filenameOSVolOSVol--Windows--System32--winlogon.exe.fullextract
size393216 (0x60000)
md52ccc3a654347f6174116d43d19397d04
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
132307291
149307292
1473072917
10411
1313072919
1383072960
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x4ce79fa6
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion9.0
SizeOfCode0x3f000
SizeOfInitializedData0x20400
SizeOfUninitializedData0
AddressOfEntryPoint0x108d8
BaseOfCode0x1000
ImageBase0x100000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x62000
SizeOfHeaders0x400
CheckSum0x638d2
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x80000
SizeOfStackCommit0xe000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x3ef210x3f000R-X CODE
.rdata0x400000x131fc0x13200R-- IDATA
.data0x540000x46580x4600RW- IDATA
.pdata0x590000x2ee00x3000R-- IDATA
.rsrc0x5c0000x4fd00x5000R-- IDATA
.reloc0x610000x8a00xa00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x498dc0xb4
RESOURCE0x5c0000x4fd0
EXCEPTION0x590000x2ee0
SECURITY00
BASERELOC0x610000x8a0
DEBUG0x3fec00x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2d80xe8
IAT0x400000xad0
Delay_IAT0x48dd40x200
CLR_Header00
typenamesizecp
MUI#12560
WEVT_TEMPLATE#1110500
ICON#17440
ICON#229840
ICON#329840
GROUP_ICONIDD_SHUTDOWN_BITMAP200
GROUP_ICON#920200
GROUP_ICON#921200
VERSION#19280
MANIFEST#16860
module_namehintordfunction_name
USER32.dll499LoadImageW
USER32.dll510LoadStringW
USER32.dll665SetForegroundWindow
USER32.dll718SetWindowPos
USER32.dll293GetDesktopWindow
USER32.dll358GetParent
USER32.dll640SendMessageW
USER32.dll297GetDlgItem
USER32.dll218EndDialog
USER32.dll558OpenInputDesktop
USER32.dll300GetDlgItemTextW
USER32.dll172DialogBoxParamW
USER32.dll512LockWindowStation
USER32.dll721SetWindowStationUser
USER32.dll792UpdatePerUserSystemParameters
USER32.dll586RealGetWindowClassW
USER32.dll743ShowWindow
USER32.dll242EnumWindows
USER32.dll250FindWindowW
USER32.dll753SwitchDesktopWithFade
USER32.dll503LoadLocalFonts
USER32.dll603RegisterLogonProcess
USER32.dll688SetProcessWindowStation
USER32.dll78CloseWindowStation
USER32.dll112CreateWindowStationW
USER32.dll708SetUserObjectSecurity
USER32.dll752SwitchDesktop
USER32.dll779UnlockWindowStation
USER32.dll410GetWindowLongW
USER32.dll416GetWindowRect
USER32.dll327GetLastInputInfo
USER32.dll319GetKeyState
USER32.dll756SystemParametersInfoW
USER32.dll94CreateDesktopW
USER32.dll31CancelShutdown
USER32.dll263GetAsyncKeyState
USER32.dll245ExitWindowsEx
USER32.dll537MessageBoxW
USER32.dll384GetSystemMetrics
USER32.dll74CloseDesktop
USER32.dll397GetUserObjectInformationW
USER32.dll704SetThreadDesktop
msvcrt.dll19void * __ptr64 __cdecl operator new(unsigned __int64)

??2@YAPEAX_K@Z

msvcrt.dll856_vsnwprintf
msvcrt.dll1154memmove
msvcrt.dll1263wcschr
msvcrt.dll889_wcsicmp
msvcrt.dll1278wcsrchr
msvcrt.dll1284wcstok
msvcrt.dll1126iswspace
msvcrt.dll21void __cdecl operator delete(void * __ptr64)

??3@YAXPEAX@Z

msvcrt.dll809_ultow
msvcrt.dll1011_wtoi
msvcrt.dll113__getmainargs
msvcrt.dll83__C_specific_handler
msvcrt.dll82_XcptFilter
msvcrt.dll255_exit
msvcrt.dll392_ismbblead
msvcrt.dll179_cexit
msvcrt.dll1056exit
msvcrt.dll148_acmdln
msvcrt.dll364_initterm
msvcrt.dll160_amsg_exit
msvcrt.dll130__setusermatherr
msvcrt.dll196_commode
msvcrt.dll280_fmode
msvcrt.dll128__set_app_type
msvcrt.dll1282wcsstr
msvcrt.dll116__isascii
msvcrt.dll1115isupper
msvcrt.dll795_tolower
msvcrt.dll1156memset
msvcrt.dll1152memcpy
msvcrt.dll48void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll1151memcmp
ntdll.dll785RtlEnterCriticalSection
ntdll.dll938RtlInitializeCriticalSection
ntdll.dll1387WinSqmAddToStream
ntdll.dll930RtlInitString
ntdll.dll179NtAllocateLocallyUniqueId
ntdll.dll501NtSetInformationToken
ntdll.dll254NtCreateToken
ntdll.dll609RtlAdjustPrivilege
ntdll.dll654RtlCompareUnicodeString
ntdll.dll690RtlCreateEnvironment
ntdll.dll931RtlInitUnicodeString
ntdll.dll1156RtlSetEnvironmentVariable
ntdll.dll1074RtlQueryEnvironmentVariable_U
ntdll.dll932RtlInitUnicodeStringEx
ntdll.dll52EtwEventActivityIdControl
ntdll.dll62EtwEventWriteStartScenario
ntdll.dll58EtwEventWriteEndScenario
ntdll.dll364NtOpenThreadToken
ntdll.dll1118RtlRemovePrivileges
ntdll.dll56EtwEventUnregister
ntdll.dll735RtlDeleteCriticalSection
ntdll.dll1406WinSqmSetDWORD
ntdll.dll1321RtlpVerifyAndCommitUILanguageSettings
ntdll.dll1003RtlLeaveCriticalSection
ntdll.dll81EtwUnregisterTraceGuids
ntdll.dll74EtwRegisterTraceGuidsW
ntdll.dll65EtwGetTraceEnableFlags
ntdll.dll66EtwGetTraceEnableLevel
ntdll.dll67EtwGetTraceLoggerHandle
ntdll.dll426NtQuerySystemInformation
ntdll.dll533NtSystemDebugControl
ntdll.dll1398WinSqmEndSession
ntdll.dll1412WinSqmStartSession
ntdll.dll888RtlGetNtProductType
ntdll.dll214NtClose
ntdll.dll402NtQueryInformationToken
ntdll.dll356NtOpenProcessToken
ntdll.dll525NtShutdownSystem
ntdll.dll1045RtlNtStatusToDosError
ntdll.dll53EtwEventEnabled
ntdll.dll57EtwEventWrite
ntdll.dll79EtwTraceMessage
ntdll.dll1006RtlLengthSid
ntdll.dll754RtlDestroyEnvironment
ntdll.dll1377TpSimpleTryPost
ntdll.dll1376TpSetWait
ntdll.dll1382TpWaitForWait
ntdll.dll1368TpReleaseWait
ntdll.dll1383TpWaitForWork
ntdll.dll1369TpReleaseWork
ntdll.dll1340TpAllocWork
ntdll.dll1360TpPostWork
ntdll.dll1339TpAllocWait
ntdll.dll810RtlExpandEnvironmentStrings_U
ntdll.dll1381TpWaitForTimer
ntdll.dll592RtlAddAce
ntdll.dll1152RtlSetDaclSecurityDescriptor
ntdll.dll864RtlGetDaclSecurityDescriptor
ntdll.dll276NtDuplicateToken
ntdll.dll176NtAdjustPrivilegesToken
ntdll.dll1220RtlUnhandledExceptionFilter
ntdll.dll399NtQueryInformationProcess
ntdll.dll1367TpReleaseTimer
ntdll.dll221NtCompleteConnectPort
ntdll.dll241NtCreatePort
ntdll.dll460NtReplyWaitReceivePort
ntdll.dll164NtAcceptConnectPort
ntdll.dll459NtReplyPort
ntdll.dll228NtCreateEvent
ntdll.dll1046RtlNtStatusToDosErrorNoTeb
ntdll.dll680RtlCopySid
ntdll.dll1056RtlOpenCurrentUser
ntdll.dll611RtlAllocateAndInitializeSid
ntdll.dll701RtlCreateSecurityDescriptor
ntdll.dll684RtlCreateAcl
ntdll.dll602RtlAddMandatoryAce
ntdll.dll1169RtlSetSaclSecurityDescriptor
ntdll.dll512NtSetSecurityObject
ntdll.dll846RtlFreeSid
ntdll.dll340NtOpenDirectoryObject
ntdll.dll1204RtlTimeToSecondsSince1980
ntdll.dll1375TpSetTimer
ntdll.dll1338TpAllocTimer
ntdll.dll315NtInitiatePowerAction
ntdll.dll777RtlDuplicateUnicodeString
ntdll.dll848RtlFreeUnicodeString
ntdll.dll285NtFilterToken
ntdll.dll798RtlEqualSid
ntdll.dll1265RtlVirtualUnwind
ntdll.dll1026RtlLookupFunctionEntry
ntdll.dll635RtlCaptureContext
ntdll.dll55EtwEventRegister
API-MS-Win-Core-LocalRegistry-L1-1-0.dll28RegQueryInfoKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll35RegSetKeySecurity
API-MS-Win-Core-LocalRegistry-L1-1-0.dll4RegDeleteKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll25RegOpenKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll30RegQueryValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dllRegCloseKey
API-MS-Win-Core-LocalRegistry-L1-1-0.dll8RegDeleteValueW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll13RegEnumValueW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll37RegSetValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll2RegCreateKeyExW
API-MS-Win-Security-Base-L1-1-0.dll24CheckTokenMembership
API-MS-Win-Security-Base-L1-1-0.dll38EqualSid
API-MS-Win-Security-Base-L1-1-0.dll58GetTokenInformation
API-MS-Win-Security-Base-L1-1-0.dll45GetLengthSid
API-MS-Win-Security-Base-L1-1-0.dll61ImpersonateLoggedOnUser
API-MS-Win-Security-Base-L1-1-0.dll83RevertToSelf
API-MS-Win-Security-Base-L1-1-0.dll35DuplicateTokenEx
API-MS-Win-Security-Base-L1-1-0.dll31CreateWellKnownSid
API-MS-Win-Security-Base-L1-1-0.dll21AllocateLocallyUniqueId
WINSTA.dll39WinStationFreeMemory
WINSTA.dll90WinStationReportUIResult
WINSTA.dll65WinStationNegotiateSession
WINSTA.dll61WinStationIsSessionPermitted
WINSTA.dll74WinStationQueryInformationW
WINSTA.dll138_WinStationWaitForConnect
WINSTA.dll29WinStationDisconnect
WINSTA.dll42WinStationFreeUserCredentials
WINSTA.dll57WinStationGetUserCredentials
WINSTA.dll62WinStationIsSessionRemoteable
RPCRT4.dll61I_RpcMapWin32Status
RPCRT4.dll134Ndr64AsyncClientCall
RPCRT4.dll351RpcAsyncInitializeHandle
RPCRT4.dll348RpcAsyncCancelCall
RPCRT4.dll420RpcMgmtIsServerListening
RPCRT4.dll506RpcStringFreeW
RPCRT4.dll374RpcBindingSetAuthInfoExW
RPCRT4.dll502RpcStringBindingComposeW
RPCRT4.dll456RpcServerSubscribeForNotification
RPCRT4.dll460RpcServerUnsubscribeForNotification
RPCRT4.dll455RpcServerRegisterIfEx
RPCRT4.dll444RpcServerInqBindings
RPCRT4.dll450RpcServerListen
RPCRT4.dll36I_RpcBindingIsClientLocal
RPCRT4.dll390RpcEpRegisterW
RPCRT4.dll476RpcServerUseProtseqW
RPCRT4.dll381RpcBindingVectorFree
RPCRT4.dll458RpcServerUnregisterIf
RPCRT4.dll392RpcEpUnregister
RPCRT4.dll141NdrAsyncServerCall
RPCRT4.dll439RpcRaiseException
RPCRT4.dll291NdrServerCall2
RPCRT4.dll136Ndr64AsyncServerCallAll
RPCRT4.dll292NdrServerCallAll
RPCRT4.dll469RpcServerUseProtseqEpW
RPCRT4.dll446RpcServerInqCallAttributesW
RPCRT4.dll457RpcServerTestCancel
RPCRT4.dll359RpcBindingFromStringBindingW
RPCRT4.dll520UuidFromStringW
RPCRT4.dll150NdrClientCall3
RPCRT4.dll380RpcBindingUnbind
RPCRT4.dll353RpcBindingBind
RPCRT4.dll43I_RpcExceptionFilter
RPCRT4.dll357RpcBindingFree
RPCRT4.dll356RpcBindingCreateW
RPCRT4.dll347RpcAsyncAbortCall
RPCRT4.dll349RpcAsyncCompleteCall
RPCRT4.dll440RpcRevertToSelf
RPCRT4.dll407RpcImpersonateClient
RPCRT4.dll30I_RpcBindingInqLocalClientPID
KERNEL32.dll848LocalSize
KERNEL32.dll846LocalReAlloc
KERNEL32.dll866MoveFileExW
KERNEL32.dll82CloseHandle
KERNEL32.dll1127SetEvent
KERNEL32.dll133CreateEventW
KERNEL32.dll1289WaitForSingleObject
KERNEL32.dll843LocalFree
KERNEL32.dll839LocalAlloc
KERNEL32.dll536GetModuleFileNameW
KERNEL32.dll1151SetLastError
KERNEL32.dll726HeapCreate
KERNEL32.dll518GetLastError
KERNEL32.dll727HeapDestroy
KERNEL32.dll724HeapAlloc
KERNEL32.dll728HeapFree
KERNEL32.dll733HeapSize
KERNEL32.dll1161SetPriorityClass
KERNEL32.dll454GetCurrentProcess
KERNEL32.dll1190SetThreadPriority
KERNEL32.dll458GetCurrentThread
KERNEL32.dll339FindResourceExW
KERNEL32.dll639GetSystemTimeAsFileTime
KERNEL32.dll732HeapSetInformation
KERNEL32.dll834LoadLibraryW
KERNEL32.dll586GetProcAddress
KERNEL32.dll360FreeLibrary
KERNEL32.dll1290WaitForSingleObjectEx
KERNEL32.dll1259UnregisterWaitEx
KERNEL32.dll1217Sleep
KERNEL32.dll836LoadResource
KERNEL32.dll854LockResource
KERNEL32.dll1046ResumeThread
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll100CompareStringW
KERNEL32.dll615GetShortPathNameW
KERNEL32.dll1273VirtualAlloc
KERNEL32.dll1378lstrlenW
KERNEL32.dll981RegGetValueA
KERNEL32.dll971RegDeleteTreeW
KERNEL32.dll976RegEnumKeyExW
KERNEL32.dll166CreateProcessInternalW
KERNEL32.dll38BaseInitAppcompatCacheSupport
KERNEL32.dll1220SleepEx
KERNEL32.dll1201SetTimerQueueTimer
KERNEL32.dll495GetFileAttributesW
KERNEL32.dll169CreateRemoteThread
KERNEL32.dll664GetThreadUILanguage
KERNEL32.dll666GetTickCount64
KERNEL32.dll684GetVersionExW
KERNEL32.dll1313WideCharToMultiByte
KERNEL32.dll200DebugBreak
KERNEL32.dll1251UnhandledExceptionFilter
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll937QueryPerformanceCounter
KERNEL32.dll1203SetUnhandledExceptionFilter
KERNEL32.dll617GetStartupInfoW
KERNEL32.dll207DelayLoadFailureHook
KERNEL32.dll832LoadLibraryExA
KERNEL32.dll1287WaitForMultipleObjects
KERNEL32.dll1149SetInformationJobObject
KERNEL32.dll630GetSystemDirectoryW
KERNEL32.dll180CreateThread
KERNEL32.dll963ReadFile
KERNEL32.dll143CreateFileW
KERNEL32.dll1126SetErrorMode
KERNEL32.dll540GetModuleHandleW
KERNEL32.dll887OpenEventW
KERNEL32.dll593GetProcessId
KERNEL32.dll219DeleteTimerQueueTimer
KERNEL32.dll188CreateTimerQueueTimer
KERNEL32.dll168CreateProcessW
KERNEL32.dll1067SearchPathW
KERNEL32.dll1231TerminateProcess
KERNEL32.dll22AssignProcessToJobObject
KERNEL32.dll665GetTickCount
KERNEL32.dll463GetDateFormatW
KERNEL32.dll669GetTimeFormatW
KERNEL32.dll1229SystemTimeToTzSpecificLocalTime
KERNEL32.dll299FileTimeToSystemTime
KERNEL32.dll96CompareFileTime
KERNEL32.dll356FormatMessageW
KERNEL32.dll1276VirtualFree
KERNEL32.dll1283VirtualUnlock
KERNEL32.dll1169SetProcessWorkingSetSize
KERNEL32.dll602GetProcessWorkingSetSize
KERNEL32.dll1278VirtualLock
KERNEL32.dll150CreateJobObjectW
KERNEL32.dll397GetCommandLineW
KERNEL32.dll1042ResetEvent
KERNEL32.dll1230TerminateJobObject
KERNEL32.dll405GetComputerNameW
KERNEL32.dll236DuplicateHandle
KERNEL32.dll1258UnregisterWait
KERNEL32.dll1016RegisterWaitForSingleObject
KERNEL32.dll898OpenProcess
KERNEL32.dll935QueryInformationJobObject
KERNEL32.dll932QueryFullProcessImageNameW
KERNEL32.dll591GetProcessHeap
KERNEL32.dll486GetExitCodeProcess
KERNEL32.dll1125SetEnvironmentVariableW
KERNEL32.dll291ExpandEnvironmentStringsW

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows Logon Application
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNamewinlogon
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameWINLOGON.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d0387632BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 393216 bytes (384 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x2d8