filenamenotepad.exe
size202240 (0x31600)
md5423d3ade2f14572c5bd5f546973eb493
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
1473072946
2602741210
259274123
257274129
101324
2642741230
2612741233
253274121
255274121
258274121

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections7
TimeDateStamp0x86fcbd69
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.20
SizeOfCode0x24a00
SizeOfInitializedData0xe200
SizeOfUninitializedData0
AddressOfEntryPoint0x23db0
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion10.0
ImageVersion10.0
SubsystemVersion10.0
Reserved10
SizeOfImage0x38000
SizeOfHeaders0x400
CheckSum0x36bb0
Subsystem2
DllCharacteristics0xc160
SizeOfStackReserve0x80000
SizeOfStackCommit0x11000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x249f20x24a00R-X CODE
.rdata0x260000x947e0x9600R-- IDATA
.data0x300000x27a80xe00RW- IDATA
.pdata0x330000x11280x1200R-- IDATA
.didat0x350000x1780x200RW- IDATA
.rsrc0x360000xbd80xc00R-- IDATA
.reloc0x370000x2d40x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x2d2880x230
RESOURCE0x360000xbd8
EXCEPTION0x330000x1128
SECURITY00
BASERELOC0x370000x2d4
DEBUG0x2ad500x54
ARCHITECTURE00
GLOBALPTR00
TLS0x267b80x28
LOAD_CONFIG0x266a00x118
Bound_IAT00
IAT0x267e00x918
Delay_IAT0x2cba00xe0
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x14002bb300x14002bb380x1400312b80x1400271b800x300000
typenamesizecp
EDPENLIGHTENEDAPPINFOIDMICROSOFTEDPENLIGHTENEDAPPINFO20
EDPPERMISSIVEAPPINFOIDMICROSOFTEDPPERMISSIVEAPPINFO20
MUI#13200
VERSION#18840
MANIFEST#111990
module_namehintordfunction_name
KERNEL32.dll696GetProcAddress
KERNEL32.dll220CreateMutexExW
KERNEL32.dll1AcquireSRWLockShared
KERNEL32.dll276DeleteCriticalSection
KERNEL32.dll545GetCurrentProcessId
KERNEL32.dll702GetProcessHeap
KERNEL32.dll641GetModuleHandleW
KERNEL32.dll266DebugBreak
KERNEL32.dll901IsDebuggerPresent
KERNEL32.dll832GlobalFree
KERNEL32.dll622GetLocaleInfoW
KERNEL32.dll206CreateFileW
KERNEL32.dll1145ReadFile
KERNEL32.dll1013MulDiv
KERNEL32.dll544GetCurrentProcess
KERNEL32.dll480GetCommandLineW
KERNEL32.dll857HeapSetInformation
KERNEL32.dll436FreeLibrary
KERNEL32.dll393FindFirstFileW
KERNEL32.dll382FindClose
KERNEL32.dll157CompareStringOrdinal
KERNEL32.dll977LocalAlloc
KERNEL32.dll982LocalFree
KERNEL32.dll429FoldStringW
KERNEL32.dll637GetModuleFileNameW
KERNEL32.dll801GetUserDefaultUILanguage
KERNEL32.dll619GetLocalTime
KERNEL32.dll555GetDateFormatW
KERNEL32.dll790GetTimeFormatW
KERNEL32.dll1553WideCharToMultiByte
KERNEL32.dll1573WriteFile
KERNEL32.dll591GetFileAttributesW
KERNEL32.dll984LocalLock
KERNEL32.dll443GetACP
KERNEL32.dll989LocalUnlock
KERNEL32.dll281DeleteFileW
KERNEL32.dll1312SetEndOfFile
KERNEL32.dll588GetFileAttributesExW
KERNEL32.dll593GetFileInformationByHandle
KERNEL32.dll203CreateFileMappingW
KERNEL32.dll997MapViewOfFile
KERNEL32.dll1014MultiByteToWideChar
KERNEL32.dll985LocalReAlloc
KERNEL32.dll1475UnmapViewOfFile
KERNEL32.dll611GetFullPathNameW
KERNEL32.dll987LocalSize
KERNEL32.dll730GetStartupInfoW
KERNEL32.dll1610lstrcmpiW
KERNEL32.dll400FindNLSString
KERNEL32.dll836GlobalLock
KERNEL32.dll843GlobalUnlock
KERNEL32.dll825GlobalAlloc
KERNEL32.dll562GetDiskFreeSpaceExW
KERNEL32.dll189CreateDirectoryW
KERNEL32.dll1193RegisterApplicationRestart
KERNEL32.dll238CreateSemaphoreExW
KERNEL32.dll249CreateThreadpoolTimer
KERNEL32.dll1209ReleaseSRWLockShared
KERNEL32.dll1400SetThreadpoolTimer
KERNEL32.dll137CloseHandle
KERNEL32.dll1046OpenSemaphoreW
KERNEL32.dll1515WaitForSingleObjectEx
KERNEL32.dllAcquireSRWLockExclusive
KERNEL32.dll147CloseThreadpoolTimer
KERNEL32.dll1054OutputDebugStringW
KERNEL32.dll1208ReleaseSRWLockExclusive
KERNEL32.dll618GetLastError
KERNEL32.dll432FormatMessageW
KERNEL32.dll1206ReleaseMutex
KERNEL32.dll549GetCurrentThreadId
KERNEL32.dll1514WaitForSingleObject
KERNEL32.dll1517WaitForThreadpoolTimerCallbacks
KERNEL32.dll876InitializeCriticalSectionEx
KERNEL32.dll964LeaveCriticalSection
KERNEL32.dll640GetModuleHandleExW
KERNEL32.dll1210ReleaseSemaphore
KERNEL32.dll312EnterCriticalSection
KERNEL32.dll1345SetLastError
KERNEL32.dll849HeapAlloc
KERNEL32.dll853HeapFree
KERNEL32.dll1231ResolveDelayLoadedAPI
KERNEL32.dll273DelayLoadFailureHook
KERNEL32.dll636GetModuleFileNameA
GDI32.dll52CreateDCW
GDI32.dll927StartPage
GDI32.dll925StartDocW
GDI32.dll870SetAbortProc
GDI32.dll384DeleteDC
GDI32.dll398EndDoc
GDI32.dllAbortDoc
GDI32.dll401EndPage
GDI32.dll727GetTextMetricsW
GDI32.dll876SetBkMode
GDI32.dll743LPtoDP
GDI32.dll921SetWindowExtEx
GDI32.dll917SetViewportExtEx
GDI32.dll897SetMapMode
GDI32.dll719GetTextExtentPoint32W
GDI32.dll934TextOutW
GDI32.dll455EnumFontsW
GDI32.dll725GetTextFaceW
GDI32.dll868SelectObject
GDI32.dll387DeleteObject
GDI32.dll67CreateFontIndirectW
GDI32.dll635GetDeviceCaps
USER32.dll343GetFocus
USER32.dll687PostMessageW
USER32.dll375GetMenu
USER32.dll67CheckMenuItem
USER32.dll450GetSubMenu
USER32.dll233EnableMenuItem
USER32.dll909ShowWindow
USER32.dll322GetDC
USER32.dll764ReleaseDC
USER32.dll808SetCursor
USER32.dll340GetDpiForWindow
USER32.dll795SetActiveWindow
USER32.dll615LoadStringW
USER32.dll167DefWindowProcW
USER32.dll565IsIconic
USER32.dll823SetFocus
USER32.dll688PostQuitMessage
USER32.dll181DestroyWindow
USER32.dll644MessageBeep
USER32.dll344GetForegroundWindow
USER32.dll331GetDlgCtrlID
USER32.dll891SetWindowPos
USER32.dll730RedrawWindow
USER32.dll361GetKeyboardLayout
USER32.dll52CharNextW
USER32.dll879SetWinEventHook
USER32.dll393GetMessageW
USER32.dll939TranslateAcceleratorW
USER32.dll561IsDialogMessageW
USER32.dll941TranslateMessage
USER32.dll189DispatchMessageW
USER32.dll944UnhookWinEvent
USER32.dll896SetWindowTextW
USER32.dll669OpenClipboard
USER32.dll558IsClipboardFormatAvailable
USER32.dll79CloseClipboard
USER32.dll820SetDlgItemTextW
USER32.dll335GetDlgItemTextW
USER32.dll242EndDialog
USER32.dll783SendDlgItemMessageW
USER32.dll861SetScrollPos
USER32.dll546InvalidateRect
USER32.dll967UpdateWindow
USER32.dll494GetWindowPlacement
USER32.dll890SetWindowPlacement
USER32.dll63CharUpperW
USER32.dll454GetSystemMenu
USER32.dll594LoadAcceleratorsW
USER32.dll889SetWindowLongW
USER32.dll118CreateWindowExW
USER32.dll657MonitorFromWindow
USER32.dll762RegisterWindowMessageW
USER32.dll600LoadCursorW
USER32.dll734RegisterClassExW
USER32.dll502GetWindowTextLengthW
USER32.dll489GetWindowLongW
USER32.dll683PeekMessageW
USER32.dll503GetWindowTextW
USER32.dll239EnableWindow
USER32.dll106CreateDialogParamW
USER32.dll221DrawTextExW
USER32.dll602LoadIconW
USER32.dll604LoadImageW
USER32.dll186DialogBoxParamW
USER32.dll872SetThreadDpiAwarenessContext
USER32.dll792SendMessageW
USER32.dll658MoveWindow
USER32.dll307GetClientRect
USER32.dll652MessageBoxW
api-ms-win-crt-string-l1-1-0.dll131memset
api-ms-win-crt-string-l1-1-0.dll169wcsnlen
api-ms-win-crt-string-l1-1-0.dll158wcscmp
api-ms-win-crt-runtime-l1-1-0.dll21_c_exit
api-ms-win-crt-runtime-l1-1-0.dll61_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll55_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll54_initterm
api-ms-win-crt-private-l1-1-0.dll145_o__callnewh
api-ms-win-crt-private-l1-1-0.dll147_o__cexit
api-ms-win-crt-private-l1-1-0.dll159_o__configthreadlocale
api-ms-win-crt-private-l1-1-0.dll161_o__configure_wide_argv
api-ms-win-crt-private-l1-1-0.dll167_o__crt_atexit
api-ms-win-crt-private-l1-1-0.dll192_o__errno
api-ms-win-crt-private-l1-1-0.dll199_o__exit
api-ms-win-crt-private-l1-1-0.dll281_o__get_wide_winmain_command_line
api-ms-win-crt-private-l1-1-0.dll317_o__initialize_onexit_table
api-ms-win-crt-private-l1-1-0.dll318_o__initialize_wide_environment
api-ms-win-crt-private-l1-1-0.dll319_o__invalid_parameter_noinfo
api-ms-win-crt-private-l1-1-0.dll579_o__purecall
api-ms-win-crt-private-l1-1-0.dll593_o__register_onexit_function
api-ms-win-crt-private-l1-1-0.dll602_o__seh_filter_exe
api-ms-win-crt-private-l1-1-0.dll604_o__set_app_type
api-ms-win-crt-private-l1-1-0.dll607_o__set_fmode
api-ms-win-crt-private-l1-1-0.dll610_o__set_new_mode
api-ms-win-crt-private-l1-1-0.dll717_o__wcsicmp
api-ms-win-crt-private-l1-1-0.dll823_o__wtol
api-ms-win-crt-private-l1-1-0.dll877_o_exit
api-ms-win-crt-private-l1-1-0.dll908_o_free
api-ms-win-crt-private-l1-1-0.dll944_o_iswdigit
api-ms-win-crt-private-l1-1-0.dll983_o_malloc
api-ms-win-crt-private-l1-1-0.dll1077_o_terminate
api-ms-win-crt-private-l1-1-0.dll1084_o_toupper
api-ms-win-crt-private-l1-1-0.dll42__std_terminate
api-ms-win-crt-private-l1-1-0.dll18__CxxFrameHandler3
api-ms-win-crt-private-l1-1-0.dll1_CxxThrowException
api-ms-win-crt-private-l1-1-0.dll95_o___std_exception_destroy
api-ms-win-crt-private-l1-1-0.dll94_o___std_exception_copy
api-ms-win-crt-private-l1-1-0.dll12__C_specific_handler
api-ms-win-crt-private-l1-1-0.dll112_o___stdio_common_vswprintf
api-ms-win-crt-private-l1-1-0.dll1121memcmp
api-ms-win-crt-private-l1-1-0.dll83_o___p__commode
api-ms-win-crt-private-l1-1-0.dll1122memcpy
api-ms-win-crt-private-l1-1-0.dll1123memmove
api-ms-win-core-com-l1-1-0.dll7CoCreateFreeThreadedMarshaler
api-ms-win-core-com-l1-1-0.dll73CoWaitForMultipleHandles
api-ms-win-core-com-l1-1-0.dll80PropVariantClear
api-ms-win-core-com-l1-1-0.dll67CoTaskMemFree
api-ms-win-core-com-l1-1-0.dll66CoTaskMemAlloc
api-ms-win-core-com-l1-1-0.dll9CoCreateInstance
api-ms-win-core-com-l1-1-0.dll40CoInitializeEx
api-ms-win-core-com-l1-1-0.dll8CoCreateGuid
api-ms-win-core-com-l1-1-0.dll70CoUninitialize
api-ms-win-core-shlwapi-legacy-l1-1-0.dll20PathFileExistsW
api-ms-win-core-shlwapi-legacy-l1-1-0.dll22PathFindExtensionW
api-ms-win-core-shlwapi-legacy-l1-1-0.dll34PathIsFileSpecW
api-ms-win-shcore-obsolete-l1-1-0.dll2SHStrDupW
api-ms-win-shcore-path-l1-1-0.dll170
api-ms-win-shcore-scaling-l1-1-1.dllGetDpiForMonitor
api-ms-win-core-rtlsupport-l1-1-0.dll1576RtlVirtualUnwind
api-ms-win-core-rtlsupport-l1-1-0.dll755RtlCaptureContext
api-ms-win-core-rtlsupport-l1-1-0.dll1257RtlLookupFunctionEntry
api-ms-win-core-errorhandling-l1-1-0.dll7RaiseException
api-ms-win-core-errorhandling-l1-1-0.dll15SetUnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-0.dll17UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0.dll79TerminateProcess
api-ms-win-core-processthreads-l1-1-1.dll27GetProcessMitigationPolicy
api-ms-win-core-processthreads-l1-1-1.dll47IsProcessorFeaturePresent
api-ms-win-core-synch-l1-1-0.dll25InitializeCriticalSectionAndSpinCount
api-ms-win-core-synch-l1-1-0.dll41SetEvent
api-ms-win-core-synch-l1-1-0.dll39ResetEvent
api-ms-win-core-synch-l1-1-0.dll5CreateEventExW
api-ms-win-core-synch-l1-1-0.dll6CreateEventW
api-ms-win-core-profile-l1-1-0.dllQueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0.dll26GetTickCount
api-ms-win-core-sysinfo-l1-1-0.dll22GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0.dllInitializeSListHead
api-ms-win-core-libraryloader-l1-2-0.dll24LoadLibraryExW
api-ms-win-core-winrt-string-l1-1-0.dll12WindowsDeleteString
api-ms-win-core-winrt-string-l1-1-0.dll11WindowsCreateStringReference
api-ms-win-core-winrt-string-l1-1-0.dll16WindowsGetStringRawBuffer
api-ms-win-core-winrt-string-l1-1-0.dll10WindowsCreateString
api-ms-win-core-winrt-error-l1-1-0.dll18SetRestrictedErrorInfo
api-ms-win-core-winrt-l1-1-0.dll3RoInitialize
api-ms-win-core-winrt-l1-1-0.dll1RoGetActivationFactory
api-ms-win-core-winrt-l1-1-0.dll7RoUninitialize
api-ms-win-core-winrt-error-l1-1-1.dll6RoGetMatchingRestrictedErrorInfo
api-ms-win-eventing-provider-l1-1-0.dll2EventProviderEnabled
api-ms-win-core-synch-l1-2-0.dll45Sleep
COMCTL32.dll12CreateStatusWindowW
COMCTL32.dll345

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionNotepad
FileVersion10.0.19041.746 (WinBuild.160101.0800)
InternalNameNotepad
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameNOTEPAD.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion10.0.19041.746

VS_FIXEDFILEINFO

FileVersion10.0.19041.746
ProductVersion10.0.19041.746
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d0196656BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x312b8