filenamenotepad.exe
size352256 (0x56000)
md53acd46e57d62c79da122ad9d4456915e
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
1473072944
2602939510
259293954
2612939531
257293959
101364
2642939527
253293951
255293951
258293951

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections7
TimeDateStamp0xd51c38ae
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.28
SizeOfCode0x27000
SizeOfInitializedData0x30000
SizeOfUninitializedData0
AddressOfEntryPoint0x1b60
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion10.0
ImageVersion10.0
SubsystemVersion10.0
Reserved10
SizeOfImage0x58000
SizeOfHeaders0x1000
CheckSum0x573b3
Subsystem2
DllCharacteristics0xc160
SizeOfStackReserve0x80000
SizeOfStackCommit0x11000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x263320x27000R-X CODE
.rdata0x280000x989a0xa000R-- IDATA
.data0x320000x26a00x1000RW- IDATA
.pdata0x350000x13f80x2000R-- IDATA
.didat0x370000x1880x1000RW- IDATA
.rsrc0x380000x1e1d00x1f000R-- IDATA
.reloc0x570000x31c0x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x2f5800x208
RESOURCE0x380000x1e1d0
EXCEPTION0x350000x13f8
SECURITY00
BASERELOC0x570000x31c
DEBUG0x2d1700x54
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x287900x138
Bound_IAT00
IAT0x288c80x990
Delay_IAT0x2ee500xe0
CLR_Header00
typenamesizecp
EDPENLIGHTENEDAPPINFOIDMICROSOFTEDPENLIGHTENEDAPPINFO20
EDPPERMISSIVEAPPINFOIDMICROSOFTEDPPERMISSIVEAPPINFO20
MUI#13200
ICON#116400
ICON#27440
ICON#34880
ICON#42960
ICON#537520
ICON#622160
ICON#717360
ICON#813840
ICON#9720240
ICON#1096400
ICON#1142640
ICON#1224400
ICON#1311280
ICON#1426320
ICON#1518000
ICON#1611920
ICON#1726320
ICON#1818000
ICON#1911920
ICON#2026320
ICON#2118000
ICON#2211920
GROUP_ICON#21880
GROUP_ICON#300480
GROUP_ICON#301480
GROUP_ICON#302480
VERSION#18840
MANIFEST#112520
module_namehintordfunction_name
KERNEL32.dll1340SetEvent
KERNEL32.dll850GlobalFree
KERNEL32.dll632GetLocaleInfoW
KERNEL32.dll211CreateFileW
KERNEL32.dll1164ReadFile
KERNEL32.dll452GetACP
KERNEL32.dll554GetCurrentProcess
KERNEL32.dll489GetCommandLineW
KERNEL32.dll875HeapSetInformation
KERNEL32.dll1000LocalFree
KERNEL32.dll995LocalAlloc
KERNEL32.dll402FindFirstFileW
KERNEL32.dll391FindClose
KERNEL32.dll438FoldStringW
KERNEL32.dll956K32GetModuleFileNameExW
KERNEL32.dll648GetModuleFileNameW
KERNEL32.dll819GetUserDefaultUILanguage
KERNEL32.dll629GetLocalTime
KERNEL32.dll565GetDateFormatW
KERNEL32.dll808GetTimeFormatW
KERNEL32.dll1577WideCharToMultiByte
KERNEL32.dll1597WriteFile
KERNEL32.dll601GetFileAttributesW
KERNEL32.dll1002LocalLock
KERNEL32.dll198CreateEventExW
KERNEL32.dll288DeleteFileW
KERNEL32.dll1334SetEndOfFile
KERNEL32.dll598GetFileAttributesExW
KERNEL32.dll603GetFileInformationByHandle
KERNEL32.dll208CreateFileMappingW
KERNEL32.dll1015MapViewOfFile
KERNEL32.dll1032MultiByteToWideChar
KERNEL32.dll1003LocalReAlloc
KERNEL32.dll1499UnmapViewOfFile
KERNEL32.dll621GetFullPathNameW
KERNEL32.dll1005LocalSize
KERNEL32.dll744GetStartupInfoW
KERNEL32.dll1634lstrcmpiW
KERNEL32.dll409FindNLSString
KERNEL32.dll854GlobalLock
KERNEL32.dll861GlobalUnlock
KERNEL32.dll843GlobalAlloc
KERNEL32.dll1327SetCurrentDirectoryW
KERNEL32.dll572GetDiskFreeSpaceExW
KERNEL32.dll194CreateDirectoryW
KERNEL32.dll1212RegisterApplicationRestart
KERNEL32.dll547GetCurrentDirectoryW
KERNEL32.dll238CreateProcessW
KERNEL32.dll1538WaitForSingleObject
KERNEL32.dll1147RaiseException
KERNEL32.dll1031MulDiv
KERNEL32.dll919IsDebuggerPresent
KERNEL32.dll273DebugBreak
KERNEL32.dll652GetModuleHandleW
KERNEL32.dll715GetProcessHeap
KERNEL32.dll555GetCurrentProcessId
KERNEL32.dll283DeleteCriticalSection
KERNEL32.dll1AcquireSRWLockShared
KERNEL32.dll225CreateMutexExW
KERNEL32.dll708GetProcAddress
KERNEL32.dll867HeapAlloc
KERNEL32.dll255CreateThreadpoolTimer
KERNEL32.dll1229ReleaseSRWLockShared
KERNEL32.dll1424SetThreadpoolTimer
KERNEL32.dll142CloseHandle
KERNEL32.dll1064OpenSemaphoreW
KERNEL32.dll1539WaitForSingleObjectEx
KERNEL32.dllAcquireSRWLockExclusive
KERNEL32.dll152CloseThreadpoolTimer
KERNEL32.dll1072OutputDebugStringW
KERNEL32.dll1228ReleaseSRWLockExclusive
KERNEL32.dll628GetLastError
KERNEL32.dll441FormatMessageW
KERNEL32.dll559GetCurrentThreadId
KERNEL32.dll1225ReleaseMutex
KERNEL32.dll1541WaitForThreadpoolTimerCallbacks
KERNEL32.dll894InitializeCriticalSectionEx
KERNEL32.dll982LeaveCriticalSection
KERNEL32.dll651GetModuleHandleExW
KERNEL32.dll1230ReleaseSemaphore
KERNEL32.dll321EnterCriticalSection
KERNEL32.dll1367SetLastError
KERNEL32.dll871HeapFree
KERNEL32.dll647GetModuleFileNameA
KERNEL32.dll244CreateSemaphoreExW
KERNEL32.dll1007LocalUnlock
KERNEL32.dll1251ResolveDelayLoadedAPI
KERNEL32.dll280DelayLoadFailureHook
GDI32.dll52CreateDCW
GDI32.dll934StartPage
GDI32.dll932StartDocW
GDI32.dll877SetAbortProc
GDI32.dll402EndDoc
GDI32.dllAbortDoc
GDI32.dll405EndPage
GDI32.dll734GetTextMetricsW
GDI32.dll883SetBkMode
GDI32.dll750LPtoDP
GDI32.dll928SetWindowExtEx
GDI32.dll924SetViewportExtEx
GDI32.dll904SetMapMode
GDI32.dll941TextOutW
GDI32.dll459EnumFontsW
GDI32.dll732GetTextFaceW
GDI32.dll642GetDeviceCaps
GDI32.dll389DeleteDC
GDI32.dll392DeleteObject
GDI32.dll882SetBkColor
GDI32.dll90CreateSolidBrush
GDI32.dll726GetTextExtentPoint32W
GDI32.dll875SelectObject
GDI32.dll49CreateCompatibleDC
GDI32.dll67CreateFontIndirectW
USER32.dll272FillRect
USER32.dll222DrawTextW
USER32.dll210DrawFocusRect
USER32.dll167DefWindowProcW
USER32.dll939TrackMouseEvent
USER32.dll547InvalidateRect
USER32.dll177DestroyIcon
USER32.dll875SetThreadDpiAwarenessContext
USER32.dll186DialogBoxParamW
USER32.dll602LoadIconW
USER32.dll344GetFocus
USER32.dll650MessageBoxW
USER32.dll914ShowWindow
USER32.dll808SetCursor
USER32.dll795SetActiveWindow
USER32.dll233EnableMenuItem
USER32.dll566IsIconic
USER32.dll823SetFocus
USER32.dll642MessageBeep
USER32.dll345GetForegroundWindow
USER32.dll332GetDlgCtrlID
USER32.dll894SetWindowPos
USER32.dll730RedrawWindow
USER32.dll362GetKeyboardLayout
USER32.dll52CharNextW
USER32.dll882SetWinEventHook
USER32.dll394GetMessageW
USER32.dll944TranslateAcceleratorW
USER32.dll562IsDialogMessageW
USER32.dll946TranslateMessage
USER32.dll189DispatchMessageW
USER32.dll949UnhookWinEvent
USER32.dll899SetWindowTextW
USER32.dll376GetMenu
USER32.dll451GetSubMenu
USER32.dll667OpenClipboard
USER32.dll559IsClipboardFormatAvailable
USER32.dll79CloseClipboard
USER32.dll67CheckMenuItem
USER32.dll820SetDlgItemTextW
USER32.dll336GetDlgItemTextW
USER32.dll242EndDialog
USER32.dll783SendDlgItemMessageW
USER32.dll863SetScrollPos
USER32.dll972UpdateWindow
USER32.dll495GetWindowPlacement
USER32.dll893SetWindowPlacement
USER32.dll63CharUpperW
USER32.dll455GetSystemMenu
USER32.dll594LoadAcceleratorsW
USER32.dll892SetWindowLongW
USER32.dll655MonitorFromWindow
USER32.dll762RegisterWindowMessageW
USER32.dll600LoadCursorW
USER32.dll604LoadImageW
USER32.dll503GetWindowTextLengthW
USER32.dll490GetWindowLongW
USER32.dll681PeekMessageW
USER32.dll504GetWindowTextW
USER32.dll239EnableWindow
USER32.dll106CreateDialogParamW
USER32.dll221DrawTextExW
USER32.dll307GetClientRect
USER32.dll181DestroyWindow
USER32.dll341GetDpiForWindow
USER32.dll17BeginPaint
USER32.dll686PostQuitMessage
USER32.dll118CreateWindowExW
USER32.dll734RegisterClassExW
USER32.dll615LoadStringW
USER32.dll929SystemParametersInfoForDpi
USER32.dll792SendMessageW
USER32.dll656MoveWindow
USER32.dll322GetDC
USER32.dll764ReleaseDC
USER32.dll244EndPaint
USER32.dll685PostMessageW
api-ms-win-crt-string-l1-1-0.dll131memset
api-ms-win-crt-string-l1-1-0.dll158wcscmp
api-ms-win-crt-string-l1-1-0.dll169wcsnlen
api-ms-win-crt-runtime-l1-1-0.dll54_initterm
api-ms-win-crt-runtime-l1-1-0.dll55_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll21_c_exit
api-ms-win-crt-runtime-l1-1-0.dll61_register_thread_local_exe_atexit_callback
api-ms-win-crt-private-l1-1-0.dll143_o__beginthreadex
api-ms-win-crt-private-l1-1-0.dll145_o__callnewh
api-ms-win-crt-private-l1-1-0.dll147_o__cexit
api-ms-win-crt-private-l1-1-0.dll159_o__configthreadlocale
api-ms-win-crt-private-l1-1-0.dll161_o__configure_wide_argv
api-ms-win-crt-private-l1-1-0.dll167_o__crt_atexit
api-ms-win-crt-private-l1-1-0.dll192_o__errno
api-ms-win-crt-private-l1-1-0.dll199_o__exit
api-ms-win-crt-private-l1-1-0.dll281_o__get_wide_winmain_command_line
api-ms-win-crt-private-l1-1-0.dll317_o__initialize_onexit_table
api-ms-win-crt-private-l1-1-0.dll318_o__initialize_wide_environment
api-ms-win-crt-private-l1-1-0.dll319_o__invalid_parameter_noinfo
api-ms-win-crt-private-l1-1-0.dll579_o__purecall
api-ms-win-crt-private-l1-1-0.dll593_o__register_onexit_function
api-ms-win-crt-private-l1-1-0.dll602_o__seh_filter_exe
api-ms-win-crt-private-l1-1-0.dll604_o__set_app_type
api-ms-win-crt-private-l1-1-0.dll607_o__set_fmode
api-ms-win-crt-private-l1-1-0.dll610_o__set_new_mode
api-ms-win-crt-private-l1-1-0.dll717_o__wcsicmp
api-ms-win-crt-private-l1-1-0.dll823_o__wtol
api-ms-win-crt-private-l1-1-0.dll877_o_exit
api-ms-win-crt-private-l1-1-0.dll909_o_free
api-ms-win-crt-private-l1-1-0.dll945_o_iswdigit
api-ms-win-crt-private-l1-1-0.dll984_o_malloc
api-ms-win-crt-private-l1-1-0.dll1078_o_terminate
api-ms-win-crt-private-l1-1-0.dll18__CxxFrameHandler3
api-ms-win-crt-private-l1-1-0.dll32__current_exception
api-ms-win-crt-private-l1-1-0.dll33__current_exception_context
api-ms-win-crt-private-l1-1-0.dll1_CxxThrowException
api-ms-win-crt-private-l1-1-0.dll112_o___stdio_common_vswprintf
api-ms-win-crt-private-l1-1-0.dll1131wcschr
api-ms-win-crt-private-l1-1-0.dll12__C_specific_handler
