show
Overview
overview
8Static
static
76657fe8d49...18.exe
windows7-x64
76657fe8d49...18.exe
windows10-2004-x64
7$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...Ex.dll
windows7-x64
3$PLUGINSDI...Ex.dll
windows10-2004-x64
3$PLUGINSDI...ay.dll
windows7-x64
3$PLUGINSDI...ay.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$PLUGINSDI...nz.dll
windows7-x64
3$PLUGINSDI...nz.dll
windows10-2004-x64
3$_17_/IJL15.dll
windows7-x64
1$_17_/IJL15.dll
windows10-2004-x64
1$_17_/ijl15.dll
windows7-x64
1$_17_/ijl15.dll
windows10-2004-x64
1MabiAssist.hta
windows7-x64
8MabiAssist.hta
windows10-2004-x64
8js/MabiAssist.js
windows7-x64
3js/MabiAssist.js
windows10-2004-x64
3Behavioral task
behavioral1
Sample
6657fe8d4992741a142c70acdf8bc0f1_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6657fe8d4992741a142c70acdf8bc0f1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/AdvSplash.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AdvSplash.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptionsEx.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptionsEx.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/NSISArray.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/NSISArray.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/SkinnedControls.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/SkinnedControls.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
$_17_/IJL15.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
$_17_/IJL15.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
$_17_/ijl15.dll
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
$_17_/ijl15.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral29
Sample
MabiAssist.hta
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
MabiAssist.hta
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
js/MabiAssist.js
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
js/MabiAssist.js
Resource
win10v2004-20240709-en
General
-
Target
6657fe8d4992741a142c70acdf8bc0f1_JaffaCakes118
-
Size
4.7MB
-
MD5
6657fe8d4992741a142c70acdf8bc0f1
-
SHA1
1cc32d02dc261c01aa67cf5fb7ea6132668e77c0
-
SHA256
e64332d9f18d4d3f83a80a520652b8f048fd8da10ed8d477a3ff745506ab03ad
-
SHA512
371a08bd5480e378df2555d5ccbb68cb9e0c8394a9fa1e056fcc207cfdbdfd66401ae442d341fa1355e1cbc5d0458445c12d161ca08ab4ef14f31904c6d735c7
-
SSDEEP
98304:ocFHkLuYtse+Z80sZKE2w5J3HGO7yuSm0//3yqvbLfTZDy9F0yG0:VwuYtlmnsZHHhqzrOJG0
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 15 IoCs
Checks for missing Authenticode signature.
resource 6657fe8d4992741a142c70acdf8bc0f1_JaffaCakes118 unpack001/$PLUGINSDIR/AdvSplash.dll unpack001/$PLUGINSDIR/Banner.dll unpack001/$PLUGINSDIR/FindProcDLL.dll unpack001/$PLUGINSDIR/InstallOptionsEx.dll unpack001/$PLUGINSDIR/NSISArray.dll unpack001/$PLUGINSDIR/SkinnedControls.dll unpack001/$PLUGINSDIR/System.dll unpack001/$PLUGINSDIR/UserInfo.dll unpack001/$PLUGINSDIR/inetc.dll unpack001/$PLUGINSDIR/nsis7z.dll unpack001/$PLUGINSDIR/nsisunz.dll unpack001/$_17_/IJL15.DLL unpack001/$_17_/ijl15.dat unpack001/out.upx -
NSIS installer 1 IoCs
resource yara_rule static1/unpack001/out.upx nsis_installer_2
Files
-
6657fe8d4992741a142c70acdf8bc0f1_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 204KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 19KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
$PLUGINSDIR/AdvSplash.dll.dll windows:4 windows x86 arch:x86
741b6bafe355b63a372d737b30543a95
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpynA
GetVersion
lstrcpyA
lstrcatA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
user32
LoadCursorA
RegisterClassA
SetWindowPos
SetWindowLongA
SystemParametersInfoA
EndPaint
GetClientRect
BeginPaint
DefWindowProcA
DestroyWindow
LoadImageA
CreateWindowExA
IsWindow
GetMessageA
DispatchMessageA
UnregisterClassA
wsprintfA
PostMessageA
SetWindowRgn
EnumDisplaySettingsA
gdi32
CombineRgn
CreateRectRgn
GetDIBits
SelectObject
CreateCompatibleDC
GetObjectA
DeleteDC
BitBlt
DeleteObject
winmm
timeSetEvent
PlaySoundA
timeKillEvent
Exports
Exports
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/AlternativeStartMenuApplication.ini
-
$PLUGINSDIR/Banner.dll.dll windows:4 windows x86 arch:x86
7a3709b093081d5614be1eaa2fe7fe76
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
CloseHandle
Sleep
CreateThread
GetCurrentThreadId
GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
user32
DestroyWindow
SetWindowLongA
GetWindowLongA
SetWindowTextA
SetDlgItemTextA
DispatchMessageA
PeekMessageA
WaitMessage
IsWindow
CreateDialogParamA
ShowWindow
AttachThreadInput
IsWindowVisible
wsprintfA
PostMessageA
Exports
Exports
destroy
getWindow
show
Sections
.text Size: 1024B - Virtual size: 862B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/BtmImg.bmp
-
$PLUGINSDIR/ButtonImg.bmp
-
$PLUGINSDIR/COMPLETE.bmp
-
$PLUGINSDIR/Custom.bmp
-
$PLUGINSDIR/FindProcDLL.dll.dll windows:4 windows x86 arch:x86
8df26927f8978d4eb40ff179c0aa961b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
lstrcmpA
OpenProcess
lstrcpyA
LoadLibraryA
CloseHandle
FreeLibrary
GetVersionExA
lstrlenA
GlobalFree
user32
wsprintfA
Exports
Exports
FindProc
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/Header.bmp
-
$PLUGINSDIR/InstallOptionsEx.dll.dll windows:5 windows x86 arch:x86
ac4e928037af5a32b52d9b140ae0017f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
comctl32
ImageList_AddMasked
ImageList_Create
ImageList_Destroy
shlwapi
PathFindExtensionA
PathFileExistsA
kernel32
LoadLibraryA
WritePrivateProfileStringA
GetModuleHandleA
GetCurrentDirectoryA
CloseHandle
GetSystemTime
HeapSize
GetProcessHeap
SetEndOfFile
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
HeapReAlloc
VirtualAlloc
HeapAlloc
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
SetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
ExitProcess
Sleep
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
GetPrivateProfileStringA
lstrcmpiA
FindFirstFileA
SetCurrentDirectoryA
GlobalUnlock
MultiByteToWideChar
lstrcatA
ReadFile
MulDiv
GetDateFormatA
GetTickCount
GetTimeFormatA
GlobalLock
SetErrorMode
lstrlenA
lstrcmpA
GetFileSize
CreateFileA
lstrcpyA
GlobalFree
GlobalAlloc
lstrcpynA
TlsSetValue
TlsAlloc
TlsGetValue
GetProcAddress
GetModuleHandleW
HeapFree
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
WriteFile
RtlUnwind
DeleteCriticalSection
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
GetLastError
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
user32
IsDialogMessageA
DestroyWindow
SetCursor
GetMessageA
SetWindowRgn
GetSystemMenu
SetTimer
ScreenToClient
GetWindowRect
MapDialogRect
CreateDialogParamA
KillTimer
DrawTextA
GetKeyState
CopyImage
IsWindowEnabled
CharNextA
GetClientRect
GetWindowTextLengthA
wsprintfA
GetIconInfo
GetDC
DrawFocusRect
SendMessageA
TranslateMessage
GetWindowTextA
SetWindowLongA
MessageBoxA
GetWindowLongA
CreateWindowExA
ReleaseDC
EnableMenuItem
GetDlgItem
DestroyCursor
GetSysColor
SetWindowPos
GetCursorPos
ShowWindow
PostMessageA
DispatchMessageA
SetWindowTextA
LoadImageA
MapWindowPoints
UpdateWindow
EnableWindow
CallWindowProcA
LoadCursorA
GetDlgCtrlID
DestroyIcon
gdi32
PatBlt
SetTextColor
GetBkMode
GetDeviceCaps
CreateFontIndirectA
GetDIBits
SetBkColor
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CombineRgn
CreateBrushIndirect
GetBkColor
CreateRectRgn
GetObjectA
GetTextColor
CreateSolidBrush
comdlg32
CommDlgExtendedError
GetOpenFileNameA
ChooseColorA
GetSaveFileNameA
ChooseFontA
shell32
ExtractIconExA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA
SHBrowseForFolderA
ole32
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
Exports
Exports
dialog
initDialog
setFocus
show
skipValidation
Sections
.text Size: 79KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/LeftImg.bmp
-
$PLUGINSDIR/MA_DIRECTORY.ini
-
$PLUGINSDIR/MINIMAL.bmp
-
$PLUGINSDIR/NSISArray.dll.dll windows:4 windows x86 arch:x86
91596216b99c852af6e0fb1fe8192de4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalFree
lstrcpyA
lstrcpynA
lstrcmpiA
lstrcmpA
lstrcatA
GlobalAlloc
user32
MessageBoxA
SendMessageA
wsprintfA
GetDlgItem
FindWindowExA
DialogBoxParamA
EnableWindow
SetWindowTextA
EndDialog
RedrawWindow
CharLowerA
Exports
Exports
ArrayCount
ArrayExists
Clear
Concat
Copy
Cut
Debug
Delete
ErrorStyle
Exists
ExistsI
FreeUnusedMem
Join
New
Pop
Push
Put
ReDim
Read
ReadToStack
Reverse
Search
SearchI
SetAutoReDim
SetSize
Shift
SizeOf
Sort
Splice
Subtract
Swap
Unload
Unshift
Write
WriteList
WriteListC
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/PageBG.bmp
-
$PLUGINSDIR/STANDARD.bmp
-
$PLUGINSDIR/ScrollBarImg.bmp
-
$PLUGINSDIR/SetupType.ini
-
$PLUGINSDIR/SkinnedControls.dll.dll windows:4 windows x86 arch:x86
061c6722cad7481b1b1ec5ef69682b80
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetSystemInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetLocaleInfoA
GetCPInfo
GetOEMCP
GetACP
VirtualQuery
GetModuleFileNameA
GetStdHandle
WriteFile
GetCurrentThreadId
InitializeCriticalSection
TerminateProcess
ExitProcess
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
InterlockedExchange
RtlUnwind
LoadLibraryA
GetProcAddress
GetCurrentProcess
FlushInstructionCache
VirtualProtect
SetLastError
MulDiv
HeapAlloc
GetModuleHandleA
GetProcessHeap
HeapFree
GetVersion
GetVersionExA
lstrcmpA
lstrlenA
GetFileAttributesA
LocalFree
GetLastError
FormatMessageA
lstrcmpiA
GlobalAlloc
lstrcpynA
lstrcpyA
WideCharToMultiByte
GlobalFree
user32
SetCursor
GetCursorPos
ScreenToClient
GetMessagePos
ReleaseCapture
KillTimer
SetCapture
SetTimer
PtInRect
MapWindowPoints
CopyRect
ReleaseDC
GetWindowDC
WindowFromDC
InflateRect
FrameRect
OffsetRect
GetWindowRect
DrawEdge
GetSysColorBrush
GetSystemMetrics
SetRect
DrawFrameControl
GetSysColor
GetClientRect
CreateWindowExA
SendMessageA
SetWindowPos
ShowScrollBar
SetScrollRange
SetScrollPos
SetScrollInfo
GetScrollRange
GetScrollPos
GetScrollInfo
EnableScrollBar
FillRect
wsprintfA
LoadImageA
ShowWindow
FindWindowExA
EnumChildWindows
RemovePropA
GetClassNameA
GetParent
UpdateWindow
GetDlgItem
SetPropA
SetWindowLongA
InvalidateRect
PostMessageA
CallWindowProcA
GetDlgItemTextA
GetClassLongA
GetWindowLongA
GetPropA
DrawTextA
IsWindowVisible
gdi32
SetWindowOrgEx
GetObjectA
ExtTextOutA
CreatePatternBrush
SetBrushOrgEx
PatBlt
CreateBitmap
UnrealizeObject
CreateCompatibleBitmap
SetBkColor
GetStockObject
CreateSolidBrush
SetStretchBltMode
BitBlt
StretchBlt
SetBkMode
SetTextColor
DeleteObject
CreateCompatibleDC
SelectObject
GetPixel
DeleteDC
SelectClipRgn
IntersectClipRect
PlayEnhMetaFile
Exports
Exports
setskin
skinit
unskinit
Sections
.text Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/System.dll.dll windows:4 windows x86 arch:x86
2017f2acbdaa42ab3e4adeb8b4c37e7b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Exports
Exports
Alloc
Call
Copy
Free
Get
Int64Op
Store
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 520B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/UserInfo.dll.dll windows:4 windows x86 arch:x86
afa8e526425f3585465337467d0b5909
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetVersion
GetCurrentThread
lstrcpynA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
GlobalAlloc
advapi32
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken
Exports
Exports
GetAccountType
GetName
GetOriginalAccountType
Sections
.text Size: 1024B - Virtual size: 741B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 673B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 190B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/confirm.ini
-
$PLUGINSDIR/inetc.dll.dll windows:4 windows x86 arch:x86
8773e19ae02f331332db1b00671fdecf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
_mbschr
_adjust_fdiv
malloc
_initterm
free
_mbsrchr
strtoul
memset
_mbsstr
strtol
kernel32
CloseHandle
CreateThread
WaitForSingleObject
TerminateThread
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc
LoadLibraryA
GetProcAddress
lstrlenA
WriteFile
ReadFile
lstrcmpA
lstrcpynA
GetLastError
GlobalFree
lstrcmpiA
DeleteFileA
SleepEx
SetFilePointer
GetTickCount
lstrcatA
GetFileSize
CreateFileA
user32
MessageBoxA
GetParent
ShowWindow
SetWindowLongA
GetWindowLongA
SetWindowTextA
IsWindow
GetDlgItem
PostMessageA
GetWindowTextA
SendMessageA
SetDlgItemTextA
SetWindowPos
SystemParametersInfoA
GetClientRect
GetWindowRect
SetTimer
LoadIconA
UpdateWindow
DestroyWindow
KillTimer
RedrawWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
IsWindowVisible
EnableWindow
CreateDialogParamA
FindWindowExA
wsprintfA
SendDlgItemMessageA
wininet
HttpSendRequestA
HttpSendRequestExA
HttpQueryInfoA
FtpCreateDirectoryA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetSetFilePointer
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
InternetErrorDlg
HttpOpenRequestA
HttpAddRequestHeadersA
HttpEndRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
InternetWriteFile
comctl32
ord17
Exports
Exports
get
head
post
put
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/ioFile.ini
-
$PLUGINSDIR/ioSpecial.ini
-
$PLUGINSDIR/nsis7z.dll.dll windows:5 windows x86 arch:x86
4c04c20a976733bf789fead96eb58701
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryA
AreFileApisANSI
GetModuleFileNameA
SetLastError
CreateFileW
SetFileTime
CloseHandle
SetFileAttributesA
RemoveDirectoryA
MoveFileA
SetFileAttributesW
RemoveDirectoryW
MoveFileW
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
GetFullPathNameA
lstrlenA
GetFullPathNameW
FindClose
FindFirstFileA
FindFirstFileW
CreateFileA
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
GetProcAddress
GetCurrentProcess
GetSystemInfo
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
DeleteCriticalSection
VirtualFree
VirtualAlloc
WaitForSingleObject
SetEvent
InitializeCriticalSection
CreateEventA
ResetEvent
SetFileApisToOEM
GetVersionExA
GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
RaiseException
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
WriteConsoleW
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
HeapReAlloc
HeapCreate
HeapDestroy
GetModuleHandleW
Sleep
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
VirtualQuery
user32
GetDlgItem
FindWindowExA
SetWindowTextA
wsprintfA
CharUpperW
CharUpperA
SendMessageA
oleaut32
VariantCopy
VariantClear
SysAllocString
Exports
Exports
Extract
ExtractWithCallback
ExtractWithDetails
Sections
.text Size: 125KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/nsisunz.dll.dll windows:4 windows x86 arch:x86
11fff8f2508658ef41662344b464f9e3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DeleteCriticalSection
InitializeCriticalSection
CreateDirectoryA
lstrcpyA
GetVersion
lstrlenA
lstrcatA
GlobalFree
lstrcpynA
GlobalAlloc
LeaveCriticalSection
EnterCriticalSection
lstrcmpiA
lstrcmpA
GetSystemInfo
VirtualProtect
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapFree
GetLastError
CloseHandle
WriteFile
ReadFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapAlloc
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
RtlUnwind
InterlockedExchange
VirtualQuery
CreateFileA
GetACP
GetOEMCP
GetCPInfo
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetEndOfFile
HeapSize
GetLocaleInfoA
GetStringTypeA
user32
MessageBoxA
CharPrevA
PeekMessageA
TranslateMessage
DispatchMessageA
FindWindowExA
GetDlgItem
SendMessageA
wsprintfA
Exports
Exports
Unzip
UnzipToLog
UnzipToStack
extract_RunDLL
Sections
.text Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$_17_/IJL15.DLL.dll windows:5 windows x86 arch:x86
858bc1143564d13bd82d93d8f6b0c3c8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
psapi
GetModuleInformation
kernel32
GetModuleHandleW
GetProcAddress
GetPrivateProfileStringW
GetModuleFileNameW
WritePrivateProfileStringW
GetPrivateProfileIntW
LoadLibraryW
DeleteFileW
GetCurrentProcess
VirtualProtect
Sleep
CreateThread
Thread32First
Thread32Next
SetThreadPriority
OpenThread
CloseHandle
GetCurrentProcessId
SuspendThread
ResumeThread
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
ReadFile
GetProcessHeap
SetEndOfFile
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
CreateToolhelp32Snapshot
HeapSize
GetLocalTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
HeapAlloc
GetLastError
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetModuleHandleA
ExitProcess
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
CreateFileA
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetLocaleInfoA
SetFilePointer
MultiByteToWideChar
user32
GetSubMenu
LoadIconW
CheckMenuRadioItem
LoadMenuW
GetClassNameW
GetSystemMenu
InsertMenuW
SendMessageW
SetMenuItemInfoW
CallWindowProcW
EnumThreadWindows
wsprintfW
SetWindowLongW
gdi32
DeleteObject
Exports
Exports
ijlErrorStr
ijlFree
ijlGetLibVersion
ijlInit
ijlRead
ijlWrite
Sections
.text Size: 185KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$_17_/Lbg-patch.ini
-
$_17_/ijl15.dat.dll windows:4 windows x86 arch:x86
6b540d7d784d97e028bc85e2ab457662
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetStartupInfoA
CloseHandle
ReadFile
WriteFile
SetFilePointer
LoadLibraryA
GetProcAddress
FreeLibrary
OutputDebugStringA
GetCurrentThreadId
GetModuleFileNameA
lstrlenA
RtlUnwind
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
GetModuleHandleA
HeapAlloc
HeapFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
CreateFileA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
InterlockedDecrement
InterlockedIncrement
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
FlushFileBuffers
Exports
Exports
ijlErrorStr
ijlFree
ijlGetLibVersion
ijlInit
ijlRead
ijlWrite
Sections
.text Size: 304KB - Virtual size: 301KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 912B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
License.html.js .xml polyglot
-
MabiAssist.hta.hta .js polyglot
-
MabiAssist.ico
-
MabiAssist.ini
-
img/3MLE.png.png
-
img/BMP2MabiPNG.png.png
-
img/KukuTimer.png.png
-
img/KukuTimerFairy.png.png
-
img/MabinogiColorHelper.png.png
-
img/Noginogi.png.png
-
img/Weather/0.png.png
-
img/Weather/1.png.png
-
img/Weather/10.png.png
-
img/Weather/11.png.png
-
img/Weather/12.png.png
-
img/Weather/13.png.png
-
img/Weather/14.png.png
-
img/Weather/15.png.png
-
img/Weather/16.png.png
-
img/Weather/17.png.png
-
img/Weather/18.png.png
-
img/Weather/19.png.png
-
img/Weather/2.png.png
-
img/Weather/20.png.png
-
img/Weather/21.png.png
-
img/Weather/22.png.png
-
img/Weather/3.png.png
-
img/Weather/4.png.png
-
img/Weather/5.png.png
-
img/Weather/6.png.png
-
img/Weather/7.png.png
-
img/Weather/8.png.png
-
img/Weather/9.png.png
-
img/html.ico
-
img/icons/cancel.png.png
-
img/icons/config.png.png
-
img/icons/edit.png.png
-
img/icons/execute.png.png
-
img/icons/feed.png.png
-
img/icons/file.png.png
-
img/icons/home.png.png
-
img/icons/license.png.png
-
img/icons/official.png.png
-
img/icons/ok.png.png
-
img/icons/print.png.png
-
img/icons/weather.png.png
-
img/kbd.png.png
-
img/loading.gif.gif
-
img/mabinogi.png.png
-
img/mmSeq.png.png
-
js/MabiAssist.css
-
js/MabiAssist.js.js
-
js/ini.js.js
-
js/io.js.js
-
locale/China.ini
-
locale/Japan.ini
-
locale/Korea.ini
-
locale/Taiwan.ini
-
locale/US.ini
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