notepad.exe - Notepad

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	notepad.exe
size	181248 (0x2c400)
md5	06e6c0482562459adb462ca9008262f8

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
147	30729	82
259	26715	3
260	26715	21
261	26715	6
257	26715	9
1	0	295
265	26715	25
255	26715	1
258	26715	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	7
TimeDateStamp	0x6e3b99c1
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.15
SizeOfCode	0x20600
SizeOfInitializedData	0xd400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x20110
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	10.0
ImageVersion	10.0
SubsystemVersion	10.0
Reserved1	0
SizeOfImage	0x32000
SizeOfHeaders	0x400
CheckSum	0x2c69f
Subsystem	2
DllCharacteristics	0xc160
SizeOfStackReserve	0x80000
SizeOfStackCommit	0x11000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x2045b	0x20600	R-X CODE
.rdata	0x22000	0x8b48	0x8c00	R-- IDATA
.data	0x2b000	0x24d0	0xc00	RW- IDATA
.pdata	0x2e000	0xe58	0x1000	R-- IDATA
.didat	0x2f000	0xf0	0x200	RW- IDATA
.rsrc	0x30000	0xbe0	0xc00	R-- IDATA
.reloc	0x31000	0x280	0x400	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x28648	0x384
RESOURCE	0x30000	0xbe0
EXCEPTION	0x2e000	0xe58
SECURITY	0	0
BASERELOC	0x31000	0x280
DEBUG	0x268e0	0x54
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x22748	0x28
LOAD_CONFIG	0x22640	0x108
Bound_IAT	0	0
IAT	0x22770	0x988
Delay_IAT	0x281a8	0xe0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x1400272bc	0x1400272c4	0x14002c0a0	0x140023190	0	0x300000

show previews

type	name	size
EDPENLIGHTENEDAPPINFOID	MICROSOFTEDPENLIGHTENEDAPPINFO	2
EDPPERMISSIVEAPPINFOID	MICROSOFTEDPPERMISSIVEAPPINFO	2
MUI	#1	328
VERSION	#1	884
MANIFEST	#1	1199

module_name	hint	ord	function_name
GDI32.dll	860		SelectObject
GDI32.dll	720		GetTextFaceW
GDI32.dll	450		EnumFontsW
GDI32.dll	926		TextOutW
GDI32.dll	714		GetTextExtentPoint32W
GDI32.dll	889		SetMapMode
GDI32.dll	909		SetViewportExtEx
GDI32.dll	913		SetWindowExtEx
GDI32.dll	737		LPtoDP
GDI32.dll	383		DeleteObject
GDI32.dll	722		GetTextMetricsW
GDI32.dll	396		EndPage
GDI32.dll			AbortDoc
GDI32.dll	393		EndDoc
GDI32.dll	380		DeleteDC
GDI32.dll	862		SetAbortProc
GDI32.dll	917		StartDocW
GDI32.dll	919		StartPage
GDI32.dll	52		CreateDCW
GDI32.dll	67		CreateFontIndirectW
GDI32.dll	868		SetBkMode
GDI32.dll	630		GetDeviceCaps
USER32.dll	868		SetThreadDpiAwarenessContext
USER32.dll	685		PostMessageW
USER32.dll	186		DialogBoxParamW
USER32.dll	343		GetFocus
USER32.dll	650		MessageBoxW
USER32.dll	375		GetMenu
USER32.dll	67		CheckMenuItem
USER32.dll	449		GetSubMenu
USER32.dll	233		EnableMenuItem
USER32.dll	905		ShowWindow
USER32.dll	322		GetDC
USER32.dll	761		ReleaseDC
USER32.dll	805		SetCursor
USER32.dll	340		GetDpiForWindow
USER32.dll	792		SetActiveWindow
USER32.dll	613		LoadStringW
USER32.dll	167		DefWindowProcW
USER32.dll	563		IsIconic
USER32.dll	820		SetFocus
USER32.dll	686		PostQuitMessage
USER32.dll	181		DestroyWindow
USER32.dll	642		MessageBeep
USER32.dll	344		GetForegroundWindow
USER32.dll	656		MoveWindow
USER32.dll	887		SetWindowPos
USER32.dll	727		RedrawWindow
USER32.dll	361		GetKeyboardLayout
USER32.dll	52		CharNextW
USER32.dll	875		SetWinEventHook
USER32.dll	393		GetMessageW
USER32.dll	935		TranslateAcceleratorW
USER32.dll	559		IsDialogMessageW
USER32.dll	937		TranslateMessage
USER32.dll	189		DispatchMessageW
USER32.dll	940		UnhookWinEvent
USER32.dll	892		SetWindowTextW
USER32.dll	667		OpenClipboard
USER32.dll	556		IsClipboardFormatAvailable
USER32.dll	79		CloseClipboard
USER32.dll	817		SetDlgItemTextW
USER32.dll	335		GetDlgItemTextW
USER32.dll	242		EndDialog
USER32.dll	780		SendDlgItemMessageW
USER32.dll	857		SetScrollPos
USER32.dll	544		InvalidateRect
USER32.dll	963		UpdateWindow
USER32.dll	493		GetWindowPlacement
USER32.dll	886		SetWindowPlacement
USER32.dll	63		CharUpperW
USER32.dll	453		GetSystemMenu
USER32.dll	592		LoadAcceleratorsW
USER32.dll	885		SetWindowLongW
USER32.dll	118		CreateWindowExW
USER32.dll	655		MonitorFromWindow
USER32.dll	759		RegisterWindowMessageW
USER32.dll	598		LoadCursorW
USER32.dll	731		RegisterClassExW
USER32.dll	501		GetWindowTextLengthW
USER32.dll	488		GetWindowLongW
USER32.dll	681		PeekMessageW
USER32.dll	502		GetWindowTextW
USER32.dll	239		EnableWindow
USER32.dll	106		CreateDialogParamW
USER32.dll	221		DrawTextExW
USER32.dll	602		LoadImageW
USER32.dll	600		LoadIconW
USER32.dll	307		GetClientRect
USER32.dll	789		SendMessageW
USER32.dll	331		GetDlgCtrlID
msvcrt.dll	47		void __cdecl terminate(void) ?terminate@@YAXXZ
msvcrt.dll	1174		memset
msvcrt.dll	162		_acmdln
msvcrt.dll	142		__set_app_type
msvcrt.dll	1074		exit
msvcrt.dll	127		__getmainargs
msvcrt.dll	123		__dllonexit
