filenamenotepad.exe
size212992 (0x34000)
md59d12a01443d52bb25a8ad0f100f91b83
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
207655011
205655013
2066550122
2036550127
10219
2106550119
201655011
204655011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x559ea1b6
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion11.0
SizeOfCode0x16000
SizeOfInitializedData0x1ee00
SizeOfUninitializedData0
AddressOfEntryPoint0x62f0
BaseOfCode0x1000
BaseOfData0x17000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.3
ImageVersion6.3
SubsystemVersion6.3
Reserved10
SizeOfImage0x38000
SizeOfHeaders0x400
CheckSum0x36ede
Subsystem2
DllCharacteristics0xc140
SizeOfStackReserve0x40000
SizeOfStackCommit0x11000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x15e900x16000R-X CODE
.data0x170000x23080x1200RW- IDATA
.idata0x1a0000x16960x1800R-- IDATA
.rsrc0x1c0000x19af00x19c00R-- IDATA
.reloc0x360000x14f40x1600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1a3900x118
RESOURCE0x1c0000x19af0
EXCEPTION00
SECURITY00
BASERELOC0x360000x14f4
DEBUG0x16e300x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x11a00x5c
Bound_IAT00
IAT0x1a0000x38c
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12320
ICON#116400
ICON#27440
ICON#34880
ICON#42960
ICON#537520
ICON#622160
ICON#717360
ICON#813840
ICON#9720240
ICON#1096400
ICON#1142640
ICON#1224400
ICON#1311280
GROUP_ICON#21880
VERSION#18840
MANIFEST#111700
module_namehintordfunction_name
ADVAPI32.dll658RegQueryValueExW
ADVAPI32.dll608RegCreateKeyW
ADVAPI32.dll596RegCloseKey
ADVAPI32.dll645RegOpenKeyExW
ADVAPI32.dll237DuplicateEncryptionInfoFile
ADVAPI32.dll406IsTextUnicode
ADVAPI32.dll674RegSetValueExW
KERNEL32.dll949LocalReAlloc
KERNEL32.dll1413UnmapViewOfFile
KERNEL32.dll378FindNLSString
KERNEL32.dll791GlobalAlloc
KERNEL32.dll593GetLocalTime
KERNEL32.dll531GetDateFormatW
KERNEL32.dll759GetTimeFormatW
KERNEL32.dll802GlobalLock
KERNEL32.dll809GlobalUnlock
KERNEL32.dll767GetUserDefaultUILanguage
KERNEL32.dll977MultiByteToWideChar
KERNEL32.dll960MapViewOfFile
KERNEL32.dll191CreateFileMappingW
KERNEL32.dll567GetFileInformationByHandle
KERNEL32.dll1258SetEndOfFile
KERNEL32.dll266DeleteFileW
KERNEL32.dll420GetACP
KERNEL32.dll565GetFileAttributesW
KERNEL32.dll1505WriteFile
KERNEL32.dll1291SetLastError
KERNEL32.dll1485WideCharToMultiByte
KERNEL32.dll702GetStartupInfoW
KERNEL32.dll592GetLastError
KERNEL32.dll951LocalSize
KERNEL32.dll585GetFullPathNameW
KERNEL32.dll407FoldStringW
KERNEL32.dll952LocalUnlock
KERNEL32.dll948LocalLock
KERNEL32.dll410FormatMessageW
KERNEL32.dll360FindClose
KERNEL32.dll371FindFirstFileW
KERNEL32.dll1535lstrcmpW
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll614GetModuleHandleExW
KERNEL32.dll611GetModuleFileNameW
KERNEL32.dll674GetProcessHeap
KERNEL32.dll819HeapFree
KERNEL32.dll815HeapAlloc
KERNEL32.dll669GetProcAddress
KERNEL32.dll754GetTickCount
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll823HeapSetInformation
KERNEL32.dll457GetCommandLineW
KERNEL32.dll1547lstrlenW
KERNEL32.dll976MulDiv
KERNEL32.dll596GetLocaleInfoW
KERNEL32.dll798GlobalFree
KERNEL32.dll942LocalAlloc
KERNEL32.dll127CloseHandle
KERNEL32.dll1104ReadFile
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll194CreateFileW
KERNEL32.dll1263SetErrorMode
KERNEL32.dll1538lstrcmpiW
KERNEL32.dll946LocalFree
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll612GetModuleHandleA
KERNEL32.dll1377TerminateProcess
KERNEL32.dll1362Sleep
KERNEL32.dll701GetStartupInfoA
KERNEL32.dll1410UnhandledExceptionFilter
KERNEL32.dll1347SetUnhandledExceptionFilter
KERNEL32.dll521GetCurrentProcess
GDI32.dll51CreateDCW
GDI32.dll784StartPage
GDI32.dll782StartDocW
GDI32.dll727SetAbortProc
GDI32.dll268DeleteDC
GDI32.dll280EndDoc
GDI32.dllAbortDoc
GDI32.dll283EndPage
GDI32.dll594GetTextMetricsW
GDI32.dll733SetBkMode
GDI32.dll608LPtoDP
GDI32.dll778SetWindowExtEx
GDI32.dll774SetViewportExtEx
GDI32.dll754SetMapMode
GDI32.dll586GetTextExtentPoint32W
GDI32.dll791TextOutW
GDI32.dll337EnumFontsW
GDI32.dll592GetTextFaceW
GDI32.dll725SelectObject
GDI32.dll271DeleteObject
GDI32.dll65CreateFontIndirectW
GDI32.dll503GetDeviceCaps
USER32.dll881WinHelpW
USER32.dll307GetCursorPos
USER32.dll685ScreenToClient
USER32.dll69ChildWindowFromPoint
USER32.dll378GetParent
USER32.dll458GetWindowPlacement
USER32.dll60CharUpperW
USER32.dll425GetSystemMenu
USER32.dll539LoadAcceleratorsW
USER32.dll781SetWindowLongW
USER32.dll675RegisterWindowMessageW
USER32.dll545LoadCursorW
USER32.dll113CreateWindowExW
USER32.dll782SetWindowPlacement
USER32.dll549LoadImageW
USER32.dll649RegisterClassExW
USER32.dll758SetScrollPos
USER32.dll495InvalidateRect
USER32.dll855UpdateWindow
USER32.dll465GetWindowTextLengthW
USER32.dll453GetWindowLongW
USER32.dll620PeekMessageW
USER32.dll466GetWindowTextW
USER32.dll228EnableWindow
USER32.dll102CreateDialogParamW
USER32.dll213DrawTextExW
USER32.dll315GetDlgCtrlID
USER32.dll691SendDlgItemMessageW
USER32.dll231EndDialog
USER32.dll319GetDlgItemTextW
USER32.dll722SetDlgItemTextW
USER32.dll75CloseClipboard
USER32.dll507IsClipboardFormatAvailable
USER32.dll606OpenClipboard
USER32.dll364GetMenuState
USER32.dll788SetWindowTextW
USER32.dll833UnhookWinEvent
USER32.dll181DispatchMessageW
USER32.dll831TranslateMessage
USER32.dll829TranslateAcceleratorW
USER32.dll510IsDialogMessageW
USER32.dll371GetMessageW
USER32.dll773SetWinEventHook
USER32.dll49CharNextW
USER32.dll340GetKeyboardLayout
USER32.dll323GetForegroundWindow
USER32.dll581MessageBeep
USER32.dll173DestroyWindow
USER32.dll625PostQuitMessage
USER32.dll514IsIconic
USER32.dll161DefWindowProcW
USER32.dll703SetActiveWindow
USER32.dll713SetCursor
USER32.dll677ReleaseDC
USER32.dll308GetDC
USER32.dll800ShowWindow
USER32.dll293GetClientRect
USER32.dll63CheckMenuItem
USER32.dll589MessageBoxW
USER32.dll322GetFocus
USER32.dll547LoadIconW
USER32.dll178DialogBoxParamW
USER32.dll724SetFocus
USER32.dll422GetSubMenu
USER32.dll224EnableMenuItem
USER32.dll353GetMenu
USER32.dll624PostMessageW
USER32.dll595MoveWindow
USER32.dll700SendMessageW
USER32.dll560LoadStringW
msvcrt.dll1006_vsnwprintf
msvcrt.dll113_XcptFilter
msvcrt.dll1332strchr
msvcrt.dll1291memcpy
msvcrt.dll1261iswctype
msvcrt.dll1166_wtol
msvcrt.dll364_except_handler4_common
msvcrt.dll203__p__commode
msvcrt.dll275_amsg_exit
msvcrt.dll313_controlfp
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll249_acmdln
msvcrt.dll490_initterm
msvcrt.dll230__setusermatherr
msvcrt.dll521_ismbblead
msvcrt.dll208__p__fmode
msvcrt.dll294_cexit
msvcrt.dll373_exit
msvcrt.dll1200exit
msvcrt.dll228__set_app_type
msvcrt.dll163__getmainargs
msvcrt.dll1295memset
COMDLG32.dll4CommDlgExtendedError
COMDLG32.dll12GetOpenFileNameW
COMDLG32.dll14GetSaveFileNameW
COMDLG32.dll23ReplaceTextW
COMDLG32.dll8FindTextW
COMDLG32.dll17PageSetupDlgW
COMDLG32.dll3ChooseFontW
COMDLG32.dll10GetFileTitleW
COMDLG32.dll20PrintDlgExW
SHELL32.dll154SHCreateItemFromParsingName
SHELL32.dll303ShellAboutW
SHELL32.dll36DragQueryFileW
SHELL32.dll32DragFinish
SHELL32.dll31DragAcceptFiles
SHELL32.dll120SHAddToRecentDocs
WINSPOOL.DRV140GetPrinterDriverW
WINSPOOL.DRV29ClosePrinter
WINSPOOL.DRV150OpenPrinterW
ole32.dll26CoCreateInstance
ole32.dll122CoTaskMemAlloc
ole32.dll123CoTaskMemFree
ole32.dll80CoInitializeEx
ole32.dll127CoUninitialize
SHLWAPI.dll264SHStrDupW
SHLWAPI.dll97PathIsFileSpecW
COMCTL32.dll12CreateStatusWindowW
COMCTL32.dll345
OLEAUT32.dll6
OLEAUT32.dll2
ntdll.dll1515WinSqmAddToStream

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionNotepad
FileVersion6.3.9600.17930 (winblue_ltsb.150709-0600)
InternalNameNotepad
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameNOTEPAD.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.3.9600.17930

VS_FIXEDFILEINFO

FileVersion6.3.9600.17930
ProductVersion6.3.9600.17930
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0212992EXE07/09/2015 16:30:46#
15c115HTM#
1c63872024PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER