notepad.exe - Notepad

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	notepad.exe
size	243200 (0x3b600)
md5	3b508cae5debcba928b5bc355517e2e6

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
147	30729	30
259	23917	3
260	23917	19
261	23917	4
257	23917	29
1	0	277
264	23917	26
255	23917	1
258	23917	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x5789986a
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.0
SizeOfCode	0x18600
SizeOfInitializedData	0x24e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x187d0
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	10.0
ImageVersion	10.0
SubsystemVersion	10.0
Reserved1	0
SizeOfImage	0x41000
SizeOfHeaders	0x400
CheckSum	0x47c64
Subsystem	2
DllCharacteristics	0xc160
SizeOfStackReserve	0x80000
SizeOfStackCommit	0x11000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x184ae	0x18600	R-X CODE
.rdata	0x1a000	0x73a8	0x7400	R-- IDATA
.data	0x22000	0x2cf4	0xc00	RW- IDATA
.pdata	0x25000	0x8c4	0xa00	R-- IDATA
.rsrc	0x26000	0x19ce8	0x19e00	R-- IDATA
.reloc	0x40000	0x20c	0x400	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x1f300	0x258
RESOURCE	0x26000	0x19ce8
EXCEPTION	0x25000	0x8c4
SECURITY	0	0
BASERELOC	0x40000	0x20c
DEBUG	0x1e1d0	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x1a550	0xd0
Bound_IAT	0	0
IAT	0x1a620	0x978
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
EDPENLIGHTENEDAPPINFOID	MICROSOFTEDPENLIGHTENEDAPPINFO	2
EDPPERMISSIVEAPPINFOID	MICROSOFTEDPPERMISSIVEAPPINFO	2
MUI	#1	328
ICON	#1	1640
ICON	#2	744
ICON	#3	488
ICON	#4	296
ICON	#5	3752
ICON	#6	2216
ICON	#7	1736
ICON	#8	1384
ICON	#9	72024
ICON	#10	9640
ICON	#11	4264
ICON	#12	2440
ICON	#13	1128
GROUP_ICON	#2	188
VERSION	#1	892
MANIFEST	#1	1185