api-ms-win-crt-private-l1-1-0.dll95_o___std_exception_destroy
api-ms-win-crt-private-l1-1-0.dll94_o___std_exception_copy
api-ms-win-crt-private-l1-1-0.dll83_o___p__commode
api-ms-win-crt-private-l1-1-0.dll1122memcmp
api-ms-win-crt-private-l1-1-0.dll1123memcpy
api-ms-win-crt-private-l1-1-0.dll1124memmove
api-ms-win-core-com-l1-1-0.dll66CoTaskMemAlloc
api-ms-win-core-com-l1-1-0.dll73CoWaitForMultipleHandles
api-ms-win-core-com-l1-1-0.dll7CoCreateFreeThreadedMarshaler
api-ms-win-core-com-l1-1-0.dll9CoCreateInstance
api-ms-win-core-com-l1-1-0.dll40CoInitializeEx
api-ms-win-core-com-l1-1-0.dll70CoUninitialize
api-ms-win-core-com-l1-1-0.dll8CoCreateGuid
api-ms-win-core-com-l1-1-0.dll67CoTaskMemFree
api-ms-win-core-com-l1-1-0.dll80PropVariantClear
api-ms-win-core-shlwapi-legacy-l1-1-0.dll34PathIsFileSpecW
api-ms-win-core-shlwapi-legacy-l1-1-0.dll22PathFindExtensionW
api-ms-win-core-shlwapi-legacy-l1-1-0.dll20PathFileExistsW
api-ms-win-core-winrt-string-l1-1-0.dll10WindowsCreateString
api-ms-win-core-winrt-string-l1-1-0.dll12WindowsDeleteString
api-ms-win-core-winrt-string-l1-1-0.dll11WindowsCreateStringReference
api-ms-win-core-winrt-string-l1-1-0.dll16WindowsGetStringRawBuffer
api-ms-win-core-winrt-l1-1-0.dll1RoGetActivationFactory
api-ms-win-shcore-obsolete-l1-1-0.dll2SHStrDupW
api-ms-win-shcore-path-l1-1-0.dll170
api-ms-win-shcore-scaling-l1-1-1.dllGetDpiForMonitor
api-ms-win-core-rtlsupport-l1-1-0.dll768RtlCaptureContext
api-ms-win-core-rtlsupport-l1-1-0.dll1281RtlLookupFunctionEntry
api-ms-win-core-rtlsupport-l1-1-0.dll1605RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-0.dll17UnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-0.dll15SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0.dll85TerminateProcess
api-ms-win-core-processthreads-l1-1-1.dll29GetProcessMitigationPolicy
api-ms-win-core-processthreads-l1-1-1.dll50IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0.dllQueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0.dll22GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0.dllInitializeSListHead
api-ms-win-core-libraryloader-l1-2-0.dll13FreeLibrary
api-ms-win-core-winrt-error-l1-1-0.dll18SetRestrictedErrorInfo
api-ms-win-core-string-l1-1-0.dll1CompareStringOrdinal
api-ms-win-core-winrt-error-l1-1-1.dll6RoGetMatchingRestrictedErrorInfo
COMCTL32.dll114ImageList_SetBkColor
COMCTL32.dll12CreateStatusWindowW
COMCTL32.dll345
COMCTL32.dll85ImageList_Destroy
COMCTL32.dll413
COMCTL32.dll100ImageList_GetIconSize
COMCTL32.dll91ImageList_Draw
COMCTL32.dll410
COMCTL32.dll112ImageList_ReplaceIcon
COMCTL32.dll381
COMCTL32.dll84ImageList_Create

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionNotepad
FileVersion10.0.22000.2360 (WinBuild.160101.0800)
InternalNameNotepad
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameNOTEPAD.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion10.0.22000.2360

VS_FIXEDFILEINFO

FileVersion10.0.22000.2360
ProductVersion10.0.22000.2360
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
39c4872024PNG(256 x 256)#
4b5a043616BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER