filenamenotepad.exe
size66049 (0x10201)
md50e8dc043f97cf5ccdef1c225ef913f3c
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
6492101
001
25921019
10194
6991111
28917819
6192101

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x3b7d840d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.0
SizeOfCode0x6e00
SizeOfInitializedData0x9000
SizeOfUninitializedData0
AddressOfEntryPoint0x6ae0
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion4.0
Reserved10
SizeOfImage0x13000
SizeOfHeaders0x400
CheckSum0x1f21e
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x40000
SizeOfStackCommit0x11000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.x >> *SigBy Ahmed18

Sections

namevavsizeraw sizeflags
.text0x10000x6d720x6e00R-X CODE
.data0x80000x1ba80x600RW- IDATA
.rsrc0xa0000x89480x8a00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x6d200xc8
RESOURCE0xa0000x7f10
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x13400x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2580xd0
IAT0x10000x324
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#116401252
ICON#27441252
ICON#32961252
ICON#437521252
ICON#522161252
ICON#613841252
ICON#796401252
ICON#842641252
ICON#911281252
MENU#18161252
DIALOGNPENCODINGDIALOG1241252
DIALOG#111921252
DIALOG#1211281252
DIALOG#142081252
STRING#16681252
STRING#27001252
STRING#32321252
STRING#30401252
ACCELERATORSMAINACC1361252
ACCELERATORSSLIPUPACC1681252
GROUP_ICON#21321252
VERSION#18641252
MANIFEST#16701252
idlangstring
12052不能打开文件: %%。 请确认指定的驱动器中是否有盘。
22052找不到文件: %%。 要创建新文件吗?
32052文件 %% 的文字已经改变。 想保存文件吗?
42052无标题
52052 - 记事本
62052找不到 "%%"
72052无足够的可用内存完成该操作。请关闭部分应用程序以增加可用内存，然后再试一次。
82052文件 %% 太长，无法用记事本打开。 请使用其他编辑器。
92052记事本
102052初始化文件对话失败。更改文件名，再试一次。
112052初始化打印对话失败。请确认打印机已正确连接，并用“控制面板”确认打印机已正确配置。
122052不能打印 %% 文件。请检查打印机是否正常连接，同时使用控制面板检查打印机的配置情况。
132052不是合法的文件名。
142052不能创建文件 %%。 请确认路径和文件名是否正确。
152052不能进行自动换行，因为该文件的正文太长。
162052%%
172052notepad.hlp
182052&f
192052第 &p 页
202052文本文档(*.txt)
212052所有文件
222052打开
232052另存为
242052记事本中的“另存为”对话框未关闭， 因此您无法退出 Windows。请切换到记事本，关闭对话框， 然后重试退出 Windows。
252052不能访问您的打印机。请检查打印机是否正常连接，同时使用控制面板检查打印机的配置情况。
262052%% 不允许打开该文件，请向文件的所有者或管理员申请权限。
272052%% 该文件含有 Unicode 格式的字符，当文件保存为 ANSI 编码的文本文件时，该字符将丢失。要保存 Unicode 信息，单击下面的“取消”，然后从编码列表中选择一个 Unicode 选项。继续吗?
282052纸张小于行高，无法打印。 请换用较小的字体打印。
292052共用对话框错误(0x%04x)
302052记事本 - 跳行
312052行数超过范围
322052ANSI
332052Unicode
342052Unicode big endian
352052UTF-8
362052第 %d 页
372052 Ln %d, Col %d
382052 压缩，
392052 加密，
402052 隐藏，
412052 脱机，
422052 只读，
432052 系统，
442052 文件
452052fFpPtTdDcCrRlL
4692052文本文档
module_namehintordfunction_name
comdlg32.dll15PageSetupDlgW
comdlg32.dll6FindTextW
comdlg32.dll18PrintDlgExW
comdlg32.dll3ChooseFontW
comdlg32.dll12GetSaveFileNameW
comdlg32.dll10GetOpenFileNameW
comdlg32.dll21ReplaceTextW
comdlg32.dll8GetFileTitleW
comdlg32.dll4CommDlgExtendedError
SHELL32.dll21DragFinish
SHELL32.dll25DragQueryFileW
SHELL32.dll20DragAcceptFiles
SHELL32.dll148ShellAboutW
WINSPOOL.DRV120GetPrinterDriverW
WINSPOOL.DRV27ClosePrinter
WINSPOOL.DRV124OpenPrinterW
COMCTL32.dll6CreateStatusWindowW
msvcrt.dll200_cexit
msvcrt.dll78_XcptFilter
msvcrt.dll246_exit
msvcrt.dll197_c_exit
msvcrt.dll790time
msvcrt.dll655exit
msvcrt.dll815wcsncpy
msvcrt.dll709iswctype
msvcrt.dll627_wtol
msvcrt.dll814wcsncmp
msvcrt.dll483_snwprintf
msvcrt.dll168_acmdln
msvcrt.dll109__getmainargs
msvcrt.dll314_initterm
msvcrt.dll154__setusermatherr
msvcrt.dll182_adjust_fdiv
msvcrt.dll128__p__commode
msvcrt.dll133__p__fmode
msvcrt.dll152__set_app_type
msvcrt.dll237_except_handler3
msvcrt.dll214_controlfp
msvcrt.dll723localtime
ADVAPI32.dll492RegQueryValueExW
ADVAPI32.dll456RegCloseKey
ADVAPI32.dll462RegCreateKeyW
ADVAPI32.dll311IsTextUnicode
ADVAPI32.dll491RegQueryValueExA
ADVAPI32.dll481RegOpenKeyExA
ADVAPI32.dll505RegSetValueExW
KERNEL32.dll489GlobalUnlock
KERNEL32.dll332GetFileInformationByHandle
KERNEL32.dll76CreateFileMappingW
KERNEL32.dll580MapViewOfFile
KERNEL32.dll593MultiByteToWideChar
KERNEL32.dll837UnmapViewOfFile
KERNEL32.dll235GetACP
KERNEL32.dll121DeleteFileW
KERNEL32.dll744SetEndOfFile
KERNEL32.dll451GetUserDefaultLangID
KERNEL32.dll225FormatMessageW
KERNEL32.dll482GlobalLock
KERNEL32.dll448GetTimeFormatW
KERNEL32.dll308GetDateFormatW
KERNEL32.dll450GetUserDefaultLCID
KERNEL32.dll348GetLocalTime
KERNEL32.dll558LoadLibraryA
KERNEL32.dll412GetStartupInfoA
KERNEL32.dll478GlobalFree
KERNEL32.dll350GetLocaleInfoW
KERNEL32.dll912lstrcatW
KERNEL32.dll193FindClose
KERNEL32.dll200FindFirstFileW
KERNEL32.dll331GetFileAttributesW
KERNEL32.dll921lstrcpyW
KERNEL32.dll915lstrcmpW
KERNEL32.dll568LocalFree
KERNEL32.dll564LocalAlloc
KERNEL32.dll927lstrlenW
KERNEL32.dll574LocalUnlock
KERNEL32.dll51CompareStringW
KERNEL32.dll570LocalLock
KERNEL32.dll223FoldStringW
KERNEL32.dll44CloseHandle
KERNEL32.dll656ReadFile
KERNEL32.dll77CreateFileW
KERNEL32.dll918lstrcmpiW
KERNEL32.dll304GetCurrentProcessId
KERNEL32.dll393GetProcAddress
KERNEL32.dll254GetCommandLineW
KERNEL32.dll592MulDiv
KERNEL32.dll924lstrcpynW
KERNEL32.dll573LocalSize
KERNEL32.dll346GetLastError
KERNEL32.dll886WriteFile
KERNEL32.dll766SetLastError
KERNEL32.dll873WideCharToMultiByte
KERNEL32.dll571LocalReAlloc
KERNEL32.dll359GetModuleHandleA
GDI32.dll152EndPage
GDI32.dllAbortDoc
GDI32.dll150EndDoc
GDI32.dll140DeleteDC
GDI32.dll582StartPage
GDI32.dll437GetTextExtentPoint32W
GDI32.dll47CreateDCW
GDI32.dll526SetAbortProc
GDI32.dll443GetTextFaceW
GDI32.dll589TextOutW
GDI32.dll580StartDocW
GDI32.dll206EnumFontsW
GDI32.dll421GetStockObject
GDI32.dll407GetObjectW
GDI32.dll363GetDeviceCaps
GDI32.dll61CreateFontIndirectW
GDI32.dll143DeleteObject
GDI32.dll445GetTextMetricsW
GDI32.dll532SetBkMode
GDI32.dll457LPtoDP
GDI32.dll576SetWindowExtEx
GDI32.dll572SetViewportExtEx
GDI32.dll553SetMapMode
GDI32.dll524SelectObject
USER32.dll554ReleaseDC
USER32.dll268GetDC
USER32.dll159DialogBoxParamW
USER32.dll579SetActiveWindow
USER32.dll290GetKeyboardLayout
USER32.dll143DefWindowProcW
USER32.dll153DestroyWindow
USER32.dll475MessageBeep
USER32.dll513PostQuitMessage
USER32.dll279GetForegroundWindow
USER32.dll422IsIconic
USER32.dll589SetCursor
USER32.dll371GetWindowPlacement
USER32.dll55CharUpperW
USER32.dll457LoadStringW
USER32.dll641SetWindowLongW
USER32.dll436LoadAcceleratorsW
USER32.dll348GetSystemMenu
USER32.dll536RegisterClassExW
USER32.dll446LoadImageW
USER32.dll442LoadCursorW
USER32.dll642SetWindowPlacement
USER32.dll97CreateWindowExW
USER32.dll552RegisterWindowMessageW
USER32.dll255GetClientRect
USER32.dll658ShowWindow
USER32.dll270GetDesktopWindow
USER32.dll278GetFocus
USER32.dll699UpdateWindow
USER32.dll623SetScrollPos
USER32.dll41CharLowerW
USER32.dll367GetWindowLongW
USER32.dll510PeekMessageW
USER32.dll196EnableWindow
USER32.dll190DrawTextExW
USER32.dll86CreateDialogParamW
USER32.dll378GetWindowTextW
USER32.dll444LoadIconW
USER32.dll489MoveWindow
USER32.dll403InvalidateRect
USER32.dll723WinHelpW
USER32.dll272GetDlgCtrlID
USER32.dll60ChildWindowFromPoint
USER32.dll561ScreenToClient
USER32.dll267GetCursorPos
USER32.dll567SendDlgItemMessageW
USER32.dll576SendMessageW
USER32.dll44CharNextW
USER32.dll647SetWindowTextW
USER32.dll57CheckMenuItem
USER32.dll66CloseClipboard
USER32.dll415IsClipboardFormatAvailable
USER32.dll499OpenClipboard
USER32.dll311GetMenuState
USER32.dll194EnableMenuItem
USER32.dll345GetSubMenu
USER32.dll300GetMenu
USER32.dll483MessageBoxW
USER32.dll598SetFocus
USER32.dll596SetDlgItemTextW
USER32.dll729wsprintfW
USER32.dll276GetDlgItemTextW
USER32.dll198EndDialog
USER32.dll325GetParent
USER32.dll684UnhookWinEvent
USER32.dll162DispatchMessageW
USER32.dll682TranslateMessage
USER32.dll680TranslateAcceleratorW
USER32.dll418IsDialogMessageW
USER32.dll512PostMessageW
USER32.dll318GetMessageW
USER32.dll638SetWinEventHook
USER32.dll349GetSystemMetrics

StringTable 080404B0

CompanyNameMicrosoft Corporation
FileDescription记事本
FileVersion5.1.2600.0 (xpclient.010817-1148)
InternalNameNotepad
LegalCopyright(C) Microsoft Corporation. All rights reserved.
OriginalFilenameNOTEPAD.EXE
ProductNameMicrosoft(R) Windows(R) Operating System
ProductVersion5.1.2600.0

VS_FIXEDFILEINFO

FileVersion5.1.2600.0
ProductVersion5.1.2600.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
066048EXE08/17/2001 20:52:29#
15c115HTM#
102001BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 66049 bytes (65 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x258