filenamenotepad.exe
size242176 (0x3b200)
md58be866cf6dfa0f813988b7e6938cdcd8
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
189307161
187307162
1853071627
10223
1883071621
1923071619
183307161
186307161

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x4fb704fc
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion10.10
SizeOfCode0x1ce00
SizeOfInitializedData0x1f200
SizeOfUninitializedData0
AddressOfEntryPoint0x5a30
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.2
ImageVersion6.2
SubsystemVersion6.2
Reserved10
SizeOfImage0x3f000
SizeOfHeaders0x600
CheckSum0x417b0
Subsystem2
DllCharacteristics0x8160
SizeOfStackReserve0x80000
SizeOfStackCommit0x11000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x1cd400x1ce00R-X CODE
.data0x1e0000x2acc0x1800RW- IDATA
.pdata0x210000x6780x800R-- IDATA
.idata0x220000x1e300x2000R-- IDATA
.rsrc0x240000x19ae00x19c00R-- IDATA
.reloc0x3e0000x1240x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x227380x118
RESOURCE0x240000x19ae0
EXCEPTION0x210000x678
SECURITY00
BASERELOC0x3e0000x124
DEBUG0x1d4500x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x1d3e00x70
Bound_IAT0x2e80x14c
IAT0x220000x738
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12320
ICON#116400
ICON#27440
ICON#34880
ICON#42960
ICON#537520
ICON#622160
ICON#717360
ICON#813840
ICON#9720240
ICON#1096400
ICON#1142640
ICON#1224400
ICON#1311280
GROUP_ICON#21880
VERSION#18720
MANIFEST#111720
module_namehintordfunction_name
ADVAPI32.dll662RegQueryValueExW
ADVAPI32.dll612RegCreateKeyW
ADVAPI32.dll600RegCloseKey
ADVAPI32.dll649RegOpenKeyExW
ADVAPI32.dll406IsTextUnicode
ADVAPI32.dll678RegSetValueExW
KERNEL32.dll411FindNLSString
KERNEL32.dll827GlobalAlloc
KERNEL32.dll622GetLocalTime
KERNEL32.dll563GetDateFormatW
KERNEL32.dll793GetTimeFormatW
KERNEL32.dll838GlobalLock
KERNEL32.dll845GlobalUnlock
KERNEL32.dll803GetUserDefaultUILanguage
KERNEL32.dll1436UnmapViewOfFile
KERNEL32.dll976LocalReAlloc
KERNEL32.dll1004MultiByteToWideChar
KERNEL32.dll987MapViewOfFile
KERNEL32.dll210CreateFileMappingW
KERNEL32.dll598GetFileInformationByHandle
KERNEL32.dll1282SetEndOfFile
KERNEL32.dll291DeleteFileW
KERNEL32.dll451GetACP
KERNEL32.dll1526WriteFile
KERNEL32.dll1312SetLastError
KERNEL32.dll1506WideCharToMultiByte
KERNEL32.dll621GetLastError
KERNEL32.dll978LocalSize
KERNEL32.dll614GetFullPathNameW
KERNEL32.dll439FoldStringW
KERNEL32.dll979LocalUnlock
KERNEL32.dll975LocalLock
KERNEL32.dll441FormatMessageW
KERNEL32.dll393FindClose
KERNEL32.dll404FindFirstFileW
KERNEL32.dll1562lstrcmpW
KERNEL32.dll553GetCurrentProcessId
KERNEL32.dll643GetModuleHandleExW
KERNEL32.dll789GetTickCount64
KERNEL32.dll859HeapSetInformation
KERNEL32.dll488GetCommandLineW
KERNEL32.dll1574lstrlenW
KERNEL32.dll255CreateThread
KERNEL32.dll446FreeLibraryAndExitThread
KERNEL32.dll640GetModuleFileNameW
KERNEL32.dll697GetProcAddress
KERNEL32.dll702GetProcessHeap
KERNEL32.dll855HeapFree
KERNEL32.dll962LoadLibraryExW
KERNEL32.dll851HeapAlloc
KERNEL32.dll445FreeLibrary
KERNEL32.dll1003MulDiv
KERNEL32.dll625GetLocaleInfoW
KERNEL32.dll834GlobalFree
KERNEL32.dll969LocalAlloc
KERNEL32.dll141CloseHandle
KERNEL32.dll1113ReadFile
KERNEL32.dll213CreateFileW
KERNEL32.dll788GetTickCount
KERNEL32.dll1287SetErrorMode
KERNEL32.dll1565lstrcmpiW
KERNEL32.dll973LocalFree
KERNEL32.dll1385Sleep
KERNEL32.dll731GetStartupInfoW
KERNEL32.dll1433UnhandledExceptionFilter
KERNEL32.dll1370SetUnhandledExceptionFilter
KERNEL32.dll552GetCurrentProcess
KERNEL32.dll1400TerminateProcess
KERNEL32.dll644GetModuleHandleW
KERNEL32.dll1084QueryPerformanceCounter
KERNEL32.dll557GetCurrentThreadId
KERNEL32.dll760GetSystemTimeAsFileTime
GDI32.dll51CreateDCW
GDI32.dll772StartPage
GDI32.dll770StartDocW
GDI32.dll715SetAbortProc
GDI32.dll258DeleteDC
GDI32.dll270EndDoc
GDI32.dllAbortDoc
GDI32.dll273EndPage
GDI32.dll582GetTextMetricsW
GDI32.dll721SetBkMode
GDI32.dll596LPtoDP
GDI32.dll766SetWindowExtEx
GDI32.dll762SetViewportExtEx
GDI32.dll742SetMapMode
GDI32.dll574GetTextExtentPoint32W
GDI32.dll779TextOutW
