loader (1)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader (1).exe
Size 12.5MB
Sample261110-3pr3vsce49
SHA256 b3871b8210dbba411ce4a200dc4324a50cb3e4e878dac0aed52576dc2daaa46a
MD5 61ba835bcfecc952c835a0f846c306df
SHA1 a495ab4817ccef3eeb5118100b658f75f4dfbb27
SHA512 053cf1591adfde8da4de82b0fd8fb0093e3eadd75a4e88587580ba12ae4cb9b9a210daa8bdfa46dc891afbbe3de0777ff9f40f311fc3b877225cb18296908335
SSDEEP 196608:OhHBlLrTW0GSGwybMFIH9idMWOwH9hDD9URuA:mqFsIUdrOwdJiRu
TLSH
T11DD6BE17A65802F8D0BAC1788A478D12FB71744A4371A7EB3B9849564FE3BE0BE3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader (1).exe

File Explorer

loader (1).exe

.exe 12.5MB

loader (1).exe

IMPHASH 98b1e33ed8938a681fc8185ca97995f3
SHA256 b3871b8210dbba411ce4a200dc4324a50cb3e4e878dac0aed52576dc2daaa46a
MD5 61ba835bcfecc952c835a0f846c306df
SHA1 a495ab4817ccef3eeb5118100b658f75f4dfbb27
SHA512 053cf1591adfde8da4de82b0fd8fb0093e3eadd75a4e88587580ba12ae4cb9b9a210daa8bdfa46dc891afbbe3de0777ff9f40f311fc3b877225cb18296908335
SSDEEP 196608:OhHBlLrTW0GSGwybMFIH9idMWOwH9hDD9URuA:mqFsIUdrOwdJiRu
TLSH
T11DD6BE17A65802F8D0BAC1788A478D12FB71744A4371A7EB3B9849564FE3BE0BE3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11878151

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\source\repos\Unbanned-newui\x64\Release\LoaderNeon.pdb

winhttp

WinHttpConnect WinHttpAddRequestHeaders WinHttpReadData WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpSetStatusCallback WinHttpSetTimeouts