msvcrt.dll	270		_exit
msvcrt.dll	193		_cexit
msvcrt.dll	174		_amsg_exit
msvcrt.dll	833		_unlock
msvcrt.dll	486		_lock
msvcrt.dll	409		_ismbblead
msvcrt.dll	144		__setusermatherr
msvcrt.dll	381		_initterm
msvcrt.dll	210		_commode
msvcrt.dll	295		_fmode
msvcrt.dll	656		_onexit
msvcrt.dll	85		_XcptFilter
msvcrt.dll	1100		free
msvcrt.dll	1139		iswdigit
msvcrt.dll	1294		wcsnlen
msvcrt.dll	906		_wcsicmp
msvcrt.dll	87		__C_specific_handler
msvcrt.dll	91		__CxxFrameHandler3
msvcrt.dll	1033		_wtol
msvcrt.dll	1173		memmove_s
msvcrt.dll	670		_purecall
msvcrt.dll	1171		memcpy_s
msvcrt.dll	873		_vsnwprintf
msvcrt.dll	1158		malloc
msvcrt.dll	191		_callnewh
msvcrt.dll	1169		memcmp
msvcrt.dll	1170		memcpy
msvcrt.dll	1282		wcscmp
api-ms-win-core-libraryloader-l1-2-0.dll	15		GetModuleFileNameA
api-ms-win-core-libraryloader-l1-2-0.dll	24		LoadLibraryExW
api-ms-win-core-libraryloader-l1-2-0.dll	19		GetModuleHandleExW
api-ms-win-core-libraryloader-l1-2-0.dll	21		GetProcAddress
api-ms-win-core-libraryloader-l1-2-0.dll	12		FreeLibrary
api-ms-win-core-libraryloader-l1-2-0.dll	20		GetModuleHandleW
api-ms-win-core-libraryloader-l1-2-0.dll	16		GetModuleFileNameW
api-ms-win-core-synch-l1-1-0.dll	38		ReleaseSemaphore
api-ms-win-core-synch-l1-1-0.dll	26		InitializeCriticalSectionEx
api-ms-win-core-synch-l1-1-0.dll	29		LeaveCriticalSection
api-ms-win-core-synch-l1-1-0.dll	17		EnterCriticalSection
api-ms-win-core-synch-l1-1-0.dll	54		WaitForSingleObject
api-ms-win-core-synch-l1-1-0.dll	55		WaitForSingleObjectEx
api-ms-win-core-synch-l1-1-0.dll	33		OpenSemaphoreW
api-ms-win-core-synch-l1-1-0.dll	37		ReleaseSRWLockShared
api-ms-win-core-synch-l1-1-0.dll	41		SetEvent
api-ms-win-core-synch-l1-1-0.dll			AcquireSRWLockExclusive
api-ms-win-core-synch-l1-1-0.dll	9		CreateMutexExW
api-ms-win-core-synch-l1-1-0.dll	1		AcquireSRWLockShared
api-ms-win-core-synch-l1-1-0.dll	11		CreateSemaphoreExW
api-ms-win-core-synch-l1-1-0.dll	5		CreateEventExW
api-ms-win-core-synch-l1-1-0.dll	15		DeleteCriticalSection
api-ms-win-core-synch-l1-1-0.dll	35		ReleaseMutex
api-ms-win-core-synch-l1-1-0.dll	36		ReleaseSRWLockExclusive
api-ms-win-core-heap-l1-1-0.dll	6		HeapFree
api-ms-win-core-heap-l1-1-0.dll	10		HeapSetInformation
api-ms-win-core-heap-l1-1-0.dll	2		HeapAlloc
api-ms-win-core-heap-l1-1-0.dll			GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0.dll	5		GetLastError
api-ms-win-core-errorhandling-l1-1-0.dll	13		SetLastError
api-ms-win-core-errorhandling-l1-1-0.dll	17		UnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-0.dll	7		RaiseException
api-ms-win-core-errorhandling-l1-1-0.dll	15		SetUnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0.dll	6		CloseThreadpoolTimer
api-ms-win-core-threadpool-l1-2-0.dll	26		SetThreadpoolTimer
api-ms-win-core-threadpool-l1-2-0.dll	12		CreateThreadpoolTimer
api-ms-win-core-threadpool-l1-2-0.dll	34		WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0.dll	2		OpenProcessToken
api-ms-win-core-processthreads-l1-1-0.dll	13		GetCurrentProcessId
api-ms-win-core-processthreads-l1-1-0.dll	77		TerminateProcess
api-ms-win-core-processthreads-l1-1-0.dll	17		GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-0.dll	32		GetStartupInfoW
api-ms-win-core-processthreads-l1-1-0.dll	12		GetCurrentProcess
api-ms-win-core-localization-l1-2-0.dll	9		FormatMessageW
api-ms-win-core-localization-l1-2-0.dll	10		GetACP
api-ms-win-core-localization-l1-2-0.dll	21		GetLocaleInfoW
api-ms-win-core-localization-l1-2-0.dll	6		FindNLSString
api-ms-win-core-debug-l1-1-0.dll	4		DebugBreak
api-ms-win-core-debug-l1-1-0.dll	7		OutputDebugStringW
api-ms-win-core-debug-l1-1-0.dll	5		IsDebuggerPresent
api-ms-win-core-handle-l1-1-0.dll			CloseHandle
api-ms-win-core-com-l1-1-0.dll	78		PropVariantClear
api-ms-win-core-com-l1-1-0.dll	68		CoUninitialize
api-ms-win-core-com-l1-1-0.dll	8		CoCreateGuid
api-ms-win-core-com-l1-1-0.dll	9		CoCreateInstance
api-ms-win-core-com-l1-1-0.dll	71		CoWaitForMultipleHandles
api-ms-win-core-com-l1-1-0.dll	65		CoTaskMemFree
api-ms-win-core-com-l1-1-0.dll	40		CoInitializeEx
api-ms-win-core-com-l1-1-0.dll	64		CoTaskMemAlloc
api-ms-win-core-com-l1-1-0.dll	7		CoCreateFreeThreadedMarshaler
api-ms-win-core-heap-l2-1-0.dll	14		LocalUnlock
api-ms-win-core-heap-l2-1-0.dll	2		GlobalFree
api-ms-win-core-heap-l2-1-0.dll			GlobalAlloc
api-ms-win-core-heap-l2-1-0.dll	10		LocalFree
api-ms-win-core-heap-l2-1-0.dll	11		LocalLock
api-ms-win-core-heap-l2-1-0.dll	8		LocalAlloc
api-ms-win-core-heap-l2-1-0.dll	12		LocalReAlloc
api-ms-win-core-file-l1-1-0.dll	73		ReadFile
api-ms-win-core-file-l1-1-0.dll	78		SetEndOfFile
api-ms-win-core-file-l1-1-0.dll	44		GetFileAttributesW
api-ms-win-core-file-l1-1-0.dll	91		WriteFile
api-ms-win-core-file-l1-1-0.dll	53		GetFullPathNameW
api-ms-win-core-file-l1-1-0.dll	45		GetFileInformationByHandle
api-ms-win-core-file-l1-1-0.dll	6		CreateFileW
api-ms-win-core-file-l1-1-0.dll	20		FindFirstFileW
api-ms-win-core-file-l1-1-0.dll	9		DeleteFileW
api-ms-win-core-file-l1-1-0.dll	43		GetFileAttributesExW
api-ms-win-core-file-l1-1-0.dll	12		FindClose
api-ms-win-core-shlwapi-legacy-l1-1-0.dll	22		PathFindExtensionW
api-ms-win-core-shlwapi-legacy-l1-1-0.dll	34		PathIsFileSpecW
api-ms-win-core-shlwapi-legacy-l1-1-0.dll	20		PathFileExistsW
api-ms-win-core-largeinteger-l1-1-0.dll	69		MulDiv
api-ms-win-shcore-obsolete-l1-1-0.dll	2		SHStrDupW
api-ms-win-security-base-l1-1-0.dll	66		GetTokenInformation
api-ms-win-core-processenvironment-l1-1-0.dll	5		GetCommandLineW
api-ms-win-core-string-l1-1-0.dll	6		MultiByteToWideChar
api-ms-win-core-string-l1-1-0.dll	3		FoldStringW
api-ms-win-core-string-l1-1-0.dll	1		CompareStringOrdinal
api-ms-win-core-string-l1-1-0.dll	7		WideCharToMultiByte
api-ms-win-core-localization-obsolete-l1-2-0.dll	8		GetUserDefaultUILanguage
api-ms-win-core-sysinfo-l1-1-0.dll	22		GetSystemTimeAsFileTime
api-ms-win-core-sysinfo-l1-1-0.dll	26		GetTickCount
api-ms-win-core-sysinfo-l1-1-0.dll	5		GetLocalTime
api-ms-win-core-datetime-l1-1-0.dll	2		GetDateFormatW
api-ms-win-core-datetime-l1-1-0.dll	6		GetTimeFormatW
api-ms-win-shcore-path-l1-1-0.dll		170
api-ms-win-core-memory-l1-1-0.dll	36		UnmapViewOfFile
api-ms-win-core-memory-l1-1-0.dll	16		MapViewOfFile
api-ms-win-core-memory-l1-1-0.dll	5		CreateFileMappingW
api-ms-win-core-registry-l1-1-0.dll			RegCloseKey
api-ms-win-core-registry-l1-1-0.dll	37		RegQueryValueExW
api-ms-win-core-registry-l1-1-0.dll	46		RegSetValueExW
api-ms-win-core-registry-l1-1-0.dll	30		RegOpenKeyExW
api-ms-win-core-registry-l2-1-0.dll	6		RegCreateKeyW
api-ms-win-core-heap-obsolete-l1-1-0.dll	4		GlobalLock
api-ms-win-core-heap-obsolete-l1-1-0.dll	7		GlobalUnlock
api-ms-win-core-heap-obsolete-l1-1-0.dll	13		LocalSize
api-ms-win-shcore-scaling-l1-1-1.dll			GetDpiForMonitor
api-ms-win-core-string-obsolete-l1-1-0.dll	5		lstrcmpiW
api-ms-win-eventing-provider-l1-1-0.dll	9		EventWriteTransfer
api-ms-win-eventing-provider-l1-1-0.dll	5		EventUnregister
api-ms-win-eventing-provider-l1-1-0.dll	3		EventRegister
api-ms-win-eventing-provider-l1-1-0.dll	4		EventSetInformation
api-ms-win-base-util-l1-1-0.dll			IsTextUnicode
api-ms-win-core-synch-l1-2-0.dll	57		WakeAllConditionVariable
api-ms-win-core-synch-l1-2-0.dll	45		Sleep
api-ms-win-core-synch-l1-2-0.dll	47		SleepConditionVariableSRW
api-ms-win-core-rtlsupport-l1-1-0.dll	2		RtlCaptureContext
api-ms-win-core-rtlsupport-l1-1-0.dll	15		RtlVirtualUnwind
api-ms-win-core-rtlsupport-l1-1-0.dll	9		RtlLookupFunctionEntry
api-ms-win-core-profile-l1-1-0.dll			QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-1.dll	27		GetProcessMitigationPolicy
api-ms-win-core-winrt-string-l1-1-0.dll	16		WindowsGetStringRawBuffer
api-ms-win-core-winrt-string-l1-1-0.dll	11		WindowsCreateStringReference
api-ms-win-core-winrt-string-l1-1-0.dll	12		WindowsDeleteString
api-ms-win-core-winrt-string-l1-1-0.dll	10		WindowsCreateString
api-ms-win-core-winrt-error-l1-1-0.dll	18		SetRestrictedErrorInfo
api-ms-win-core-winrt-l1-1-0.dll	7		RoUninitialize
api-ms-win-core-winrt-l1-1-0.dll	1		RoGetActivationFactory
api-ms-win-core-winrt-l1-1-0.dll	3		RoInitialize
api-ms-win-core-winrt-error-l1-1-1.dll	6		RoGetMatchingRestrictedErrorInfo
COMCTL32.dll	12		CreateStatusWindowW
COMCTL32.dll		345
api-ms-win-core-delayload-l1-1-1.dll	1		ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0.dll			DelayLoadFailureHook

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Notepad
FileVersion	10.0.18362.693 (WinBuild.160101.0800)
InternalName	Notepad
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	NOTEPAD.EXE
ProductName	Microsoft® Windows® Operating System
ProductVersion	10.0.18362.693

VS_FIXEDFILEINFO

FileVersion	10.0.18362.693
ProductVersion	10.0.18362.693
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	175664	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x2c0a0

notepad.exe-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

TLS

StringTable 040904B0

VS_FIXEDFILEINFO

notepad.exe
-