filenamenotepad.exe
size217600 (0x35200)
md524da05ade2a978e199875da0d859e7eb
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
207655011
205655012
2066550121
2036550127
10221
2106550119
201655011
204655011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x5215ef3b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion11.0
SizeOfCode0x17400
SizeOfInitializedData0x1ee00
SizeOfUninitializedData0
AddressOfEntryPoint0x6094
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.3
ImageVersion6.3
SubsystemVersion6.3
Reserved10
SizeOfImage0x3a000
SizeOfHeaders0x400
CheckSum0x40a8e
Subsystem2
DllCharacteristics0x8160
SizeOfStackReserve0x80000
SizeOfStackCommit0x11000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x173640x17400R-X CODE
.data0x190000x282c0x1600RW- IDATA
.pdata0x1c0000x6600x800R-- IDATA
.idata0x1d0000x1df00x1e00R-- IDATA
.rsrc0x1f0000x19af00x19c00R-- IDATA
.reloc0x390000x1280x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1d7280x118
RESOURCE0x1f0000x19af0
EXCEPTION0x1c0000x660
SECURITY00
BASERELOC0x390000x128
DEBUG0x17ab00x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x17a100x94
Bound_IAT00
IAT0x1d0000x728
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12320
ICON#116400
ICON#27440
ICON#34880
ICON#42960
ICON#537520
ICON#622160
ICON#717360
ICON#813840
ICON#9720240
ICON#1096400
ICON#1142640
ICON#1224400
ICON#1311280
GROUP_ICON#21880
VERSION#18840
MANIFEST#111720
module_namehintordfunction_name
ADVAPI32.dll658RegQueryValueExW
ADVAPI32.dll608RegCreateKeyW
ADVAPI32.dll596RegCloseKey
ADVAPI32.dll645RegOpenKeyExW
ADVAPI32.dll237DuplicateEncryptionInfoFile
ADVAPI32.dll406IsTextUnicode
ADVAPI32.dll674RegSetValueExW
KERNEL32.dll1427UnmapViewOfFile
KERNEL32.dll384FindNLSString
KERNEL32.dll800GlobalAlloc
KERNEL32.dll599GetLocalTime
KERNEL32.dll538GetDateFormatW
KERNEL32.dll766GetTimeFormatW
KERNEL32.dll811GlobalLock
KERNEL32.dll818GlobalUnlock
KERNEL32.dll776GetUserDefaultUILanguage
KERNEL32.dll952LocalReAlloc
KERNEL32.dll980MultiByteToWideChar
KERNEL32.dll963MapViewOfFile
KERNEL32.dll191CreateFileMappingW
KERNEL32.dll574GetFileInformationByHandle
KERNEL32.dll1272SetEndOfFile
KERNEL32.dll267DeleteFileW
KERNEL32.dll426GetACP
KERNEL32.dll572GetFileAttributesW
KERNEL32.dll1519WriteFile
KERNEL32.dll1304SetLastError
KERNEL32.dll1499WideCharToMultiByte
KERNEL32.dll598GetLastError
KERNEL32.dll954LocalSize
KERNEL32.dll592GetFullPathNameW
KERNEL32.dll413FoldStringW
KERNEL32.dll955LocalUnlock
KERNEL32.dll951LocalLock
KERNEL32.dll416FormatMessageW
KERNEL32.dll366FindClose
KERNEL32.dll377FindFirstFileW
KERNEL32.dll1553lstrcmpW
KERNEL32.dll528GetCurrentProcessId
KERNEL32.dll620GetModuleHandleExW
KERNEL32.dll617GetModuleFileNameW
KERNEL32.dll832HeapSetInformation
KERNEL32.dll681GetProcessHeap
KERNEL32.dll828HeapFree
KERNEL32.dll676GetProcAddress
KERNEL32.dll824HeapAlloc
KERNEL32.dll761GetTickCount
KERNEL32.dll733GetSystemTimeAsFileTime
KERNEL32.dll463GetCommandLineW
KERNEL32.dll1565lstrlenW
KERNEL32.dll979MulDiv
KERNEL32.dll602GetLocaleInfoW
KERNEL32.dll807GlobalFree
KERNEL32.dll945LocalAlloc
KERNEL32.dll127CloseHandle
KERNEL32.dll1107ReadFile
KERNEL32.dll194CreateFileW
KERNEL32.dll532GetCurrentThreadId
KERNEL32.dll1277SetErrorMode
KERNEL32.dll1556lstrcmpiW
KERNEL32.dll949LocalFree
KERNEL32.dll1072QueryPerformanceCounter
KERNEL32.dll621GetModuleHandleW
KERNEL32.dll1390TerminateProcess
KERNEL32.dll1375Sleep
KERNEL32.dll709GetStartupInfoW
KERNEL32.dll1424UnhandledExceptionFilter
KERNEL32.dll1360SetUnhandledExceptionFilter
KERNEL32.dll527GetCurrentProcess
GDI32.dll51CreateDCW
GDI32.dll783StartPage
GDI32.dll781StartDocW
GDI32.dll726SetAbortProc
GDI32.dll267DeleteDC
GDI32.dll279EndDoc
GDI32.dllAbortDoc
GDI32.dll282EndPage
GDI32.dll593GetTextMetricsW
GDI32.dll732SetBkMode
GDI32.dll607LPtoDP
GDI32.dll777SetWindowExtEx
GDI32.dll773SetViewportExtEx
GDI32.dll753SetMapMode
GDI32.dll585GetTextExtentPoint32W
GDI32.dll790TextOutW
GDI32.dll336EnumFontsW
GDI32.dll591GetTextFaceW
GDI32.dll724SelectObject
GDI32.dll270DeleteObject
GDI32.dll65CreateFontIndirectW
GDI32.dll502GetDeviceCaps
USER32.dll889WinHelpW
USER32.dll309GetCursorPos
USER32.dll689ScreenToClient
USER32.dll69ChildWindowFromPoint
USER32.dll380GetParent
USER32.dll462GetWindowPlacement
USER32.dll60CharUpperW
USER32.dll427GetSystemMenu
USER32.dll543LoadAcceleratorsW
USER32.dll789SetWindowLongW
USER32.dll679RegisterWindowMessageW
USER32.dll549LoadCursorW
USER32.dll113CreateWindowExW
USER32.dll790SetWindowPlacement
USER32.dll553LoadImageW
USER32.dll653RegisterClassExW
USER32.dll764SetScrollPos
USER32.dll499InvalidateRect
USER32.dll863UpdateWindow
USER32.dll469GetWindowTextLengthW
USER32.dll457GetWindowLongW
USER32.dll624PeekMessageW
USER32.dll470GetWindowTextW
USER32.dll228EnableWindow
USER32.dll102CreateDialogParamW
USER32.dll213DrawTextExW
USER32.dll317GetDlgCtrlID
USER32.dll695SendDlgItemMessageW
USER32.dll231EndDialog
USER32.dll321GetDlgItemTextW
USER32.dll728SetDlgItemTextW
USER32.dll75CloseClipboard
USER32.dll511IsClipboardFormatAvailable
USER32.dll610OpenClipboard
USER32.dll366GetMenuState
USER32.dll796SetWindowTextW
USER32.dll841UnhookWinEvent
USER32.dll181DispatchMessageW
USER32.dll839TranslateMessage
USER32.dll837TranslateAcceleratorW
USER32.dll514IsDialogMessageW
USER32.dll373GetMessageW
USER32.dll779SetWinEventHook
USER32.dll49CharNextW
USER32.dll342GetKeyboardLayout
USER32.dll325GetForegroundWindow
USER32.dll585MessageBeep
USER32.dll173DestroyWindow
USER32.dll629PostQuitMessage
USER32.dll518IsIconic
USER32.dll564LoadStringW
USER32.dll707SetActiveWindow
USER32.dll719SetCursor
USER32.dll681ReleaseDC
USER32.dll310GetDC
USER32.dll808ShowWindow
USER32.dll295GetClientRect
USER32.dll63CheckMenuItem
USER32.dll593MessageBoxW
USER32.dll324GetFocus
USER32.dll551LoadIconW
USER32.dll178DialogBoxParamW
USER32.dll730SetFocus
USER32.dll424GetSubMenu
USER32.dll224EnableMenuItem
USER32.dll355GetMenu
USER32.dll628PostMessageW
USER32.dll599MoveWindow
USER32.dll704SendMessageW
USER32.dll161DefWindowProcW
msvcrt.dll1034_wtol
msvcrt.dll1171memcpy
msvcrt.dll1175memset
msvcrt.dll874_vsnwprintf
msvcrt.dll1218strchr
msvcrt.dll211_commode
msvcrt.dll1139iswctype
msvcrt.dll86_XcptFilter
msvcrt.dll175_amsg_exit
msvcrt.dll128__getmainargs
msvcrt.dll143__set_app_type
msvcrt.dll48void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll1283wcscmp
msvcrt.dll296_fmode
msvcrt.dll163_acmdln
msvcrt.dll88__C_specific_handler
msvcrt.dll382_initterm
msvcrt.dll145__setusermatherr
msvcrt.dll410_ismbblead
msvcrt.dll194_cexit
msvcrt.dll271_exit
msvcrt.dll1075exit
COMDLG32.dll12GetOpenFileNameW
COMDLG32.dll14GetSaveFileNameW
COMDLG32.dll23ReplaceTextW
COMDLG32.dll8FindTextW
COMDLG32.dll17PageSetupDlgW
COMDLG32.dll3ChooseFontW
COMDLG32.dll10GetFileTitleW
COMDLG32.dll20PrintDlgExW
COMDLG32.dll4CommDlgExtendedError
SHELL32.dll154SHCreateItemFromParsingName
SHELL32.dll303ShellAboutW
SHELL32.dll36DragQueryFileW
SHELL32.dll120SHAddToRecentDocs
SHELL32.dll31DragAcceptFiles
SHELL32.dll32DragFinish
WINSPOOL.DRV150OpenPrinterW
WINSPOOL.DRV29ClosePrinter
WINSPOOL.DRV140GetPrinterDriverW
ole32.dll131CoUninitialize
ole32.dll84CoInitializeEx
ole32.dll30CoCreateInstance
ole32.dll126CoTaskMemAlloc
ole32.dll127CoTaskMemFree
SHLWAPI.dll264SHStrDupW
SHLWAPI.dll97PathIsFileSpecW
COMCTL32.dll12CreateStatusWindowW
COMCTL32.dll345
OLEAUT32.dll6
OLEAUT32.dll2
ntdll.dll1385RtlVirtualUnwind
ntdll.dll1117RtlLookupFunctionEntry
ntdll.dll699RtlCaptureContext
ntdll.dll1527WinSqmAddToStream

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionNotepad
FileVersion6.3.9600.16384 (winblue_rtm.130821-1623)
InternalNameNotepad
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameNOTEPAD.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.3.9600.16384

VS_FIXEDFILEINFO

FileVersion6.3.9600.16384
ProductVersion6.3.9600.16384
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
1ec3872024PNG(256 x 256)#
3059019568BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER