalls
GetCurrentThread
CloseHandle
GetProcAddress
GetModuleHandleW
VirtualAlloc
GetTickCount
GetTickCount64
GetFileAttributesA
WideCharToMultiByte
VirtualProtect
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
GetFileAttributesExW
FormatMessageA
VirtualQuery
CreateFile2
AreFileApisANSI
GetLastError
GetFileInformationByHandleEx
MultiByteToWideChar
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
user32
CallNextHookEx
GetCursorPos
GetAsyncKeyState
GetSystemMetrics
MessageBoxA
msvcp140
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??7ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?narrow@?$ctype@_W@std@@QEBAPEB_WPEB_W0DPEAD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?uncaught_exceptions@std@@YAHXZ
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?good@ios_base@std@@QEBA_NXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?_Syserror_map@std@@YAPEBDH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Winerror_map@std@@YAHH@Z
?_Id_cnt@id@locale@std@@0HA
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
winmm
PlaySoundW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
__std_exception_copy
__std_terminate
__C_specific_handler
memcmp
memcpy
memmove
memset
__current_exception
__current_exception_context
_CxxThrowException
__std_type_info_destroy_list
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_errno
_execute_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
_initterm_e
_initterm
_crt_atexit
_beginthreadex
_cexit
_seh_filter_dll
abort
api-ms-win-crt-stdio-l1-1-0
fflush
fclose
fwrite
_get_stream_buffer_pointers
_fseeki64
fread
__stdio_common_vswprintf_s
fputc
__stdio_common_vsprintf_s
fsetpos
fgetc
fgetpos
setvbuf
ungetc
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-string-l1-1-0
isdigit
wcslen
towlower
strlen
wcscpy_s
tolower
api-ms-win-crt-convert-l1-1-0
strtod
mbstowcs
strtof
strtol
api-ms-win-crt-math-l1-1-0
sqrtf
sqrt
fmin
fmodf
powf
sin
fmod
cosf
cos
atan2
atan
acos
sinf
fmax
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
windowsaudiocore85
Name
.text
Size
313KB
Virtual Size
313KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
496B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35721,
count=8, id=260, version=35721,
count=29, id=261, version=35721,
count=6, id=257, version=35721,
count=9, id=257, version=33145,
count=249, id=1, productName=Unmarked objects,
count=5, id=265, version=36248,
count=2, id=259, version=36248,
count=1, id=256, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,
Yeni klasör/injector.exe
- IMPHASH 194fa51a1bba1a03bf2643ba920ade49
- SHA256 b131f70f3f0bb2026bebe5d6143bff2e37c747560932f126bd8c4a6a9c6837fd
- MD5 37dd792f9348ff6e03add0ec53a43a5f
- SHA1 e286d88427974f0429bea452cba49061ee78f24a
- SHA512 754c0b921ea6aee2f15cd5de055bad9ee8de08bde76b0bbe3f57ce5493c0c068ad607f1477a2909ee47814150a488948c2da22073826d09b82104b646141ab7e
- SSDEEP 384:DZSbiQai6piV9rVc29FoPPWAwLzEM43yA22oLZAvXa6U3jZTpz:DI5a9pi3rVc2PoP5M43yn2o9eY39Tp
- TLSH T1DCB21A56F7560CE5E1BB537D4AE20A16C2B2B9072761A3CF538292160FFB7D26D3AC01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
11424
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\Users\ıkıkıııkıık\Desktop\Yeni klasör\output\injector.pdb
ole32
CoInitializeEx
CoTaskMemFree
CoCreateInstance
dbghelp
ImageDirectoryEntryToData
kernel32
SetUnhandledExceptionFilter
InitializeSListHead
GetCurrentProcessId
GetCurrentThreadId
GetModuleHandleW
Sleep
GetLastError
GetProcAddress
LoadLibraryExW
GetSystemTimeAsFileTime
QueryPerformanceCounter
user32
GetWindowThreadProcessId
GetAsyncKeyState
FindWindowW
PostThreadMessageW
SetWindowsHookExW
msvcp140
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Xlength_error@std@@YAXPEBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?good@ios_base@std@@QEBA_NXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
__std_exception_destroy
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
memcpy
memmove
__std_terminate
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_exit
_seh_filter_exe
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
exit
_set_app_type
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_get_initial_narrow_environment
_configure_narrow_argv
_initterm_e
_initialize_narrow_environment
system
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-string-l1-1-0
wcslen
strlen
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
432B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
84B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35721,
count=10, id=260, version=35721,
count=25, id=261, version=35721,
count=6, id=257, version=35721,
count=1, id=260, version=33145,
count=9, id=257, version=33145,
count=101, id=1, productName=Unmarked objects,
count=1, id=265, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,