filenamenotepad.exe
size244736 (0x3bc00)
md560336413e419c2ea5e215f1a32061e40
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1473072930
241401163
2424011619
243401165
2394011629
10263
2464011625
237401161
240401161

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x5632d3a5
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion12.10
SizeOfCode0x18e00
SizeOfInitializedData0x24a00
SizeOfUninitializedData0
AddressOfEntryPoint0x18ef0
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion10.0
ImageVersion10.0
SubsystemVersion10.0
Reserved10
SizeOfImage0x41000
SizeOfHeaders0x400
CheckSum0x41dea
Subsystem2
DllCharacteristics0xc160
SizeOfStackReserve0x80000
SizeOfStackCommit0x11000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x18c060x18e00R-X CODE
.rdata0x1a0000x71660x7200R-- IDATA
.data0x220000x2b140xc00RW- IDATA
.pdata0x250000x8040xa00R-- IDATA
.rsrc0x260000x19cd80x19e00R-- IDATA
.reloc0x400000x20c0x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1f1e80x258
RESOURCE0x260000x19cd8
EXCEPTION0x250000x804
SECURITY00
BASERELOC0x400000x20c
DEBUG0x1e0600x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x1e0c00xa0
Bound_IAT00
IAT0x1a0000x908
Delay_IAT00
CLR_Header00
typenamesizecp
EDPENLIGHTENEDAPPINFOIDMICROSOFTEDPENLIGHTENEDAPPINFO20
EDPPERMISSIVEAPPINFOIDMICROSOFTEDPPERMISSIVEAPPINFO20
MUI#13280
ICON#116400
ICON#27440
ICON#34880
ICON#42960
ICON#537520
ICON#622160
ICON#717360
ICON#813840
ICON#9720240
ICON#1096400
ICON#1142640
ICON#1224400
ICON#1311280
GROUP_ICON#21880
VERSION#18920
MANIFEST#111720
module_namehintordfunction_name
ADVAPI32.dll532OpenProcessToken
ADVAPI32.dll367GetTokenInformation
ADVAPI32.dll237DuplicateEncryptionInfoFile
ADVAPI32.dll678RegSetValueExW
ADVAPI32.dll662RegQueryValueExW
ADVAPI32.dll612RegCreateKeyW
ADVAPI32.dll600RegCloseKey
ADVAPI32.dll649RegOpenKeyExW
ADVAPI32.dll289EventSetInformation
ADVAPI32.dll288EventRegister
ADVAPI32.dll290EventUnregister
ADVAPI32.dll296EventWriteTransfer
ADVAPI32.dll407IsTextUnicode
KERNEL32.dll529GetCurrentProcessId
KERNEL32.dll987MultiByteToWideChar
KERNEL32.dll959LocalReAlloc
KERNEL32.dll1444UnmapViewOfFile
KERNEL32.dll961LocalSize
KERNEL32.dll189CreateFileMappingW
KERNEL32.dll384FindNLSString
KERNEL32.dll804GlobalAlloc
KERNEL32.dll815GlobalLock
KERNEL32.dll822GlobalUnlock
KERNEL32.dll575GetFileInformationByHandle
KERNEL32.dll570GetFileAttributesExW
KERNEL32.dll593GetFullPathNameW
KERNEL32.dll1573lstrcmpW
KERNEL32.dll1285SetEndOfFile
KERNEL32.dll266DeleteFileW
KERNEL32.dll427GetACP
KERNEL32.dll599GetLastError
KERNEL32.dll573GetFileAttributesW
KERNEL32.dll1539WriteFile
KERNEL32.dll1318SetLastError
KERNEL32.dll1519WideCharToMultiByte
KERNEL32.dll770GetTimeFormatW
KERNEL32.dll539GetDateFormatW
KERNEL32.dll600GetLocalTime
KERNEL32.dll780GetUserDefaultUILanguage
KERNEL32.dll413FoldStringW
KERNEL32.dll962LocalUnlock
KERNEL32.dll958LocalLock
KERNEL32.dll416FormatMessageW
KERNEL32.dll366FindClose
KERNEL32.dll377FindFirstFileW
KERNEL32.dll711GetStartupInfoW
KERNEL32.dll836HeapSetInformation
KERNEL32.dll464GetCommandLineW
KERNEL32.dll528GetCurrentProcess
KERNEL32.dll1585lstrlenW
KERNEL32.dll956LocalFree
KERNEL32.dll1576lstrcmpiW
KERNEL32.dll986MulDiv
KERNEL32.dll603GetLocaleInfoW
KERNEL32.dll811GlobalFree
KERNEL32.dll1290SetErrorMode
KERNEL32.dll952LocalAlloc
KERNEL32.dll124CloseHandle
KERNEL32.dll1119ReadFile
