AN9Picker.zip
- SHA256 2e5cf5c608cca2a89686bf26c1db036c3bea08d29155b5c767e7dec5f08aa716
Overview
overview
6Static
static
3An9VCamPicker.dll
windows10-2004-x64
3An9VCamPicker.dll
windows11-ltsc_2024-x64
3An9VCamPickerUI.exe
windows10-2004-x64
6An9VCamPickerUI.exe
windows11-ltsc_2024-x64
6LsCamera.exe
windows10-2004-x64
1LsCamera.exe
windows11-ltsc_2024-x64
1setdll.exe
windows10-2004-x64
3setdll.exe
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
An9VCamPicker.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
An9VCamPicker.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
An9VCamPickerUI.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
An9VCamPickerUI.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
LsCamera.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
LsCamera.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
setdll.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
setdll.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target AN9Picker.zip
- Size 3.9MB
- Sample260804-l9mkfahd66
- SHA256 2e5cf5c608cca2a89686bf26c1db036c3bea08d29155b5c767e7dec5f08aa716
- MD5 5be1af2842020305f382d4619e60901e
- SHA1 3cbfc661d84a59b76b5c1ba5a995410ee6da6d4c
- SHA512 269eed6088dbaf8ab97311ab82f06b08450c8335a891725bc56ce454e49aec985f3ac4b8b116e999c0548370c5581114246b5fc20e8e6324df68b7cc1194348f
- SSDEEP 98304:98SGUhgN7YlS8TPESR3G4LOL9ZEEGsxOuGt8mq9p5kq2T:99hkElS8A14iJ6c0r+cq2T
- TLSH T18B1633653A0DA02CB5F91335A24C687CE8F5D8BFA70F9B40BCAD05BFCC1A549646DE24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/An9VCamPicker.dll unpack001/An9VCamPickerUI.exe unpack001/LsCamera.exe unpack001/setdll.exe
File Explorer
-
AN9Picker.zip.zip 3.9MB
-
An9VCamPicker.dll.dll 223KB
-
An9VCamPickerUI.exe.exe 9.3MB
-
LsCamera.exe.exe 14KB
-
setdll.exe.exe 147KB
An9VCamPicker.dll
- IMPHASH 8116e1a80c90b82cddde03066e6b2331
- SHA256 a53211a70cbc3ac772ded3f5e777ce8bf8ca2c81dc3bdd46a6d261faab5fb24b
- MD5 ba52687da3f539568a285731dc1044e8
- SHA1 09dcd769e054cfa779e31b00aea69118b871642b
- SHA512 a89aee234c48613625b2c1dc3a4fc4055ca5f399344cf1e9304b696c03eb35e78f18de82f3a697ddf9f0e0464847e1b934791753063c238d933571bfe3796e2f
- SSDEEP 3072:afD+8641snqVyHxph0LR/hSMXlk4ZqKFya5XB67TzRJECxNs:af8nqVyRph0lhSMXlBXBWH3LxNs
- TLSH T16A24AF14E52690B1D44C12B9156D3FEB57298F20C3E622CB379A29F79E6A0C36C35F0B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
84790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\mark\Desktop\Coding\android-emulator-vcam-selector\An9VCamPicker\Release\An9VCamPicker.pdb
ole32
CoCreateInstance
CoUninitialize
CoInitialize
kernel32
InitOnceComplete
GetCPInfoExW
InitOnceBeginInitialize
ReleaseSRWLockExclusive
GetCurrentProcess
Sleep
GetLastError
K32GetModuleBaseNameA
CreateThread
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread
WideCharToMultiByte
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
VirtualProtectEx
VirtualQueryEx
SetLastError
GetModuleHandleW
GetSystemTimeAsFileTime
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
QueryPerformanceCounter
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
oleaut32
VariantClear
VariantInit
msvcp140
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
_Mtx_unlock
_Mtx_lock
?_Xlength_error@std@@YAXPBD@Z
?id@?$numpunct@D@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
_Mbrtowc
?_Throw_Cpp_error@std@@YAXH@Z
ws2_32
WSAGetLastError
WSACleanup
htons
recv
closesocket
inet_pton
connect
send
socket
WSAStartup
vcruntime140
memcpy
memset
memchr
_except_handler4_common
__std_type_info_destroy_list
__std_terminate
__CxxFrameHandler3
memmove
__std_exception_copy
_CxxThrowException
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_seh_filter_dll
_initialize_narrow_environment
_configure_narrow_argv
abort
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
calloc
api-ms-win-crt-math-l1-1-0
_dsign
_ldsign
_fdsign
_dclass
_fdclass
_ldclass
api-ms-win-crt-string-l1-1-0
strcmp
LsCamera
Name
.text
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
128KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, version=33808,
count=24, id=261, version=33808,
count=6, id=259, version=33808,
count=4, id=257, version=33808,
count=2, id=260, version=30795,
count=9, id=257, version=30795,
count=128, id=1, productName=Unmarked objects,
count=3, id=261, version=34120,
count=2, id=265, version=34120,
count=1, id=256, version=34120,
count=1, id=255, version=34120,
count=1, id=258, version=34120,
An9VCamPickerUI.exe
- IMPHASH d42595b695fc008ef2c56aabd8efd68e
- SHA256 2143ae17948e3f8976034e1f424e14b42ce596e579b1e4617aa6f91474ca5dc7
- MD5 2521f25f28ce60a37af3091e0b3ee56d
- SHA1 d77d9b771c7767f95af3fbf410c97336b8db3d88
- SHA512 ad6da79ee50dc207302820c2978c843c9388463317c97b0e086ada6a030a126db907fb661a495bf9708f4f9ca8cdaee9fe3be9018d27b20131aa8b29ddd27268
- SSDEEP 49152:00vWP+oTiBxxlYOIcyAPIIjf+N3UsCdO+VkqaMFfyxoZL459J/Ve8HGKrP4XN7jC:mTZc5sd6fyxojEWjPvWKuxQ
- TLSH T175A64A07ECA648F5C4ADC63485729253BA717C494B2067D72BA0F7382FB7BE069B9710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
491744
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.6MB
Virtual Size
4.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
601KB
Virtual Size
917KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
LsCamera.exe
- IMPHASH c2f549bec5cb5cae6afa1fd234ab1005
- SHA256 1d415fddf26a360cb53d47eca7a9d24bfb450ecfeba390aade1f144230e875db
- MD5 0a9d320b0c836cb1a07e03f10d9e8829
- SHA1 6ece389cd29856198e202c7d9e78042596e26c86
- SHA512 062a683773486eac075f4de231471ec78e657e8e03c48f965a14078d149a52faedd7e453eac614f834e51afc033d34788d3fce20932aad1c968a8f2f7f91ec9b
- SSDEEP 192:Oa1uxhsodPe2/Yi2LM1O52hejMvVoxtvQGMJEPXYdoP3IG5PA2H+eI3Q5tfMcmK:OPxhVdPe2/Yi2LM1OywMCvRVC3NK
- TLSH T1A8622C0773A34CEAD1A9917685A31904E2F17F6117A293CF5794A43F2FD92D07A36B08
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6368
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\mark\Desktop\Coding\android-emulator-vcam-selector\LsCamera\LsCamera\x64\Release\LsCamera.pdb
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
VariantInit
VariantClear
msvcp140
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?good@ios_base@std@@QEBA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
__current_exception_context
memset
__current_exception
memcpy
__C_specific_handler
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_exit
_crt_atexit
_cexit
exit
_initterm_e
_register_thread_local_exe_atexit_callback
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_c_exit
_set_app_type
__p___argv
terminate
__p___argc
_seh_filter_exe
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
kernel32
GetCurrentProcessId
InitializeSListHead
GetModuleHandleW
GetSystemTimeAsFileTime
GetCurrentThreadId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
IsDebuggerPresent
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
468B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=33808,
count=10, id=260, version=33808,
count=19, id=261, version=33808,
count=6, id=257, version=33808,
count=2, id=260, version=30795,
count=7, id=257, version=30795,
count=78, id=1, productName=Unmarked objects,
count=1, id=265, version=34120,
count=1, id=255, version=34120,
count=1, id=258, version=34120,
setdll.exe
- IMPHASH c16f7f2f01eb62ff50a5599543f7e153
- SHA256 c2f64c972f4e851da8b818e2b8e6661dec6a866d34ee6c3b72492dccba4af3f7
- MD5 d82f3d5f55b97df805df59f81da05a22
- SHA1 520ff530440474d7abdc969f3a2c40a96f3ce504
- SHA512 e297c9f3fee98aef58390972f49decbc12d61aea45fb33eb4693748baae56740cc4d97b14894ec0e464d185a05b77bd390986516f8070820dfe2cde7e996f670
- SSDEEP 3072:mYci8PXk+ypEhiEPSKfAJJzbGP03715nvC/Wvt/O46B:mYci8PXy9gSKfEJzbGGpwnB
- TLSH T140E35B03F182C472F8661A3106B496B59A6EFF310B5169DF2B881FFA5E307D09E35A17
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
27519
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\mark\source\repos\Dll1\Detours\bin.X86\setdll.pdb
kernel32
CreateFileA
DeleteFileA
GetFullPathNameA
CloseHandle
GetLastError
FreeLibrary
LoadLibraryExA
MoveFileA
SetLastError
GetCurrentProcess
GetModuleHandleW
GetProcAddress
LoadLibraryExW
GetFileSize
SetFilePointer
WriteFile
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
GetCurrentThreadId
WriteConsoleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize
HeapReAlloc
CreateFileW
DecodePointer
Name
.text
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=30795,
count=141, id=261, version=30795,
count=20, id=260, version=30795,
count=20, id=259, version=33808,
count=18, id=260, version=33808,
count=43, id=261, version=33808,
count=3, id=257, version=30795,
count=102, id=1, productName=Unmarked objects,
count=5, id=261, version=34120,
count=1, id=258, version=34120,