kernel32

MapViewOfFile VirtualQuery OpenThread VirtualQueryEx CheckRemoteDebuggerPresent SuspendThread RaiseException SetThreadContext SetFileAttributesW K32EnumProcessModules GetTickCount VirtualProtect FlushInstructionCache LocalAlloc LocalFree GetExitCodeThread K32GetModuleInformation GetThreadId GetProcessIdOfThread GetProcessTimes GetVolumeInformationW GetFileSizeEx SetHandleInformation GetCommandLineW GetFullPathNameW WriteFile InitializeProcThreadAttributeList CreatePipe GetFileInformationByHandle UpdateProcThreadAttribute DeleteProcThreadAttributeList SetFilePointerEx ReplaceFileW CreateProcessW CopyFileW GetFileType LoadLibraryExW FlushFileBuffers QueryDosDeviceW SetNamedPipeHandleState GetNamedPipeClientProcessId PeekNamedPipe GetNamedPipeInfo GetLogicalDriveStringsW ProcessIdToSessionId GetNamedPipeServerProcessId GetStdHandle GetFileAttributesExW K32GetProcessMemoryInfo GetNativeSystemInfo GlobalMemoryStatusEx K32GetMappedFileNameW SetUnhandledExceptionFilter FindFirstFileA FindNextFileA FindClose GetSystemTimeAsFileTime GetDiskFreeSpaceExW OutputDebugStringA LoadLibraryW HeapCreate HeapDestroy HeapReAlloc GetSystemInfo QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext LoadLibraryA SwitchToFiber DeleteFiber CreateFiber ConvertThreadToFiber VirtualLock GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW GetConsoleOutputCP FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx CreateFileMappingW SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceBeginInitialize InitOnceComplete GetStringTypeW AcquireSRWLockShared ReleaseSRWLockShared GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle FindFirstFileExW Module32NextW FreeLibrary ReadProcessMemory TerminateThread K32EnumProcessModulesEx GetModuleHandleA UnmapViewOfFile ResumeThread GetSystemDirectoryW Thread32First InitializeCriticalSection LeaveCriticalSection Thread32Next K32GetModuleFileNameExW GetProcessId EnterCriticalSection GetEnvironmentVariableW GetDriveTypeW GetOverlappedResultEx GetOverlappedResult CancelIoEx GetLogicalDrives ReadFile SetConsoleTitleW AllocConsole QueryFullProcessImageNameW MoveFileExW SetStdHandle GetFileAttributesW VirtualAlloc VirtualFree DeleteFileW CreateFileW GetTempPathW CreateDirectoryW FindResourceW LoadResource LockResource CreateMutexW CompareStringOrdinal SizeofResource GetExitCodeProcess GetLocaleInfoEx WakeConditionVariable TryAcquireSRWLockExclusive InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter SleepConditionVariableSRW HeapQueryInformation RtlUnwind WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageA GetSystemTime EnumSystemFirmwareTables GetEnvironmentVariableA DeviceIoControl GetSystemFirmwareTable ExpandEnvironmentStringsW SystemTimeToFileTime GetConsoleMode WriteConsoleA SetConsoleTextAttribute GetConsoleScreenBufferInfo CreateRemoteThread VirtualProtectEx WriteProcessMemory VirtualFreeEx VirtualAllocEx IsWow64Process IsDebuggerPresent MulDiv DebugBreak CreateProcessA GetThreadTimes WideCharToMultiByte GetModuleHandleW GetProcessHeap GetCurrentProcessId ExitProcess CreateMutexExW GetProcAddress HeapAlloc CloseHandle Process32FirstW OpenSemaphoreW DeleteFileA WaitForSingleObjectEx GetCurrentThread DeleteCriticalSection GetWindowsDirectoryW GetThreadContext Module32FirstW CloseThreadpoolWork CreateThread GetCurrentDirectoryW GetSystemWow64DirectoryW DeactivateActCtx ActivateActCtx ReleaseActCtx GetTempFileNameW CreateActCtxW ResetEvent WaitForMultipleObjects GetModuleFileNameA Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection GetComputerNameA GetFileTime MoveFileW GlobalFindAtomA CreateSemaphoreExW HeapFree SetLastError GetCurrentProcess ReleaseSemaphore GetModuleHandleExW TerminateProcess GetModuleFileNameW WaitForSingleObject GetCurrentThreadId ReleaseMutex DuplicateHandle VerifyVersionInfoW OpenProcess CreateToolhelp32Snapshot CreateEventW MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetTickCount64 GetLastError Process32NextW OutputDebugStringW SetEvent lstrcpyW lstrcatW PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetQueuedCompletionStatus CreateIoCompletionPort InitializeConditionVariable InitializeSRWLock HeapSize FileTimeToSystemTime CreateFileA GlobalAddAtomA GetCommandLineA SetCurrentDirectoryA SetEndOfFile SetFilePointer FindNextFileW FindFirstFileW SetEnvironmentVariableW GetTimeZoneInformation IsValidCodePage GetACP WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP EnumSystemLocalesW GetSystemTimeAsFileTime CreateEventA GetModuleHandleA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree HeapAlloc HeapFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar GetModuleHandleW LoadResource FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers FlsSetValue GetCommandLineA GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer DecodePointer FlsGetValue FlsFree SetLastError FlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException RtlPcToFileHeader RtlUnwindEx LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

user32

KillTimer GetClientRect LoadCursorW TranslateMessage SetLayeredWindowAttributes EnumWindows MessageBoxA PostQuitMessage GetMonitorInfoW SetTimer DispatchMessageW IsWindow ShowWindow RegisterClassExW GetSystemMetrics SendMessageW UpdateWindow SetForegroundWindow LoadImageW GetCursorPos MonitorFromRect PeekMessageW ExitWindowsEx ScreenToClient CharLowerW wsprintfW GetDpiForWindow MessageBoxW SetWindowPos GetShellWindow CreatePopupMenu TrackPopupMenu DestroyMenu AppendMenuW DestroyWindow SetWindowLongPtrW GetWindowLongPtrW LoadIconW MsgWaitForMultipleObjects IsWindowVisible SetWindowLongW ReleaseCapture InvalidateRect GetAsyncKeyState GetClassNameW GetDC MonitorFromWindow GetDesktopWindow SystemParametersInfoW SetProcessDPIAware ReleaseDC GetWindowLongW GetWindowThreadProcessId GetMessageW DefWindowProcW PostMessageW MonitorFromPoint GetWindowRect CreateWindowExW