KERNEL32.dll192CreateFileW
KERNEL32.dll970MapViewOfFile
GDI32.dll777SelectObject
GDI32.dll51CreateDCW
GDI32.dll836StartPage
GDI32.dll834StartDocW
GDI32.dll779SetAbortProc
GDI32.dll317DeleteDC
GDI32.dll329EndDoc
GDI32.dllAbortDoc
GDI32.dll332EndPage
GDI32.dll646GetTextMetricsW
GDI32.dll785SetBkMode
GDI32.dll660LPtoDP
GDI32.dll830SetWindowExtEx
GDI32.dll826SetViewportExtEx
GDI32.dll806SetMapMode
GDI32.dll638GetTextExtentPoint32W
GDI32.dll843TextOutW
GDI32.dll386EnumFontsW
GDI32.dll644GetTextFaceW
GDI32.dll320DeleteObject
GDI32.dll65CreateFontIndirectW
GDI32.dll555GetDeviceCaps
USER32.dll879UnhookWinEvent
USER32.dll834SetWindowTextW
USER32.dll369GetMenuState
USER32.dll625OpenClipboard
USER32.dll524IsClipboardFormatAvailable
USER32.dll75CloseClipboard
USER32.dll765SetDlgItemTextW
USER32.dll323GetDlgItemTextW
USER32.dll233EndDialog
USER32.dll732SendDlgItemMessageW
USER32.dll319GetDlgCtrlID
USER32.dll928WinHelpW
USER32.dll311GetCursorPos
USER32.dll726ScreenToClient
USER32.dll69ChildWindowFromPoint
USER32.dll383GetParent
USER32.dll802SetScrollPos
USER32.dll511InvalidateRect
USER32.dll902UpdateWindow
USER32.dll182DispatchMessageW
USER32.dll60CharUpperW
USER32.dll431GetSystemMenu
USER32.dll558LoadAcceleratorsW
USER32.dll827SetWindowLongW
USER32.dll714RegisterWindowMessageW
USER32.dll564LoadCursorW
USER32.dll113CreateWindowExW
USER32.dll828SetWindowPlacement
USER32.dll568LoadImageW
USER32.dll685RegisterClassExW
USER32.dll474GetWindowTextLengthW
USER32.dll462GetWindowLongW
USER32.dll639PeekMessageW
USER32.dll475GetWindowTextW
USER32.dll230EnableWindow
USER32.dll102CreateDialogParamW
USER32.dll214DrawTextExW
USER32.dll877TranslateMessage
USER32.dll875TranslateAcceleratorW
USER32.dll527IsDialogMessageW
USER32.dll817SetWinEventHook
USER32.dll376GetMessageW
USER32.dll49CharNextW
USER32.dll345GetKeyboardLayout
USER32.dll328GetForegroundWindow
USER32.dll600MessageBeep
USER32.dll174DestroyWindow
USER32.dll531IsIconic
USER32.dll644PostQuitMessage
USER32.dll162DefWindowProcW
USER32.dll467GetWindowPlacement
USER32.dll579LoadStringW
USER32.dll744SetActiveWindow
USER32.dll756SetCursor
USER32.dll716ReleaseDC
USER32.dll312GetDC
USER32.dll846ShowWindow
USER32.dll297GetClientRect
USER32.dll63CheckMenuItem
USER32.dll608MessageBoxW
USER32.dll566LoadIconW
USER32.dll179DialogBoxParamW
USER32.dll768SetFocus
USER32.dll428GetSubMenu
USER32.dll226EnableMenuItem
USER32.dll358GetMenu
USER32.dll643PostMessageW
USER32.dll614MoveWindow
USER32.dll741SendMessageW
USER32.dll327GetFocus
msvcrt.dll486_lock
msvcrt.dll47void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll210_commode
msvcrt.dll833_unlock
msvcrt.dll1174memset
msvcrt.dll1170memcpy
msvcrt.dll162_acmdln
msvcrt.dll123__dllonexit
msvcrt.dll381_initterm
msvcrt.dll144__setusermatherr
msvcrt.dll409_ismbblead
msvcrt.dll193_cexit
msvcrt.dll270_exit
msvcrt.dll1074exit
msvcrt.dll142__set_app_type
msvcrt.dll127__getmainargs
msvcrt.dll174_amsg_exit
msvcrt.dll85_XcptFilter
msvcrt.dll1138iswctype
msvcrt.dll906_wcsicmp
msvcrt.dll1033_wtol
msvcrt.dll656_onexit
msvcrt.dll87__C_specific_handler
msvcrt.dll295_fmode
msvcrt.dll75_CxxThrowException
msvcrt.dll191_callnewh
msvcrt.dll873_vsnwprintf
msvcrt.dll1217strchr
msvcrt.dll1100free
msvcrt.dll1158malloc
msvcrt.dll670_purecall
msvcrt.dll18public: virtual __cdecl type_info::~type_info(void) __ptr64

??1type_info@@UEAA@XZ

msvcrt.dll91__CxxFrameHandler3
msvcrt.dll1282wcscmp
api-ms-win-core-com-l1-1-1.dll38CoInitializeEx
api-ms-win-core-com-l1-1-1.dll7CoCreateGuid
api-ms-win-core-com-l1-1-1.dll6CoCreateFreeThreadedMarshaler
api-ms-win-core-com-l1-1-1.dll63CoTaskMemFree
api-ms-win-core-com-l1-1-1.dll69CoWaitForMultipleHandles
api-ms-win-core-com-l1-1-1.dll62CoTaskMemAlloc
api-ms-win-core-com-l1-1-1.dll8CoCreateInstance
api-ms-win-core-com-l1-1-1.dll66CoUninitialize
api-ms-win-core-com-l1-1-1.dll76PropVariantClear
OLEAUT32.dll6
OLEAUT32.dll2
api-ms-win-core-synch-l1-2-0.dll5CreateEventExW
api-ms-win-core-synch-l1-2-0.dll41SetEvent
api-ms-win-core-synch-l1-2-0.dll45Sleep
api-ms-win-core-rtlsupport-l1-2-0.dll9RtlLookupFunctionEntry
api-ms-win-core-rtlsupport-l1-2-0.dll15RtlVirtualUnwind
api-ms-win-core-rtlsupport-l1-2-0.dll2RtlCaptureContext
api-ms-win-core-errorhandling-l1-1-1.dll7RaiseException
api-ms-win-core-errorhandling-l1-1-1.dll15SetUnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-1.dll17UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-2.dll17GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-2.dll75TerminateProcess
api-ms-win-core-libraryloader-l1-2-0.dll23LoadLibraryExW
api-ms-win-core-libraryloader-l1-2-0.dll20GetProcAddress
api-ms-win-core-libraryloader-l1-2-0.dll14GetModuleFileNameA
api-ms-win-core-libraryloader-l1-2-0.dll15GetModuleFileNameW
api-ms-win-core-libraryloader-l1-2-0.dll18GetModuleHandleExW
api-ms-win-core-libraryloader-l1-2-0.dll11FreeLibrary
api-ms-win-core-libraryloader-l1-2-0.dll19GetModuleHandleW
api-ms-win-core-profile-l1-1-0.dllQueryPerformanceCounter
api-ms-win-core-sysinfo-l1-2-1.dll20GetSystemTimeAsFileTime
api-ms-win-core-sysinfo-l1-2-1.dll24GetTickCount
api-ms-win-core-heap-l1-2-0.dllGetProcessHeap
api-ms-win-core-heap-l1-2-0.dll2HeapAlloc
api-ms-win-core-heap-l1-2-0.dll6HeapFree
api-ms-win-core-winrt-error-l1-1-1.dll18SetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1.dll6RoGetMatchingRestrictedErrorInfo
api-ms-win-core-winrt-string-l1-1-0.dll11WindowsCreateStringReference
api-ms-win-core-winrt-string-l1-1-0.dll16WindowsGetStringRawBuffer
api-ms-win-core-winrt-string-l1-1-0.dll12WindowsDeleteString
api-ms-win-core-winrt-string-l1-1-0.dll10WindowsCreateString
api-ms-win-core-debug-l1-1-1.dll7OutputDebugStringW
api-ms-win-core-winrt-l1-1-0.dll1RoGetActivationFactory
api-ms-win-core-string-l1-1-0.dll1CompareStringOrdinal
COMCTL32.dll345
COMCTL32.dll12CreateStatusWindowW
COMDLG32.dll10GetFileTitleW
COMDLG32.dll3ChooseFontW
COMDLG32.dll17PageSetupDlgW
COMDLG32.dll8FindTextW
COMDLG32.dll23ReplaceTextW
COMDLG32.dll14GetSaveFileNameW
COMDLG32.dll12GetOpenFileNameW
COMDLG32.dll4CommDlgExtendedError
COMDLG32.dll20PrintDlgExW
FeClient.dll21EfsClientDecryptFile
ntdll.dll1573WinSqmAddToStream
PROPSYS.dll62PSGetPropertyDescriptionListFromString
PROPSYS.dll150PropVariantToStringVectorAlloc
SHELL32.dll159SHCreateItemFromParsingName
SHELL32.dll40DragQueryFileW
SHELL32.dll124SHAddToRecentDocs
SHELL32.dll36DragFinish
SHELL32.dll35DragAcceptFiles
SHELL32.dll430ShellAboutW
SHLWAPI.dll97PathIsFileSpecW
SHLWAPI.dll101PathIsNetworkPathW
SHLWAPI.dll75PathFindExtensionW
SHLWAPI.dll264SHStrDupW
WINSPOOL.DRV140GetPrinterDriverW
WINSPOOL.DRV29ClosePrinter
WINSPOOL.DRV150OpenPrinterW
urlmon.dll59FindMimeFromData

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionNotepad
FileVersion10.0.10586.0 (th2_release.151029-1700)
InternalNameNotepad
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameNOTEPAD.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion10.0.10586.0

VS_FIXEDFILEINFO

FileVersion10.0.10586.0
ProductVersion10.0.10586.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
253b872024PNG(256 x 256)#
36d1020208BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER