filenamenotepad2.exe
size193536 (0x2f400)
md546b6dd054bbb0b7038c17f48be6adf3b
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
132307291
149307292
1473072929
10244
1313072920
1373072911
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x4a5bc9b3
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion9.0
SizeOfCode0xa800
SizeOfInitializedData0x25800
SizeOfUninitializedData0
AddressOfEntryPoint0x3570
BaseOfCode0x1000
ImageBase0x100000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x35000
SizeOfHeaders0x600
CheckSum0x3e800
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x80000
SizeOfStackCommit0x11000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xa7700xa800R-X CODE
.rdata0xc0000x31600x3200R-- IDATA
.data0x100000x28440x1800RW- IDATA
.pdata0x130000x6b40x800R-- IDATA
.rsrc0x140000x1f1600x1f200R-- IDATA
.reloc0x340000xb80x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xcff80x12c
RESOURCE0x140000x1f160
EXCEPTION0x130000x6b4
SECURITY00
BASERELOC0x340000xb8
DEBUG0xb7100x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2e00x138
IAT0xc0000x7f0
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12400
BITMAP#51209220420
ICON#116400
ICON#27440
ICON#34880
ICON#42960
ICON#537520
ICON#622160
ICON#717360
ICON#813840
ICON#9720240
ICON#1096400
ICON#1142640
ICON#1224400
ICON#1311280
GROUP_ICON#21880
VERSION#18760
MANIFEST#111720
module_namehintordfunction_name
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll572RegCreateKeyW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll384IsTextUnicode
ADVAPI32.dll87CloseServiceHandle
ADVAPI32.dll505OpenSCManagerW
ADVAPI32.dll507OpenServiceW
ADVAPI32.dll548QueryServiceConfigW
KERNEL32.dll521GetLocalTime
KERNEL32.dll463GetDateFormatW
KERNEL32.dll670GetTimeFormatW
KERNEL32.dll710GlobalLock
KERNEL32.dll717GlobalUnlock
KERNEL32.dll678GetUserDefaultUILanguage
KERNEL32.dll723HeapAlloc
KERNEL32.dll454GetCurrentProcess
KERNEL32.dll727HeapFree
KERNEL32.dll699GlobalAlloc
KERNEL32.dll833LoadLibraryW
KERNEL32.dll1314Wow64DisableWow64FsRedirection
KERNEL32.dll1365lstrcmpW
KERNEL32.dll1318Wow64RevertWow64FsRedirection
KERNEL32.dll497GetFileAttributesW
KERNEL32.dll538GetModuleFileNameW
KERNEL32.dll361FreeLibraryAndExitThread
KERNEL32.dll784IsWow64Process
KERNEL32.dll180CreateThread
KERNEL32.dll326FindNLSString
KERNEL32.dll1253UnmapViewOfFile
KERNEL32.dll845LocalReAlloc
KERNEL32.dll873MultiByteToWideChar
KERNEL32.dll857MapViewOfFile
KERNEL32.dll140CreateFileMappingW
KERNEL32.dll499GetFileInformationByHandle
KERNEL32.dll1121SetEndOfFile
KERNEL32.dll215DeleteFileW
KERNEL32.dll366GetACP
KERNEL32.dll1332WriteFile
KERNEL32.dll1152SetLastError
KERNEL32.dll1312WideCharToMultiByte
KERNEL32.dll520GetLastError
KERNEL32.dll847LocalSize
KERNEL32.dll514GetFullPathNameW
KERNEL32.dll354FoldStringW
KERNEL32.dll848LocalUnlock
KERNEL32.dll844LocalLock
KERNEL32.dll356FormatMessageW
KERNEL32.dll308FindClose
KERNEL32.dll963ReadFile
KERNEL32.dll319FindFirstFileW
KERNEL32.dll1230TerminateProcess
KERNEL32.dll640GetSystemTimeAsFileTime
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll666GetTickCount
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll731HeapSetInformation
KERNEL32.dll397GetCommandLineW
KERNEL32.dll1377lstrlenW
KERNEL32.dll872MulDiv
KERNEL32.dll524GetLocaleInfoW
KERNEL32.dll706GlobalFree
KERNEL32.dll838LocalAlloc
KERNEL32.dll937QueryPerformanceCounter
KERNEL32.dll684GetVersionExW
KERNEL32.dll82CloseHandle
KERNEL32.dll542GetModuleHandleW
KERNEL32.dll1203SetUnhandledExceptionFilter
KERNEL32.dll618GetStartupInfoW
KERNEL32.dll1216Sleep
KERNEL32.dll143CreateFileW
KERNEL32.dll1126SetErrorMode
KERNEL32.dll1368lstrcmpiW
KERNEL32.dll842LocalFree
KERNEL32.dll593GetProcessHeap
KERNEL32.dll1250UnhandledExceptionFilter
GDI32.dll690StartPage
GDI32.dll688StartDocW
GDI32.dll633SetAbortProc
GDI32.dll227DeleteDC
GDI32.dll239EndDoc
GDI32.dllAbortDoc
GDI32.dll242EndPage
GDI32.dll550GetTextMetricsW
GDI32.dll639SetBkMode
GDI32.dll564LPtoDP
GDI32.dll684SetWindowExtEx
GDI32.dll680SetViewportExtEx
GDI32.dll660SetMapMode
GDI32.dll542GetTextExtentPoint32W
GDI32.dll697TextOutW
GDI32.dll296EnumFontsW
GDI32.dll548GetTextFaceW
GDI32.dll631SelectObject
GDI32.dll230DeleteObject
GDI32.dll64CreateFontIndirectW
GDI32.dll459GetDeviceCaps
GDI32.dll50CreateDCW
USER32.dll300GetDlgItemTextW
USER32.dll218EndDialog
USER32.dll631SendDlgItemMessageW
USER32.dll296GetDlgCtrlID
USER32.dll817WinHelpW
USER32.dll290GetCursorPos
USER32.dll625ScreenToClient
USER32.dll67ChildWindowFromPoint
USER32.dll358GetParent
USER32.dll415GetWindowPlacement
USER32.dll60CharUpperW
USER32.dll383GetSystemMenu
USER32.dll489LoadAcceleratorsW
USER32.dll716SetWindowLongW
USER32.dll615RegisterWindowMessageW
USER32.dll495LoadCursorW
USER32.dll110CreateWindowExW
USER32.dll717SetWindowPlacement
USER32.dll499LoadImageW
USER32.dll593RegisterClassExW
USER32.dll695SetScrollPos
USER32.dll450InvalidateRect
USER32.dll793UpdateWindow
USER32.dll422GetWindowTextLengthW
USER32.dll410GetWindowLongW
USER32.dll567PeekMessageW
USER32.dll662SetDlgItemTextW
USER32.dll216EnableWindow
USER32.dll99CreateDialogParamW
USER32.dll207DrawTextExW
USER32.dll384GetSystemMetrics
USER32.dll718SetWindowPos
USER32.dll260GetAncestor
USER32.dll250FindWindowW
USER32.dll665SetForegroundWindow
USER32.dll554OpenClipboard
USER32.dll344GetMenuState
USER32.dll723SetWindowTextW
USER32.dll774UnhookWinEvent
USER32.dll175DispatchMessageW
USER32.dll772TranslateMessage
USER32.dll770TranslateAcceleratorW
USER32.dll465IsDialogMessageW
USER32.dll351GetMessageW
USER32.dll709SetWinEventHook
USER32.dll49CharNextW
USER32.dll320GetKeyboardLayout
USER32.dll303GetForegroundWindow
USER32.dll529MessageBeep
USER32.dll166DestroyWindow
USER32.dll571PostQuitMessage
USER32.dll469IsIconic
USER32.dll156DefWindowProcW
USER32.dll73CloseClipboard
USER32.dll423GetWindowTextW
USER32.dll462IsClipboardFormatAvailable
USER32.dll510LoadStringW
USER32.dll643SetActiveWindow
USER32.dll654SetCursor
USER32.dll617ReleaseDC
USER32.dll291GetDC
USER32.dll743ShowWindow
USER32.dll63CheckMenuItem
USER32.dll537MessageBoxW
USER32.dll302GetFocus
USER32.dll497LoadIconW
USER32.dll172DialogBoxParamW
USER32.dll664SetFocus
USER32.dll380GetSubMenu
USER32.dll214EnableMenuItem
USER32.dll333GetMenu
USER32.dll570PostMessageW
USER32.dll543MoveWindow
USER32.dll640SendMessageW
USER32.dll278GetClientRect
msvcrt.dll1156memset
msvcrt.dll856_vsnwprintf
msvcrt.dll1015_wtol
msvcrt.dll1120iswctype
msvcrt.dll1278wcsrchr
msvcrt.dll1273wcsncmp
msvcrt.dll113__getmainargs
msvcrt.dll128__set_app_type
msvcrt.dll280_fmode
msvcrt.dll196_commode
msvcrt.dll130__setusermatherr
msvcrt.dll160_amsg_exit
msvcrt.dll364_initterm
msvcrt.dll148_acmdln
msvcrt.dll1056exit
msvcrt.dll179_cexit
msvcrt.dll83__C_specific_handler
msvcrt.dll82_XcptFilter
msvcrt.dll255_exit
msvcrt.dll392_ismbblead
msvcrt.dll48void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll1152memcpy
COMDLG32.dll4CommDlgExtendedError
COMDLG32.dll14GetSaveFileNameW
COMDLG32.dll23ReplaceTextW
COMDLG32.dll8FindTextW
COMDLG32.dll17PageSetupDlgW
COMDLG32.dll3ChooseFontW
COMDLG32.dll10GetFileTitleW
COMDLG32.dll20PrintDlgExW
COMDLG32.dll12GetOpenFileNameW
SHELL32.dll195SHGetFolderPathW
SHELL32.dll289ShellExecuteExW
SHELL32.dll27DragFinish
SHELL32.dll144SHCreateItemFromParsingName
SHELL32.dll282ShellAboutW
SHELL32.dll31DragQueryFileW
SHELL32.dll112SHAddToRecentDocs
SHELL32.dll26DragAcceptFiles
WINSPOOL.DRV134GetPrinterDriverW
WINSPOOL.DRV29ClosePrinter
WINSPOOL.DRV144OpenPrinterW
ole32.dll112CoUninitialize
ole32.dll67CoInitializeEx
ole32.dll20CoCreateInstance
ole32.dll107CoTaskMemAlloc
ole32.dll108CoTaskMemFree
ole32.dll66CoInitialize
SHLWAPI.dll93PathIsFileSpecW
SHLWAPI.dll255SHStrDupW
COMCTL32.dll9CreatePropertySheetPageW
COMCTL32.dll134PropertySheetW
COMCTL32.dll12CreateStatusWindowW
COMCTL32.dll345
OLEAUT32.dll6
OLEAUT32.dll2
ntdll.dll635RtlCaptureContext
ntdll.dll1025RtlLookupFunctionEntry
ntdll.dll1264RtlVirtualUnwind
ntdll.dll930RtlInitUnicodeString
ntdll.dll410NtQueryLicenseValue
ntdll.dll1402WinSqmIncrementDWORD
ntdll.dll1386WinSqmAddToStream
VERSION.dll14VerQueryValueW
VERSION.dll2GetFileVersionInfoExW
VERSION.dll4GetFileVersionInfoSizeExW

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionNotepad
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNameNotepad
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameNOTEPAD.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
18ea872024PNG(256 x 256)#
2a80019456BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x2e0