filename | h.exe | |
---|---|---|
size | 514560 (0x7da00) | |
md5 | 7db59fff2af32c27eb2276424fa5eddb | |
type | PE32 executable (GUI) Intel 80386, for MS Windows | |
mimetype | application/x-dosexec | |
clamav | OK | |
virustotal | → scan with virustotal.com | |
histogram |
MZ Header
signature | MZ |
bytes_in_last_block | 0x90 |
blocks_in_file | 3 |
num_relocs | 0 |
header_paragraphs | 4 |
min_extra_paragraphs | 0 |
max_extra_paragraphs | 0xffff |
ss | 0 |
sp | 0xb8 |
checksum | 0 |
ip | 0 |
cs | 0 |
reloc_table_offset | 0x40 |
overlay_number | 0 |
reserved0 | 0 |
oem_id | 0 |
oem_info | 0 |
reserved2 | 0 |
reserved3 | 0 |
reserved4 | 0 |
reserved5 | 0 |
reserved6 | 0 |
lfanew | 0xd8 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Packer / Compiler
Sections
name | va | vsize | raw size | flags | |
---|---|---|---|---|---|
.text | 0x1000 | 0x26fc6 | 0x27000 | R-X CODE | |
.data | 0x28000 | 0x16440 | 0x5a00 | RW- IDATA | |
.rsrc | 0x3f000 | 0x50c00 | 0x50c00 | R-- IDATA |
Data Directory
id | lang | string |
---|---|---|
1 | 1033 | arial |
2 | 1033 | tahoma |
3 | 1033 | tahoma |
6 | 1033 | Type your password |
7 | 1033 | welcome |
8 | 1033 | Please type your password again. Be sure to use the correct uppercase and lowercase letters. |
9 | 1033 | You can click the "?" button to see your password hint. Please type your password again. Be sure to use the correct uppercase and lowercase letters. |
10 | 1033 | Did you forget your password? |
11 | 1033 | Turn off computer |
12 | 1033 | Turn off %s |
13 | 1033 | Password Hint: |
14 | 1033 | Undock computer |
15 | 1033 | Logged on |
16 | 1033 | Currently logged on |
17 | 1033 | Undock %s |
18 | 1033 | You can <A>use your password reset disk</A>. Please type your password again. Be sure to use the correct uppercase and lowercase letters. |
19 | 1033 | You can click the "?" button to see your password hint. Or you can <A>use your password reset disk</A>. Please type your password again. Be sure to use the correct uppercase and lowercase letters. |
22 | 1033 | To begin, click your user name |
25 | 1033 | After you log on, you can add or change accounts. Just go to Control Panel and click User Accounts. |
26 | 1033 | Logging on... |
27 | 1033 | %d unread mail message. |
28 | 1033 | %d unread mail messages. |
29 | 1033 | %d program running. |
30 | 1033 | %d programs running. |
31 | 1033 | please wait... |
32 | 1033 | %s has %d program running |
33 | 1033 | %s has %d programs running |
34 | 1033 | Running too many programs can slow down your computer. If your computer is running more slowly than normal, try closing some programs. |
35 | 1033 | %s has %d e-mail message |
36 | 1033 | %s has %d e-mail messages |
37 | 1033 | To read your messages, log on and choose E-mail from the Start menu. |
38 | 1033 | %s is logged on |
39 | 1033 | Running too many programs may slow down your computer. If your computer is running more slowly than normal, try logging some users off. |
40 | 1033 | %s (%d) |
42 | 1033 | 14 |
43 | 1033 | 9 |
44 | 1033 | 36 |
45 | 1033 | 14 |
46 | 1033 | 8 |
47 | 1033 | 8 |
48 | 1033 | arial |
100 | 1033 | Log user on |
module_name | hint | ord | function_name |
---|---|---|---|
msvcrt.dll | 436 | _onexit | |
msvcrt.dll | 18 | void __cdecl operator delete(void *) ??3@YAXPAX@Z | |
msvcrt.dll | 786 | swprintf | |
msvcrt.dll | 553 | _wcsicmp | |
msvcrt.dll | 449 | _purecall | |
msvcrt.dll | 810 | wcscpy | |
msvcrt.dll | 747 | qsort | |
msvcrt.dll | 197 | _c_exit | |
msvcrt.dll | 246 | _exit | |
msvcrt.dll | 319 | _iob | |
msvcrt.dll | 685 | fwrite | |
msvcrt.dll | 783 | strtol | |
msvcrt.dll | 626 | _wtoi | |
msvcrt.dll | 353 | _itow | |
msvcrt.dll | 280 | _ftol | |
msvcrt.dll | 735 | memmove | |
msvcrt.dll | 484 | _snwprintf | |
msvcrt.dll | 816 | wcsncpy | |
msvcrt.dll | 808 | wcscmp | |
msvcrt.dll | 813 | wcslen | |
msvcrt.dll | 214 | _controlfp | |
msvcrt.dll | 644 | atoi | |
msvcrt.dll | 106 | __dllonexit | |
msvcrt.dll | 237 | _except_handler3 | |
msvcrt.dll | 152 | __set_app_type | |
msvcrt.dll | 133 | __p__fmode | |
msvcrt.dll | 128 | __p__commode | |
msvcrt.dll | 182 | _adjust_fdiv | |
msvcrt.dll | 154 | __setusermatherr | |
msvcrt.dll | 315 | _initterm | |
msvcrt.dll | 109 | __getmainargs | |
msvcrt.dll | 168 | _acmdln | |
msvcrt.dll | 656 | exit | |
msvcrt.dll | 200 | _cexit | |
msvcrt.dll | 78 | _XcptFilter | |
ADVAPI32.dll | 483 | RegOpenKeyExA | |
ADVAPI32.dll | 334 | LookupPrivilegeValueW | |
ADVAPI32.dll | 28 | AdjustTokenPrivileges | |
ADVAPI32.dll | 431 | OpenThreadToken | |
ADVAPI32.dll | 426 | OpenProcessToken | |
ADVAPI32.dll | 80 | ConvertSidToStringSidW | |
ADVAPI32.dll | 479 | RegLoadKeyW | |
ADVAPI32.dll | 510 | RegUnLoadKeyW | |
ADVAPI32.dll | 292 | GetUserNameW | |
ADVAPI32.dll | 493 | RegQueryValueExA | |
ADVAPI32.dll | 484 | RegOpenKeyExW | |
ADVAPI32.dll | 458 | RegCloseKey | |
ADVAPI32.dll | 494 | RegQueryValueExW | |
ADVAPI32.dll | 326 | LookupAccountNameW | |
ADVAPI32.dll | 280 | GetSidSubAuthorityCount | |
ADVAPI32.dll | 279 | GetSidSubAuthority | |
KERNEL32.dll | 373 | GetModuleHandleA | |
KERNEL32.dll | 855 | UnhandledExceptionFilter | |
KERNEL32.dll | 315 | GetCurrentProcess | |
KERNEL32.dll | 838 | TerminateProcess | |
KERNEL32.dll | 445 | GetSystemTimeAsFileTime | |
KERNEL32.dll | 316 | GetCurrentProcessId | |
KERNEL32.dll | 318 | GetCurrentThreadId | |
KERNEL32.dll | 465 | GetTickCount | |
KERNEL32.dll | 657 | QueryPerformanceCounter | |
KERNEL32.dll | 577 | LoadLibraryA | |
KERNEL32.dll | 536 | InterlockedCompareExchange | |
KERNEL32.dll | 126 | DeleteAtom | |
KERNEL32.dll | 2 | AddAtomW | |
KERNEL32.dll | 933 | lstrcatW | |
KERNEL32.dll | 845 | TlsGetValue | |
KERNEL32.dll | 520 | HeapFree | |
KERNEL32.dll | 524 | HeapReAlloc | |
KERNEL32.dll | 514 | HeapAlloc | |
KERNEL32.dll | 611 | MulDiv | |
KERNEL32.dll | 407 | GetProcAddress | |
KERNEL32.dll | 580 | LoadLibraryW | |
KERNEL32.dll | 537 | InterlockedDecrement | |
KERNEL32.dll | 541 | InterlockedIncrement | |
KERNEL32.dll | 516 | HeapCreate | |
KERNEL32.dll | 843 | TlsAlloc | |
KERNEL32.dll | 844 | TlsFree | |
KERNEL32.dll | 518 | HeapDestroy | |
KERNEL32.dll | 846 | TlsSetValue | |
KERNEL32.dll | 127 | DeleteCriticalSection | |
KERNEL32.dll | 533 | InitializeCriticalSection | |
KERNEL32.dll | 240 | FreeLibrary | |
KERNEL32.dll | 364 | GetLocaleInfoW | |
KERNEL32.dll | 376 | GetModuleHandleW | |
KERNEL32.dll | 948 | lstrlenW | |
KERNEL32.dll | 945 | lstrcpynW | |
KERNEL32.dll | 939 | lstrcmpiW | |
KERNEL32.dll | 818 | SetUnhandledExceptionFilter | |
KERNEL32.dll | 182 | ExitProcess | |
KERNEL32.dll | 583 | LocalAlloc | |
KERNEL32.dll | 942 | lstrcpyW | |
KERNEL32.dll | 587 | LocalFree | |
KERNEL32.dll | 428 | GetStartupInfoA | |
KERNEL32.dll | 125 | DelayLoadFailureHook | |
KERNEL32.dll | 360 | GetLastError | |
KERNEL32.dll | 272 | GetComputerNameW | |
KERNEL32.dll | 592 | LocalSize | |
KERNEL32.dll | 787 | SetLastError | |
KERNEL32.dll | 186 | ExpandEnvironmentStringsW | |
KERNEL32.dll | 551 | IsBadWritePtr | |
KERNEL32.dll | 550 | IsBadStringPtrW | |
KERNEL32.dll | 317 | GetCurrentThread | |
KERNEL32.dll | 49 | CloseHandle | |
KERNEL32.dll | 538 | InterlockedExchange | |
KERNEL32.dll | 475 | GetVersionExA | |
KERNEL32.dll | 248 | GetAtomNameW | |
KERNEL32.dll | 800 | SetProcessWorkingSetSize | |
KERNEL32.dll | 471 | GetUserDefaultUILanguage | |
KERNEL32.dll | 612 | MultiByteToWideChar | |
KERNEL32.dll | 203 | FindAtomW | |
KERNEL32.dll | 150 | EnterCriticalSection | |
KERNEL32.dll | 576 | LeaveCriticalSection | |
KERNEL32.dll | 636 | OutputDebugStringW | |
KERNEL32.dll | 829 | SizeofResource | |
KERNEL32.dll | 596 | LockResource | |
KERNEL32.dll | 582 | LoadResource | |
KERNEL32.dll | 226 | FindResourceW | |
GDI32.dll | 45 | CreateCompatibleDC | |
GDI32.dll | 61 | CreateFontIndirectW | |
GDI32.dll | 283 | GdiFlush | |
GDI32.dll | 80 | CreateSolidBrush | |
GDI32.dll | 363 | GetDeviceCaps | |
GDI32.dll | 39 | CreateBitmap | |
GDI32.dll | 526 | SelectObject | |
GDI32.dll | 533 | SetBkColor | |
GDI32.dll | 572 | SetTextColor | |
GDI32.dll | 222 | ExtTextOutW | |
GDI32.dll | 477 | PatBlt | |
GDI32.dll | 143 | DeleteObject | |
GDI32.dll | 140 | DeleteDC | |
GDI32.dll | 75 | CreateRectRgn | |
GDI32.dll | 468 | OffsetRgn | |
GDI32.dll | 221 | ExtTextOutA | |
GDI32.dll | 459 | LPtoDP | |
GDI32.dll | 586 | StretchDIBits | |
GDI32.dll | 394 | GetLayout | |
GDI32.dll | 552 | SetLayout | |
GDI32.dll | 49 | CreateDIBPatternBrushPt | |
GDI32.dll | 50 | CreateDIBSection | |
GDI32.dll | 362 | GetDIBits | |
GDI32.dll | 336 | GetBrushOrgEx | |
GDI32.dll | 537 | SetBrushOrgEx | |
GDI32.dll | 63 | CreateHalftonePalette | |
GDI32.dll | 527 | SelectPalette | |
GDI32.dll | 499 | RealizePalette | |
GDI32.dll | 480 | PlayEnhMetaFile | |
GDI32.dll | 568 | SetStretchBltMode | |
GDI32.dll | 70 | CreatePatternBrush | |
GDI32.dll | 18 | BitBlt | |
GDI32.dll | 534 | SetBkMode | |
GDI32.dll | 570 | SetTextAlign | |
GDI32.dll | 437 | GetTextExtentPoint32W | |
GDI32.dll | 141 | DeleteEnhMetaFile | |
GDI32.dll | 405 | GetObjectA | |
GDI32.dll | 585 | StretchBlt | |
GDI32.dll | 407 | GetObjectW | |
GDI32.dll | 412 | GetPixel | |
GDI32.dll | 421 | GetStockObject | |
GDI32.dll | 44 | CreateCompatibleBitmap | |
USER32.dll | 97 | CreateWindowExW | |
USER32.dll | 658 | ShowWindow | |
USER32.dll | 599 | SetForegroundWindow | |
USER32.dll | 196 | EnableWindow | |
USER32.dll | 153 | DestroyWindow | |
USER32.dll | 692 | UnregisterClassW | |
USER32.dll | 349 | GetSystemMetrics | |
USER32.dll | 641 | SetWindowLongW | |
USER32.dll | 486 | MonitorFromPoint | |
USER32.dll | 320 | GetMonitorInfoW | |
USER32.dll | 643 | SetWindowPos | |
USER32.dll | 729 | wsprintfW | |
USER32.dll | 457 | LoadStringW | |
USER32.dll | 512 | PostMessageW | |
USER32.dll | 72 | CopyIcon | |
USER32.dll | 255 | GetClientRect | |
USER32.dll | 483 | MessageBoxW | |
USER32.dll | 230 | FindWindowW | |
USER32.dll | 290 | GetKeyboardLayout | |
USER32.dll | 150 | DestroyIcon | |
USER32.dll | 291 | GetKeyboardLayoutList | |
USER32.dll | 666 | SystemParametersInfoW | |
USER32.dll | 268 | GetDC | |
USER32.dll | 554 | ReleaseDC | |
USER32.dll | 346 | GetSysColor | |
USER32.dll | 191 | DrawTextW | |
USER32.dll | 327 | GetProcessDefaultLayout | |
USER32.dll | 90 | CreateIconIndirect | |
USER32.dll | 372 | GetWindowRect | |
USER32.dll | 576 | SendMessageW | |
USER32.dll | 434 | KillTimer | |
USER32.dll | 634 | SetTimer | |
USER32.dll | 442 | LoadCursorW | |
USER32.dll | 536 | RegisterClassExW | |
USER32.dll | 367 | GetWindowLongW | |
USER32.dll | 143 | DefWindowProcW | |
USER32.dll | 13 | BeginPaint | |
USER32.dll | 226 | FillRect | |
USER32.dll | 200 | EndPaint | |
USER32.dll | 42 | CharNextA | |
USER32.dll | 44 | CharNextW | |
USER32.dll | 366 | GetWindowLongA | |
USER32.dll | 620 | SetRect | |
USER32.dll | 282 | GetIconInfo | |
USER32.dll | 446 | LoadImageW | |
USER32.dll | 223 | EqualRect | |
USER32.dll | 183 | DrawIconEx | |
USER32.dll | 179 | DrawFocusRect | |
USER32.dll | 402 | IntersectRect | |
USER32.dll | 181 | DrawFrameControl | |
USER32.dll | 74 | CopyRect | |
USER32.dll | 621 | SetRectEmpty | |
USER32.dll | 2 | AdjustWindowRectEx | |
USER32.dll | 325 | GetParent | |
USER32.dll | 589 | SetCursor | |
USER32.dll | 561 | ScreenToClient | |
USER32.dll | 316 | GetMessagePos | |
USER32.dll | 403 | InvalidateRect | |
USER32.dll | 142 | DefWindowProcA | |
USER32.dll | 248 | GetClassInfoExW | |
USER32.dll | 347 | GetSysColorBrush | |
USER32.dll | 571 | SendMessageA | |
USER32.dll | 378 | GetWindowTextW | |
USER32.dll | 377 | GetWindowTextLengthW | |
USER32.dll | 162 | DispatchMessageW | |
USER32.dll | 682 | TranslateMessage | |
USER32.dll | 318 | GetMessageW | |
USER32.dll | 513 | PostQuitMessage | |
USER32.dll | 640 | SetWindowLongA | |
USER32.dll | 598 | SetFocus | |
USER32.dll | 665 | SystemParametersInfoA | |
USER32.dll | 492 | NotifyWinEvent | |
USER32.dll | 614 | SetParent | |
USER32.dll | 28 | CallWindowProcW | |
USER32.dll | 699 | UpdateWindow | |
USER32.dll | 644 | SetWindowRgn | |
USER32.dll | 647 | SetWindowTextW | |
USER32.dll | 471 | MapWindowPoints | |
USER32.dll | 278 | GetFocus | |
COMCTL32.dll | 413 | ||
COMCTL32.dll | 412 | ||
COMCTL32.dll | 93 | InitCommonControlsEx | |
COMCTL32.dll | 355 | ||
COMCTL32.dll | 17 | ||
COMCTL32.dll | 410 | ||
SHELL32.dll | 752 | ||
ntdll.dll | 255 | NtQuerySystemInformation | |
ntdll.dll | 834 | RtlUnhandledExceptionFilter | |
NETAPI32.dll | 105 | NetApiBufferFree | |
NETAPI32.dll | 11 | DsGetDcNameW | |
NETAPI32.dll | 176 | NetQueryDisplayInformation | |
ole32.dll | 104 | CoUninitialize | |
ole32.dll | 58 | CoInitialize | |
ole32.dll | 21 | CoDisconnectObject | |
ole32.dll | 59 | CoInitializeEx | |
ole32.dll | 16 | CoCreateInstance | |
OLEAUT32.dll | 8 | ||
OLEAUT32.dll | 9 | ||
OLEAUT32.dll | 2 | ||
OLEAUT32.dll | 6 | ||
RPCRT4.dll | 327 | RpcBindingFromStringBindingW | |
RPCRT4.dll | 127 | NdrClientCall2 | |
RPCRT4.dll | 325 | RpcBindingFree | |
RPCRT4.dll | 472 | RpcStringFreeW | |
RPCRT4.dll | 359 | RpcEpResolveBinding | |
RPCRT4.dll | 468 | RpcStringBindingComposeW | |
DUSER.dll | 107 | UtilDrawBlendRect | |
DUSER.dll | 26 | DUserRegisterStub | |
DUSER.dll | 31 | DeleteHandle | |
DUSER.dll | 37 | FindGadgetFromPoint | |
DUSER.dll | 76 | LookupGadgetTicket | |
DUSER.dll | 98 | SetGadgetRootInfo | |
DUSER.dll | 62 | GetStdColorBrushI | |
DUSER.dll | 64 | GetStdColorI | |
DUSER.dll | 39 | FindStdColor | |
DUSER.dll | 60 | GetMessageExW | |
DUSER.dll | 71 | InitGadgets | |
DUSER.dll | 88 | SetGadgetBufferInfo | |
DUSER.dll | 58 | GetGadgetTicket | |
DUSER.dll | 77 | MapGadgetPoints | |
DUSER.dll | 8 | CreateAction | |
DUSER.dll | 52 | GetGadgetRgn | |
DUSER.dll | 45 | GetGadgetAnimation | |
DUSER.dll | 7 | BuildInterpolation | |
DUSER.dll | 5 | BuildAnimation | |
DUSER.dll | 56 | GetGadgetSize | |
DUSER.dll | 51 | GetGadgetRect | |
DUSER.dll | 9 | CreateGadget | |
DUSER.dll | 23 | DUserPostEvent | |
DUSER.dll | 41 | ForwardGadgetMessage | |
DUSER.dll | 2 | AttachWndProcW | |
DUSER.dll | 72 | InvalidateGadget | |
DUSER.dll | 97 | SetGadgetRect | |
DUSER.dll | 95 | SetGadgetParent | |
DUSER.dll | 92 | SetGadgetFocus | |
DUSER.dll | 48 | GetGadgetFocus | |
DUSER.dll | 93 | SetGadgetMessageFilter | |
DUSER.dll | 101 | SetGadgetStyle | |
DUSER.dll | 28 | DUserSendEvent | |
MSIMG32.dll | 2 | GradientFill | |
MSIMG32.dll | AlphaBlend | ||
MSIMG32.dll | 3 | TransparentBlt | |
OLEACC.dll | 19 | LresultFromObject | |
OLEACC.dll | 3 | AccessibleObjectFromWindow | |
OLEACC.dll | 4 | CreateStdAccessibleObject |
StringTable 040904B0
CompanyName | Microsoft Corporation |
FileDescription | Windows Logon UI |
FileVersion | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) |
InternalName | LOGONUI |
LegalCopyright | © Microsoft Corporation. All rights reserved. |
OriginalFilename | LOGONUI.EXE |
ProductName | Microsoft® Windows® Operating System |
ProductVersion | 6.00.2900.2180 |
VS_FIXEDFILEINFO
FileVersion | 6.0.2900.2180 |
ProductVersion | 6.0.2900.2180 |
StrucVersion | 0x10000 |
FileFlagsMask | 0x3f |
FileFlags | 0 |
FileOS | 0x40004 |
FileType | 2 |
FileSubtype | 0 |
Please donate some bucks to keep this site up and running: | |
Ko-fi | |
---|---|
Yandex.Money | |
Thank you! |
[?] can't find file_offset of VA 0x248