GDI32.dll327EnumFontsW
GDI32.dll580GetTextFaceW
GDI32.dll713SelectObject
GDI32.dll261DeleteObject
GDI32.dll65CreateFontIndirectW
GDI32.dll491GetDeviceCaps
USER32.dll459GetWindowPlacement
USER32.dll60CharUpperW
USER32.dll424GetSystemMenu
USER32.dll540LoadAcceleratorsW
USER32.dll782SetWindowLongW
USER32.dll674RegisterWindowMessageW
USER32.dll546LoadCursorW
USER32.dll113CreateWindowExW
USER32.dll783SetWindowPlacement
USER32.dll550LoadImageW
USER32.dll648RegisterClassExW
USER32.dll758SetScrollPos
USER32.dll496InvalidateRect
USER32.dll856UpdateWindow
USER32.dll466GetWindowTextLengthW
USER32.dll454GetWindowLongW
USER32.dll620PeekMessageW
USER32.dll467GetWindowTextW
USER32.dll229EnableWindow
USER32.dll102CreateDialogParamW
USER32.dll214DrawTextExW
USER32.dll378GetParent
USER32.dll69ChildWindowFromPoint
USER32.dll684ScreenToClient
USER32.dll308GetCursorPos
USER32.dll881WinHelpW
USER32.dll316GetDlgCtrlID
USER32.dll690SendDlgItemMessageW
USER32.dll232EndDialog
USER32.dll320GetDlgItemTextW
USER32.dll723SetDlgItemTextW
USER32.dll75CloseClipboard
USER32.dll508IsClipboardFormatAvailable
USER32.dll606OpenClipboard
USER32.dll364GetMenuState
USER32.dll789SetWindowTextW
USER32.dll834UnhookWinEvent
USER32.dll182DispatchMessageW
USER32.dll832TranslateMessage
USER32.dll830TranslateAcceleratorW
USER32.dll511IsDialogMessageW
USER32.dll371GetMessageW
USER32.dll772SetWinEventHook
USER32.dll49CharNextW
USER32.dll340GetKeyboardLayout
USER32.dll323GetForegroundWindow
USER32.dll581MessageBeep
USER32.dll624PostQuitMessage
USER32.dll515IsIconic
USER32.dll161DefWindowProcW
USER32.dll561LoadStringW
USER32.dll702SetActiveWindow
USER32.dll714SetCursor
USER32.dll676ReleaseDC
USER32.dll309GetDC
USER32.dll801ShowWindow
USER32.dll295GetClientRect
USER32.dll63CheckMenuItem
USER32.dll589MessageBoxW
USER32.dll322GetFocus
USER32.dll548LoadIconW
USER32.dll179DialogBoxParamW
USER32.dll725SetFocus
USER32.dll421GetSubMenu
USER32.dll225EnableMenuItem
USER32.dll353GetMenu
USER32.dll623PostMessageW
USER32.dll595MoveWindow
USER32.dll699SendMessageW
USER32.dll173DestroyWindow
msvcrt.dll1124iswctype
msvcrt.dll1203strchr
msvcrt.dll1156memcpy
msvcrt.dll1019_wtol
msvcrt.dll859_vsnwprintf
msvcrt.dll48void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll82_XcptFilter
msvcrt.dll160_amsg_exit
msvcrt.dll113__getmainargs
msvcrt.dll128__set_app_type
msvcrt.dll1060exit
msvcrt.dll1160memset
msvcrt.dll196_commode
msvcrt.dll281_fmode
msvcrt.dll148_acmdln
msvcrt.dll83__C_specific_handler
msvcrt.dll367_initterm
msvcrt.dll130__setusermatherr
msvcrt.dll395_ismbblead
msvcrt.dll179_cexit
msvcrt.dll256_exit
COMDLG32.dll14GetSaveFileNameW
COMDLG32.dll8FindTextW
COMDLG32.dll17PageSetupDlgW
COMDLG32.dll3ChooseFontW
COMDLG32.dll10GetFileTitleW
COMDLG32.dll20PrintDlgExW
COMDLG32.dll12GetOpenFileNameW
COMDLG32.dll4CommDlgExtendedError
COMDLG32.dll23ReplaceTextW
SHELL32.dll298ShellAboutW
SHELL32.dll28DragFinish
SHELL32.dll149SHCreateItemFromParsingName
SHELL32.dll115SHAddToRecentDocs
SHELL32.dll32DragQueryFileW
SHELL32.dll27DragAcceptFiles
WINSPOOL.DRV150OpenPrinterW
WINSPOOL.DRV29ClosePrinter
WINSPOOL.DRV140GetPrinterDriverW
ole32.dll125CoTaskMemFree
ole32.dll124CoTaskMemAlloc
ole32.dll29CoCreateInstance
ole32.dll83CoInitializeEx
ole32.dll129CoUninitialize
SHLWAPI.dll263SHStrDupW
SHLWAPI.dll98PathIsFileSpecW
COMCTL32.dll12CreateStatusWindowW
COMCTL32.dll345
OLEAUT32.dll2
OLEAUT32.dll6
ntdll.dll1365RtlVirtualUnwind
ntdll.dll1102RtlLookupFunctionEntry
ntdll.dll688RtlCaptureContext
ntdll.dll1506WinSqmAddToStream

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionNotepad
FileVersion6.2.8400.0 (winmain_win8rc.120518-1423)
InternalNameNotepad
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameNOTEPAD.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.2.8400.0

VS_FIXEDFILEINFO

FileVersion6.2.8400.0
ProductVersion6.2.8400.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
24c3872024PNG(256 x 256)#
3659019568BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x2e8