filenamewinlogon.exe
size286720 (0x46000)
md56d13e1406f50c66e2a95d97f22c47560
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
149307296
1473072917
10411
1323072944
1313072939
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ce79517
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x3a200
SizeOfInitializedData0xba00
SizeOfUninitializedData0
AddressOfEntryPoint0x1123b
BaseOfCode0x1000
BaseOfData0x39000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x48000
SizeOfHeaders0x400
CheckSum0x46aca
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x6000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x3a1110x3a200R-X CODE
.data0x3c0000x2dec0x2e00RW- IDATA
.rsrc0x3f0000x4fd00x5000R-- IDATA
.reloc0x440000x3a780x3c00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x38f400xb4
RESOURCE0x3f0000x4fd0
EXCEPTION00
SECURITY00
BASERELOC0x440000x3a78
DEBUG0x3b0b00x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x25ae00x40
Bound_IAT0x2700xe0
IAT0x10000x568
Delay_IAT0x385900x200
CLR_Header00
typenamesizecp
MUI#12560
WEVT_TEMPLATE#1110500
ICON#17440
ICON#229840
ICON#329840
GROUP_ICONIDD_SHUTDOWN_BITMAP200
GROUP_ICON#920200
GROUP_ICON#921200
VERSION#19280
MANIFEST#16840
module_namehintordfunction_name
USER32.dll74CloseDesktop
USER32.dll250FindWindowW
USER32.dll242EnumWindows
USER32.dll582RealGetWindowClassW
USER32.dll735ShowWindow
USER32.dll172DialogBoxParamW
USER32.dll298GetDlgItemTextW
USER32.dll218EndDialog
USER32.dll495LoadImageW
USER32.dll295GetDlgItem
USER32.dll698SetThreadDesktop
USER32.dll508LockWindowStation
USER32.dll771UnlockWindowStation
USER32.dll713SetWindowStationUser
USER32.dll784UpdatePerUserSystemParameters
USER32.dll395GetUserObjectInformationW
USER32.dll554OpenInputDesktop
USER32.dll533MessageBoxW
USER32.dll382GetSystemMetrics
USER32.dll245ExitWindowsEx
USER32.dll263GetAsyncKeyState
USER32.dll31CancelShutdown
USER32.dll94CreateDesktopW
USER32.dll748SystemParametersInfoW
USER32.dll317GetKeyState
USER32.dll325GetLastInputInfo
USER32.dll659SetForegroundWindow
USER32.dll710SetWindowPos
USER32.dll291GetDesktopWindow
USER32.dll356GetParent
USER32.dll406GetWindowLongW
USER32.dll745SwitchDesktopWithFade
USER32.dll499LoadLocalFonts
USER32.dll599RegisterLogonProcess
USER32.dll412GetWindowRect
USER32.dll506LoadStringW
USER32.dll636SendMessageW
USER32.dll112CreateWindowStationW
USER32.dll682SetProcessWindowStation
USER32.dll78CloseWindowStation
USER32.dll702SetUserObjectSecurity
USER32.dll744SwitchDesktop
msvcrt.dll1361wcschr
msvcrt.dll1380wcsstr
msvcrt.dll148__isascii
msvcrt.dll1223isupper
msvcrt.dll912_tolower
msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll1258memcpy
msvcrt.dll1262memset
msvcrt.dll974_vsnwprintf
msvcrt.dll1260memmove
msvcrt.dll1007_wcsicmp
msvcrt.dll1376wcsrchr
msvcrt.dll1234iswspace
msvcrt.dll1382wcstok
msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll926_ultow
msvcrt.dll1129_wtoi
msvcrt.dll145__getmainargs
msvcrt.dll276_cexit
msvcrt.dll354_exit
msvcrt.dll106_XcptFilter
msvcrt.dll500_ismbblead
msvcrt.dll1167exit
msvcrt.dll231_acmdln
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
msvcrt.dll212__setusermatherr
msvcrt.dll185__p__commode
msvcrt.dll190__p__fmode
msvcrt.dll210__set_app_type
msvcrt.dll345_except_handler4_common
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll295_controlfp
ntdll.dll779RtlEnterCriticalSection
ntdll.dll79EtwTraceMessage
ntdll.dll524NtShutdownSystem
ntdll.dll1044RtlNtStatusToDosError
ntdll.dll212NtClose
ntdll.dll401NtQueryInformationToken
ntdll.dll355NtOpenProcessToken
ntdll.dll1397WinSqmStartSession
ntdll.dll1383WinSqmEndSession
ntdll.dll57EtwEventWrite
ntdll.dll53EtwEventEnabled
ntdll.dll882RtlGetNtProductType
ntdll.dll425NtQuerySystemInformation
ntdll.dll532NtSystemDebugControl
ntdll.dll65EtwGetTraceEnableFlags
ntdll.dll66EtwGetTraceEnableLevel
ntdll.dll67EtwGetTraceLoggerHandle
ntdll.dll74EtwRegisterTraceGuidsW
ntdll.dll81EtwUnregisterTraceGuids
ntdll.dll1114RtlRemovePrivileges
ntdll.dll55EtwEventRegister
ntdll.dll56EtwEventUnregister
ntdll.dll730RtlDeleteCriticalSection
ntdll.dll1391WinSqmSetDWORD
ntdll.dll1306RtlpVerifyAndCommitUILanguageSettings
ntdll.dll58EtwEventWriteEndScenario
ntdll.dll62EtwEventWriteStartScenario
ntdll.dll52EtwEventActivityIdControl
ntdll.dll363NtOpenThreadToken
ntdll.dll653RtlCompareUnicodeString
ntdll.dll925RtlInitUnicodeStringEx
ntdll.dll1151RtlSetEnvironmentVariable
ntdll.dll1071RtlQueryEnvironmentVariable_U
ntdll.dll924RtlInitUnicodeString
ntdll.dll931RtlInitializeCriticalSection
ntdll.dll1007RtlLengthSid
ntdll.dll923RtlInitString
ntdll.dll177NtAllocateLocallyUniqueId
ntdll.dll1372WinSqmAddToStream
ntdll.dll745RtlDestroyEnvironment
ntdll.dll1362TpSimpleTryPost
ntdll.dll1354TpReleaseWork
ntdll.dll1368TpWaitForWork
ntdll.dll1353TpReleaseWait
ntdll.dll1367TpWaitForWait
ntdll.dll1361TpSetWait
ntdll.dll1345TpPostWork
ntdll.dll1325TpAllocWork
ntdll.dll1324TpAllocWait
ntdll.dll802RtlExpandEnvironmentStrings_U
ntdll.dll688RtlCreateEnvironment
ntdll.dll500NtSetInformationToken
ntdll.dll252NtCreateToken
ntdll.dll607RtlAdjustPrivilege
ntdll.dll1366TpWaitForTimer
ntdll.dll860RtlGetDaclSecurityDescriptor
ntdll.dll1147RtlSetDaclSecurityDescriptor
ntdll.dll591RtlAddAce
ntdll.dll174NtAdjustPrivilegesToken
ntdll.dll275NtDuplicateToken
ntdll.dll1215RtlUnhandledExceptionFilter
ntdll.dll398NtQueryInformationProcess
ntdll.dll1352TpReleaseTimer
ntdll.dll458NtReplyPort
ntdll.dll219NtCompleteConnectPort
ntdll.dll459NtReplyWaitReceivePort
ntdll.dll162NtAcceptConnectPort
ntdll.dll239NtCreatePort
ntdll.dll226NtCreateEvent
ntdll.dll1045RtlNtStatusToDosErrorNoTeb
ntdll.dll678RtlCopySid
ntdll.dll1054RtlOpenCurrentUser
ntdll.dll843RtlFreeSid
ntdll.dll511NtSetSecurityObject
ntdll.dll1164RtlSetSaclSecurityDescriptor
ntdll.dll600RtlAddMandatoryAce
ntdll.dll682RtlCreateAcl
ntdll.dll699RtlCreateSecurityDescriptor
ntdll.dll609RtlAllocateAndInitializeSid
ntdll.dll1198RtlTimeToSecondsSince1980
ntdll.dll1360TpSetTimer
ntdll.dll1323TpAllocTimer
ntdll.dll339NtOpenDirectoryObject
ntdll.dll314NtInitiatePowerAction
ntdll.dll845RtlFreeUnicodeString
ntdll.dll768RtlDuplicateUnicodeString
ntdll.dll284NtFilterToken
ntdll.dll791RtlEqualSid
ntdll.dll1004RtlLeaveCriticalSection
API-MS-Win-Core-LocalRegistry-L1-1-0.dllRegCloseKey
API-MS-Win-Core-LocalRegistry-L1-1-0.dll25RegOpenKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll8RegDeleteValueW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll13RegEnumValueW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll28RegQueryInfoKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll37RegSetValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll2RegCreateKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll35RegSetKeySecurity
API-MS-Win-Core-LocalRegistry-L1-1-0.dll4RegDeleteKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll30RegQueryValueExW
API-MS-Win-Security-Base-L1-1-0.dll45GetLengthSid
API-MS-Win-Security-Base-L1-1-0.dll83RevertToSelf
API-MS-Win-Security-Base-L1-1-0.dll61ImpersonateLoggedOnUser
API-MS-Win-Security-Base-L1-1-0.dll24CheckTokenMembership
API-MS-Win-Security-Base-L1-1-0.dll35DuplicateTokenEx
API-MS-Win-Security-Base-L1-1-0.dll21AllocateLocallyUniqueId
API-MS-Win-Security-Base-L1-1-0.dll38EqualSid
API-MS-Win-Security-Base-L1-1-0.dll31CreateWellKnownSid
API-MS-Win-Security-Base-L1-1-0.dll58GetTokenInformation
WINSTA.dll57WinStationGetUserCredentials
WINSTA.dll29WinStationDisconnect
WINSTA.dll62WinStationIsSessionRemoteable
WINSTA.dll138_WinStationWaitForConnect
WINSTA.dll61WinStationIsSessionPermitted
WINSTA.dll74WinStationQueryInformationW
WINSTA.dll39WinStationFreeMemory
WINSTA.dll65WinStationNegotiateSession
WINSTA.dll42WinStationFreeUserCredentials
WINSTA.dll90WinStationReportUIResult
RPCRT4.dll343RpcAsyncInitializeHandle
RPCRT4.dll340RpcAsyncCancelCall
RPCRT4.dll412RpcMgmtIsServerListening
RPCRT4.dll498RpcStringFreeW
RPCRT4.dll494RpcStringBindingComposeW
RPCRT4.dll351RpcBindingFromStringBindingW
RPCRT4.dll366RpcBindingSetAuthInfoExW
RPCRT4.dll512UuidFromStringW
RPCRT4.dll139NdrAsyncClientCall
RPCRT4.dll452RpcServerUnsubscribeForNotification
RPCRT4.dll448RpcServerSubscribeForNotification
RPCRT4.dll36I_RpcBindingIsClientLocal
RPCRT4.dll450RpcServerUnregisterIf
RPCRT4.dll373RpcBindingVectorFree
RPCRT4.dll384RpcEpUnregister
RPCRT4.dll442RpcServerListen
RPCRT4.dll382RpcEpRegisterW
RPCRT4.dll436RpcServerInqBindings
RPCRT4.dll447RpcServerRegisterIfEx
RPCRT4.dll468RpcServerUseProtseqW
RPCRT4.dll283NdrServerCall2
RPCRT4.dll140NdrAsyncServerCall
RPCRT4.dll431RpcRaiseException
RPCRT4.dll438RpcServerInqCallAttributesW
RPCRT4.dll449RpcServerTestCancel
RPCRT4.dll62I_RpcMapWin32Status
RPCRT4.dll149NdrClientCall2
RPCRT4.dll348RpcBindingCreateW
RPCRT4.dll345RpcBindingBind
RPCRT4.dll372RpcBindingUnbind
RPCRT4.dll349RpcBindingFree
RPCRT4.dll45I_RpcExceptionFilter
RPCRT4.dll339RpcAsyncAbortCall
RPCRT4.dll341RpcAsyncCompleteCall
RPCRT4.dll461RpcServerUseProtseqEpW
RPCRT4.dll30I_RpcBindingInqLocalClientPID
RPCRT4.dll399RpcImpersonateClient
RPCRT4.dll432RpcRevertToSelf
KERNEL32.dll967RegDeleteTreeW
KERNEL32.dll972RegEnumKeyExW
KERNEL32.dll166CreateProcessInternalW
KERNEL32.dll38BaseInitAppcompatCacheSupport
KERNEL32.dll1205SleepEx
KERNEL32.dll488GetFileAttributesW
KERNEL32.dll1187SetTimerQueueTimer
KERNEL32.dll169CreateRemoteThread
KERNEL32.dll657GetThreadUILanguage
KERNEL32.dll675GetVersionExW
KERNEL32.dll659GetTickCount64
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll199DebugBreak
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll934QueryPerformanceCounter
KERNEL32.dll531GetModuleHandleA
KERNEL32.dll1188SetUnhandledExceptionFilter
KERNEL32.dll609GetStartupInfoA
KERNEL32.dll829LoadLibraryExA
KERNEL32.dll206DelayLoadFailureHook
KERNEL32.dll623GetSystemDirectoryW
KERNEL32.dll1135SetInformationJobObject
KERNEL32.dll1271WaitForMultipleObjects
KERNEL32.dll181CreateThread
KERNEL32.dll1111SetErrorMode
KERNEL32.dll143CreateFileW
KERNEL32.dll959ReadFile
KERNEL32.dll534GetModuleHandleW
KERNEL32.dll586GetProcessId
KERNEL32.dll884OpenEventW
KERNEL32.dll189CreateTimerQueueTimer
KERNEL32.dll218DeleteTimerQueueTimer
KERNEL32.dll168CreateProcessW
KERNEL32.dll1052SearchPathW
KERNEL32.dll22AssignProcessToJobObject
KERNEL32.dll1216TerminateProcess
KERNEL32.dll658GetTickCount
KERNEL32.dll96CompareFileTime
KERNEL32.dll1042ResumeThread
KERNEL32.dll293FileTimeToSystemTime
KERNEL32.dll1214SystemTimeToTzSpecificLocalTime
KERNEL32.dll662GetTimeFormatW
KERNEL32.dll1262VirtualLock
KERNEL32.dll595GetProcessWorkingSetSize
KERNEL32.dll1155SetProcessWorkingSetSize
KERNEL32.dll1267VirtualUnlock
KERNEL32.dll1260VirtualFree
KERNEL32.dll150CreateJobObjectW
KERNEL32.dll391GetCommandLineW
KERNEL32.dll1215TerminateJobObject
KERNEL32.dll1038ResetEvent
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll399GetComputerNameW
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll232DuplicateHandle
KERNEL32.dll932QueryInformationJobObject
KERNEL32.dll1012RegisterWaitForSingleObject
KERNEL32.dll895OpenProcess
KERNEL32.dll1242UnregisterWait
KERNEL32.dll929QueryFullProcessImageNameW
KERNEL32.dll479GetExitCodeProcess
KERNEL32.dll584GetProcessHeap
KERNEL32.dll1110SetEnvironmentVariableW
KERNEL32.dll100CompareStringW
KERNEL32.dll608GetShortPathNameW
KERNEL32.dll1358lstrlenW
KERNEL32.dll285ExpandEnvironmentStringsW
KERNEL32.dll1257VirtualAlloc
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll723HeapSetInformation
KERNEL32.dll831LoadLibraryW
KERNEL32.dll579GetProcAddress
KERNEL32.dll354FreeLibrary
KERNEL32.dll1274WaitForSingleObjectEx
KERNEL32.dll748InterlockedExchange
KERNEL32.dll1243UnregisterWaitEx
KERNEL32.dll1202Sleep
KERNEL32.dll632GetSystemTimeAsFileTime
KERNEL32.dll863MoveFileExW
KERNEL32.dll845LocalSize
KERNEL32.dll843LocalReAlloc
KERNEL32.dll133CreateEventW
KERNEL32.dll1112SetEvent
KERNEL32.dll82CloseHandle
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll530GetModuleFileNameW
KERNEL32.dll836LocalAlloc
KERNEL32.dll840LocalFree
KERNEL32.dll1137SetLastError
KERNEL32.dll350FormatMessageW
KERNEL32.dll333FindResourceExW
KERNEL32.dll833LoadResource
KERNEL32.dll851LockResource
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1147SetPriorityClass
KERNEL32.dll452GetCurrentThread
KERNEL32.dll1176SetThreadPriority
KERNEL32.dll724HeapSize
KERNEL32.dll719HeapFree
KERNEL32.dll715HeapAlloc
KERNEL32.dll718HeapDestroy
KERNEL32.dll717HeapCreate
KERNEL32.dll512GetLastError
KERNEL32.dll977RegGetValueA
KERNEL32.dll456GetDateFormatW

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows Logon Application
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNamewinlogon
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameWINLOGON.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0286720EXE11/20/2010 09:29:59#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x270