loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 12.5MB
Sample260806-daa4csxtb1
SHA256 a55a573d367ccd368833c6fb4d28f0ac9443b87f412ffa76a72bd0b7f723b0ba
MD5 f63544294d7694f5a3c75484fe72081a
SHA1 0e11e379eabcb92cfc6e62071a66206d5358e009
SHA512 b88ea41506aab97f04485518f86e681941f593614cdc909f0b7fb59d8c0a918e9abf59ed2fee855befc510d1d17f4c4b3b62385bbf725653371de627bf968b21
SSDEEP 196608:tJOM8vfZy/PzBwReQ+v22aw8F/6Q7++f+YZWvcQ77b0Mlku7c:zO9vEwHXhFNf+YZIcQ/b3lVc
TLSH
T168D6BE0B965901F8C0BAD0789A478D53FA7174894335A7EB379C49136FE2BE4BA3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 12.5MB

loader.exe

IMPHASH 534f59eabb8be335f7848b04601d4404
SHA256 a55a573d367ccd368833c6fb4d28f0ac9443b87f412ffa76a72bd0b7f723b0ba
MD5 f63544294d7694f5a3c75484fe72081a
SHA1 0e11e379eabcb92cfc6e62071a66206d5358e009
SHA512 b88ea41506aab97f04485518f86e681941f593614cdc909f0b7fb59d8c0a918e9abf59ed2fee855befc510d1d17f4c4b3b62385bbf725653371de627bf968b21
SSDEEP 196608:tJOM8vfZy/PzBwReQ+v22aw8F/6Q7++f+YZWvcQ77b0Mlku7c:zO9vEwHXhFNf+YZIcQ/b3lVc
TLSH
T168D6BE0B965901F8C0BAD0789A478D53FA7174894335A7EB379C49136FE2BE4BA3E311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11348932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\source\repos\Unbanned-newui\x64\Release\LoaderNeon.pdb

winhttp

WinHttpSetTimeouts WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpReadData WinHttpOpen WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpQueryHeaders WinHttpConnect