module_name	hint	ord	function_name
ADVAPI32.dll	532		OpenProcessToken
ADVAPI32.dll	367		GetTokenInformation
ADVAPI32.dll	238		DuplicateEncryptionInfoFile
ADVAPI32.dll	678		RegSetValueExW
ADVAPI32.dll	662		RegQueryValueExW
ADVAPI32.dll	612		RegCreateKeyW
ADVAPI32.dll	600		RegCloseKey
ADVAPI32.dll	649		RegOpenKeyExW
ADVAPI32.dll	289		EventSetInformation
ADVAPI32.dll	288		EventRegister
ADVAPI32.dll	290		EventUnregister
ADVAPI32.dll	296		EventWriteTransfer
ADVAPI32.dll	407		IsTextUnicode
KERNEL32.dll	995		MultiByteToWideChar
KERNEL32.dll	967		LocalReAlloc
KERNEL32.dll	1452		UnmapViewOfFile
KERNEL32.dll	969		LocalSize
KERNEL32.dll	719		GetStartupInfoW
KERNEL32.dll	1581		lstrcmpW
KERNEL32.dll	812		GlobalAlloc
KERNEL32.dll	823		GlobalLock
KERNEL32.dll	830		GlobalUnlock
KERNEL32.dll	197		CreateFileMappingW
KERNEL32.dll	583		GetFileInformationByHandle
KERNEL32.dll	578		GetFileAttributesExW
KERNEL32.dll	601		GetFullPathNameW
KERNEL32.dll	385		FindFirstFileW
KERNEL32.dll	1293		SetEndOfFile
KERNEL32.dll	274		DeleteFileW
KERNEL32.dll	435		GetACP
KERNEL32.dll	607		GetLastError
KERNEL32.dll	581		GetFileAttributesW
KERNEL32.dll	1547		WriteFile
KERNEL32.dll	1326		SetLastError
KERNEL32.dll	1527		WideCharToMultiByte
KERNEL32.dll	778		GetTimeFormatW
KERNEL32.dll	547		GetDateFormatW
KERNEL32.dll	608		GetLocalTime
KERNEL32.dll	788		GetUserDefaultUILanguage
KERNEL32.dll	421		FoldStringW
KERNEL32.dll	970		LocalUnlock
KERNEL32.dll	966		LocalLock
KERNEL32.dll	424		FormatMessageW
KERNEL32.dll	374		FindClose
KERNEL32.dll	392		FindNLSString
KERNEL32.dll	537		GetCurrentProcessId
KERNEL32.dll	844		HeapSetInformation
KERNEL32.dll	472		GetCommandLineW
KERNEL32.dll	964		LocalFree
KERNEL32.dll	1584		lstrcmpiW
KERNEL32.dll	536		GetCurrentProcess
KERNEL32.dll	994		MulDiv
KERNEL32.dll	611		GetLocaleInfoW
KERNEL32.dll	819		GlobalFree
KERNEL32.dll	960		LocalAlloc
KERNEL32.dll	132		CloseHandle
KERNEL32.dll	1127		ReadFile
KERNEL32.dll	200		CreateFileW
KERNEL32.dll	1298		SetErrorMode
KERNEL32.dll	978		MapViewOfFile
GDI32.dll	705		GetTextFaceW
GDI32.dll	61		CreateDCW
GDI32.dll	1507		StartPage
GDI32.dll	1504		StartDocW
GDI32.dll	1438		SetAbortProc
GDI32.dll	342		DeleteDC
GDI32.dll	360		EndDoc
GDI32.dll			AbortDoc
GDI32.dll	364		EndPage
GDI32.dll	708		GetTextMetricsW
GDI32.dll	1445		SetBkMode
GDI32.dll	727		LPtoDP
GDI32.dll	1499		SetWindowExtEx
GDI32.dll	1495		SetViewportExtEx
GDI32.dll	1468		SetMapMode
GDI32.dll	698		GetTextExtentPoint32W
GDI32.dll	1518		TextOutW
GDI32.dll	421		EnumFontsW
GDI32.dll	1435		SelectObject
GDI32.dll	346		DeleteObject
GDI32.dll	77		CreateFontIndirectW
GDI32.dll	605		GetDeviceCaps
USER32.dll	885		TranslateAcceleratorW
USER32.dll	887		TranslateMessage
USER32.dll	184		DispatchMessageW
USER32.dll	889		UnhookWinEvent
USER32.dll	843		SetWindowTextW
USER32.dll	373		GetMenuState
USER32.dll	631		OpenClipboard
USER32.dll	530		IsClipboardFormatAvailable
USER32.dll	77		CloseClipboard
USER32.dll	772		SetDlgItemTextW
USER32.dll	326		GetDlgItemTextW
USER32.dll	235		EndDialog
USER32.dll	739		SendDlgItemMessageW
USER32.dll	938		WinHelpW
USER32.dll	314		GetCursorPos
USER32.dll	733		ScreenToClient
USER32.dll	71		ChildWindowFromPoint
USER32.dll	387		GetParent
USER32.dll	810		SetScrollPos
USER32.dll	533		IsDialogMessageW
USER32.dll	912		UpdateWindow
USER32.dll	473		GetWindowPlacement
USER32.dll	837		SetWindowPlacement
USER32.dll	62		CharUpperW
USER32.dll	435		GetSystemMenu
USER32.dll	564		LoadAcceleratorsW
USER32.dll	836		SetWindowLongW
USER32.dll	721		RegisterWindowMessageW
USER32.dll	570		LoadCursorW
USER32.dll	115		CreateWindowExW
USER32.dll	574		LoadImageW
USER32.dll	692		RegisterClassExW
USER32.dll	480		GetWindowTextLengthW
USER32.dll	468		GetWindowLongW
USER32.dll	645		PeekMessageW
USER32.dll	481		GetWindowTextW
USER32.dll	232		EnableWindow
USER32.dll	104		CreateDialogParamW
USER32.dll	216		DrawTextExW
USER32.dll	380		GetMessageW
USER32.dll	826		SetWinEventHook
USER32.dll	51		CharNextW
USER32.dll	349		GetKeyboardLayout
USER32.dll	838		SetWindowPos
USER32.dll	688		RedrawWindow
USER32.dll	322		GetDlgCtrlID
USER32.dll	332		GetForegroundWindow
USER32.dll	606		MessageBeep
USER32.dll	176		DestroyWindow
USER32.dll	650		PostQuitMessage
USER32.dll	164		DefWindowProcW
USER32.dll	537		IsIconic
USER32.dll	585		LoadStringW
USER32.dll	518		InvalidateRect
USER32.dll	751		SetActiveWindow
USER32.dll	763		SetCursor
USER32.dll	723		ReleaseDC
USER32.dll	315		GetDC
USER32.dll	65		CheckMenuItem
USER32.dll	614		MessageBoxW
USER32.dll	331		GetFocus
USER32.dll	572		LoadIconW
USER32.dll	181		DialogBoxParamW
USER32.dll	775		SetFocus
USER32.dll	432		GetSubMenu
USER32.dll	227		EnableMenuItem
USER32.dll	362		GetMenu
USER32.dll	649		PostMessageW
USER32.dll	820		SetThreadDpiAwarenessContext
USER32.dll	620		MoveWindow
USER32.dll	300		GetClientRect
USER32.dll	748		SendMessageW
USER32.dll		2577
USER32.dll		2704
USER32.dll		2702
USER32.dll		2707
USER32.dll	855		ShowWindow
msvcrt.dll	486		_lock
msvcrt.dll	47		void __cdecl terminate(void) ?terminate@@YAXXZ
msvcrt.dll	210		_commode
msvcrt.dll	295		_fmode
msvcrt.dll	162		_acmdln
msvcrt.dll	1174		memset
msvcrt.dll	1170		memcpy
msvcrt.dll	87		__C_specific_handler
msvcrt.dll	381		_initterm
msvcrt.dll	144		__setusermatherr
msvcrt.dll	409		_ismbblead
msvcrt.dll	193		_cexit
msvcrt.dll	270		_exit
msvcrt.dll	1074		exit
msvcrt.dll	142		__set_app_type
msvcrt.dll	127		__getmainargs
msvcrt.dll	174		_amsg_exit
msvcrt.dll	85		_XcptFilter
msvcrt.dll	1138		iswctype
msvcrt.dll	1294		wcsnlen
msvcrt.dll	906		_wcsicmp
msvcrt.dll	1033		_wtol
msvcrt.dll	873		_vsnwprintf
msvcrt.dll	833		_unlock
msvcrt.dll	123		__dllonexit
msvcrt.dll	656		_onexit
msvcrt.dll	191		_callnewh
msvcrt.dll	1158		malloc
msvcrt.dll	1217		strchr
msvcrt.dll	1171		memcpy_s
msvcrt.dll	670		_purecall
msvcrt.dll	1100		free
msvcrt.dll	91		__CxxFrameHandler3
msvcrt.dll	1282		wcscmp
api-ms-win-core-com-l1-1-1.dll	62		CoTaskMemAlloc
api-ms-win-core-com-l1-1-1.dll	63		CoTaskMemFree
api-ms-win-core-com-l1-1-1.dll	8		CoCreateInstance
api-ms-win-core-com-l1-1-1.dll	76		PropVariantClear
api-ms-win-core-com-l1-1-1.dll	7		CoCreateGuid
api-ms-win-core-com-l1-1-1.dll	66		CoUninitialize
api-ms-win-core-com-l1-1-1.dll	6		CoCreateFreeThreadedMarshaler
api-ms-win-core-com-l1-1-1.dll	69		CoWaitForMultipleHandles
api-ms-win-core-com-l1-1-1.dll	38		CoInitializeEx
OLEAUT32.dll		6
OLEAUT32.dll		2
api-ms-win-core-synch-l1-2-0.dll	38		ReleaseSemaphore
api-ms-win-core-synch-l1-2-0.dll	35		ReleaseMutex
api-ms-win-core-synch-l1-2-0.dll	9		CreateMutexExW
api-ms-win-core-synch-l1-2-0.dll	41		SetEvent
api-ms-win-core-synch-l1-2-0.dll	54		WaitForSingleObject
api-ms-win-core-synch-l1-2-0.dll	45		Sleep
api-ms-win-core-synch-l1-2-0.dll	55		WaitForSingleObjectEx
api-ms-win-core-synch-l1-2-0.dll	11		CreateSemaphoreExW
api-ms-win-core-synch-l1-2-0.dll	33		OpenSemaphoreW
api-ms-win-core-synch-l1-2-0.dll	5		CreateEventExW
api-ms-win-core-rtlsupport-l1-2-0.dll	9		RtlLookupFunctionEntry
api-ms-win-core-rtlsupport-l1-2-0.dll	2		RtlCaptureContext
api-ms-win-core-rtlsupport-l1-2-0.dll	15		RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-1.dll	17		UnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-1.dll	15		SetUnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-1.dll	7		RaiseException
api-ms-win-core-processthreads-l1-1-2.dll	77		TerminateProcess
api-ms-win-core-processthreads-l1-1-2.dll	17		GetCurrentThreadId
api-ms-win-core-libraryloader-l1-2-0.dll	12		FreeLibrary
api-ms-win-core-libraryloader-l1-2-0.dll	21		GetProcAddress
api-ms-win-core-libraryloader-l1-2-0.dll	20		GetModuleHandleW
api-ms-win-core-libraryloader-l1-2-0.dll	19		GetModuleHandleExW
api-ms-win-core-libraryloader-l1-2-0.dll	16		GetModuleFileNameW
api-ms-win-core-libraryloader-l1-2-0.dll	24		LoadLibraryExW
api-ms-win-core-libraryloader-l1-2-0.dll	15		GetModuleFileNameA
api-ms-win-core-profile-l1-1-0.dll			QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-2-1.dll	20		GetSystemTimeAsFileTime
api-ms-win-core-sysinfo-l1-2-1.dll	24		GetTickCount
api-ms-win-core-heap-l1-2-0.dll	6		HeapFree
api-ms-win-core-heap-l1-2-0.dll			GetProcessHeap
api-ms-win-core-heap-l1-2-0.dll	2		HeapAlloc
api-ms-win-core-winrt-string-l1-1-0.dll	11		WindowsCreateStringReference
api-ms-win-core-winrt-string-l1-1-0.dll	16		WindowsGetStringRawBuffer
api-ms-win-core-winrt-string-l1-1-0.dll	10		WindowsCreateString
api-ms-win-core-winrt-string-l1-1-0.dll	12		WindowsDeleteString
api-ms-win-core-winrt-error-l1-1-1.dll	18		SetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1.dll	6		RoGetMatchingRestrictedErrorInfo
api-ms-win-core-string-l1-1-0.dll	1		CompareStringOrdinal
api-ms-win-core-winrt-l1-1-0.dll	1		RoGetActivationFactory
api-ms-win-core-debug-l1-1-1.dll	7		OutputDebugStringW
COMCTL32.dll		345
COMCTL32.dll	12		CreateStatusWindowW
COMDLG32.dll	17		PageSetupDlgW
COMDLG32.dll	3		ChooseFontW
COMDLG32.dll	10		GetFileTitleW
COMDLG32.dll	8		FindTextW
COMDLG32.dll	23		ReplaceTextW
COMDLG32.dll	14		GetSaveFileNameW
COMDLG32.dll	12		GetOpenFileNameW
COMDLG32.dll	4		CommDlgExtendedError
COMDLG32.dll	20		PrintDlgExW
FeClient.dll	23		EfsClientDecryptFile
ntdll.dll	1615		WinSqmAddToStream
PROPSYS.dll	62		PSGetPropertyDescriptionListFromString
PROPSYS.dll	150		PropVariantToStringVectorAlloc
SHELL32.dll	159		SHCreateItemFromParsingName
SHELL32.dll	40		DragQueryFileW
SHELL32.dll	124		SHAddToRecentDocs
SHELL32.dll	36		DragFinish
SHELL32.dll	35		DragAcceptFiles
SHELL32.dll	433		ShellAboutW
SHLWAPI.dll	97		PathIsFileSpecW
SHLWAPI.dll	73		PathFileExistsW
SHLWAPI.dll	101		PathIsNetworkPathW
SHLWAPI.dll	75		PathFindExtensionW
SHLWAPI.dll	264		SHStrDupW
WINSPOOL.DRV	140		GetPrinterDriverW
WINSPOOL.DRV	29		ClosePrinter
WINSPOOL.DRV	150		OpenPrinterW
urlmon.dll	59		FindMimeFromData

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Notepad
FileVersion	10.0.14393.0 (rs1_release.160715-1616)
InternalName	Notepad
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	NOTEPAD.EXE
ProductName	Microsoft® Windows® Operating System
ProductVersion	10.0.14393.0

VS_FIXEDFILEINFO

FileVersion	10.0.14393.0
ProductVersion	10.0.14393.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
24dc8	72024	PNG	(256 x 256)	#
36720	20192	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

notepad.exe-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

notepad.exe
-