your_file_is_ready[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

your_file_is_ready.zip
Size

3.2MB
MD5

d73577c2cf299059ac0ea3e64a9b8eba
SHA1

72584f6126d9c6f5c08ddcaf296561a8941bd3ef
SHA256

d49eb33b4beee6931d4c7dd49f405ad882436f4d99237454cfae332aa4ab11a2
SHA512

08c20d862320bd5b6485e85df9227aeb8515f2b1b5aafbd5dfecface19cdade2d1ef6499ed1fe4d7517751e662db1651a676ac704dbf0dda505028cc45288112
SSDEEP

98304:UR1u+bMD9qzSci/s99F5kJByzoHVSOGl9sIW5BX1t:G4+QpqzScciT5OByC+l9sIWHL

Score

1^/10

Malware Config

Signatures

Files

your_file_is_ready.zip
.zip
LICENSE
NppShell_06.dll
.dll regsvr32 windows x64

5c0edb7e35310ff8f3aabe7a6043f076

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4a
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

13/05/2022, 00:00

Not After

14/05/2025, 23:59

Subject

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d2:d7:83:88:82:c2:c2:77:d6:d1:26:77:c8:05:bc:b0:d0:d9:dc:ae
Signer

Actual PE Digest

d2:d7:83:88:82:c2:c2:77:d6:d1:26:77:c8:05:bc:b0:d0:d9:dc:ae

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

06/03/2023, 01:20
Valid: true

Chain 1

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Chain 2

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shell32

ShellExecuteW
DragQueryFileW

shlwapi

StrRChrW
PathFindExtensionW

msimg32

AlphaBlend

kernel32

GetLastError
lstrcatW
lstrlenW
GetModuleFileNameW
lstrcpynW
GetVersionExW
CreateProcessW
lstrcpynA
FindFirstFileW
GetProcAddress
LoadLibraryW
GetProcessHeap
HeapFree
HeapAlloc
FreeLibrary
Sleep
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
FindClose

user32

DestroyIcon
ReleaseDC
SetRect
GetDC
GetIconInfo
DrawIconEx
SetMenuItemInfoW
SendMessageW
SetDlgItemTextW
GetDlgItemTextW
GetSystemMetrics
MessageBoxW
InsertMenuW
SetMenuInfo
EndDialog
GetDlgItem
CreateIconIndirect
wsprintfW
DialogBoxParamW
DrawTextW
CharUpperBuffW
LoadImageW
PostMessageW

gdi32

CreateSolidBrush
RoundRect
CreatePen
DeleteDC
SetBkColor
CreateFontIndirectW
SetTextColor
GetTextExtentPoint32W
GetDIBits
DeleteObject
SelectObject
SetBkMode
CreateDIBSection
CreateCompatibleDC

advapi32

RegCloseKey
RegDeleteKeyW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW

ole32

CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoInitializeEx

msvcr90

_lock
__dllonexit
_unlock
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
__CppXcptFilter
__C_specific_handler
_amsg_exit
_onexit
_encoded_null
free
memset
_initterm
_malloc_crt
_encode_pointer
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
memcmp
??_U@YAPEAX_K@Z
_decode_pointer
_initterm_e

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SETUP.exe
.exe windows x64

4978c245f35bf519bc526e6275400c94

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4a
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

13/05/2022, 00:00

Not After

14/05/2025, 23:59

Subject

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

dd:ed:02:41:e9:2a:23:bc:e3:bc:c4:89:94:1f:9a:58:5f:84:36:34
Signer

Actual PE Digest

dd:ed:02:41:e9:2a:23:bc:e3:bc:c4:89:94:1f:9a:58:5f:84:36:34

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

06/03/2023, 01:20
Valid: true

Chain 1

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Chain 2

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

comctl32

ImageList_BeginDrag
ImageList_DragMove
ImageList_Remove
ImageList_DragShowNolock
ImageList_EndDrag
ord17
ImageList_SetIconSize
ImageList_AddMasked
InitCommonControlsEx
ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon
_TrackMouseEvent
ImageList_Draw
ImageList_GetImageInfo
ord412
ord411
ord410
ImageList_DragEnter
ord413

shlwapi

AssocQueryStringW
ColorRGBToHLS
PathStripPathW
PathAppendW
PathAddExtensionW
ColorAdjustLuma
PathRemoveExtensionW
PathIsDirectoryW
PathCombineW
PathIsRelativeW
PathFindFileNameW
PathCompactPathExW
PathGetDriveNumberW
PathMatchSpecW
PathFindExtensionW
PathFileExistsW
PathRemoveFileSpecW
ColorHLSToRGB

shell32

DragQueryFileW
SHFileOperationW
DragQueryPoint
DragFinish
ShellExecuteW
ord165
SHGetFolderPathW
SHCreateItemFromParsingName
Shell_NotifyIconW

dbghelp

ImageNtHeader

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

crypt32

CertGetCertificateContextProperty
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CertCloseStore
CryptQueryObject
CertNameToStrW
CryptMsgClose

wintrust

WinVerifyTrust

sensapi

IsDestinationReachableW
IsNetworkAlive

wininet

InternetCrackUrlW

imm32

ImmSetCompositionStringW
ImmEscapeW
ImmGetCompositionStringW
ImmSetCompositionWindow
ImmSetCompositionFontW
ImmReleaseContext
ImmGetContext
ImmNotifyIME
ImmSetCandidateWindow

msimg32

AlphaBlend

uxtheme

EndBufferedAnimation
SetWindowTheme
GetThemeTransitionDuration
DrawThemeParentBackground
CloseThemeData
GetThemePartSize
DrawThemeBackground
OpenThemeData
GetThemeFont
GetThemeBackgroundContentRect
EnableThemeDialogTexture
DrawThemeTextEx
BufferedPaintStopAllAnimations
BeginBufferedAnimation
BufferedPaintRenderAnimation

kernel32

FindClose
GetFileAttributesW
CreateDirectoryW
CompareFileTime
GetFullPathNameW
GetLongPathNameW
SetFileAttributesW
GetFileAttributesExW
FileTimeToSystemTime
DeleteFileW
GetTimeFormatW
MoveFileExW
lstrcpyW
SystemTimeToTzSpecificLocalTime
GetDateFormatW
GlobalLock
GlobalUnlock
WriteFile
GetTimeFormatEx
CreateFileW
GetDateFormatEx
FormatMessageW
GlobalAlloc
CloseHandle
GetLocalTime
GetCurrentDirectoryW
SetFilePointerEx
LCMapStringW
FlushFileBuffers
FormatMessageA
ExpandEnvironmentStringsW
SetCurrentDirectoryW
SizeofResource
LockResource
LoadResource
FindResourceW
FreeLibrary
WaitForSingleObject
CreateEventW
SetEvent
CreateThread
GetCurrentThreadId
CopyFileW
GetCurrentProcess
GetCurrentProcessId
CreateMutexW
ReleaseMutex
Sleep
GlobalSize
lstrcpynW
lstrcmpiA
WaitForMultipleObjects
CopyFileExW
GetVersionExW
GetSystemInfo
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
SetLastError
GetTempPathW
CancelIo
WaitForSingleObjectEx
QueueUserAPC
SleepEx
ReadDirectoryChangesW
GetLocaleInfoA
GetTickCount
GetStringTypeExW
LCMapStringA
GetStringTypeExA
FindNextFileW
LoadLibraryA
GetSystemTimeAsFileTime
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetModuleHandleExW
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
IsProcessorFeaturePresent
GetNativeSystemInfo
RaiseException
RtlPcToFileHeader
QueryPerformanceFrequency
QueryPerformanceCounter
InitOnceBeginInitialize
InitOnceComplete
GetStringTypeW
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
LocalFree
GetLastError
LocalAlloc
LoadLibraryExW
lstrcmpiW
GetModuleHandleW
GetProcAddress
VirtualProtect
EncodePointer
DecodePointer
GetLocaleInfoEx
LCMapStringEx
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
FindFirstFileW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
GetVersion
GetACP
GetModuleFileNameW
MulDiv
GetUserDefaultLCID
lstrcmpW
InitializeSListHead
RtlUnwindEx
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ReadFile
ExitProcess
ExitThread
FreeLibraryAndExitThread
GetStdHandle
HeapAlloc
HeapFree
GetFileType
GetConsoleMode
ReadConsoleW
CompareStringW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
GetFileSizeEx
GetConsoleOutputCP
IsValidCodePage
GetOEMCP
RtlUnwind
HeapReAlloc
FindFirstFileExW
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
HeapSize
SetEndOfFile
WriteConsoleW
ResetEvent

user32

CharUpperW
IsCharLowerW
FindWindowW
CreateAcceleratorTableW
ShowCursor
CreateDialogIndirectParamW
MonitorFromRect
SetRectEmpty
LoadBitmapW
GetCapture
AppendMenuW
RegisterWindowMessageW
ScrollWindow
RemovePropW
GetPropW
InsertMenuItemW
EndDeferWindowPos
BeginDeferWindowPos
DeferWindowPos
KillTimer
GetCaretBlinkTime
AppendMenuA
GetMessageTime
GetKeyboardLayout
ValidateRect
SetTimer
DestroyCursor
MsgWaitForMultipleObjects
NotifyWinEvent
GetUpdateRgn
SystemParametersInfoA
GetDoubleClickTime
DrawTextA
CopyImage
MonitorFromPoint
AdjustWindowRectEx
LoadStringW
LoadStringA
SetForegroundWindow
DestroyIcon
MessageBoxA
TranslateMessage
FlashWindowEx
PostQuitMessage
GetSysColorBrush
BringWindowToTop
SetCapture
ReleaseCapture
GetActiveWindow
RedrawWindow
IsChild
SetParent
FindWindowExW
UnhookWindowsHookEx
SetWindowsHookExW
GetMenuState
GetMenuItemCount
CreatePopupMenu
SetMenuItemInfoW
DestroyMenu
InsertMenuW
CheckMenuItem
EnableMenuItem
CreateMenu
IsWindow
EmptyClipboard
SetClipboardData
GetDlgCtrlID
GetDlgItemInt
SetDlgItemInt
CreateDialogParamW
IsWindowVisible
ShowWindow
ClientToScreen
RegisterClipboardFormatW
SetClipboardViewer
MessageBoxW
OpenClipboard
ChangeClipboardChain
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
IsIconic
ShowScrollBar
PostMessageW
GetMenu
DestroyWindow
GetDC
HideCaret
CreateWindowExW
MessageBeep
IsCharAlphaNumericW
GetWindowPlacement
GetKeyboardState
SetCaretPos
GetScrollRange
CreateCaret
RegisterClassW
SetWindowPlacement
DrawTextExW
LoadCursorW
DestroyCaret
SetCursor
SetScrollRange
ShowCaret
SetScrollPos
DrawEdge
GetParent
UpdateWindow
DrawFrameControl
ToAscii
MoveWindow
GetKeyState
EndDialog
SendDlgItemMessageW
DialogBoxIndirectParamW
SetFocus
DrawIconEx
DialogBoxParamW
LoadImageW
ModifyMenuW
GetMenuItemID
GetSubMenu
RemoveMenu
GetIconInfo
IsCharAlphaW
DrawIcon
SetLayeredWindowAttributes
GetLastActivePopup
LoadMenuW
GetClassNameA
GetWindowTextA
CreateIconIndirect
LoadIconW
WindowFromPoint
EnableWindow
GetMenuItemInfoW
DefWindowProcW
GetWindowRect
GetFocus
InflateRect
SetWindowPos
EnumChildWindows
FillRect
ScreenToClient
GetSystemMetrics
GetMenuBarInfo
OffsetRect
MapWindowPoints
TrackMouseEvent
FrameRect
DrawFocusRect
GetSysColor
IsWindowEnabled
IntersectRect
GetClassNameW
GetWindowDC
EnumThreadWindows
GetComboBoxInfo
GetClientRect
DrawTextW
PtInRect
InvalidateRect
ChildWindowFromPoint
ReleaseDC
GetCursorPos
BeginPaint
EndPaint
GetWindowTextW
CallWindowProcW
SetWindowLongPtrW
SendMessageW
SetWindowTextW
GetWindowLongPtrW
SetDlgItemTextW
GetDlgItemTextW
SetDlgItemTextA
GetDlgItem
wsprintfW
SetPropW
SystemParametersInfoW
GetAncestor
LockWindowUpdate
IsDialogMessageW
SetMenu
CheckMenuRadioItem
MonitorFromWindow
DeleteMenu
SetMenuItemBitmaps
ChildWindowFromPointEx
GetMonitorInfoW
DestroyAcceleratorTable
GetMenuStringW
TranslateAcceleratorW
DrawMenuBar
mouse_event
GetDesktopWindow
GetDCEx
GetDlgItemTextA
SetScrollInfo
GetScrollInfo
GetWindowTextLengthW
GetMessageW
CharLowerW
GetScrollPos
IsZoomed
UnregisterClassW
RegisterClassExW
TrackPopupMenu
GetWindowLongW
DispatchMessageW
CallNextHookEx

gdi32

GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
RestoreDC
GetPixel
BitBlt
Polyline
SetWindowOrgEx
DeleteDC
LineTo
MoveToEx
CreateHatchBrush
CreateFontW
GetTextMetricsW
Rectangle
SetROP2
SelectObject
SaveDC
CreateBitmap
CreatePatternBrush
PatBlt
SetBrushOrgEx
SetDIBits
GetDIBits
EnumFontFamiliesExW
EndPage
DPtoLP
StartDocW
SetTextAlign
EndDoc
StartPage
GetTextExtentPointW
StretchBlt
CombineRgn
IntersectClipRect
Ellipse
Polygon
ExtCreatePen
GetTextExtentExPointA
GetTextExtentExPointW
GetTextExtentPoint32A
CreateDIBSection
ExtTextOutA
GetClipRgn
GetStockObject
GetROP2
CreateRectRgn
GetTextExtentPoint32W
SetTextColor
SetBkMode
CreatePen
SelectClipRgn
GetObjectW
ExcludeClipRect
SetBkColor
DeleteObject
CreateSolidBrush
CreateFontIndirectW
RoundRect
CreateRectRgnIndirect
OffsetWindowOrgEx
ExtTextOutW

comdlg32

ChooseColorW
PrintDlgW

advapi32

RegGetValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
RegDeleteValueW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
IsTextUnicode

ole32

RevokeDragDrop
CLSIDFromProgID
OleInitialize
DoDragDrop
OleUninitialize
CoGetApartmentType
CoGetObjectContext
ReleaseStgMedium
CoUninitialize
CoInitialize
CoTaskMemFree
CoCreateInstance
RegisterDragDrop

oleaut32

SysAllocStringLen
SysFreeString

Exports

Exports

CreateLexer
GetLexerCount
GetLexerFactory
GetLexerName
GetLibraryPropertyNames
GetNameSpace
LexerNameFromID
SetLibraryProperty

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 829KB - Virtual size: 829KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 71KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
contextMenu.xml
.xml
langs.model.xml
.xml .js
plugins/Config/nppPluginList.dll
.dll windows x64

10033053d04f10f8dd58e18b71fecb77

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4a
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

13/05/2022, 00:00

Not After

14/05/2025, 23:59

Subject

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4c:f1:4d:ea:af:b2:60:10:74:2d:ef:f8:95:f1:c3:7d:25:00:d4:67
Signer

Actual PE Digest

4c:f1:4d:ea:af:b2:60:10:74:2d:ef:f8:95:f1:c3:7d:25:00:d4:67

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

06/03/2023, 01:20
Valid: true

Chain 1

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Chain 2

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
WriteConsoleW

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NppConverter/NppConverter.dll
.dll windows x64

f121e8464bca774488e7df9052a56492

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

AreFileApisANSI
SetProcessPriorityBoost
SleepConditionVariableCS
GetSystemFirmwareTable
GetPrivateProfileStructW
GetStartupInfoW
IsValidNLSVersion
GetProcessWorkingSetSizeEx
InitializeSRWLock
EnumLanguageGroupLocalesW
PowerSetRequest
FindStringOrdinal
GetCommConfig
BackupWrite
QueryDosDeviceW
RemoveDirectoryTransactedW
TryEnterCriticalSection
SetFileIoOverlappedRange
SetConsoleCtrlHandler
GetConsoleAliasExesLengthW
AddVectoredContinueHandler
RemoveVectoredExceptionHandler
EnumTimeFormatsW
GetProcessWorkingSetSize
GetVolumeInformationW
SetInformationJobObject
GetLogicalDrives
GetThreadPriorityBoost
CancelIo
WriteProfileStringW
LocalLock
GetNamedPipeServerSessionId
QueryInformationJobObject
CloseThreadpoolWork
SetNamedPipeHandleState
GetCurrentProcessorNumberEx
EnumResourceTypesExW
GetOEMCP
CloseThreadpool
StartThreadpoolIo
EnumTimeFormatsEx
GetFileInformationByHandleEx
NotifyUILanguageChange
SetThreadLocale
CompareFileTime
InitOnceBeginInitialize
FindFirstFileW
GetFileSizeEx
InitOnceExecuteOnce
GetNumaAvailableMemoryNodeEx
GetProcessShutdownParameters
CreateThreadpool
WriteProcessMemory
SetHandleInformation
IsBadWritePtr
CreateTimerQueueTimer
HeapCreate
EnumResourceLanguagesExW
GetBinaryTypeW
NeedCurrentDirectoryForExePathW
SetProcessAffinityUpdateMode
LoadModule
EraseTape
SetWaitableTimer
CompareStringW
MapUserPhysicalPagesScatter
SetThreadDescription
FindFirstVolumeW
GetSystemDefaultLCID
VirtualProtect
GetConsoleScreenBufferInfo
SetLastError
SetPriorityClass
SetDefaultDllDirectories
GetProfileSectionW
GetCommProperties
RtlCaptureContext
SetLocalTime
EnterCriticalSection
VirtualFree
GetCommandLineW
CreateTapePartition
SetConsoleActiveScreenBuffer
IsThreadpoolTimerSet
EnumCalendarInfoExEx
FindVolumeMountPointClose
IsDBCSLeadByteEx
QueryProtectedPolicy
SetSystemPowerState
GetFullPathNameW
FindNextFileW
FindNLSString
GetCurrentProcess
GetConsoleOutputCP
SetProcessAffinityMask
GetThreadErrorMode
GetProcessDEPPolicy
EnumCalendarInfoW
ReleaseSemaphore
EnumResourceTypesW
SetDynamicTimeZoneInformation
CreateFileMappingNumaW
Wow64DisableWow64FsRedirection
GetThreadIdealProcessorEx
lstrcpynW
TryAcquireSRWLockExclusive
CheckTokenMembershipEx
DeleteTimerQueue
RegisterWaitForSingleObject
RemoveDllDirectory
ExpandEnvironmentStringsW
GetSystemDefaultUILanguage
CreatePrivateNamespaceW
GetShortPathNameW
GetDiskFreeSpaceW
GetAppContainerNamedObjectPath
SetConsoleMode
GetConsoleCursorInfo
SetCurrentConsoleFontEx
GetTimeFormatEx
GetPrivateProfileIntW
RtlPcToFileHeader
SetFileBandwidthReservation
DeviceIoControl
VirtualAlloc
AssignProcessToJobObject
GetNumberOfConsoleMouseButtons
WaitForDebugEvent
TerminateProcess
RemoveDirectoryW
GetProfileIntW
WakeAllConditionVariable
HeapLock
GetProcessIdOfThread
GetUserDefaultLangID
AddSecureMemoryCacheCallback
GetModuleFileNameW
OpenPrivateNamespaceW
WakeConditionVariable
CreateThreadpoolIo
ReOpenFile
DeleteFiber
CreateNamedPipeW
GetSystemTimes
WaitForMultipleObjects
SetMailslotInfo
InitializeProcThreadAttributeList
GetCommModemStatus
GetConsoleHistoryInfo
GetConsoleCP
SetEnvironmentVariableW
GetThreadSelectorEntry
AddScopedPolicyIDAce
SetThreadUILanguage
GetLocaleInfoEx
SetConsoleWindowInfo
GetNumaProcessorNodeEx
GetUserDefaultLocaleName
Wow64SetThreadContext
GetNumaNodeNumberFromHandle
LocalHandle
SignalObjectAndWait
CreateJobObjectW
DeleteTimerQueueEx
GetUserDefaultUILanguage
GetNamedPipeClientComputerNameW
GetConsoleFontSize
CompareStringOrdinal
SetSystemFileCacheSize
DnsHostnameToComputerNameW
InitializeCriticalSectionAndSpinCount
CreateConsoleScreenBuffer
GetNamedPipeClientProcessId
GetDynamicTimeZoneInformation
LeaveCriticalSection
CreatePipe
GetConsoleAliasExesW
FoldStringW
InitializeCriticalSection
AllocateUserPhysicalPages
Wow64GetThreadContext
SetErrorMode
LeaveCriticalSectionWhenCallbackReturns
InitializeConditionVariable
InitOnceInitialize
TryAcquireSRWLockShared
GetNumaAvailableMemoryNode
GetQueuedCompletionStatus
GetFileMUIPath
GetConsoleTitleW
FlsGetValue
GetEnvironmentVariableW
WriteFileEx
GetConsoleAliasW
GetSystemPowerStatus
FindFirstFileTransactedW
WaitForThreadpoolIoCallbacks
FlushProcessWriteBuffers
CreateBoundaryDescriptorW
PeekNamedPipe
FatalExit
EnumCalendarInfoExW
GetTempPathW
GetWriteWatch
CreateMutexW
OpenFile
TrySubmitThreadpoolCallback
InitializeCriticalSectionEx
GetLargePageMinimum
WaitForMultipleObjectsEx
CreateHardLinkW
GetConsoleScreenBufferInfoEx
FindClose
GetLocaleInfoW
IsNLSDefinedString
GetVolumePathNameW
GetCommMask
CreateFileW
GetFileAttributesW
GetNumberFormatEx
GetTapePosition
FreeLibraryAndExitThread
UnregisterBadMemoryNotification
SetComputerNameExW
OpenJobObjectW
MapViewOfFileExNuma
DebugActiveProcessStop
OpenEventW
GetVersionExW
GetPrivateProfileSectionNamesW
QueryThreadCycleTime
ReleaseMutex
WriteTapemark
UnregisterApplicationRecoveryCallback
OpenFileMappingW
CancelThreadpoolIo
WaitForThreadpoolWorkCallbacks
GetCommTimeouts
SetThreadpoolThreadMinimum
ApplicationRecoveryFinished
SetupComm
SetSearchPathMode
IsSystemResumeAutomatic
FreeEnvironmentStringsW
IsBadCodePtr
CallbackMayRunLong
GlobalDeleteAtom
GetUILanguageInfo
ContinueDebugEvent
Wow64EnableWow64FsRedirection
GetAtomNameW
MapUserPhysicalPages
GlobalGetAtomNameW
UnmapViewOfFile
DuplicateHandle
GetStringScripts
GetSystemDefaultLangID
GetACP
PrepareTape
DisconnectNamedPipe
RtlCaptureStackBackTrace
FindFirstChangeNotificationW
LCIDToLocaleName
OpenProcess
HeapSize
CloseThreadpoolWait
SwitchToFiber
PostQueuedCompletionStatus
CancelWaitableTimer
QueueUserWorkItem
IsValidCodePage
GetLogicalDriveStringsW
CloseThreadpoolCleanupGroup
EndUpdateResourceW
CreateEventW
RemoveSecureMemoryCacheCallback
SetFileAttributesTransactedW
CloseThreadpoolCleanupGroupMembers
GetSystemWow64DirectoryW
GetPrivateProfileStringW
ResolveLocaleName
SetVolumeLabelW
GetConsoleMode
GetFileInformationByHandle
SetTapeParameters
LoadPackagedLibrary
FormatMessageW
WritePrivateProfileStructW
GetDurationFormat
CancelSynchronousIo
ReadThreadProfilingData
SetConsoleScreenBufferInfoEx
EnumSystemLanguageGroupsW
PowerCreateRequest
GetDevicePowerState
GetTickCount64
LCMapStringEx
MoveFileWithProgressW
GetMaximumProcessorCount
Wow64RevertWow64FsRedirection
FlsSetValue
GetLargestConsoleWindowSize
GetCurrencyFormatEx
WaitForThreadpoolWaitCallbacks
EnumSystemLocalesEx
SetUserGeoID
ChangeTimerQueueTimer
AttachConsole
GetCalendarInfoW
EscapeCommFunction
UpdateProcThreadAttribute
GetConsoleAliasesLengthW
TzSpecificLocalTimeToSystemTime
SetThreadpoolThreadMaximum
SetConsoleCursorInfo
GetLogicalProcessorInformationEx
GetFileAttributesExW
ReleaseSRWLockExclusive
GetConsoleDisplayMode
GetConsoleProcessList
OutputDebugStringW
GetMaximumProcessorGroupCount
ConvertDefaultLocale
WaitCommEvent
FillConsoleOutputCharacterW
ReadConsoleInputW
SetThreadpoolTimerEx
FlushViewOfFile
GlobalSize
CreateFileA
GetUserDefaultLCID
SetEvent
GetLogicalProcessorInformation
FileTimeToSystemTime
CloseThreadpoolTimer
GetDiskFreeSpaceExW
GetSystemFileCacheSize
OfferVirtualMemory
DisableThreadLibraryCalls
GetCurrentThread
ReadConsoleOutputW
InitOnceComplete
AcquireSRWLockExclusive
TerminateThread
GetNumaProximityNodeEx
FindCloseChangeNotification
LoadLibraryA
lstrcatW
GetApplicationRestartSettings
GetTapeParameters
WaitForSingleObjectEx
SetWaitableTimerEx
CreateThreadpoolWait
DefineDosDeviceW
PulseEvent
ClearCommBreak
QueryPerformanceFrequency
GetCommState
GlobalFlags
CreateHardLinkTransactedW
GlobalAlloc
DeleteFileW
OpenSemaphoreW
InterlockedPushListSListEx
TransmitCommChar
GetSystemDEPPolicy
MoveFileTransactedW
GlobalFree
HeapReAlloc
CloseHandle
WriteConsoleOutputAttribute
GetProcessIoCounters
SetThreadpoolTimer
ReleaseSRWLockShared
ReleaseMutexWhenCallbackReturns
CompareStringEx
FindNLSStringEx
GetSystemInfo
CreateSymbolicLinkTransactedW
PowerClearRequest
GetProcessHeaps
WriteProfileSectionW
SetProcessWorkingSetSizeEx
QueryProcessCycleTime
LoadLibraryW
HeapSetInformation
IsDBCSLeadByte
ScrollConsoleScreenBufferW
LoadResource
DiscardVirtualMemory
FindResourceW
EnumDateFormatsExW
GlobalFindAtomW
HeapAlloc
Wow64SuspendThread
ClearCommError
FileTimeToLocalFileTime
DeleteSynchronizationBarrier
QueueUserAPC
FatalAppExitW
GetLocalTime
GetConsoleOriginalTitleW
GetDefaultCommConfigW
GetUserGeoID
GetNLSVersionEx
GetCurrentDirectoryW
FillConsoleOutputAttribute
GetProcessPreferredUILanguages
UpdateResourceW
GetOverlappedResult
HeapCompact
FindNextChangeNotification
VirtualProtectEx
AddSIDToBoundaryDescriptor
GetNamedPipeServerProcessId
AddVectoredExceptionHandler
FindNextFileNameW
SetThreadIdealProcessor
GetNamedPipeClientSessionId
IsThreadAFiber
LocalSize
UnlockFile
GetThreadContext
ReadDirectoryChangesW
SubmitThreadpoolWork
CreateFileMappingFromApp
FlushConsoleInputBuffer
SetLocaleInfoW
SetThreadGroupAffinity
InitAtomTable
SetCurrentDirectoryW
GetWindowsDirectoryW
WriteConsoleW
GetErrorMode
SetThreadPriorityBoost
VirtualLock
SetProcessDEPPolicy
GetPriorityClass
Beep
GetProcAddress
UnregisterApplicationRestart
VirtualAllocEx
CreateMutexExW
UnregisterWaitEx
DebugActiveProcess
LocalFree
HeapQueryInformation
GetTimeFormatW
GetThreadId
GetProcessorSystemCycleTime
GetOverlappedResultEx
SetFileApisToOEM
ReplaceFileW
LockFileEx
AcquireSRWLockShared
SetThreadStackGuarantee
CreateMemoryResourceNotification
DeleteCriticalSection
ExitProcess
FindAtomW
VerSetConditionMask
LCMapStringW
GetComputerNameW
SetProtectedPolicy
FindVolumeClose
DisableThreadProfiling
SetConsoleCP
FindFirstStreamW
UnhandledExceptionFilter
CopyFile2
EnumSystemLocalesW
GetProcessHeap
SystemTimeToFileTime
GlobalMemoryStatusEx
CreateProcessW
SetThreadExecutionState
FreeLibrary
SetFirmwareEnvironmentVariableExW
CreateSemaphoreW
TransactNamedPipe
CopyFileW
FlushInstructionCache
GetProfileStringW
SetThreadpoolStackInformation
GetNumaProximityNode
WideCharToMultiByte
GetConsoleWindow
SetCommBreak
GetVolumePathNamesForVolumeNameW
WinExec
CreateRemoteThread
DeleteBoundaryDescriptor
SleepConditionVariableSRW
RemoveVectoredContinueHandler
LocaleNameToLCID
VerifyVersionInfoW
WritePrivateProfileSectionW
GetThreadTimes
BeginUpdateResourceW
FreeUserPhysicalPages

user32

CharLowerW
LogicalToPhysicalPoint
GetMenu
MessageBeep
WaitMessage
MsgWaitForMultipleObjects
SetMenuItemInfoW
SetDlgItemTextW
GetClipCursor
ShowScrollBar
GetUpdateRect
SetWindowContextHelpId
GetScrollBarInfo
EnableScrollBar
SetWindowLongW
DdeAbandonTransaction
DrawTextW
ShowCaret
DrawEdge
DdeQueryNextServer
GetMouseMovePointsEx

Exports

Exports

Jkjaeogjeowasighjies
Oisogesiwjghseih
Toisaegoesghiose

Sections

.text
Size: 206KB - Virtual size: 205KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 215KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NppExport/NppExport.dll
.dll windows x64

17ff9a294f3152c5c744802081c5e1c4

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4a
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

13/05/2022, 00:00

Not After

14/05/2025, 23:59

Subject

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fb:b5:9e:98:7a:49:e8:d4:46:f6:df:b1:ec:aa:fe:55:4c:02:ee:5f
Signer

Actual PE Digest

fb:b5:9e:98:7a:49:e8:d4:46:f6:df:b1:ec:aa:fe:55:4c:02:ee:5f

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

06/03/2023, 01:20
Valid: true

Chain 1

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Chain 2

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleFileNameW
MulDiv
lstrcpynW
lstrcpyW
lstrcatW
MultiByteToWideChar
WriteConsoleW
CloseHandle
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetStdHandle
GetStringTypeW
WriteFile
CreateFileW
lstrcmpiA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SetFilePointerEx
GetProcessHeap
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW

user32

GetDC
EmptyClipboard
ReleaseDC
CloseClipboard
OpenClipboard
SendMessageW
MessageBoxW
RegisterClipboardFormatW
SetClipboardData

gdi32

GetTextExtentPoint32W
GetDeviceCaps
DeleteObject
CreateFontW
SelectObject

comdlg32

GetSaveFileNameW

shlwapi

PathFindFileNameW
PathRemoveExtensionW
PathRemoveFileSpecW

Exports

Exports

beNotified
getFuncsArray
getName
isUnicode
messageProc
setInfo

Sections

.text
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/mimeTools/mimeTools.dll
.dll windows x64

2120549f0f488cc1a263553fac68a39f

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4a
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

13/05/2022, 00:00

Not After

14/05/2025, 23:59

Subject

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

27:0e:c1:94:ec:9c:94:a1:31:0c:d1:dc:ff:81:ec:b9:07:41:9e:ae
Signer

Actual PE Digest

27:0e:c1:94:ec:9c:94:a1:31:0c:d1:dc:ff:81:ec:b9:07:41:9e:ae

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

06/03/2023, 01:20
Valid: true

Chain 1

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Chain 2

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

lstrcpyW
WriteConsoleW
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP

user32

GetClientRect
ClientToScreen
CreateDialogParamW
SetWindowPos
SendMessageW
EndDialog
MessageBoxW

Exports

Exports

beNotified
getFuncsArray
getName
isUnicode
messageProc
setInfo

Sections

.text
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
shortcuts.xml
.xml
stylers.model.xml
.xml

Sharing

General

Malware Config

Signatures

Files

5c0edb7e35310ff8f3aabe7a6043f076

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4aCertificate

Extended Key Usages

Key Usages

d2:d7:83:88:82:c2:c2:77:d6:d1:26:77:c8:05:bc:b0:d0:d9:dc:aeSigner

Signature Validations

Verification

06/03/2023, 01:20 Valid: true

Chain 1

Chain 2

Headers

File Characteristics

Imports

shell32

shlwapi

msimg32

kernel32

user32

gdi32

advapi32

ole32

msvcr90

Exports

Exports

Sections

.text Size: 19KB - Virtual size: 19KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 1KB - Virtual size: 2KB

.pdata Size: 1024B - Virtual size: 780B

.rsrc Size: 185KB - Virtual size: 184KB

.reloc Size: 1024B - Virtual size: 684B

4978c245f35bf519bc526e6275400c94

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4aCertificate

Extended Key Usages

Key Usages

dd:ed:02:41:e9:2a:23:bc:e3:bc:c4:89:94:1f:9a:58:5f:84:36:34Signer

Signature Validations

Verification

06/03/2023, 01:20 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

shlwapi

shell32

dbghelp

version

crypt32

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4a
Certificate

d2:d7:83:88:82:c2:c2:77:d6:d1:26:77:c8:05:bc:b0:d0:d9:dc:ae
Signer

06/03/2023, 01:20
Valid: true

.text
Size: 19KB - Virtual size: 19KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 1KB - Virtual size: 2KB

.pdata
Size: 1024B - Virtual size: 780B

.rsrc
Size: 185KB - Virtual size: 184KB

.reloc
Size: 1024B - Virtual size: 684B

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4a
Certificate

dd:ed:02:41:e9:2a:23:bc:e3:bc:c4:89:94:1f:9a:58:5f:84:36:34
Signer

06/03/2023, 01:20
Valid: true

.text
Size: 3.9MB - Virtual size: 3.9MB

.rdata
Size: 829KB - Virtual size: 829KB

.data
Size: 71KB - Virtual size: 150KB

.pdata
Size: 113KB - Virtual size: 112KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 20KB - Virtual size: 20KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4a
Certificate

4c:f1:4d:ea:af:b2:60:10:74:2d:ef:f8:95:f1:c3:7d:25:00:d4:67
Signer

06/03/2023, 01:20
Valid: true

.text
Size: 44KB - Virtual size: 44KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 2KB - Virtual size: 6KB

.pdata
Size: 3KB - Virtual size: 3KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 85KB - Virtual size: 85KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 206KB - Virtual size: 205KB

.rdata
Size: 68KB - Virtual size: 68KB