kernel32

OpenThread VirtualQueryEx CheckRemoteDebuggerPresent SuspendThread RaiseException SetThreadContext SetFileAttributesW K32EnumProcessModules GetTickCount VirtualProtect FlushInstructionCache LocalAlloc LocalFree K32GetModuleInformation GetThreadId GetVolumeInformationW GetCommandLineA ReadFile GetFileSizeEx GetVersionExW K32GetProcessMemoryInfo GetNativeSystemInfo GlobalMemoryStatusEx SetUnhandledExceptionFilter FindFirstFileA FindNextFileA FindClose GetSystemTimeAsFileTime GetProcessTimes WriteFile GetFileAttributesExW GetDiskFreeSpaceExW OutputDebugStringA LoadLibraryExW LoadLibraryW FreeLibrary HeapCreate HeapDestroy HeapReAlloc GetSystemInfo RtlCaptureContext LoadLibraryA SwitchToFiber DeleteFiber CreateFiber ConvertThreadToFiber VirtualLock CopyFileW AreFileApisANSI SetFileInformationByHandle CreateThread SetEvent CreateEventW GetFileAttributesW VirtualAlloc GetCurrentProcess GetCommandLineW VirtualFree DeleteFileW CreateFileW GetTempPathW CreateDirectoryW FindResourceW LoadResource LockResource CreateMutexW SizeofResource GetExitCodeProcess IsDebuggerPresent DebugBreak CreateProcessA WideCharToMultiByte VirtualQuery CreateProcessW GetProcessHeap GetCurrentProcessId ExitProcess CreateMutexExW GetProcAddress HeapAlloc CloseHandle Process32FirstW OpenSemaphoreW DeleteFileA WaitForSingleObjectEx OutputDebugStringW Process32NextW GetLastError GetTickCount64 FormatMessageW GetTempPathA Sleep CancelIoEx PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetQueuedCompletionStatus CreateIoCompletionPort MapViewOfFile CreateFileMappingW Module32NextW ReadProcessMemory DeleteCriticalSection MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess ReleaseMutex GetCurrentThreadId WaitForSingleObject GetModuleFileNameW TerminateProcess GetModuleHandleExW ReleaseSemaphore SetLastError HeapFree CreateSemaphoreExW GetModuleFileNameA GetFileInformationByHandle FindFirstFileExW GetLocaleInfoEx FormatMessageA GetSystemTime EnumSystemFirmwareTables CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork RtlUnwind HeapQueryInformation GetWindowsDirectoryW GetEnvironmentVariableA DeviceIoControl GetSystemFirmwareTable ExpandEnvironmentStringsW SystemTimeToFileTime GetConsoleMode WriteConsoleA GetStdHandle InitializeConditionVariable InitializeSRWLock HeapSize WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetEnvironmentVariableW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetThreadContext Module32FirstW TerminateThread GetCurrentThread K32EnumProcessModulesEx GetModuleHandleA DuplicateHandle UnmapViewOfFile ResumeThread GetSystemDirectoryW Thread32First GetEnvironmentVariableW InitializeCriticalSection LeaveCriticalSection Thread32Next K32GetModuleFileNameExW GetProcessId EnterCriticalSection SetConsoleTitleW AllocConsole QueryFullProcessImageNameW MoveFileExW GetModuleHandleW SetStdHandle FlsFree FlsSetValue FlsGetValue FlsAlloc FlushFileBuffers GetFileType ReadConsoleW GetConsoleOutputCP FreeLibraryAndExitThread ExitThread TlsFree SetConsoleTextAttribute GetConsoleScreenBufferInfo GetThreadTimes IsWow64Process TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer FreeLibraryWhenCallbackReturns InitializeCriticalSectionEx InitOnceBeginInitialize InitOnceComplete GetExitCodeThread ResetEvent GetCurrentDirectoryW GetSystemWow64DirectoryW DeactivateActCtx ActivateActCtx WakeAllConditionVariable WakeConditionVariable GetStringTypeW SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive QueryPerformanceFrequency GetLogicalDrives FindFirstFileW WriteProcessMemory FindNextFileW SetFilePointer SetEndOfFile SetCurrentDirectoryA GlobalAddAtomA CreateFileA FileTimeToSystemTime lstrcatW VirtualProtectEx VirtualAllocEx lstrcpyW CreateRemoteThread VerifyVersionInfoW GlobalFindAtomA VirtualFreeEx MoveFileW GetFileTime GetComputerNameA Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection QueryPerformanceCounter SetFilePointerEx CreateActCtxW GetTempFileNameW ReleaseActCtx GetFileInformationByHandleEx GetSystemTimeAsFileTime CreateEventA GetModuleHandleA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree HeapAlloc HeapFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar GetModuleHandleW LoadResource FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers FlsSetValue GetCommandLineA GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer DecodePointer FlsGetValue FlsFree SetLastError FlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException RtlPcToFileHeader RtlUnwindEx LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

user32

wsprintfW AppendMenuA DestroyMenu TrackPopupMenu CreatePopupMenu DestroyWindow SetWindowLongPtrW GetWindowLongPtrW LoadIconW MsgWaitForMultipleObjects ReleaseCapture InvalidateRect GetAsyncKeyState GetClassNameW SetWindowLongW GetCursorPos SetForegroundWindow UpdateWindow PostQuitMessage KillTimer GetClientRect LoadCursorW TranslateMessage SetLayeredWindowAttributes EnumWindows MessageBoxA PeekMessageW GetMonitorInfoW SetTimer DispatchMessageW IsWindow ShowWindow RegisterClassExW GetSystemMetrics SendMessageW ScreenToClient CreateWindowExW MessageBoxW SetWindowPos IsWindowVisible GetWindowRect MonitorFromPoint ExitWindowsEx PostMessageW DefWindowProcW GetMessageW GetWindowThreadProcessId GetWindowLongW ReleaseDC SetProcessDPIAware SystemParametersInfoW GetDesktopWindow MonitorFromWindow GetDC CharLowerW

gdi32

GetStockObject GetDeviceCaps

comdlg32

GetOpenFileNameW

advapi32

RegSetKeyValueW SystemFunction036 RegGetValueW EventUnregister EventWriteTransfer EventSetInformation EventRegister RegEnumKeyExW LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey AllocateAndInitializeSid OpenProcessToken FreeSid CheckTokenMembership RegOpenKeyExW RegQueryValueExW GetUserNameW CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext GetTokenInformation RegEnumValueW RegDeleteValueW RegCreateKeyW RegCopyTreeW RegSetValueExA RegSetValueExW ControlService SetNamedSecurityInfoW RegCreateKeyExW GetUserNameA RegCreateKeyExA SetEntriesInAclW CloseServiceHandle ConvertSidToStringSidA RegQueryInfoKeyW RegDeleteKeyExW RegOpenKeyA MakeAbsoluteSD GetNamedSecurityInfoW BuildExplicitAccessWithNameW SetSecurityDescriptorDacl RegOpenKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW OpenThreadToken RegDeleteTreeW CryptGenRandom ConvertSidToStringSidW OpenServiceA DeleteService OpenSCManagerA QueryServiceStatus LsaNtStatusToWinError

shell32

ShellExecuteW SHGetFolderPathW ShellExecuteExW ShellExecuteA Shell_NotifyIconW SHFileOperationW SHGetKnownFolderPath

ole32

CoSetProxyBlanket CoCreateInstance StringFromGUID2 CoInitializeSecurity CoInitialize CoTaskMemAlloc CoInitializeEx CoUninitialize CoTaskMemFree

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor SetProcessDpiAwareness

wintrust

WinVerifyTrust

crypt32

CertFreeCertificateContext CertGetNameStringA CryptStringToBinaryA CryptQueryObject CertGetCertificateContextProperty CertCreateCertificateContext CryptEncodeObjectEx CertCloseStore CertFindCertificateInStore CryptMsgGetParam CryptMsgClose

iphlpapi

GetAdaptersInfo GetBestRoute GetIfTable SendARP

ws2_32

ntohs setsockopt shutdown socket WSASetLastError inet_addr freeaddrinfo inet_ntop WSAGetLastError getaddrinfo WSACleanup listen htons htonl getsockopt getsockname getpeername connect closesocket bind accept WSAStartup WSARecv WSASend WSASocketA inet_pton WSAIoctl

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

shlwapi

SHDeleteValueW StrStrW SHDeleteKeyW PathFileExistsW

ntdll

RtlAddFunctionTable NtQuerySystemInformation NtQueryInformationProcess NtUnloadDriver NtAllocateUuids RtlAdjustPrivilege RtlPcToFileHeader RtlLookupFunctionEntry VerSetConditionMask NtLoadDriver RtlInitUnicodeString RtlVirtualUnwind

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGenRandom

dbghelp

SymSetOptions MiniDumpWriteDump SymCleanup SymGetModuleBase64 SymGetLineFromAddr64 SymFunctionTableAccess64 SymInitialize StackWalk64 SymFromAddr

setupapi

SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailA SetupDiOpenDevRegKey SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW

tbs

Tbsip_Context_Close Tbsip_Submit_Command Tbsi_Context_Create

ncrypt

NCryptOpenStorageProvider NCryptGetProperty NCryptFreeObject

oleaut32

SafeArrayGetUBound SafeArrayGetLBound SysAllocString SysFreeString VariantInit SafeArrayAccessData SafeArrayUnaccessData VariantClear

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

282KB

Virtual Size

312KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

155KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.iseeyou

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.iseeyou

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.iseeyou

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

107KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=203, id=261, version=33145,

count=17, id=260, version=35207,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=10, id=259, version=35207,

count=118, id=261, version=35207,

count=1, id=259, version=35222,

count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=260, version=26706,

count=7, id=261, version=32216,

count=13, id=259, version=33145,

count=29, id=260, version=33145,

count=1, id=262, version=33145,

count=45, id=257, version=33145,

count=587, id=1, productName=Unmarked objects,

count=40, id=261, version=35222,

count=57, id=260, version=35222,

count=6, productName=Unmarked objects (old),

count=134, id=265, version=35222,

count=1, id=256, version=35222,

count=1, id=255, version=35222,

count=1, id=151,

count=1, id=258, version=35222,