filenamenm-launcher.exe
size131117 (0x2002d)
md578bf6bcaad0c84d5f0c31e33b8d7d5bb
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections0x12
TimeDateStamp0x5c6f26b2
PointerToSymbolTable0x13e00
NumberOfSymbols0x864
SizeOfOptionalHeader0xf0
Characteristics0x26
Magic0x20b
LinkerVersion2.30
SizeOfCode0x9000
SizeOfInitializedData0x10c00
SizeOfUninitializedData0x1400
AddressOfEntryPoint0x14b0
BaseOfCode0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x21000
SizeOfHeaders0x600
CheckSum0x226c2
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x8fb80x9000R-X CODE IDATA
.data0xa0000x1400x200RW- IDATA
.rdata0xb0000x11c00x1200R-- IDATA
.pdata0xd0000x7380x800R-- IDATA
.xdata0xe0000x6a00x800R-- IDATA
.bss0xf0000x13e00RW- UDATA
.edata0x110000x720x200R-- IDATA
.idata0x120000xef40x1000RW- IDATA
.CRT0x130000x680x200RW- IDATA
.tls0x140000x100x200RW- IDATA
.rsrc0x150000x3f900x4000RW- IDATA
.reloc0x190000x900x200R-- IDATA DISCARDABLE
/40x1a0000x500x200R-- IDATA DISCARDABLE
/190x1b0000x1f080x2000R-- IDATA DISCARDABLE
/310x1d0000x1490x200R-- IDATA DISCARDABLE
/450x1e0000x2220x400R-- IDATA DISCARDABLE
/570x1f0000x480x200R-- IDATA DISCARDABLE
/700x200000x9b0x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x110000x72
IMPORT0x120000xef4
RESOURCE0x150000x3f90
EXCEPTION0xd0000x738
SECURITY00
BASERELOC0x190000x90
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0xb7c00x28
LOAD_CONFIG00
Bound_IAT00
IAT0x123a40x340
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4140000x4140080x40f65c0x41304000
typenamesizecp
ICON#111280
ICON#242640
ICON#396400
GROUP_ICONID480
VERSION#18520
module_namehintordfunction_name
ADVAPI32.dll1101CloseServiceHandle
ADVAPI32.dll1106ControlService
ADVAPI32.dll1143CreateServiceA
ADVAPI32.dll1234DeleteService
ADVAPI32.dll1235DeregisterEventSource
ADVAPI32.dll1531OpenSCManagerA
ADVAPI32.dll1533OpenServiceA
ADVAPI32.dll1582QueryServiceConfigA
ADVAPI32.dll1596RegCloseKey
ADVAPI32.dll1644RegOpenKeyExA
ADVAPI32.dll1657RegQueryValueExA
ADVAPI32.dll1678RegisterEventSourceA
ADVAPI32.dll1681RegisterServiceCtrlHandlerA
ADVAPI32.dll1694ReportEventA
ADVAPI32.dll1746SetServiceStatus
ADVAPI32.dll1752StartServiceA
ADVAPI32.dll1753StartServiceCtrlDispatcherA
KERNEL32.dll131CloseHandle
KERNEL32.dll222CreateProcessA
KERNEL32.dll269DeleteCriticalSection
KERNEL32.dll305EnterCriticalSection
KERNEL32.dll536GetCurrentProcess
KERNEL32.dll537GetCurrentProcessId
KERNEL32.dll541GetCurrentThreadId
KERNEL32.dll610GetLastError
KERNEL32.dll629GetModuleFileNameA
KERNEL32.dll690GetProcAddress
KERNEL32.dll722GetStartupInfoA
KERNEL32.dll747GetSystemTimeAsFileTime
KERNEL32.dll775GetTickCount
KERNEL32.dll864InitializeCriticalSection
KERNEL32.dll890IsDBCSLeadByteEx
KERNEL32.dll952LeaveCriticalSection
KERNEL32.dll955LoadLibraryA
KERNEL32.dll1000MultiByteToWideChar
KERNEL32.dll1094QueryPerformanceCounter
KERNEL32.dll1180RtlAddFunctionTable
KERNEL32.dll1181RtlCaptureContext
KERNEL32.dll1188RtlLookupFunctionEntry
KERNEL32.dll1195RtlVirtualUnwind
KERNEL32.dll1347SetUnhandledExceptionFilter
KERNEL32.dll1361Sleep
KERNEL32.dll1376TerminateProcess
KERNEL32.dll1396TlsGetValue
KERNEL32.dll1410UnhandledExceptionFilter
KERNEL32.dll1444VirtualProtect
KERNEL32.dll1446VirtualQuery
KERNEL32.dll1454WaitForSingleObject
KERNEL32.dll1491WideCharToMultiByte
msvcrt.dll56__C_specific_handler
msvcrt.dll64___lc_codepage_func
msvcrt.dll67___mb_cur_max_func
msvcrt.dll82__getmainargs
msvcrt.dll83__initenv
msvcrt.dll84__iob_func
msvcrt.dll91__lconv_init
msvcrt.dll97__set_app_type
msvcrt.dll99__setusermatherr
msvcrt.dll115_acmdln
msvcrt.dll123_amsg_exit
msvcrt.dll141_cexit
msvcrt.dll201_errno
msvcrt.dll253_fmode
msvcrt.dll295_getch
msvcrt.dll331_initterm
msvcrt.dll440_lock
msvcrt.dll611_onexit
msvcrt.dll643_rmdir
msvcrt.dll813_unlock
msvcrt.dll1031abort
msvcrt.dll1050calloc
msvcrt.dll1063exit
msvcrt.dll1067fclose
msvcrt.dll1080fopen
msvcrt.dll1082fprintf
msvcrt.dll1084fputc
msvcrt.dll1089free
msvcrt.dll1101fwrite
msvcrt.dll1141localeconv
msvcrt.dll1148malloc
msvcrt.dll1156memcpy
msvcrt.dll1162perror
msvcrt.dll1169puts
msvcrt.dll1177remove
msvcrt.dll1178rename
msvcrt.dll1186signal
msvcrt.dll1197strcat
msvcrt.dll1202strcpy
msvcrt.dll1205strerror
msvcrt.dll1207strlen
msvcrt.dll1208strncat
msvcrt.dll1210strncmp
msvcrt.dll1236tolower
msvcrt.dll1242vfprintf
msvcrt.dll1263wcslen
USER32.dll573LoadCursorA
USER32.dll613MessageBoxA
USER32.dll656PostQuitMessage
USER32.dll770SetCursor
USER32.dll958wsprintfA
ordentry_vafunction_name
10x32b0_Z14logger_messagePKcS0_
20x32d0logger_close
module_namenm-launcher.exe
flags0
timestamp2019-02-21 22:31:14
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0x11030
Functions(2)0x11028
NameOrdinals(2)0x11038

StringTable 080904E4

CompanyNamenotesoft group ltd.
FileDescriptionNOTEMATRIXВ® EPR-system
FileVersion3.0.0.0
InternalNamexxxxxxx
LegalCopyright2011-2019 NOTESOFT GROUP, 1998-2019 Sergey Khalyutin
OriginalFilenamenotematrix.exe
ProductNameNOTEMATRIXВ® EPR-system
ProductVersion3.0.0.${PRODUCT_VER}

VS_FIXEDFILEINFO

FileVersion3.0.0.0
ProductVersion3.0.0.0
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS0
FileType0
FileSubtype0
offsetsizetypecomment
0131117EXE02/21/2019 22:31:14#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0xf65c