gdi32

GetStockObject GetDeviceCaps

comdlg32

GetOpenFileNameW

advapi32

RegSetKeyValueW LsaNtStatusToWinError QueryServiceStatus OpenSCManagerA DeleteService OpenServiceA CryptGenRandom RegDeleteTreeW OpenThreadToken RegOpenKeyW SetSecurityDescriptorDacl BuildExplicitAccessWithNameW GetNamedSecurityInfoW MakeAbsoluteSD RegOpenKeyA ConvertStringSecurityDescriptorToSecurityDescriptorW RegDeleteKeyExW RegQueryInfoKeyW ConvertSidToStringSidA CloseServiceHandle SetEntriesInAclW RegCreateKeyExA GetUserNameA RegCreateKeyExW SetNamedSecurityInfoW ControlService RegSetValueExW RegSetValueExA RegCopyTreeW RegCreateKeyW RegDeleteValueW RegEnumValueW CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW GetUserNameW RegEnumKeyExW RegQueryValueExW RegOpenKeyExW CheckTokenMembership FreeSid OpenProcessToken AllocateAndInitializeSid RegCloseKey AdjustTokenPrivileges CloseThreadWaitChainSession SystemFunction036 RegGetValueW EventUnregister EventWriteTransfer EventSetInformation EventRegister CredWriteW CredReadW CredFree CredDeleteW EqualSid IsValidSid ConvertSidToStringSidW GetTokenInformation OpenThreadWaitChainSession GetThreadWaitChain LookupPrivilegeValueW

shell32

Shell_NotifyIconW SHGetKnownFolderPath ShellExecuteExW CommandLineToArgvW SHGetFolderPathW ShellExecuteW ShellExecuteA SHFileOperationW

ole32

CreateStreamOnHGlobal CoInitializeEx CoCreateInstance StringFromGUID2 CoTaskMemAlloc CoTaskMemFree CoInitializeSecurity CoSetProxyBlanket CoUninitialize CoInitialize

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness GetDpiForMonitor

wintrust

WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain CryptCATAdminReleaseCatalogContext CryptCATAdminAcquireContext2 CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext CryptCATAdminCalcHashFromFileHandle2 CryptCATAdminReleaseContext WinVerifyTrust

crypt32

CryptMsgClose CertGetCertificateChain CertFreeCertificateContext CryptQueryObject CertCloseStore CryptMsgGetParam CertFreeCertificateChain CertGetNameStringW CertVerifyCertificateChainPolicy CertGetCertificateContextProperty CertGetNameStringA CryptEncodeObjectEx CertCreateCertificateContext CryptStringToBinaryA CertFindCertificateInStore

iphlpapi

GetAdaptersInfo GetBestRoute GetIfTable SendARP

ws2_32

socket shutdown WSAIoctl WSARecv WSASetLastError bind WSASend WSASocketA inet_pton accept freeaddrinfo WSAStartup setsockopt ntohs listen htons htonl getsockopt getsockname getpeername connect closesocket getaddrinfo inet_ntop WSACleanup inet_addr WSAGetLastError

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

shlwapi

SHDeleteValueW SHDeleteKeyW PathFileExistsW StrStrW

bcrypt

BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider BCryptFinishHash BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptGenRandom

ntdll

RtlInitUnicodeString NtLoadDriver NtUnloadDriver RtlAdjustPrivilege VerSetConditionMask RtlPcToFileHeader RtlVirtualUnwind RtlLookupFunctionEntry NtQuerySystemInformation NtQueryInformationProcess NtAllocateUuids

dbghelp

SymCleanup SymFromAddr MiniDumpWriteDump SymGetLineFromAddr64 SymFunctionTableAccess64 SymInitialize StackWalk64 SymSetOptions SymGetModuleBase64

wevtapi

EvtNext EvtRender EvtClose EvtQuery

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsA SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailA SetupDiOpenDevRegKey SetupDiGetDeviceRegistryPropertyA

tbs

Tbsip_Context_Close Tbsi_Context_Create Tbsip_Submit_Command

ncrypt

NCryptGetProperty NCryptFreeObject NCryptOpenStorageProvider

oleaut32

SysAllocString SysFreeString VariantInit SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetLBound SafeArrayGetUBound VariantClear

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

395KB

Virtual Size

440KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.iseeyou

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.iseeyou

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.iseeyou

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=203, id=261, version=33145,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=10, id=259, version=35207,

count=17, id=260, version=35207,

count=119, id=261, version=35207,

count=1, id=259, version=35222,

count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=260, version=26706,

count=7, id=261, version=32216,

count=13, id=259, version=33145,

count=30, id=260, version=33145,

count=1, id=262, version=33145,

count=47, id=257, version=33145,

count=634, id=1, productName=Unmarked objects,

count=40, id=261, version=35222,

count=63, id=260, version=35222,

count=6, productName=Unmarked objects (old),

count=152, id=265, version=35222,

count=1, id=256, version=35222,

count=1, id=255, version=35222,

count=1, id=151,

count=1, id=258, version=35222,