Downloads.rar
- SHA256 048cf068866ad05ef0cc5ba042775b8e1cd7ad1a9d4cdcd98d68dd77b85af79d
Overview
overview
7Static
static
7Downloads.rar
windows10-2004-x64
1Downloads.rar
windows11-ltsc_2024-x64
1hookloader.exe
windows10-2004-x64
3hookloader.exe
windows11-ltsc_2024-x64
3internal (3).exe
windows10-2004-x64
5internal (3).exe
windows11-ltsc_2024-x64
5vipexyz.dll
windows10-2004-x64
1vipexyz.dll
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
Downloads.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Downloads.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
hookloader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
hookloader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
internal (3).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
internal (3).exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
vipexyz.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
vipexyz.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Downloads.rar
- Size 24.7MB
- Sample260806-s8vb8avdne
- SHA256 048cf068866ad05ef0cc5ba042775b8e1cd7ad1a9d4cdcd98d68dd77b85af79d
- MD5 fb2f169c2c78cb5dde7ffa4da2669662
- SHA1 e496be944b533d9d23c6ffbbc189d54f51c714d4
- SHA512 63f36aabe284c8af8ed9ac6588bcba9986d5f2472c1956bf2debfda381a85b92aa4c23b32b2a61b4b80a8ff083ff8b7b36577cc61a5ef810263cfe3b7468304b
- SSDEEP 786432:hSrpyw42rMzikhnnZx9TyvMsEpbaRNGEcc:hmHdpMnMvqp2Fcc
- TLSH T179473386DC432A35CF03EA6D3C0953A75F0DE6A6D58361D60639DC718E4AF64883E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/internal (3).exe themida - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/hookloader.exe unpack001/internal (3).exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/vipexyz.dll
File Explorer
-
Downloads.rar.rar 24.7MB
-
hookloader.exe.exe 33KB
-
internal (3).exe.exe 25.9MB
-
vipexyz.dll.dll 722KB
hookloader.exe
- IMPHASH 5654544fc4c95c8ddbff1c0577ac668b
- SHA256 f8629c51bb0c97c7848425705b59a8cb887b88225dbcf518228949ce263755df
- MD5 ad100e026561d360de921a4baf47fdb7
- SHA1 3f3bf64f0824d81006535a72e29999d56ad92030
- SHA512 c36acc757b347a353014e6b1a8ad2701773750e0c3e1736d43e4c423b11f8de677480284248f055f9a99330778f4559c34b28811e93ed27e0eeb3c389eafc591
- SSDEEP 384:Do9ZbonucNXW/KubqInO05XFIJTnCr31bRGJXRfWaY2RuZoijtBKYkOlCtNRuZoL:c9Z2xNG/Kaq/AItA3dwJJWaYvL96x
- TLSH T118F2C72ADD2BA03BD35D8D74C6534D05DE62BCD78BE1B58FA7400CE60974AA4AB3F601
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
11768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Elon Musk\source\repos\valorant-injector-main\build\hookloader.pdb
kernel32
GetProcAddress
GetFileAttributesW
SetConsoleScreenBufferSize
GetStdHandle
SetConsoleWindowInfo
LoadLibraryW
GetConsoleWindow
SetConsoleTitleW
LoadLibraryExW
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
RtlLookupFunctionEntry
FreeLibrary
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlCaptureContext
user32
SetWindowsHookExW
UnhookWindowsHookEx
FindWindowW
GetWindowThreadProcessId
GetWindowLongPtrW
SetWindowLongPtrW
SetWindowPos
PostThreadMessageW
comdlg32
GetOpenFileNameW
msvcp140
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?good@ios_base@std@@QEBA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exceptions@std@@YAHXZ
?_Xout_of_range@std@@YAXPEBD@Z
dbghelp
ImageDirectoryEntryToData
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
__current_exception_context
__current_exception
_CxxThrowException
__C_specific_handler
memset
memcpy
__std_exception_destroy
__std_terminate
memmove
api-ms-win-crt-runtime-l1-1-0
__p___argc
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_crt_atexit
terminate
_get_initial_wide_environment
exit
_c_exit
__p___wargv
_invoke_watson
_exit
_initialize_wide_environment
_configure_wide_argv
_cexit
_set_app_type
_seh_filter_exe
_initterm_e
_initterm
_register_onexit_function
system
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35207,
count=10, id=260, version=35207,
count=27, id=261, version=35207,
count=6, id=257, version=35207,
count=9, id=257, version=33145,
count=115, id=1, productName=Unmarked objects,
count=5, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
internal (3).exe
- IMPHASH af2182414f8a835b2080c5bbd875a6d9
- SHA256 b7dc841a8ebdedd3651301da7c7ef6e56f87c5f5d452ac3c181e95628fec358b
- MD5 88a97474b28c7dc82b3637392a20b42b
- SHA1 395959e5c85197bb115a219f8660ae085e962c6e
- SHA512 15b68b7a61aa9e092f1102dd8dceaa0f90ac3154582de4d56f4ca78ad7b141ce47786c0c4c1086d8480c0f51f0950fffcec2c4f54c97352259fc7e648fe06dbe
- SSDEEP 393216:9admtQ5sfAu+gBxOCrI/IVPR4jEji7rc4vZAJpCEGQP0bDHFgCS6YPa70YV7MGyP:95j4u+gBMVqRQ7rlviSbDHyYYUM
- TLSH T12457339642D5B2DCCBC18640374580CE78D4A49D40FEAD793FCF8D56EA28D8E058AEB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
37974474
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
urlmon
URLDownloadToFileA
advapi32
InitializeAcl
kernel32
ReleaseSRWLockExclusive
user32
ShowWindow
shell32
ShellExecuteExA
msvcp140
?_Xbad_alloc@std@@YAXXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-runtime-l1-1-0
_initterm_e
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
13.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.Protd
Size
Virtual Size
490B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.Samar
Size
Virtual Size
794B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.UXI00
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
7.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.themida
Size
512B
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.themida
Size
25.9MB
Virtual Size
25.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
vipexyz.dll
- IMPHASH 1d5551a56cfc4aef7cce320531ce490e
- SHA256 e7376b28060f02ac5720da5bf27e010c8eb3311f1c6eef5e96685ce1554e0792
- MD5 bfc791dea7bb5d1dadd59e1139b9c22f
- SHA1 0542a7e949383c9c7e82570b28381bec42cd1ed4
- SHA512 98fb1a15259a1f3577bc282965d1dc3436fa7a4a2fa1321f4ae1307394b6bf75bf6053928fbe4748ddd74c34bb999e0d817e5d1d1157bc172a47f53fd3126375
- SSDEEP 12288:OdKI0qySxtHrpkWB/3o/H3ZjfvWvumly+dOE15ldP:OdKIVygtHrpN4/H3ZjfvsumlZnxP
- TLSH T19AF47D05A7F811E9F1B3EA76D9B21512EAB27C850B70A5DF03E0499D1F337A0963B712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
82:66:48:43:76:da:25:43:a9:14:68:c5:9f:81:99:e4:9f:74:6d:74:04:f4:8a:d2:5c:a7:9e:a7:cf:ef:21:ce
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Henan Pushitong Intelligent Technology Co.\, Ltd.,O=Henan Pushitong Intelligent Technology Co.\, Ltd.,L=Zhengzhou,ST=Henan,C=CN
Chains
Aug 5, 2026
CN=Henan Pushitong Intelligent Technology Co.\, Ltd.,O=Henan Pushitong Intelligent Technology Co.\, Ltd.,L=Zhengzhou,ST=Henan,C=CN
Subject
CN=Henan Pushitong Intelligent Technology Co.\, Ltd.,O=Henan Pushitong Intelligent Technology Co.\, Ltd.,L=Zhengzhou,ST=Henan,C=CN
Serial Number
28:77:79:fb:66:62:61:cb:73:17:47:92:9a:62:17:70
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 13, 2017 - Oct 13, 2018
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
327168
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\ellenhvh\Desktop\dvn\project\x64\Release\JJGBFRV368BY238RB8R3HFSNS.pdb
kernel32
FindNextFileW
Sleep
VirtualAlloc
VirtualProtect
VirtualQuery
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateDirectoryA
CreateFileW
GetFileAttributesW
WriteFile
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
FindFirstFileW
GetTickCount
GetTickCount64
WideCharToMultiByte
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
HeapReAlloc
GetLocalTime
FindClose
GetOEMCP
GetACP
IsValidCodePage
DeleteFileW
ReadConsoleW
SetFilePointerEx
GetLastError
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
FormatMessageA
LocalFree
GetLocaleInfoEx
MultiByteToWideChar
GetStringTypeW
FindFirstFileExW
GetFileAttributesExW
CreateFile2
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
WakeAllConditionVariable
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
InterlockedFlushSList
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CreateThread
ExitThread
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleExW
IsProcessorFeaturePresent
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleFileNameW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
LoadLibraryExW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
RtlUnwind
user32
CallNextHookEx
GetActiveWindow
GetAsyncKeyState
GetKeyboardState
GetKeyNameTextA
ToUnicode
ScreenToClient
GetCursorPos
GetSystemMetrics
MapVirtualKeyW
advapi32
GetUserNameW
wininet
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
InternetOpenA
winmm
PlaySoundW
MertdOirf__
Name
.text
Size
504KB
Virtual Size
503KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
176KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
440KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=178, id=261, version=33145,
count=29, id=260, version=33145,
count=20, id=259, version=33145,
count=10, id=259, version=35721,
count=14, id=260, version=35721,
count=85, id=261, version=35721,
count=11, id=257, version=33145,
count=163, id=1, productName=Unmarked objects,
count=4, id=261, version=36252,
count=1, id=259, version=36252,
count=1, id=256, version=36252,
count=1, id=255, version=36252,
count=1, id=258, version=36252,