filenamenotepad.exe
size246784 (0x3c400)
md515750221bbffa36c055d656c46899460
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
1473072930
259252033
2602520319
261252034
2572520327
10278
2642520329
255252031
258252031

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0xa0c4ceab
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.10
SizeOfCode0x19000
SizeOfInitializedData0x25200
SizeOfUninitializedData0
AddressOfEntryPoint0x193e0
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion10.0
ImageVersion10.0
SubsystemVersion10.0
Reserved10
SizeOfImage0x41000
SizeOfHeaders0x400
CheckSum0x4ac7b
Subsystem2
DllCharacteristics0xc160
SizeOfStackReserve0x80000
SizeOfStackCommit0x11000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x18fce0x19000R-X CODE
.rdata0x1a0000x76020x7800R-- IDATA
.data0x220000x2d140xc00RW- IDATA
.pdata0x250000x8dc0xa00R-- IDATA
.rsrc0x260000x19ce00x19e00R-- IDATA
.reloc0x400000x21c0x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1f4d80x244
RESOURCE0x260000x19ce0
EXCEPTION0x250000x8dc
SECURITY00
BASERELOC0x400000x21c
DEBUG0x1e3700x54
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x1a5500x100
Bound_IAT00
IAT0x1a6500x978
Delay_IAT00
CLR_Header00
typenamesizecp
EDPENLIGHTENEDAPPINFOIDMICROSOFTEDPENLIGHTENEDAPPINFO20
EDPPERMISSIVEAPPINFOIDMICROSOFTEDPPERMISSIVEAPPINFO20
MUI#13280
ICON#116400
ICON#27440
ICON#34880
ICON#42960
ICON#537520
ICON#622160
ICON#717360
ICON#813840
ICON#9720240
ICON#1096400
ICON#1142640
ICON#1224400
ICON#1311280
GROUP_ICON#21880
VERSION#18840
MANIFEST#111870
module_namehintordfunction_name
ADVAPI32.dll533OpenProcessToken
ADVAPI32.dll368GetTokenInformation
ADVAPI32.dll239DuplicateEncryptionInfoFile
ADVAPI32.dll681RegSetValueExW
ADVAPI32.dll665RegQueryValueExW
ADVAPI32.dll615RegCreateKeyW
ADVAPI32.dll603RegCloseKey
ADVAPI32.dll652RegOpenKeyExW
ADVAPI32.dll290EventSetInformation
ADVAPI32.dll289EventRegister
ADVAPI32.dll291EventUnregister
ADVAPI32.dll297EventWriteTransfer
ADVAPI32.dll408IsTextUnicode
ADVAPI32.dll234DecryptFileW
KERNEL32.dll199CreateFileMappingW
KERNEL32.dll986MapViewOfFile
KERNEL32.dll1003MultiByteToWideChar
KERNEL32.dll975LocalReAlloc
KERNEL32.dll1463UnmapViewOfFile
KERNEL32.dll977LocalSize
KERNEL32.dll723GetStartupInfoW
KERNEL32.dll395FindNLSString
KERNEL32.dll829GlobalLock
KERNEL32.dll836GlobalUnlock
KERNEL32.dll818GlobalAlloc
KERNEL32.dll629GetModuleFileNameA
KERNEL32.dll233CreateSemaphoreExW
KERNEL32.dll846HeapFree
KERNEL32.dll586GetFileInformationByHandle
KERNEL32.dll540GetCurrentProcessId
KERNEL32.dll1502WaitForSingleObject
KERNEL32.dll544GetCurrentThreadId
KERNEL32.dll1197ReleaseMutex
KERNEL32.dll1045OutputDebugStringW
KERNEL32.dll1503WaitForSingleObjectEx
KERNEL32.dll1037OpenSemaphoreW
KERNEL32.dll842HeapAlloc
KERNEL32.dll689GetProcAddress
KERNEL32.dll216CreateMutexExW
KERNEL32.dll695GetProcessHeap
KERNEL32.dll634GetModuleHandleW
KERNEL32.dll261DebugBreak
KERNEL32.dll893IsDebuggerPresent
KERNEL32.dll581GetFileAttributesExW
KERNEL32.dll604GetFullPathNameW
KERNEL32.dll1302SetEndOfFile
KERNEL32.dll276DeleteFileW
KERNEL32.dll978LocalUnlock
KERNEL32.dll438GetACP
KERNEL32.dll974LocalLock
KERNEL32.dll611GetLastError
KERNEL32.dll584GetFileAttributesW
KERNEL32.dll1561WriteFile
KERNEL32.dll1335SetLastError
KERNEL32.dll1541WideCharToMultiByte
KERNEL32.dll783GetTimeFormatW
KERNEL32.dll550GetDateFormatW
KERNEL32.dll612GetLocalTime
KERNEL32.dll794GetUserDefaultUILanguage
KERNEL32.dll424FoldStringW
KERNEL32.dll427FormatMessageW
KERNEL32.dll377FindClose
KERNEL32.dll388FindFirstFileW
KERNEL32.dll1595lstrcmpW
KERNEL32.dll1201ReleaseSemaphore
KERNEL32.dll431FreeLibrary
KERNEL32.dll972LocalFree
KERNEL32.dll850HeapSetInformation
KERNEL32.dll475GetCommandLineW
KERNEL32.dll539GetCurrentProcess
KERNEL32.dll1002MulDiv
KERNEL32.dll615GetLocaleInfoW
KERNEL32.dll825GlobalFree
KERNEL32.dll1598lstrcmpiW
KERNEL32.dll968LocalAlloc
KERNEL32.dll134CloseHandle
KERNEL32.dll1136ReadFile
KERNEL32.dll202CreateFileW
KERNEL32.dll1307SetErrorMode
KERNEL32.dll633GetModuleHandleExW
GDI32.dll902StartPage
GDI32.dll900StartDocW
GDI32.dll844SetAbortProc
GDI32.dll362DeleteDC
GDI32.dll376EndDoc
GDI32.dllAbortDoc
GDI32.dll379EndPage
GDI32.dll704GetTextMetricsW
GDI32.dll850SetBkMode
GDI32.dll719LPtoDP
GDI32.dll896SetWindowExtEx
GDI32.dll892SetViewportExtEx
GDI32.dll872SetMapMode
GDI32.dll696GetTextExtentPoint32W
GDI32.dll909TextOutW
GDI32.dll433EnumFontsW
GDI32.dll702GetTextFaceW
GDI32.dll842SelectObject
GDI32.dll365DeleteObject
GDI32.dll67CreateFontIndirectW
GDI32.dll612GetDeviceCaps
GDI32.dll52CreateDCW
USER32.dll867SetWinEventHook
USER32.dll389GetMessageW
USER32.dll547IsDialogMessageW
USER32.dll926TranslateAcceleratorW
USER32.dll928TranslateMessage
USER32.dll189DispatchMessageW
USER32.dll931UnhookWinEvent
USER32.dll884SetWindowTextW
USER32.dll382GetMenuState
USER32.dll666OpenClipboard
USER32.dll544IsClipboardFormatAvailable
USER32.dll77CloseClipboard
USER32.dll813SetDlgItemTextW
USER32.dll334GetDlgItemTextW
USER32.dll241EndDialog
USER32.dll776SendDlgItemMessageW
USER32.dll979WinHelpW
USER32.dll320GetCursorPos
USER32.dll770ScreenToClient
USER32.dll71ChildWindowFromPoint
USER32.dll51CharNextW
USER32.dll851SetScrollPos
USER32.dll532InvalidateRect
USER32.dll954UpdateWindow
USER32.dll483GetWindowPlacement
USER32.dll878SetWindowPlacement
USER32.dll62CharUpperW
USER32.dll445GetSystemMenu
USER32.dll578LoadAcceleratorsW
USER32.dll877SetWindowLongW
USER32.dll115CreateWindowExW
USER32.dll757RegisterWindowMessageW
USER32.dll584LoadCursorW
USER32.dll729RegisterClassExW
USER32.dll490GetWindowTextLengthW
USER32.dll478GetWindowLongW
USER32.dll680PeekMessageW
USER32.dll491GetWindowTextW
USER32.dll238EnableWindow
USER32.dll104CreateDialogParamW
USER32.dll221DrawTextExW
USER32.dll357GetKeyboardLayout
USER32.dll725RedrawWindow
USER32.dll879SetWindowPos
USER32.dll330GetDlgCtrlID
USER32.dll641MessageBeep
USER32.dll340GetForegroundWindow
USER32.dll181DestroyWindow
USER32.dll685PostQuitMessage
USER32.dll551IsIconic
USER32.dll168DefWindowProcW
USER32.dll599LoadStringW
USER32.dll788SetActiveWindow
USER32.dll801SetCursor
USER32.dll338GetDpiForWindow
USER32.dll759ReleaseDC
USER32.dll396GetParent
USER32.dll321GetDC
USER32.dll896ShowWindow
USER32.dll65CheckMenuItem
USER32.dll649MessageBoxW
USER32.dll339GetFocus
USER32.dll186DialogBoxParamW
USER32.dll816SetFocus
USER32.dll233EnableMenuItem
USER32.dll371GetMenu
USER32.dll684PostMessageW
USER32.dll861SetThreadDpiAwarenessContext
USER32.dll655MoveWindow
USER32.dll306GetClientRect
USER32.dll442GetSubMenu
USER32.dll785SendMessageW
USER32.dll586LoadIconW
USER32.dll588LoadImageW
msvcrt.dll833_unlock
msvcrt.dll486_lock
msvcrt.dll123__dllonexit
msvcrt.dll295_fmode
msvcrt.dll162_acmdln
msvcrt.dll381_initterm
msvcrt.dll1174memset
msvcrt.dll656_onexit
msvcrt.dll144__setusermatherr
msvcrt.dll409_ismbblead
msvcrt.dll193_cexit
msvcrt.dll47void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll1074exit
msvcrt.dll142__set_app_type
msvcrt.dll127__getmainargs
msvcrt.dll174_amsg_exit
msvcrt.dll85_XcptFilter
msvcrt.dll1100free
msvcrt.dll1171memcpy_s
msvcrt.dll1138iswctype
msvcrt.dll1294wcsnlen
msvcrt.dll906_wcsicmp
msvcrt.dll87__C_specific_handler
msvcrt.dll1033_wtol
msvcrt.dll873_vsnwprintf
msvcrt.dll270_exit
msvcrt.dll1282wcscmp
msvcrt.dll210_commode
msvcrt.dll1170memcpy
msvcrt.dll191_callnewh
msvcrt.dll1217strchr
msvcrt.dll670_purecall
msvcrt.dll91__CxxFrameHandler3
msvcrt.dll1158malloc
api-ms-win-core-com-l1-1-0.dll64CoTaskMemAlloc
api-ms-win-core-com-l1-1-0.dll7CoCreateFreeThreadedMarshaler
api-ms-win-core-com-l1-1-0.dll9CoCreateInstance
api-ms-win-core-com-l1-1-0.dll40CoInitializeEx
api-ms-win-core-com-l1-1-0.dll71CoWaitForMultipleHandles
api-ms-win-core-com-l1-1-0.dll65CoTaskMemFree
api-ms-win-core-com-l1-1-0.dll8CoCreateGuid
api-ms-win-core-com-l1-1-0.dll78PropVariantClear
api-ms-win-core-com-l1-1-0.dll68CoUninitialize
api-ms-win-core-synch-l1-2-0.dll45Sleep
api-ms-win-core-rtlsupport-l1-1-0.dll15RtlVirtualUnwind
api-ms-win-core-rtlsupport-l1-1-0.dll9RtlLookupFunctionEntry
api-ms-win-core-rtlsupport-l1-1-0.dll2RtlCaptureContext
api-ms-win-core-errorhandling-l1-1-0.dll17UnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-0.dll7RaiseException
api-ms-win-core-errorhandling-l1-1-0.dll15SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0.dll77TerminateProcess
api-ms-win-core-profile-l1-1-0.dllQueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0.dll20GetSystemTimeAsFileTime
api-ms-win-core-sysinfo-l1-1-0.dll24GetTickCount
api-ms-win-core-libraryloader-l1-2-0.dll16GetModuleFileNameW
api-ms-win-core-libraryloader-l1-2-0.dll24LoadLibraryExW
api-ms-win-core-processthreads-l1-1-1.dll27GetProcessMitigationPolicy
api-ms-win-core-winrt-string-l1-1-0.dll12WindowsDeleteString
api-ms-win-core-winrt-string-l1-1-0.dll10WindowsCreateString
api-ms-win-core-winrt-string-l1-1-0.dll11WindowsCreateStringReference
api-ms-win-core-winrt-string-l1-1-0.dll16WindowsGetStringRawBuffer
api-ms-win-core-synch-l1-1-0.dll5CreateEventExW
api-ms-win-core-synch-l1-1-0.dll41SetEvent
api-ms-win-core-winrt-error-l1-1-0.dll18SetRestrictedErrorInfo
api-ms-win-core-string-l1-1-0.dll1CompareStringOrdinal
api-ms-win-core-winrt-l1-1-0.dll1RoGetActivationFactory
api-ms-win-core-winrt-l1-1-0.dll7RoUninitialize
api-ms-win-core-winrt-l1-1-0.dll3RoInitialize
api-ms-win-core-winrt-error-l1-1-1.dll6RoGetMatchingRestrictedErrorInfo
COMCTL32.dll345
COMCTL32.dll12CreateStatusWindowW
COMDLG32.dll3ChooseFontW
COMDLG32.dll10GetFileTitleW
COMDLG32.dll8FindTextW
COMDLG32.dll17PageSetupDlgW
COMDLG32.dll14GetSaveFileNameW
COMDLG32.dll12GetOpenFileNameW
COMDLG32.dll4CommDlgExtendedError
COMDLG32.dll20PrintDlgExW
COMDLG32.dll23ReplaceTextW
ntdll.dll1664WinSqmAddToStream
PROPSYS.dll62PSGetPropertyDescriptionListFromString
PROPSYS.dll150PropVariantToStringVectorAlloc
SHELL32.dll159SHCreateItemFromParsingName
SHELL32.dll40DragQueryFileW
SHELL32.dll124SHAddToRecentDocs
SHELL32.dll36DragFinish
SHELL32.dll35DragAcceptFiles
SHELL32.dll440ShellExecuteW
SHELL32.dll432ShellAboutW
SHLWAPI.dll97PathIsFileSpecW
SHLWAPI.dll73PathFileExistsW
SHLWAPI.dll101PathIsNetworkPathW
SHLWAPI.dll75PathFindExtensionW
SHLWAPI.dll264SHStrDupW
WINSPOOL.DRV150OpenPrinterW
WINSPOOL.DRV29ClosePrinter
WINSPOOL.DRV140GetPrinterDriverW
urlmon.dll59FindMimeFromData

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionNotepad
FileVersion10.0.16299.15 (WinBuild.160101.0800)
InternalNameNotepad
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameNOTEPAD.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion10.0.16299.15

VS_FIXEDFILEINFO

FileVersion10.0.16299.15
ProductVersion10.0.16299.15
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
25bc872024PNG(256 x 256)#
3752020192BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER