filenamenotepad.exe
size233984 (0x39200)
md522e1963fe26d5bceab0575eb6ff60cb5
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
189307161
187307162
1883071621
1853071627
10226
1923071619
183307161
186307161

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x50109a6f
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion10.10
SizeOfCode0x1b200
SizeOfInitializedData0x1ee00
SizeOfUninitializedData0
AddressOfEntryPoint0x5fd6
BaseOfCode0x1000
BaseOfData0x1c000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.2
ImageVersion6.2
SubsystemVersion6.2
Reserved10
SizeOfImage0x3e000
SizeOfHeaders0x400
CheckSum0x45ed7
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x11000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x1b0a40x1b200R-X CODE
.data0x1d0000x23680x1200RW- IDATA
.idata0x200000x17500x1800R-- IDATA
.rsrc0x220000x19ae80x19c00R-- IDATA
.reloc0x3c0000x151c0x1600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x203a80x118
RESOURCE0x220000x19ae8
EXCEPTION00
SECURITY00
BASERELOC0x3c0000x151c
DEBUG0x1c0440x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x110200x40
Bound_IAT00
IAT0x200000x3a8
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12320
ICON#116400
ICON#27440
ICON#34880
ICON#42960
ICON#537520
ICON#622160
ICON#717360
ICON#813840
ICON#9720240
ICON#1096400
ICON#1142640
ICON#1224400
ICON#1311280
GROUP_ICON#21880
VERSION#18760
MANIFEST#111700
module_namehintordfunction_name
ADVAPI32.dll662RegQueryValueExW
ADVAPI32.dll612RegCreateKeyW
ADVAPI32.dll600RegCloseKey
ADVAPI32.dll649RegOpenKeyExW
ADVAPI32.dll406IsTextUnicode
ADVAPI32.dll678RegSetValueExW
KERNEL32.dll976LocalReAlloc
KERNEL32.dll1427UnmapViewOfFile
KERNEL32.dll406FindNLSString
KERNEL32.dll821GlobalAlloc
KERNEL32.dll619GetLocalTime
KERNEL32.dll557GetDateFormatW
KERNEL32.dll789GetTimeFormatW
KERNEL32.dll832GlobalLock
KERNEL32.dll839GlobalUnlock
KERNEL32.dll797GetUserDefaultUILanguage
KERNEL32.dll1004MultiByteToWideChar
KERNEL32.dll987MapViewOfFile
KERNEL32.dll211CreateFileMappingW
KERNEL32.dll592GetFileInformationByHandle
KERNEL32.dll1270SetEndOfFile
KERNEL32.dll291DeleteFileW
KERNEL32.dll446GetACP
KERNEL32.dll1521WriteFile
KERNEL32.dll1303SetLastError
KERNEL32.dll1501WideCharToMultiByte
KERNEL32.dll618GetLastError
KERNEL32.dll978LocalSize
KERNEL32.dll610GetFullPathNameW
KERNEL32.dll434FoldStringW
KERNEL32.dll979LocalUnlock
KERNEL32.dll975LocalLock
KERNEL32.dll436FormatMessageW
KERNEL32.dll388FindClose
KERNEL32.dll399FindFirstFileW
KERNEL32.dll1553lstrcmpW
KERNEL32.dll548GetCurrentProcessId
KERNEL32.dll853HeapSetInformation
KERNEL32.dll483GetCommandLineW
KERNEL32.dll640GetModuleHandleExW
KERNEL32.dll785GetTickCount64
KERNEL32.dll1565lstrlenW
KERNEL32.dll1003MulDiv
KERNEL32.dll622GetLocaleInfoW
KERNEL32.dll257CreateThread
KERNEL32.dll441FreeLibraryAndExitThread
KERNEL32.dll637GetModuleFileNameW
KERNEL32.dll1375Sleep
KERNEL32.dll698GetProcessHeap
KERNEL32.dll849HeapFree
KERNEL32.dll962LoadLibraryExW
KERNEL32.dll845HeapAlloc
KERNEL32.dll440FreeLibrary
KERNEL32.dll784GetTickCount
KERNEL32.dll828GlobalFree
KERNEL32.dll969LocalAlloc
KERNEL32.dll142CloseHandle
KERNEL32.dll1112ReadFile
KERNEL32.dll214CreateFileW
KERNEL32.dll1275SetErrorMode
KERNEL32.dll756GetSystemTimeAsFileTime
KERNEL32.dll1556lstrcmpiW
KERNEL32.dll973LocalFree
KERNEL32.dll877InterlockedDecrement
KERNEL32.dll881InterlockedIncrement
KERNEL32.dll878InterlockedExchange
KERNEL32.dll875InterlockedCompareExchange
KERNEL32.dll726GetStartupInfoA
KERNEL32.dll1424UnhandledExceptionFilter
KERNEL32.dll1360SetUnhandledExceptionFilter
KERNEL32.dll547GetCurrentProcess
KERNEL32.dll1391TerminateProcess
KERNEL32.dll638GetModuleHandleA
KERNEL32.dll1084QueryPerformanceCounter
KERNEL32.dll552GetCurrentThreadId
KERNEL32.dll693GetProcAddress
KERNEL32.dll2147483647
GDI32.dll51CreateDCW
GDI32.dll772StartPage
GDI32.dll770StartDocW
GDI32.dll715SetAbortProc
GDI32.dll258DeleteDC
GDI32.dll270EndDoc
GDI32.dllAbortDoc
GDI32.dll273EndPage
GDI32.dll582GetTextMetricsW
GDI32.dll721SetBkMode
GDI32.dll596LPtoDP
GDI32.dll766SetWindowExtEx
GDI32.dll762SetViewportExtEx
GDI32.dll742SetMapMode
GDI32.dll574GetTextExtentPoint32W
GDI32.dll779TextOutW
GDI32.dll327EnumFontsW
GDI32.dll580GetTextFaceW
GDI32.dll713SelectObject
GDI32.dll261DeleteObject
GDI32.dll65CreateFontIndirectW
GDI32.dll491GetDeviceCaps
USER32.dll424GetSystemMenu
USER32.dll538LoadAcceleratorsW
USER32.dll777SetWindowLongW
USER32.dll672RegisterWindowMessageW
USER32.dll544LoadCursorW
USER32.dll113CreateWindowExW
USER32.dll778SetWindowPlacement
USER32.dll548LoadImageW
USER32.dll646RegisterClassExW
USER32.dll754SetScrollPos
USER32.dll494InvalidateRect
USER32.dll851UpdateWindow
USER32.dll464GetWindowTextLengthW
USER32.dll452GetWindowLongW
USER32.dll618PeekMessageW
USER32.dll465GetWindowTextW
USER32.dll229EnableWindow
USER32.dll102CreateDialogParamW
USER32.dll214DrawTextExW
USER32.dll60CharUpperW
USER32.dll457GetWindowPlacement
USER32.dll378GetParent
USER32.dll69ChildWindowFromPoint
USER32.dll682ScreenToClient
USER32.dll308GetCursorPos
USER32.dll876WinHelpW
USER32.dll316GetDlgCtrlID
USER32.dll688SendDlgItemMessageW
USER32.dll232EndDialog
USER32.dll320GetDlgItemTextW
USER32.dll719SetDlgItemTextW
USER32.dll75CloseClipboard
USER32.dll506IsClipboardFormatAvailable
USER32.dll604OpenClipboard
USER32.dll364GetMenuState
USER32.dll784SetWindowTextW
USER32.dll829UnhookWinEvent
USER32.dll182DispatchMessageW
USER32.dll827TranslateMessage
USER32.dll825TranslateAcceleratorW
USER32.dll509IsDialogMessageW
USER32.dll371GetMessageW
USER32.dll769SetWinEventHook
USER32.dll49CharNextW
USER32.dll340GetKeyboardLayout
USER32.dll323GetForegroundWindow
USER32.dll579MessageBeep
USER32.dll622PostQuitMessage
USER32.dll513IsIconic
USER32.dll161DefWindowProcW
USER32.dll559LoadStringW
USER32.dll700SetActiveWindow
USER32.dll710SetCursor
USER32.dll674ReleaseDC
USER32.dll309GetDC
USER32.dll796ShowWindow
USER32.dll294GetClientRect
USER32.dll63CheckMenuItem
USER32.dll587MessageBoxW
USER32.dll322GetFocus
USER32.dll546LoadIconW
USER32.dll179DialogBoxParamW
USER32.dll721SetFocus
USER32.dll421GetSubMenu
USER32.dll225EnableMenuItem
USER32.dll353GetMenu
USER32.dll621PostMessageW
USER32.dll593MoveWindow
USER32.dll697SendMessageW
USER32.dll173DestroyWindow
USER32.dll2147483647
msvcrt.dll1137_wtol
msvcrt.dll1303strchr
msvcrt.dll1261memcmp
msvcrt.dll1262memcpy
msvcrt.dll1232iswctype
msvcrt.dll106_XcptFilter
msvcrt.dll231_acmdln
msvcrt.dll977_vsnwprintf
msvcrt.dll346_except_handler4_common
msvcrt.dll295_controlfp
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll1266memset
msvcrt.dll472_initterm
msvcrt.dll212__setusermatherr
msvcrt.dll503_ismbblead
msvcrt.dll190__p__fmode
msvcrt.dll276_cexit
msvcrt.dll355_exit
msvcrt.dll1171exit
msvcrt.dll210__set_app_type
msvcrt.dll145__getmainargs
msvcrt.dll257_amsg_exit
msvcrt.dll185__p__commode
COMDLG32.dll14GetSaveFileNameW
COMDLG32.dll8FindTextW
COMDLG32.dll17PageSetupDlgW
COMDLG32.dll3ChooseFontW
COMDLG32.dll10GetFileTitleW
COMDLG32.dll20PrintDlgExW
COMDLG32.dll12GetOpenFileNameW
COMDLG32.dll4CommDlgExtendedError
COMDLG32.dll23ReplaceTextW
SHELL32.dll32DragQueryFileW
SHELL32.dll27DragAcceptFiles
SHELL32.dll298ShellAboutW
SHELL32.dll149SHCreateItemFromParsingName
SHELL32.dll28DragFinish
SHELL32.dll115SHAddToRecentDocs
WINSPOOL.DRV140GetPrinterDriverW
WINSPOOL.DRV29ClosePrinter
WINSPOOL.DRV150OpenPrinterW
ole32.dll120CoTaskMemAlloc
ole32.dll25CoCreateInstance
ole32.dll79CoInitializeEx
ole32.dll125CoUninitialize
ole32.dll121CoTaskMemFree
ole32.dll2147483647
SHLWAPI.dll263SHStrDupW
SHLWAPI.dll98PathIsFileSpecW
COMCTL32.dll12CreateStatusWindowW
COMCTL32.dll345
OLEAUT32.dll6
OLEAUT32.dll2
ntdll.dll1489WinSqmAddToStream

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionNotepad
FileVersion6.2.9200.16384 (win8_rtm.120725-1247)
InternalNameNotepad
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameNOTEPAD.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.2.9200.16384

VS_FIXEDFILEINFO

FileVersion6.2.9200.16384
ProductVersion6.2.9200.16384
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0233984EXE07/26/2012 01:16:31#
15c115HTM#
2183872024PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER