result.exe - NOTEPAD.EXE

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	result.exe
size	180224 (0x2c000)
md5	05e1a903b4b6e771c2bb6e7fbb51e8fa

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
149	30729	3
147	30729	29
1	0	246
131	30729	31
132	30729	2
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4a5bc60f
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0xa800
SizeOfInitializedData	0x22400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x3689
BaseOfCode	0x1000
BaseOfData	0xc000
ImageBase	0x1000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.1
ImageVersion	6.1
SubsystemVersion	6.1
Reserved1	0
SizeOfImage	0x30000
SizeOfHeaders	0x400
CheckSum	0x39741
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x11000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xa68c	0xa800	R-X CODE
.data	0xc000	0x2164	0x1000	RW- IDATA
.rsrc	0xf000	0x1f160	0x1f290	R-- IDATA
.reloc	0x2f000	0xe34	0x1000	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xa048	0x12c
RESOURCE	0xf000	0x1f160
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x2f000	0xe34
DEBUG	0xb62c	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x6d58	0x40
Bound_IAT	0x278	0x128
IAT	0x1000	0x400
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp	r
BITMAP	#356	1064963050	3171284864	3729192689
BITMAP	#876	0	0	1245184
BITMAP	#498089985	334336	128	0
BITMAP	#111	110	3538944	3211310
BITMAP	#7274601	7864320	4035444736	15728640
BITMAP	#6357104	0	65536	1033
BITMAP	#6815847	61576	240	0
BITMAP	#65536	0	0	4864
BITMAP	#65536	0	150995200	469762052
BITMAP	#1052	2002655103	2490929704	1556935910
ICON	#1	1640	0	0
ICON	#5	3752	0	0
VERSION	#1	876	0	0
MANIFEST	#1	1170	0	0
#33	#66	48	0	0

module_name	hint	ord	function_name
ADVAPI32.dll	638		RegSetValueExW
ADVAPI32.dll	622		RegQueryValueExW
ADVAPI32.dll	560		RegCloseKey
ADVAPI32.dll	572		RegCreateKeyW
ADVAPI32.dll	609		RegOpenKeyExW
ADVAPI32.dll	384		IsTextUnicode
ADVAPI32.dll	87		CloseServiceHandle
ADVAPI32.dll	548		QueryServiceConfigW
ADVAPI32.dll	507		OpenServiceW
ADVAPI32.dll	505		OpenSCManagerW
KERNEL32.dll	320		FindNLSString
KERNEL32.dll	691		GlobalAlloc
KERNEL32.dll	709		GlobalUnlock
KERNEL32.dll	702		GlobalLock
KERNEL32.dll	663		GetTimeFormatW
KERNEL32.dll	456		GetDateFormatW
KERNEL32.dll	515		GetLocalTime
KERNEL32.dll	670		GetUserDefaultUILanguage
KERNEL32.dll	719		HeapFree
KERNEL32.dll	715		HeapAlloc
KERNEL32.dll	586		GetProcessHeap
KERNEL32.dll	492		GetFileInformationByHandle
KERNEL32.dll	748		InterlockedExchange
KERNEL32.dll	355		FreeLibraryAndExitThread
KERNEL32.dll	490		GetFileAttributesW
KERNEL32.dll	1303		Wow64RevertWow64FsRedirection
KERNEL32.dll	1299		Wow64DisableWow64FsRedirection
KERNEL32.dll	782		IsWow64Process
KERNEL32.dll	448		GetCurrentProcess
KERNEL32.dll	181		CreateThread
KERNEL32.dll	831		LoadLibraryW
KERNEL32.dll	532		GetModuleFileNameW
KERNEL32.dll	140		CreateFileMappingW
KERNEL32.dll	350		FormatMessageW
KERNEL32.dll	855		MapViewOfFile
KERNEL32.dll	871		MultiByteToWideChar
KERNEL32.dll	1238		UnmapViewOfFile
KERNEL32.dll	843		LocalReAlloc
KERNEL32.dll	360		GetACP
KERNEL32.dll	214		DeleteFileW
KERNEL32.dll	1107		SetEndOfFile
KERNEL32.dll	1297		WideCharToMultiByte
KERNEL32.dll	1139		SetLastError
KERNEL32.dll	1317		WriteFile
KERNEL32.dll	514		GetLastError
KERNEL32.dll	845		LocalSize
KERNEL32.dll	507		GetFullPathNameW
KERNEL32.dll	870		MulDiv
KERNEL32.dll	391		GetCommandLineW
KERNEL32.dll	449		GetCurrentProcessId
KERNEL32.dll	348		FoldStringW
KERNEL32.dll	1346		lstrcmpW
KERNEL32.dll	313		FindFirstFileW
KERNEL32.dll	302		FindClose
KERNEL32.dll	723		HeapSetInformation
KERNEL32.dll	1216		TerminateProcess
KERNEL32.dll	633		GetSystemTimeAsFileTime
KERNEL32.dll	453		GetCurrentThreadId
KERNEL32.dll	659		GetTickCount
KERNEL32.dll	935		QueryPerformanceCounter
KERNEL32.dll	533		GetModuleHandleA
KERNEL32.dll	1189		SetUnhandledExceptionFilter
KERNEL32.dll	610		GetStartupInfoA
KERNEL32.dll	745		InterlockedCompareExchange
KERNEL32.dll	1202		Sleep
KERNEL32.dll	842		LocalLock
KERNEL32.dll	846		LocalUnlock
KERNEL32.dll	1358		lstrlenW
KERNEL32.dll	518		GetLocaleInfoW
KERNEL32.dll	698		GlobalFree
KERNEL32.dll	1349		lstrcmpiW
KERNEL32.dll	1112		SetErrorMode
KERNEL32.dll	143		CreateFileW
KERNEL32.dll	960		ReadFile
KERNEL32.dll	82		CloseHandle
KERNEL32.dll	836		LocalAlloc
KERNEL32.dll	747		InterlockedDecrement
KERNEL32.dll	840		LocalFree
KERNEL32.dll	751		InterlockedIncrement
KERNEL32.dll	676		GetVersionExW
KERNEL32.dll	1235		UnhandledExceptionFilter
GDI32.dll	64		CreateFontIndirectW
GDI32.dll	660		SetMapMode
GDI32.dll	680		SetViewportExtEx
GDI32.dll	684		SetWindowExtEx
GDI32.dll	564		LPtoDP
GDI32.dll	639		SetBkMode
GDI32.dll	550		GetTextMetricsW
GDI32.dll	633		SetAbortProc
GDI32.dll	688		StartDocW
GDI32.dll	690		StartPage
GDI32.dll	242		EndPage
GDI32.dll			AbortDoc
GDI32.dll	239		EndDoc
GDI32.dll	227		DeleteDC
GDI32.dll	697		TextOutW
GDI32.dll	542		GetTextExtentPoint32W
GDI32.dll	50		CreateDCW
GDI32.dll	631		SelectObject
GDI32.dll	548		GetTextFaceW
GDI32.dll	296		EnumFontsW
GDI32.dll	459		GetDeviceCaps
GDI32.dll	230		DeleteObject
USER32.dll	639		SetActiveWindow
USER32.dll	318		GetKeyboardLayout
USER32.dll	567		PostQuitMessage
USER32.dll	156		DefWindowProcW
USER32.dll	301		GetForegroundWindow
USER32.dll	465		IsIconic
USER32.dll	166		DestroyWindow
USER32.dll	525		MessageBeep
USER32.dll	411		GetWindowPlacement
USER32.dll	60		CharUpperW
USER32.dll	589		RegisterClassExW
USER32.dll	495		LoadImageW
USER32.dll	491		LoadCursorW
USER32.dll	708		SetWindowLongW
USER32.dll	485		LoadAcceleratorsW
USER32.dll	381		GetSystemMenu
USER32.dll	709		SetWindowPlacement
USER32.dll	110		CreateWindowExW
USER32.dll	611		RegisterWindowMessageW
USER32.dll	785		UpdateWindow
USER32.dll	446		InvalidateRect
USER32.dll	689		SetScrollPos
USER32.dll	418		GetWindowTextLengthW
USER32.dll	406		GetWindowLongW
USER32.dll	563		PeekMessageW
USER32.dll	216		EnableWindow
USER32.dll	172		DialogBoxParamW
USER32.dll	99		CreateDialogParamW
USER32.dll	419		GetWindowTextW
USER32.dll	710		SetWindowPos
USER32.dll	648		SetCursor
USER32.dll	659		SetForegroundWindow
USER32.dll	250		FindWindowW
USER32.dll	382		GetSystemMetrics
USER32.dll	539		MoveWindow
USER32.dll	636		SendMessageW
USER32.dll	49		CharNextW
USER32.dll	63		CheckMenuItem
USER32.dll	73		CloseClipboard
USER32.dll	458		IsClipboardFormatAvailable
USER32.dll	550		OpenClipboard
USER32.dll	342		GetMenuState
USER32.dll	214		EnableMenuItem
USER32.dll	378		GetSubMenu
USER32.dll	276		GetClientRect
USER32.dll	766		UnhookWinEvent
USER32.dll	300		GetFocus
USER32.dll	331		GetMenu
USER32.dll	533		MessageBoxW
USER32.dll	809		WinHelpW
USER32.dll	294		GetDlgCtrlID
USER32.dll	67		ChildWindowFromPoint
USER32.dll	289		GetDC
USER32.dll	735		ShowWindow
USER32.dll	207		DrawTextExW
USER32.dll	613		ReleaseDC
USER32.dll	493		LoadIconW
USER32.dll	703		SetWinEventHook
USER32.dll	349		GetMessageW
USER32.dll	566		PostMessageW
USER32.dll	461		IsDialogMessageW
USER32.dll	762		TranslateAcceleratorW
USER32.dll	218		EndDialog
USER32.dll	298		GetDlgItemTextW
USER32.dll	656		SetDlgItemTextW
USER32.dll	658		SetFocus
USER32.dll	715		SetWindowTextW
USER32.dll	356		GetParent
USER32.dll	506		LoadStringW
USER32.dll	627		SendDlgItemMessageW
USER32.dll	288		GetCursorPos
USER32.dll	621		ScreenToClient
USER32.dll	764		TranslateMessage
USER32.dll	260		GetAncestor
USER32.dll	175		DispatchMessageW
msvcrt.dll	295		_controlfp
msvcrt.dll	974		_vsnwprintf
msvcrt.dll	1262		memset
msvcrt.dll	1133		_wtol
msvcrt.dll	1258		memcpy
msvcrt.dll	1228		iswctype
msvcrt.dll	1371		wcsncmp
msvcrt.dll	1376		wcsrchr
msvcrt.dll	345		_except_handler4_common
msvcrt.dll	190		__p__fmode
msvcrt.dll	185		__p__commode
msvcrt.dll	212		__setusermatherr
msvcrt.dll	257		_amsg_exit
msvcrt.dll	469		_initterm
msvcrt.dll	231		_acmdln
msvcrt.dll	1167		exit
msvcrt.dll	500		_ismbblead
msvcrt.dll	106		_XcptFilter
msvcrt.dll	145		__getmainargs
msvcrt.dll	276		_cexit
msvcrt.dll	354		_exit
msvcrt.dll	55		void __cdecl terminate(void) ?terminate@@YAXXZ
msvcrt.dll	210		__set_app_type
COMDLG32.dll	23		ReplaceTextW
COMDLG32.dll	17		PageSetupDlgW
COMDLG32.dll	20		PrintDlgExW
COMDLG32.dll	8		FindTextW
COMDLG32.dll	3		ChooseFontW
COMDLG32.dll	14		GetSaveFileNameW
COMDLG32.dll	4		CommDlgExtendedError
COMDLG32.dll	12		GetOpenFileNameW
COMDLG32.dll	10		GetFileTitleW
SHELL32.dll	26		DragAcceptFiles
SHELL32.dll	112		SHAddToRecentDocs
SHELL32.dll	195		SHGetFolderPathW
SHELL32.dll	144		SHCreateItemFromParsingName
SHELL32.dll	289		ShellExecuteExW
SHELL32.dll	31		DragQueryFileW
SHELL32.dll	27		DragFinish
SHELL32.dll	282		ShellAboutW
WINSPOOL.DRV	144		OpenPrinterW
WINSPOOL.DRV	29		ClosePrinter
WINSPOOL.DRV	134		GetPrinterDriverW
ole32.dll	63		CoInitializeEx
ole32.dll	108		CoUninitialize
ole32.dll	103		CoTaskMemAlloc
ole32.dll	16		CoCreateInstance
ole32.dll	104		CoTaskMemFree
ole32.dll	62		CoInitialize
SHLWAPI.dll	93		PathIsFileSpecW
SHLWAPI.dll	255		SHStrDupW
COMCTL32.dll	9		CreatePropertySheetPageW
COMCTL32.dll	133		PropertySheetW
COMCTL32.dll	12		CreateStatusWindowW
COMCTL32.dll		345
OLEAUT32.dll		6
OLEAUT32.dll		2
ntdll.dll	1387		WinSqmIncrementDWORD
ntdll.dll	923		RtlInitUnicodeString
ntdll.dll	409		NtQueryLicenseValue
ntdll.dll	1371		WinSqmAddToStream
VERSION.dll	2		GetFileVersionInfoExW
VERSION.dll	4		GetFileVersionInfoSizeExW
VERSION.dll	14		VerQueryValueW

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Notepad
FileVersion	6.1.7600.16385 (win7_rtm.090713-1255)
InternalName	Notepad
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	NOTEPAD.EXE


	ЉМҒ㼼浸⁬敶獲潩㵮ㄢ〮•湥潣楤杮∽呕ⵆ∸猠慴摮污湯㵥礢獥㼢ാ㰊ⴡ‭潃祰楲桧⁴挨 楍牣獯景⁴潃灲牯瑡潩⁮ⴭാ㰊獡敳扭祬砠汭獮∽牵㩮捳敨慭⵳業牣獯景⵴潣㩭獡⹭ㅶ•慭楮敦瑳敖獲潩㵮ㄢ〮㸢਍愼獳浥汢䥹敤瑮瑩൹ †渠浡㵥䴢捩潲潳瑦圮湩潤獷匮敨汬渮瑯灥摡BԲ耀ЉՊ0䅁䅁䅁䅁䅁䅁䅁䅁䉂䉂䉂䉂䉂䉂䉂䉂䍃䍃䍃䍃䍃䍃䍃䍃灩楴湯ാ㰊敤数摮湥祣ാ †㰠敤数摮湥䅴獳浥汢㹹਍††††愼獳浥汢䥹敤瑮瑩൹ †††††琠灹㵥眢湩㈳ഢ †††††渠浡㵥䴢捩潲潳瑦圮湩潤獷䌮浯潭⵮潃瑮潲獬ഢ †††††瘠牥楳湯∽⸶⸰⸰∰਍††††††牰捯獥潳䅲捲楨整瑣牵㵥⨢ഢ †††††瀠扵楬䭣祥潔敫㵮㘢㤵戵㐶㐱挴晣搱≦਍††††††慬杮慵敧∽∪਍††††㸯਍††⼼敤数摮湥䅴獳浥汢㹹਍⼼敤数摮湥祣ാ㰊牴獵䥴普⁯浸湬㵳產湲猺档浥獡洭捩潲潳瑦挭浯愺浳瘮∳ാ †㰠敳畣楲祴ാ †††㰠敲畱獥整偤楲楶敬敧㹳਍††††††爼煥敵瑳摥硅捥瑵潩䱮癥汥氠癥汥∽獡湉潶敫≲甠䅩捣獥㵳昢污敳⼢ാ †††㰠爯煥敵瑳摥牐癩汩来獥ാ †㰠猯捥牵瑩㹹਍⼼牴獵䥴普㹯਍愼灰楬慣楴湯砠汭獮∽牵㩮捳敨慭⵳業牣獯景⵴潣

VS_FIXEDFILEINFO

FileVersion	6.1.7600.16385
ProductVersion	6.1.7600.16385
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	180224	EXE	07/13/2009 23:41:03	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[!] PEdump::IMAGE_RESOURCE_DIRECTORY failed to read entry name: "\xE6\xDF" on UTF-16LE

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 48144

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 48207

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 48254

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 48244

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 48260

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 49158

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 110652

[?] too many errors getting resource data, stopped on 527 of 1033

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: 77241 entries in directory, but got EOF on 13528-th.

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 180224

[?] too many errors getting resource data, stopped on 15 of 13528

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 72002

[?] too many errors getting resource data, stopped on 82 of 111

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 49498

[?] too many errors getting resource data, stopped on 7 of 19

[?] can't find file_offset of VA 0xea74ca67

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0x6f0069

[?] can't find file_offset of VA 0x4090001

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0x78

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0x16336bd3

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] invalid VS_VERSIONINFO child type "v3\">\r\n"

[?] can't find file_offset of VA 0x278

result.exe-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

result.exe
-