ccad6e6afd6920e298068e179e7457b4944cc61a8752f5eb895d3738f2a92956

Sharing

Copy URL

Twitter E-mail

General

Target

ccad6e6afd6920e298068e179e7457b4944cc61a8752f5eb895d3738f2a92956
Size

3.6MB
MD5

ab6c503ca025141c0173c61810c77eba
SHA1

5dc918ea3b61934415a5623737cc4ecd803ec951
SHA256

ccad6e6afd6920e298068e179e7457b4944cc61a8752f5eb895d3738f2a92956
SHA512

a76c5a340296b28740cc2c14565d23e6decff0a05fd2f83e36e8fd3e1bd0a687ede63e3f157b09cab98da5aa850cb1e425dce6bfc235cbbeabe406c50a575f84
SSDEEP

49152:/Msf/CcVUURP2r5Kp0UceoNXXCaSadgXgDUM0WxM8BJfLwXDTJ3RQbfI9RKk3:/n/C8peA0bkLawM0WtfLwTTJ3RIuUg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/BANDIZIP-PORTABLE-GL-64BIT/bdzsfx.sfx

Files

ccad6e6afd6920e298068e179e7457b4944cc61a8752f5eb895d3738f2a92956
.zip
BANDIZIP-PORTABLE-GL-64BIT/Ark64.dll
.dll windows:6 windows x64

534b07cb34cf9c01ac12039be384b876

Code Sign

6c:fb:60:32:69:e9:62:a4:94:e3:f3:87:c1:a2:c9:9e
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

26-12-2019 00:00

Not After

26-03-2023 23:59

Subject

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

22-07-2014 00:00

Not After

21-07-2024 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19-02-2018 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:5d:e6:75:2e:75:8e:7f:c2:73:cd:e1:73:cd:db:68:b3:fb:61:22:e9:14:a0:0f:71:df:a5:3c:25:dc:c6:92
Signer

Actual PE Digest

14:5d:e6:75:2e:75:8e:7f:c2:73:cd:e1:73:cd:db:68:b3:fb:61:22:e9:14:a0:0f:71:df:a5:3c:25:dc:c6:92

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetProcessHeap
lstrcatW
lstrlenW
GetFileAttributesA
GetFileAttributesW
lstrlenA
lstrcpyW
CreateDirectoryW
MultiByteToWideChar
WideCharToMultiByte
SetFileAttributesW
GetFileSize
CreateFileW
GetFileSizeEx
CloseHandle
GetCurrentThread
SetFileTime
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
Sleep
NormalizeString
DeleteFileW
RemoveDirectoryW
CreateSymbolicLinkW
GlobalMemoryStatusEx
lstrcpynW
FreeLibrary
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetSystemInfo
lstrcpyA
GetFileAttributesExW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateEventW
SetEvent
WaitForSingleObject
ResetEvent
GetDriveTypeW
WriteFile
SetFilePointer
ReadFile
FlushFileBuffers
CreateFileA
GetFileTime
MoveFileW
GetModuleFileNameW
LoadLibraryW
GetProcAddress
IsNormalizedString
lstrcpynA
LocalFileTimeToFileTime
GetCurrentThreadId
QueryPerformanceCounter
SetThreadPriority
lstrcmpW
VirtualAlloc
VirtualFree
GetTickCount
CreateSemaphoreW
ReleaseSemaphore
DeleteCriticalSection
GetCPInfo
IsDBCSLeadByte
CreateThread
GetCurrentProcess
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetThreadLocale
GetACP
GetLocaleInfoA
WaitForMultipleObjects
IsDebuggerPresent
OutputDebugStringW
WaitForSingleObjectEx
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
QueryPerformanceFrequency
ExitProcess
LCMapStringW
GetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetFilePointerEx
GetStringTypeW
SetStdHandle
WriteConsoleW
HeapDestroy
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
CompareStringW
GetCurrentProcessId

user32

FindWindowW
SendMessageW
MessageBoxW
wsprintfW

shlwapi

PathIsDirectoryW

advapi32

ImpersonateSelf
RevertToSelf
OpenThreadToken
AccessCheck
AreAllAccessesGranted
GetFileSecurityW

oleaut32

SysFreeString
SysAllocStringLen
SysAllocString
SysStringLen
VariantClear

Exports

Exports

CreateArk
CreateArkCompressor

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 494KB - Virtual size: 493KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BANDIZIP-PORTABLE-GL-64BIT/Ark64lgplv2.dll
.dll windows:6 windows x64

2483385e8509173cd93c766cb3e330b5

Code Sign

6c:fb:60:32:69:e9:62:a4:94:e3:f3:87:c1:a2:c9:9e
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

26-12-2019 00:00

Not After

26-03-2023 23:59

Subject

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

22-07-2014 00:00

Not After

21-07-2024 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19-02-2018 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:fe:0a:88:a4:29:84:33:86:ca:19:97:ac:ad:b3:e9:be:06:4c:ea:66:c6:08:12:ae:dc:34:19:58:0e:26:86
Signer

Actual PE Digest

11:fe:0a:88:a4:29:84:33:86:ca:19:97:ac:ad:b3:e9:be:06:4c:ea:66:c6:08:12:ae:dc:34:19:58:0e:26:86

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

VirtualAlloc
VirtualFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetLastError
CloseHandle
WaitForSingleObject
CreateEventW
SetEvent
ResetEvent
InitializeCriticalSection
CompareFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
WaitForMultipleObjects
MultiByteToWideChar
WideCharToMultiByte
GetSystemInfo
GetSystemTimeAsFileTime
HeapFree
InitializeCriticalSectionAndSpinCount
HeapSize
HeapReAlloc
RaiseException
HeapAlloc
GetProcessHeap
WriteConsoleW
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
SetStdHandle
GetStringTypeW
IsDebuggerPresent
OutputDebugStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetModuleHandleW
GetProcAddress
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType

user32

CharUpperW

oleaut32

SysStringLen
SysAllocStringLen
SysFreeString
VariantClear
SysAllocString

Exports

Exports

AllocWinZipJPEGDecompressor
AreMoreWinZipJPEGBytesAvailable
AreMoreWinZipJPEGSlicesAvailable
Create7zArc
EncodeWinZipJPEGBlocksToBuffer
FreeWinZipJPEGDecompressor
IsFinalWinZipJPEGBundle
ReadNextWinZipJPEGBundle
ReadNextWinZipJPEGSlice
ReadWinZipJPEGHeader
WinZipJPEGBundleMetadataBytes
WinZipJPEGBundleMetadataLength

Sections

.text
Size: 388KB - Virtual size: 388KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BANDIZIP-PORTABLE-GL-64BIT/Bandizip64.exe
.exe windows:6 windows x64

15edf8660c1fae8d1f04218b7fdf6d00

Code Sign

6c:fb:60:32:69:e9:62:a4:94:e3:f3:87:c1:a2:c9:9e
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

26-12-2019 00:00

Not After

26-03-2023 23:59

Subject

CN=Bandisoft,O=Bandisoft,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

22-07-2014 00:00

Not After

21-07-2024 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19-02-2018 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c0:f2:00:38:da:06:2a:4e:54:64:52:1c:45:4f:4c:96:23:b9:4f:86:9e:58:68:00:ac:6e:5a:af:b6:ac:29:01
Signer

Actual PE Digest

c0:f2:00:38:da:06:2a:4e:54:64:52:1c:45:4f:4c:96:23:b9:4f:86:9e:58:68:00:ac:6e:5a:af:b6:ac:29:01

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetSystemDirectoryW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
GetCurrentProcessId
OpenProcess
TerminateProcess
GetSystemInfo
LocalAlloc
FileTimeToLocalFileTime
GetModuleHandleExW
MulDiv
GlobalLock
GlobalUnlock
FormatMessageW
WriteFile
CreateThread
ExitProcess
SetUnhandledExceptionFilter
GlobalSize
lstrlenA
InitializeCriticalSection
CreateEventW
SetEvent
GetWindowsDirectoryW
GetDateFormatW
GetTimeFormatW
CompareFileTime
GetVersion
ResetEvent
GetUserDefaultUILanguage
CompareStringW
GetTickCount
MoveFileW
GlobalMemoryStatusEx
TerminateThread
SetPriorityClass
CreateMutexW
MapViewOfFile
OpenFileMappingW
UnmapViewOfFile
lstrcmpiW
LoadLibraryExW
DecodePointer
SetErrorMode
GetProcessHandleCount
SetCurrentDirectoryW
CreateFileMappingW
GetDriveTypeW
GetShortPathNameW
GetUserDefaultLangID
GetPrivateProfileIntW
ReleaseMutex
GetExitCodeThread
VirtualQuery
MultiByteToWideChar
SetEndOfFile
WriteConsoleW
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetFileType
GetStdHandle
FreeLibraryAndExitThread
ExitThread
SetConsoleCtrlHandler
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlPcToFileHeader
RtlUnwindEx
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
WideCharToMultiByte
RemoveDirectoryW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
LocalFree
GetFileSizeEx
GetFileSize
GetFileAttributesW
lstrlenW
DeleteFileW
GetTempFileNameW
GetTempPathW
GetCurrentDirectoryW
GetModuleFileNameW
GetDiskFreeSpaceW
GlobalFree
GlobalAlloc
GetCurrentThread
GetCurrentProcess
FreeLibrary
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcpyW
lstrcpynW
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetFileTime
ReadFile
SetFilePointer
CreateFileW
OutputDebugStringA
OutputDebugStringW
CloseHandle
SetLastError
RaiseException
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionEx
GetLastError
DeleteCriticalSection
Sleep
GetTickCount64
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetCurrentThreadId
FindClose
FindNextFileW
lstrcmpW
FindFirstFileW
GetProcessHeap
HeapAlloc
HeapFree
RtlUnwind
HeapReAlloc
HeapSize
VirtualProtect
HeapDestroy

user32

GetCapture
CreateDialogIndirectParamW
SetFocus
GetFocus
LoadIconW
PostMessageW
SendMessageTimeoutW
GetActiveWindow
GetSubMenu
GetMenuItemInfoW
ModifyMenuW
GetMenuItemID
GetMenuStringW
GetMenuItemCount
EnumChildWindows
IntersectRect
SetWindowRgn
AdjustWindowRectEx
SubtractRect
GetClassLongW
GetClassNameW
MapWindowPoints
RegisterClipboardFormatW
ReleaseCapture
GetMessageW
GetDlgItem
SetWindowLongW
DestroyIcon
BringWindowToTop
SetForegroundWindow
AttachThreadInput
GetForegroundWindow
GetWindowPlacement
GetWindowThreadProcessId
IsWindow
IsDialogMessageW
ClientToScreen
DrawIcon
EndDialog
RedrawWindow
CreatePopupMenu
TrackPopupMenu
GetMenuDefaultItem
EnumWindows
EnumDisplayMonitors
UnionRect
SetPropW
GetPropW
RemovePropW
GetKeyState
IsWindowEnabled
UpdateWindow
TrackMouseEvent
LoadMenuW
DestroyMenu
GetDlgItemInt
SetDlgItemInt
ScrollWindow
GetScrollInfo
CreateDialogParamW
InsertMenuW
PostQuitMessage
SendMessageW
RegisterClassW
GetCaretPos
GetWindowTextLengthW
GetWindowTextW
LoadCursorW
SetCursor
DefWindowProcW
DestroyWindow
FindWindowExW
GetDlgCtrlID
SetWindowLongPtrW
GetWindowLongPtrW
CallWindowProcW
ShowWindow
IsWindowVisible
GetMenu
TranslateAcceleratorW
LoadAcceleratorsW
CharNextW
DeleteMenu
EnableMenuItem
SetWindowTextA
SetWindowPlacement
DialogBoxParamW
CheckMenuItem
WaitForInputIdle
SetDlgItemTextW
GetWindow
MonitorFromWindow
wsprintfW
MessageBoxW
SetCapture
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
SetWindowTextW
GetWindowLongW
MonitorFromPoint
CopyRect
GetMonitorInfoW
RegisterWindowMessageW
PeekMessageW
TranslateMessage
DispatchMessageW
SetRectEmpty
GetDesktopWindow
GetSysColor
DrawTextW
BeginPaint
GetClientRect
EndPaint
GetSystemMetrics
CreateWindowExW
EnableWindow
SetScrollPos
GetDC
ReleaseDC
MoveWindow
IsRectEmpty
MonitorFromRect
SystemParametersInfoW
FindWindowW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
InflateRect
EqualRect
KillTimer
GetParent
SetTimer
SetWindowPos
GetCursorPos
InvalidateRect
PtInRect
SetRect
OffsetRect
GetWindowDC
SetScrollInfo
SetScrollRange
ScreenToClient
GetWindowRect

gdi32

SetPixel
CombineRgn
ExtCreateRegion
LineTo
MoveToEx
CreateSolidBrush
OffsetRgn
CreateFontIndirectW
CreateDIBSection
OffsetWindowOrgEx
CreateFontW
CreateRectRgn
GetDeviceCaps
GetObjectW
GetTextExtentPoint32W
ExcludeClipRect
GetTextMetricsW
DeleteDC
DeleteObject
BitBlt
SetBkMode
GetStockObject
SetWindowOrgEx
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
SetTextColor
SetBkColor
ExtTextOutW

comdlg32

ChooseColorW
GetOpenFileNameW
GetSaveFileNameW

advapi32

AreAllAccessesGranted
OpenProcessToken
GetTokenInformation
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegQueryInfoKeyW
RevertToSelf
OpenThreadToken
AccessCheck
ImpersonateSelf
GetFileSecurityW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

shell32

Shell_NotifyIconW
ord155
SHOpenFolderAndSelectItems
ord190
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFolderPathW
SHGetFolderLocation
SHGetSpecialFolderPathW
ExtractIconExW
DragFinish
DragAcceptFiles
ord16
ShellExecuteW
ord2
ord4
SHCreateDirectoryExW
ord21
SHGetDataFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc
SHGetDesktopFolder
SHGetFileInfoW
SHChangeNotify
SHAppBarMessage
ShellExecuteExW
SHFileOperationW
DragQueryFileW

ole32

OleUninitialize
OleInitialize
CoTaskMemRealloc
CoUninitialize
CoInitialize
DoDragDrop
CoTaskMemAlloc
CoTaskMemFree
OleGetClipboard
ReleaseStgMedium
OleSetClipboard
CoCreateInstance
CoAllowSetForegroundWindow

oleaut32

VarUI4FromStr

shlwapi

PathCanonicalizeW
StrFormatByteSizeW
StrStrW
PathMatchSpecW
PathFileExistsW
PathGetDriveNumberW
PathIsDirectoryW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

comctl32

_TrackMouseEvent
ord17

dbghelp

MiniDumpWriteDump

wininet

HttpEndRequestW
InternetWriteFile
HttpSendRequestExW
HttpSendRequestW
InternetErrorDlg
HttpQueryInfoW
InternetQueryOptionW
InternetConnectA
InternetSetOptionW
InternetOpenW
InternetCrackUrlA
InternetCloseHandle
InternetQueryDataAvailable
InternetReadFile
HttpOpenRequestA
HttpAddRequestHeadersW

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 395KB - Virtual size: 395KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ve_share
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BANDIZIP-PORTABLE-GL-64BIT/Bandizip64.ini
BANDIZIP-PORTABLE-GL-64BIT/VersionNo.ini
BANDIZIP-PORTABLE-GL-64BIT/bdzsfx.sfx
.exe windows:5 windows x86

ae39a17bdfe2e7a4cb8e7edb36dc6838

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
FileTimeToSystemTime
GetCurrentProcessId
LoadLibraryW
QueryPerformanceCounter
WideCharToMultiByte
VirtualAlloc
VirtualFree
DeleteFileW
WaitForSingleObject
CreateEventW
SetEvent
ResetEvent
lstrcatW
GetFileAttributesA
GetFileAttributesW
lstrlenA
lstrcpyW
SetFileAttributesW
GetFileSize
CreateFileW
GetCurrentThread
SetFileTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
Sleep
GlobalMemoryStatusEx
GetDriveTypeW
WriteFile
SetFilePointer
CreateFileA
ReadFile
FlushFileBuffers
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
GetVersion
GetSystemDirectoryW
CompareStringA
WriteConsoleW
CloseHandle
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringA
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
GetSystemTimeAsFileTime
GetCommandLineW
RtlUnwind
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
GetStdHandle
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsDebuggerPresent
SetUnhandledExceptionFilter
GetModuleHandleA
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
CreateThread
ExitThread
ExitProcess
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
CreateProcessW
SetCurrentDirectoryW
GetUserDefaultLangID
GetCurrentThreadId
SetLastError
FlushInstructionCache
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryExW
MultiByteToWideChar
EnterCriticalSection
RaiseException
LeaveCriticalSection
lstrcmpiW
GetProcAddress
GetModuleHandleW
FreeLibrary
GetLastError
InterlockedDecrement
InterlockedIncrement
GlobalFree
lstrcpynW
CreateDirectoryW
GetModuleFileNameW
lstrlenW
FindResourceExW
FindResourceW
LoadResource
LockResource
GetConsoleOutputCP
SizeofResource
HeapFree
HeapAlloc
HeapDestroy

user32

TranslateMessage
SendMessageW
PeekMessageW
UnregisterClassA
CharNextW
DispatchMessageW
RegisterWindowMessageW
EndPaint
BeginPaint
ShowWindow
GetForegroundWindow
DrawIcon
DrawTextW
GetSysColor
CreateWindowExW
DestroyWindow
IsDialogMessageW
GetCapture
CreateDialogIndirectParamW
ReleaseDC
GetDC
OffsetRect
CopyRect
SystemParametersInfoW
MonitorFromRect
GetFocus
GetSystemMetrics
SetFocus
InvalidateRect
EndDialog
KillTimer
ScreenToClient
MessageBoxW
EnableWindow
SetTimer
GetDlgItem
SetDlgItemTextW
SetWindowTextW
GetWindow
MonitorFromWindow
GetMonitorInfoW
LoadIconW
GetClientRect
PostMessageW
MapWindowPoints
GetParent
MoveWindow
GetWindowRect
SetWindowPos
GetWindowLongW
GetWindowTextW
GetWindowTextLengthW
SetWindowLongW
DialogBoxParamW
GetActiveWindow
GetMessageW

gdi32

GetObjectW
GetStockObject
SetBkMode
SetTextColor
GetDeviceCaps
ExtTextOutW
SetBkColor
GetTextExtentPoint32W
GetTextMetricsW
BitBlt
DeleteDC
SelectObject
CreateCompatibleDC
CreateDIBSection
DeleteObject
CreateFontIndirectW

advapi32

AccessCheck
OpenThreadToken
RevertToSelf
ImpersonateSelf
GetFileSecurityW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
AreAllAccessesGranted

shell32

SHBrowseForFolderW
ShellExecuteW
SHGetPathFromIDListW

ole32

CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

PathIsDirectoryW

Sections

.text
Size: 203KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BANDIZIP-PORTABLE-GL-64BIT/config.ini
BANDIZIP-PORTABLE-GL-64BIT/data/ArkLicense.txt
BANDIZIP-PORTABLE-GL-64BIT/data/resource.data
BANDIZIP-PORTABLE-GL-64BIT/data/skin.data
.zip
BANDIZIP-PORTABLE-GL-64BIT/icons/default/001.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/7z.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/Bandizip.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/_desc.ini
BANDIZIP-PORTABLE-GL-64BIT/icons/default/alz.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/bz2.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/cab.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/egg.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/gz.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/iso.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/lha.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/lzh.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/rar.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/tar.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/tbz.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/tbz2.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/tgz.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/xz.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/zip.ico
BANDIZIP-PORTABLE-GL-64BIT/icons/default/zipx.ico
BANDIZIP-PORTABLE-GL-64BIT/langs/Arabic.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Armenian.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Belarusian.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Bulgarian.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Catalan.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Croatian.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Czech.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Danish.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Dutch.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/English.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Farsi.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Finnish.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/French.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/German.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Greek.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Hebrew.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Hindi.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Hungarian.ini
.ps1
BANDIZIP-PORTABLE-GL-64BIT/langs/Indonesian.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Italian.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Italian2.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Japanese.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Kazakh.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Kurdish.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Lithuanian.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Norwegian.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Polish.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Portuguese.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/PortugueseBR.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Romanian.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Russian.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Serbian.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/SimpChinese.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Sinhala.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Slovak.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Slovenian.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Spanish.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Swedish.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Tagalog.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Thai.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/TradChinese.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Turkish.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Ukrainian.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Uyghur.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/UyghurLatin.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Uzbek.ini
BANDIZIP-PORTABLE-GL-64BIT/langs/Vietnamese.ini
BANDIZIP-PORTABLE-GL-64BIT/shellicons/bandizip.ico
BANDIZIP-PORTABLE-GL-64BIT/shellicons/cmd.ico
BANDIZIP-PORTABLE-GL-64BIT/shellicons/uac.ico

Sharing

General

Malware Config

Signatures

Files

534b07cb34cf9c01ac12039be384b876

Code Sign

6c:fb:60:32:69:e9:62:a4:94:e3:f3:87:c1:a2:c9:9eCertificate

Extended Key Usages

Key Usages

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8Certificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

14:5d:e6:75:2e:75:8e:7f:c2:73:cd:e1:73:cd:db:68:b3:fb:61:22:e9:14:a0:0f:71:df:a5:3c:25:dc:c6:92Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shlwapi

advapi32

oleaut32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 494KB - Virtual size: 493KB

.data Size: 31KB - Virtual size: 112KB

.pdata Size: 52KB - Virtual size: 51KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 14KB - Virtual size: 14KB

2483385e8509173cd93c766cb3e330b5

Code Sign

6c:fb:60:32:69:e9:62:a4:94:e3:f3:87:c1:a2:c9:9eCertificate

Extended Key Usages

Key Usages

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8Certificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

11:fe:0a:88:a4:29:84:33:86:ca:19:97:ac:ad:b3:e9:be:06:4c:ea:66:c6:08:12:ae:dc:34:19:58:0e:26:86Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

oleaut32

Exports

Exports

Sections

.text Size: 388KB - Virtual size: 388KB

.rdata Size: 122KB - Virtual size: 121KB

.data Size: 7KB - Virtual size: 43KB

.pdata Size: 16KB - Virtual size: 16KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

15edf8660c1fae8d1f04218b7fdf6d00

Code Sign

6c:fb:60:32:69:e9:62:a4:94:e3:f3:87:c1:a2:c9:9eCertificate

Extended Key Usages

Key Usages

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8Certificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

6c:fb:60:32:69:e9:62:a4:94:e3:f3:87:c1:a2:c9:9e
Certificate

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

14:5d:e6:75:2e:75:8e:7f:c2:73:cd:e1:73:cd:db:68:b3:fb:61:22:e9:14:a0:0f:71:df:a5:3c:25:dc:c6:92
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 494KB - Virtual size: 493KB

.data
Size: 31KB - Virtual size: 112KB

.pdata
Size: 52KB - Virtual size: 51KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 14KB - Virtual size: 14KB

6c:fb:60:32:69:e9:62:a4:94:e3:f3:87:c1:a2:c9:9e
Certificate

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

11:fe:0a:88:a4:29:84:33:86:ca:19:97:ac:ad:b3:e9:be:06:4c:ea:66:c6:08:12:ae:dc:34:19:58:0e:26:86
Signer

.text
Size: 388KB - Virtual size: 388KB

.rdata
Size: 122KB - Virtual size: 121KB

.data
Size: 7KB - Virtual size: 43KB

.pdata
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB

6c:fb:60:32:69:e9:62:a4:94:e3:f3:87:c1:a2:c9:9e
Certificate

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

c0:f2:00:38:da:06:2a:4e:54:64:52:1c:45:4f:4c:96:23:b9:4f:86:9e:58:68:00:ac:6e:5a:af:b6:ac:29:01
Signer

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 395KB - Virtual size: 395KB

.data
Size: 34KB - Virtual size: 64KB

.pdata
Size: 43KB - Virtual size: 43KB

.didat
Size: 512B - Virtual size: 56B

ve_share
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 127KB - Virtual size: 126KB

.reloc
Size: 7KB - Virtual size: 6KB

.text
Size: 203KB - Virtual size: 202KB

.rdata
Size: 41KB - Virtual size: 41KB

.data
Size: 8KB - Virtual size: 71KB

.rsrc
Size: 37KB - Virtual size: 37KB

.reloc
Size: 19KB - Virtual size: 19KB