filenameprocessing.exe
size77824 (0x13000)
md5b4ad40f0810b60072f4d807321ec3370
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

DOS stub

00000000: be 5b 00 00 01 ad 91 ad  93 53 ad 96 56 5f ac c0  |.[.......S..V_..|
00000010: c0 4b 04 f8 c0 c8 00 aa  e2 f4 c3 38 03 00 00 9d  |.K.........8....|
00000020: 73 00 01 00 10 00 01 4d  45 57 20 30 2e 31 20 62  |s......MEW 0.1 b|
00000030: 79 20 4e 6f 72 74 68 66  6f 78 00 4d 45 57 20 30  |y Northfox.MEW 0|
00000040: 2e 31 20 62 79 20 4e 6f  72 74 68 66 6f 78 00 4d  |.1 by Northfox.M|
00000050: 45 57 20 30 2e 31 20 62  79 20 4e 6f 72 74 68 66  |EW 0.1 by Northf|
00000060: 6f 78 00 4d 45 57 20 30  2e 31 20 62 79 20 4e 6f  |ox.MEW 0.1 by No|
00000070: 72 74 68 66 6f 78 00 4d  45 57 20 30 2e 31 20 62  |rthfox.MEW 0.1 b|
00000080: 79 20 4e 6f 72 74 68 66  6f 78 00 4d 45 57 20 30  |y Northfox.MEW 0|
00000090: 2e 31 20 62 79 20 4e 6f  72 74 68 66 6f 78 00 4d  |.1 by Northfox.M|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x48025287
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x7800
SizeOfInitializedData0x8800
SizeOfUninitializedData0
AddressOfEntryPoint0x739d
BaseOfCode0x1000
BaseOfData0x9000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion4.0
Reserved10
SizeOfImage0x13000
SizeOfHeaders0x400
CheckSum0x1458c
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x40000
SizeOfStackCommit0x11000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.x >> *SigBy Ahmed18

Sections

namevavsizeraw sizeflags
.text0x10000x77480x7748RWX CODE
.data0x90000x1ba80x1ba8RW- IDATA
.rsrc0xb0000x7fe80x7fe8R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x76040xc8
RESOURCE0xb0000x7fe8
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x13500x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x18a80x40
Bound_IAT0x2500xd0
IAT0x10000x348
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#116401252
ICON#27441252
ICON#32961252
ICON#437521252
ICON#522161252
ICON#613841252
ICON#796401252
ICON#842641252
ICON#911281252
MENU#18161252
DIALOGNPENCODINGDIALOG1281252
DIALOG#111961252
DIALOG#1211401252
DIALOG#142161252
STRING#17561252
STRING#27841252
STRING#32321252
STRING#30401252
ACCELERATORSMAINACC1361252
ACCELERATORSSLIPUPACC1681252
GROUP_ICON#21321252
VERSION#18801252
MANIFEST#16701252
idlangstring
11028無法開啟 %% 檔案。 請確定磁片位於您所指定的磁碟機內。
21028找不到 %% 檔案。 是否要建立新的檔案?
31028%% 檔案中的文字已經改變。 是否要儲存這些變更?
41028未命名
51028- 記事本
61028找不到 "%%"
71028沒有足夠的記憶體可供完成這項操作。請結束一個或數個應用程式，以增加可用記憶體，再試一次。
81028%% 檔案太大，記事本無法編輯。 請使用另一個編輯器來編輯此檔案。
91028記事本
101028無法初始化檔案對話。請先變更檔案名稱，然後再試一次。
111028無法初始化列印對話。請先確認您的印表機已正確連接，再使用控制台來確認印表機的設定正確。
121028無法列印 %% 檔案。請確定印表機已妥當連結，並使用 [控制台] 來驗證印表機是否已妥當配置。
131028不是一個有效的檔案名稱。
141028無法建立 %% 檔案。 請確定路徑和檔案名稱都是正確的。
151028因為檔案內有太多文字，所以無法執行 [自動換行] 命令。
161028%%
171028notepad.hlp
181028&f
191028第 &p 頁
201028文字文件(*.txt)
211028所有檔案
221028開啟舊檔
231028另存新檔
241028因為記事本中的 [另存新檔] 對話方塊未關閉， 因此您無法結束 Windows NT。請切換到記事本，關閉對話方框， 然後重試結束 Windows NT。
251028無法存取印表機。 請檢查印表機是否連接正確，並使用控制台檢查印表機是否安裝正確。
261028%% 您未擁有開啟此檔案的使用權限。請向檔案的擁有者或系統管理員詢問並取得使用權限。
271028%% 這個檔案包含 Unicode 格式字元，如果您以 ANSI 編碼的文字檔案來儲存這個檔案，將會遺失這些字元。若要保留 Unicode 資訊，請按下面的 [取消]，然後從編碼下拉清單中選擇一個 Unicode 選項，要繼續?
281028紙張小於行高，無法列印。 請換用較小的字型列印。
291028共用對話方塊發生錯誤 (0x%04x)
301028記事本 - 跳行
311028行數超過範圍
321028ANSI
331028Unicode
341028Unicode big endian
351028UTF-8
361028Page %d
371028第 %d 列，第 %d 行
381028壓縮，
391028加密，
401028隱藏，
411028離線，
421028唯讀，
431028系統，
441028檔案
451028fFpPtTdDcCrRlL
4691028文字文件
module_namehintordfunction_name
comdlg32.dll15PageSetupDlgW
comdlg32.dll6FindTextW
comdlg32.dll18PrintDlgExW
comdlg32.dll3ChooseFontW
comdlg32.dll8GetFileTitleW
comdlg32.dll10GetOpenFileNameW
comdlg32.dll21ReplaceTextW
comdlg32.dll4CommDlgExtendedError
comdlg32.dll12GetSaveFileNameW
comdlg32.dll731464232
comdlg32.dll730932334
comdlg32.dll731505692
comdlg32.dll730928647
comdlg32.dll730403112
comdlg32.dll730977252
comdlg32.dll730934280
comdlg32.dll730986665
comdlg32.dll730979153
SHELL32.dll31DragFinish
SHELL32.dll35DragQueryFileW
SHELL32.dll30DragAcceptFiles
SHELL32.dll259ShellAboutW
SHELL32.dll1662772154
SHELL32.dll1676285099
SHELL32.dll1676840386
SHELL32.dll1662218613
WINSPOOL.DRV120GetPrinterDriverW
WINSPOOL.DRV27ClosePrinter
WINSPOOL.DRV126OpenPrinterW
WINSPOOL.DRV196549593
WINSPOOL.DRV196567802
WINSPOOL.DRV196573828
COMCTL32.dll8CreateStatusWindowW
COMCTL32.dll867733115
msvcrt.dll78_XcptFilter
msvcrt.dll246_exit
msvcrt.dll197_c_exit
msvcrt.dll791time
msvcrt.dll724localtime
msvcrt.dll200_cexit
msvcrt.dll710iswctype
msvcrt.dll237_except_handler3
msvcrt.dll628_wtol
msvcrt.dll815wcsncmp
msvcrt.dll484_snwprintf
msvcrt.dll656exit
msvcrt.dll168_acmdln
msvcrt.dll109__getmainargs
msvcrt.dll315_initterm
msvcrt.dll154__setusermatherr
msvcrt.dll182_adjust_fdiv
msvcrt.dll128__p__commode
msvcrt.dll133__p__fmode
msvcrt.dll152__set_app_type
msvcrt.dll214_controlfp
msvcrt.dll816wcsncpy
msvcrt.dll872309101
msvcrt.dll872344780
msvcrt.dll872344686
msvcrt.dll856059254
msvcrt.dll856053059
msvcrt.dll872344749
msvcrt.dll871202473
msvcrt.dll872340124
msvcrt.dll871198387
msvcrt.dll856095857
msvcrt.dll872339288
msvcrt.dll872344811
msvcrt.dll857124957
msvcrt.dll871198551
msvcrt.dll872342579
msvcrt.dll856075940
msvcrt.dll857084350
msvcrt.dll871204637
msvcrt.dll871204822
ADVAPI32.dll495RegQueryValueExW
ADVAPI32.dll458RegCloseKey
ADVAPI32.dll464RegCreateKeyW
ADVAPI32.dll313IsTextUnicode
ADVAPI32.dll494RegQueryValueExA
ADVAPI32.dll484RegOpenKeyExA
ADVAPI32.dll508RegSetValueExW
ADVAPI32.dll869168119
ADVAPI32.dll869161777
ADVAPI32.dll870239650
ADVAPI32.dll870245793
ADVAPI32.dll869190613
ADVAPI32.dll869186442
ADVAPI32.dll869185075
KERNEL32.dll318GetCurrentThreadId
KERNEL32.dll468GetTickCount
KERNEL32.dll660QueryPerformanceCounter
KERNEL32.dll362GetLocalTime
KERNEL32.dll472GetUserDefaultLCID
KERNEL32.dll320GetDateFormatW
KERNEL32.dll470GetTimeFormatW
KERNEL32.dll504GlobalLock
KERNEL32.dll511GlobalUnlock
KERNEL32.dll346GetFileInformationByHandle
KERNEL32.dll81CreateFileMappingW
KERNEL32.dll448GetSystemTimeAsFileTime
KERNEL32.dll842TerminateProcess
KERNEL32.dll315GetCurrentProcess
KERNEL32.dll822SetUnhandledExceptionFilter
KERNEL32.dll580LoadLibraryA
KERNEL32.dll374GetModuleHandleA
KERNEL32.dll430GetStartupInfoA
KERNEL32.dll500GlobalFree
KERNEL32.dll364GetLocaleInfoW
KERNEL32.dll590LocalFree
KERNEL32.dll586LocalAlloc
KERNEL32.dll952lstrlenW
KERNEL32.dll596LocalUnlock
KERNEL32.dll56CompareStringW
KERNEL32.dll592LocalLock
KERNEL32.dll234FoldStringW
KERNEL32.dll49CloseHandle
KERNEL32.dll946lstrcpyW
KERNEL32.dll678ReadFile
KERNEL32.dll82CreateFileW
KERNEL32.dll943lstrcmpiW
KERNEL32.dll316GetCurrentProcessId
KERNEL32.dll408GetProcAddress
KERNEL32.dll266GetCommandLineW
KERNEL32.dll937lstrcatW
KERNEL32.dll204FindClose
KERNEL32.dll211FindFirstFileW
KERNEL32.dll345GetFileAttributesW
KERNEL32.dll940lstrcmpW
KERNEL32.dll614MulDiv
KERNEL32.dll949lstrcpynW
KERNEL32.dll595LocalSize
KERNEL32.dll360GetLastError
KERNEL32.dll911WriteFile
KERNEL32.dll790SetLastError
KERNEL32.dll898WideCharToMultiByte
KERNEL32.dll593LocalReAlloc
KERNEL32.dll236FormatMessageW
KERNEL32.dll474GetUserDefaultUILanguage
KERNEL32.dll768SetEndOfFile
KERNEL32.dll130DeleteFileW
KERNEL32.dll246GetACP
KERNEL32.dll862UnmapViewOfFile
KERNEL32.dll615MultiByteToWideChar
KERNEL32.dll602MapViewOfFile
KERNEL32.dll859UnhandledExceptionFilter
KERNEL32.dll1543287934
KERNEL32.dll1543279690
KERNEL32.dll1543249206
KERNEL32.dll1543257499
KERNEL32.dll1543304317
KERNEL32.dll1528038051
KERNEL32.dll1528054422
KERNEL32.dll1543305031
KERNEL32.dll1543305098
KERNEL32.dll1527021607
KERNEL32.dll1543281881
KERNEL32.dll1543286855
KERNEL32.dll1543301320
KERNEL32.dll1543302820
KERNEL32.dll1528578662
KERNEL32.dll1543299283
KERNEL32.dll1543288066
KERNEL32.dll1543301263
KERNEL32.dll1543299063
KERNEL32.dll1527040206
KERNEL32.dll1543292022
KERNEL32.dll1543294049
KERNEL32.dll1543294021
KERNEL32.dll1528084869
KERNEL32.dll1543247343
KERNEL32.dll1528084960
KERNEL32.dll1530148207
KERNEL32.dll1543296055
KERNEL32.dll1543296280
KERNEL32.dll1543288968
KERNEL32.dll1527011526
KERNEL32.dll1543261609
KERNEL32.dll1543292158
KERNEL32.dll1543269882
KERNEL32.dll1527034832
KERNEL32.dll1527027789
KERNEL32.dll1543270364
KERNEL32.dll1543270371
KERNEL32.dll1543288159
KERNEL32.dll1543261531
KERNEL32.dll1543289899
KERNEL32.dll1543294324
KERNEL32.dll1528066525
KERNEL32.dll1535962881
KERNEL32.dll1527023863
KERNEL32.dll1535963001
KERNEL32.dll1543243163
KERNEL32.dll1527026175
KERNEL32.dll1528078964
KERNEL32.dll1527029504
KERNEL32.dll1528056106
KERNEL32.dll1528054161
KERNEL32.dll1543292069
KERNEL32.dll1543294360
KERNEL32.dll1543298236
KERNEL32.dll1543292197
KERNEL32.dll1529674250
GDI32.dll152EndPage
GDI32.dllAbortDoc
GDI32.dll150EndDoc
GDI32.dll140DeleteDC
GDI32.dll585StartPage
GDI32.dll438GetTextExtentPoint32W
GDI32.dll47CreateDCW
GDI32.dll529SetAbortProc
GDI32.dll444GetTextFaceW
GDI32.dll592TextOutW
GDI32.dll583StartDocW
GDI32.dll206EnumFontsW
GDI32.dll422GetStockObject
GDI32.dll408GetObjectW
GDI32.dll364GetDeviceCaps
GDI32.dll61CreateFontIndirectW
GDI32.dll143DeleteObject
GDI32.dll446GetTextMetricsW
GDI32.dll535SetBkMode
GDI32.dll460LPtoDP
GDI32.dll579SetWindowExtEx
GDI32.dll575SetViewportExtEx
GDI32.dll556SetMapMode
GDI32.dll527SelectObject
GDI32.dll864017923
GDI32.dll865032846
GDI32.dll864022151
GDI32.dll863464434
GDI32.dll864002028
GDI32.dll863499236
GDI32.dll863497657
GDI32.dll865034895
GDI32.dll863446358
GDI32.dll863497053
GDI32.dll865059339
GDI32.dll864546744
GDI32.dll863437574
GDI32.dll863442069
GDI32.dll863488643
GDI32.dll863474924
GDI32.dll863458255
GDI32.dll863495109
GDI32.dll863496918
GDI32.dll863477302
GDI32.dll863996830
GDI32.dll863998947
GDI32.dll863476976
GDI32.dll863490683
USER32.dll255GetClientRect
USER32.dll589SetCursor
USER32.dll554ReleaseDC
USER32.dll268GetDC
USER32.dll159DialogBoxParamW
USER32.dll579SetActiveWindow
USER32.dll290GetKeyboardLayout
USER32.dll143DefWindowProcW
USER32.dll153DestroyWindow
USER32.dll475MessageBeep
USER32.dll658ShowWindow
USER32.dll279GetForegroundWindow
USER32.dll422IsIconic
USER32.dll371GetWindowPlacement
USER32.dll55CharUpperW
USER32.dll457LoadStringW
USER32.dll436LoadAcceleratorsW
USER32.dll348GetSystemMenu
USER32.dll536RegisterClassExW
USER32.dll446LoadImageW
USER32.dll442LoadCursorW
USER32.dll642SetWindowPlacement
USER32.dll97CreateWindowExW
USER32.dll270GetDesktopWindow
USER32.dll278GetFocus
USER32.dll444LoadIconW
USER32.dll647SetWindowTextW
USER32.dll513PostQuitMessage
USER32.dll552RegisterWindowMessageW
USER32.dll699UpdateWindow
USER32.dll623SetScrollPos
USER32.dll41CharLowerW
USER32.dll510PeekMessageW
USER32.dll196EnableWindow
USER32.dll190DrawTextExW
USER32.dll86CreateDialogParamW
USER32.dll378GetWindowTextW
USER32.dll349GetSystemMetrics
USER32.dll489MoveWindow
USER32.dll403InvalidateRect
USER32.dll723WinHelpW
USER32.dll272GetDlgCtrlID
USER32.dll60ChildWindowFromPoint
USER32.dll561ScreenToClient
USER32.dll267GetCursorPos
USER32.dll567SendDlgItemMessageW
USER32.dll576SendMessageW
USER32.dll44CharNextW
USER32.dll57CheckMenuItem
USER32.dll66CloseClipboard
USER32.dll415IsClipboardFormatAvailable
USER32.dll499OpenClipboard
USER32.dll311GetMenuState
USER32.dll194EnableMenuItem
USER32.dll345GetSubMenu
USER32.dll300GetMenu
USER32.dll483MessageBoxW
USER32.dll641SetWindowLongW
USER32.dll367GetWindowLongW
USER32.dll273GetDlgItem
USER32.dll598SetFocus
USER32.dll596SetDlgItemTextW
USER32.dll729wsprintfW
USER32.dll276GetDlgItemTextW
USER32.dll198EndDialog
USER32.dll325GetParent
USER32.dll684UnhookWinEvent
USER32.dll162DispatchMessageW
USER32.dll682TranslateMessage
USER32.dll680TranslateAcceleratorW
USER32.dll418IsDialogMessageW
USER32.dll512PostMessageW
USER32.dll318GetMessageW
USER32.dll638SetWinEventHook
USER32.dll864975980
USER32.dll864994425
USER32.dll864431332
USER32.dll864431158
USER32.dll864957013
USER32.dll864992009
USER32.dll864998575
USER32.dll864969977
USER32.dll864978396
USER32.dll865530067
USER32.dll864974250
USER32.dll864992273
USER32.dll864990455
USER32.dll865472566
USER32.dll864451726
USER32.dll864480425
USER32.dll864972715
USER32.dll864980233
USER32.dll864450035
USER32.dll864998324
USER32.dll864478275
USER32.dll864480810
USER32.dll864976405
USER32.dll864978574
USER32.dll864992318
USER32.dll864960477
USER32.dll864988264
USER32.dll864964298
USER32.dll864449945
USER32.dll864972117
USER32.dll864991098
USER32.dll864980314
USER32.dll864455892
USER32.dll864992322
USER32.dll864984480
USER32.dll864440273
USER32.dll864953702
USER32.dll864449756
USER32.dll864980460
USER32.dll864973990
USER32.dll867094686
USER32.dll864974288
USER32.dll865008112
USER32.dll864990461
USER32.dll864990314
USER32.dll864981854
USER32.dll864980172
USER32.dll864978301
USER32.dll865519845
USER32.dll865470499
USER32.dll864978731
USER32.dll865470643
USER32.dll864470835
USER32.dll864980510
USER32.dll864992940
USER32.dll865507533
USER32.dll867050393
USER32.dll864947925
USER32.dll864435245
USER32.dll864948843
USER32.dll864978312
USER32.dll864981851
USER32.dll864437677
USER32.dll864948768
USER32.dll864963178
USER32.dll864978032
USER32.dll865515613
USER32.dll864439296
USER32.dll864441519
USER32.dll864460008
USER32.dll864983833
USER32.dll864443478
USER32.dll864453678
USER32.dll865513655

StringTable 040404B0

CompanyNameMicrosoft Corporation
FileDescriptionNotepad
FileVersion5.1.2600.5512 (xpsp.080413-2105)
InternalNameNotepad
LegalCopyright(C) Microsoft Corporation. All rights reserved.
OriginalFilenameNOTEPAD.EXE
ProductNameMicrosoft(R) Windows(R) Operating System
ProductVersion5.1.2600.5512

VS_FIXEDFILEINFO

FileVersion5.1.2600.5512
ProductVersion5.1.2600.5512
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
077800EXE04/13/2008 18:35:51#
15c115HTM#
12fe824BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 77824 bytes (76 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[?] can't find file_offset of VA 0x250