filenameh.exe
size514560 (0x7da00)
md57db59fff2af32c27eb2276424fa5eddb
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
1540355
10333
93403535
9440351
96403562
95403519
9040351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x41107c11
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x27000
SizeOfInitializedData0x67200
SizeOfUninitializedData0
AddressOfEntryPoint0xb95d
BaseOfCode0x1000
BaseOfData0x28000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion4.10
Reserved10
SizeOfImage0x90000
SizeOfHeaders0x400
CheckSum0x8980c
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x40000
SizeOfStackCommit0x8000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.x >> *SigBy Ahmed18

Sections

namevavsizeraw sizeflags
.text0x10000x26fc60x27000R-X CODE
.data0x280000x164400x5a00RW- IDATA
.rsrc0x3f0000x50c000x50c00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x265240x140
RESOURCE0x3f0000x50c00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x15000x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x62f80x40
Bound_IAT0x2480x138
IAT0x10000x4fc
Delay_IAT0x264700x40
CLR_Header00
typenamesizecp
UIFILE#1000152110
BITMAP#1001366620
BITMAP#10213300
BITMAP#10321220
BITMAP#10421220
BITMAP#10523920
BITMAP#10623920
BITMAP#10721220
BITMAP#10821220
BITMAP#1099240
BITMAP#1109240
BITMAP#111172520
BITMAP#112168740
BITMAP#113134960
BITMAP#11469520
BITMAP#119134960
BITMAP#12121220
BITMAP#12221220
BITMAP#123354740
BITMAP#12414020
BITMAP#12548420
BITMAP#12672420
BITMAP#127354740
STRING#18040
STRING#212660
STRING#39760
STRING#4420
STRING#7540
VERSION#19040
idlangstring
11033arial
21033tahoma
31033tahoma
61033Type your password
71033welcome
81033Please type your password again. Be sure to use the correct uppercase and lowercase letters.
91033You can click the "?" button to see your password hint. Please type your password again. Be sure to use the correct uppercase and lowercase letters.
101033Did you forget your password?
111033Turn off computer
121033Turn off %s
131033Password Hint:
141033Undock computer
151033Logged on
161033Currently logged on
171033Undock %s
181033You can <A>use your password reset disk</A>. Please type your password again. Be sure to use the correct uppercase and lowercase letters.
191033You can click the "?" button to see your password hint. Or you can <A>use your password reset disk</A>. Please type your password again. Be sure to use the correct uppercase and lowercase letters.
221033To begin, click your user name
251033After you log on, you can add or change accounts. Just go to Control Panel and click User Accounts.
261033Logging on...
271033%d unread mail message.
281033%d unread mail messages.
291033%d program running.
301033%d programs running.
311033please wait...
321033%s has %d program running
331033%s has %d programs running
341033Running too many programs can slow down your computer. If your computer is running more slowly than normal, try closing some programs.
351033%s has %d e-mail message
361033%s has %d e-mail messages
371033To read your messages, log on and choose E-mail from the Start menu.
381033%s is logged on
391033Running too many programs may slow down your computer. If your computer is running more slowly than normal, try logging some users off.
401033%s (%d)
42103314
4310339
44103336
45103314
4610338
4710338
481033arial
1001033Log user on
module_namehintordfunction_name
msvcrt.dll436_onexit
msvcrt.dll18void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll786swprintf
msvcrt.dll553_wcsicmp
msvcrt.dll449_purecall
msvcrt.dll810wcscpy
msvcrt.dll747qsort
msvcrt.dll197_c_exit
msvcrt.dll246_exit
msvcrt.dll319_iob
msvcrt.dll685fwrite
msvcrt.dll783strtol
msvcrt.dll626_wtoi
msvcrt.dll353_itow
msvcrt.dll280_ftol
msvcrt.dll735memmove
msvcrt.dll484_snwprintf
msvcrt.dll816wcsncpy
msvcrt.dll808wcscmp
msvcrt.dll813wcslen
msvcrt.dll214_controlfp
msvcrt.dll644atoi
msvcrt.dll106__dllonexit
msvcrt.dll237_except_handler3
msvcrt.dll152__set_app_type
msvcrt.dll133__p__fmode
msvcrt.dll128__p__commode
msvcrt.dll182_adjust_fdiv
msvcrt.dll154__setusermatherr
msvcrt.dll315_initterm
msvcrt.dll109__getmainargs
msvcrt.dll168_acmdln
msvcrt.dll656exit
msvcrt.dll200_cexit
msvcrt.dll78_XcptFilter
ADVAPI32.dll483RegOpenKeyExA
ADVAPI32.dll334LookupPrivilegeValueW
ADVAPI32.dll28AdjustTokenPrivileges
ADVAPI32.dll431OpenThreadToken
ADVAPI32.dll426OpenProcessToken
ADVAPI32.dll80ConvertSidToStringSidW
ADVAPI32.dll479RegLoadKeyW
ADVAPI32.dll510RegUnLoadKeyW
ADVAPI32.dll292GetUserNameW
ADVAPI32.dll493RegQueryValueExA
ADVAPI32.dll484RegOpenKeyExW
ADVAPI32.dll458RegCloseKey
ADVAPI32.dll494RegQueryValueExW
ADVAPI32.dll326LookupAccountNameW
ADVAPI32.dll280GetSidSubAuthorityCount
ADVAPI32.dll279GetSidSubAuthority
KERNEL32.dll373GetModuleHandleA
KERNEL32.dll855UnhandledExceptionFilter
KERNEL32.dll315GetCurrentProcess
KERNEL32.dll838TerminateProcess
KERNEL32.dll445GetSystemTimeAsFileTime
KERNEL32.dll316GetCurrentProcessId
KERNEL32.dll318GetCurrentThreadId
KERNEL32.dll465GetTickCount
KERNEL32.dll657QueryPerformanceCounter
KERNEL32.dll577LoadLibraryA
KERNEL32.dll536InterlockedCompareExchange
KERNEL32.dll126DeleteAtom
KERNEL32.dll2AddAtomW
KERNEL32.dll933lstrcatW
KERNEL32.dll845TlsGetValue
KERNEL32.dll520HeapFree
KERNEL32.dll524HeapReAlloc
KERNEL32.dll514HeapAlloc
KERNEL32.dll611MulDiv
KERNEL32.dll407GetProcAddress
KERNEL32.dll580LoadLibraryW
KERNEL32.dll537InterlockedDecrement
KERNEL32.dll541InterlockedIncrement
KERNEL32.dll516HeapCreate
KERNEL32.dll843TlsAlloc
KERNEL32.dll844TlsFree
KERNEL32.dll518HeapDestroy
KERNEL32.dll846TlsSetValue
KERNEL32.dll127DeleteCriticalSection
KERNEL32.dll533InitializeCriticalSection
KERNEL32.dll240FreeLibrary
KERNEL32.dll364GetLocaleInfoW
KERNEL32.dll376GetModuleHandleW
KERNEL32.dll948lstrlenW
KERNEL32.dll945lstrcpynW
KERNEL32.dll939lstrcmpiW
KERNEL32.dll818SetUnhandledExceptionFilter
KERNEL32.dll182ExitProcess
KERNEL32.dll583LocalAlloc
KERNEL32.dll942lstrcpyW
KERNEL32.dll587LocalFree
KERNEL32.dll428GetStartupInfoA
KERNEL32.dll125DelayLoadFailureHook
KERNEL32.dll360GetLastError
KERNEL32.dll272GetComputerNameW
KERNEL32.dll592LocalSize
KERNEL32.dll787SetLastError
KERNEL32.dll186ExpandEnvironmentStringsW
KERNEL32.dll551IsBadWritePtr
KERNEL32.dll550IsBadStringPtrW
KERNEL32.dll317GetCurrentThread
KERNEL32.dll49CloseHandle
KERNEL32.dll538InterlockedExchange
KERNEL32.dll475GetVersionExA
KERNEL32.dll248GetAtomNameW
KERNEL32.dll800SetProcessWorkingSetSize
KERNEL32.dll471GetUserDefaultUILanguage
KERNEL32.dll612MultiByteToWideChar
KERNEL32.dll203FindAtomW
KERNEL32.dll150EnterCriticalSection
KERNEL32.dll576LeaveCriticalSection
KERNEL32.dll636OutputDebugStringW
KERNEL32.dll829SizeofResource
KERNEL32.dll596LockResource
KERNEL32.dll582LoadResource
KERNEL32.dll226FindResourceW
GDI32.dll45CreateCompatibleDC
GDI32.dll61CreateFontIndirectW
GDI32.dll283GdiFlush
GDI32.dll80CreateSolidBrush
GDI32.dll363GetDeviceCaps
GDI32.dll39CreateBitmap
GDI32.dll526SelectObject
GDI32.dll533SetBkColor
GDI32.dll572SetTextColor
GDI32.dll222ExtTextOutW
GDI32.dll477PatBlt
GDI32.dll143DeleteObject
GDI32.dll140DeleteDC
GDI32.dll75CreateRectRgn
GDI32.dll468OffsetRgn
GDI32.dll221ExtTextOutA
GDI32.dll459LPtoDP
GDI32.dll586StretchDIBits
GDI32.dll394GetLayout
GDI32.dll552SetLayout
GDI32.dll49CreateDIBPatternBrushPt
GDI32.dll50CreateDIBSection
GDI32.dll362GetDIBits
GDI32.dll336GetBrushOrgEx
GDI32.dll537SetBrushOrgEx
GDI32.dll63CreateHalftonePalette
GDI32.dll527SelectPalette
GDI32.dll499RealizePalette
GDI32.dll480PlayEnhMetaFile
GDI32.dll568SetStretchBltMode
GDI32.dll70CreatePatternBrush
GDI32.dll18BitBlt
GDI32.dll534SetBkMode
GDI32.dll570SetTextAlign
GDI32.dll437GetTextExtentPoint32W
GDI32.dll141DeleteEnhMetaFile
GDI32.dll405GetObjectA
GDI32.dll585StretchBlt
GDI32.dll407GetObjectW
GDI32.dll412GetPixel
GDI32.dll421GetStockObject
GDI32.dll44CreateCompatibleBitmap
USER32.dll97CreateWindowExW
USER32.dll658ShowWindow
USER32.dll599SetForegroundWindow
USER32.dll196EnableWindow
USER32.dll153DestroyWindow
USER32.dll692UnregisterClassW
USER32.dll349GetSystemMetrics
USER32.dll641SetWindowLongW
USER32.dll486MonitorFromPoint
USER32.dll320GetMonitorInfoW
USER32.dll643SetWindowPos
USER32.dll729wsprintfW
USER32.dll457LoadStringW
USER32.dll512PostMessageW
USER32.dll72CopyIcon
USER32.dll255GetClientRect
USER32.dll483MessageBoxW
USER32.dll230FindWindowW
USER32.dll290GetKeyboardLayout
USER32.dll150DestroyIcon
USER32.dll291GetKeyboardLayoutList
USER32.dll666SystemParametersInfoW
USER32.dll268GetDC
USER32.dll554ReleaseDC
USER32.dll346GetSysColor
USER32.dll191DrawTextW
USER32.dll327GetProcessDefaultLayout
USER32.dll90CreateIconIndirect
USER32.dll372GetWindowRect
USER32.dll576SendMessageW
USER32.dll434KillTimer
USER32.dll634SetTimer
USER32.dll442LoadCursorW
USER32.dll536RegisterClassExW
USER32.dll367GetWindowLongW
USER32.dll143DefWindowProcW
USER32.dll13BeginPaint
USER32.dll226FillRect
USER32.dll200EndPaint
USER32.dll42CharNextA
USER32.dll44CharNextW
USER32.dll366GetWindowLongA
USER32.dll620SetRect
USER32.dll282GetIconInfo
USER32.dll446LoadImageW
USER32.dll223EqualRect
USER32.dll183DrawIconEx
USER32.dll179DrawFocusRect
USER32.dll402IntersectRect
USER32.dll181DrawFrameControl
USER32.dll74CopyRect
USER32.dll621SetRectEmpty
USER32.dll2AdjustWindowRectEx
USER32.dll325GetParent
USER32.dll589SetCursor
USER32.dll561ScreenToClient
USER32.dll316GetMessagePos
USER32.dll403InvalidateRect
USER32.dll142DefWindowProcA
USER32.dll248GetClassInfoExW
USER32.dll347GetSysColorBrush
USER32.dll571SendMessageA
USER32.dll378GetWindowTextW
USER32.dll377GetWindowTextLengthW
USER32.dll162DispatchMessageW
USER32.dll682TranslateMessage
USER32.dll318GetMessageW
USER32.dll513PostQuitMessage
USER32.dll640SetWindowLongA
USER32.dll598SetFocus
USER32.dll665SystemParametersInfoA
USER32.dll492NotifyWinEvent
USER32.dll614SetParent
USER32.dll28CallWindowProcW
USER32.dll699UpdateWindow
USER32.dll644SetWindowRgn
USER32.dll647SetWindowTextW
USER32.dll471MapWindowPoints
USER32.dll278GetFocus
COMCTL32.dll413
COMCTL32.dll412
COMCTL32.dll93InitCommonControlsEx
COMCTL32.dll355
COMCTL32.dll17
COMCTL32.dll410
SHELL32.dll752
ntdll.dll255NtQuerySystemInformation
ntdll.dll834RtlUnhandledExceptionFilter
NETAPI32.dll105NetApiBufferFree
NETAPI32.dll11DsGetDcNameW
NETAPI32.dll176NetQueryDisplayInformation
ole32.dll104CoUninitialize
ole32.dll58CoInitialize
ole32.dll21CoDisconnectObject
ole32.dll59CoInitializeEx
ole32.dll16CoCreateInstance
OLEAUT32.dll8
OLEAUT32.dll9
OLEAUT32.dll2
OLEAUT32.dll6
RPCRT4.dll327RpcBindingFromStringBindingW
RPCRT4.dll127NdrClientCall2
RPCRT4.dll325RpcBindingFree
RPCRT4.dll472RpcStringFreeW
RPCRT4.dll359RpcEpResolveBinding
RPCRT4.dll468RpcStringBindingComposeW
DUSER.dll107UtilDrawBlendRect
DUSER.dll26DUserRegisterStub
DUSER.dll31DeleteHandle
DUSER.dll37FindGadgetFromPoint
DUSER.dll76LookupGadgetTicket
DUSER.dll98SetGadgetRootInfo
DUSER.dll62GetStdColorBrushI
DUSER.dll64GetStdColorI
DUSER.dll39FindStdColor
DUSER.dll60GetMessageExW
DUSER.dll71InitGadgets
DUSER.dll88SetGadgetBufferInfo
DUSER.dll58GetGadgetTicket
DUSER.dll77MapGadgetPoints
DUSER.dll8CreateAction
DUSER.dll52GetGadgetRgn
DUSER.dll45GetGadgetAnimation
DUSER.dll7BuildInterpolation
DUSER.dll5BuildAnimation
DUSER.dll56GetGadgetSize
DUSER.dll51GetGadgetRect
DUSER.dll9CreateGadget
DUSER.dll23DUserPostEvent
DUSER.dll41ForwardGadgetMessage
DUSER.dll2AttachWndProcW
DUSER.dll72InvalidateGadget
DUSER.dll97SetGadgetRect
DUSER.dll95SetGadgetParent
DUSER.dll92SetGadgetFocus
DUSER.dll48GetGadgetFocus
DUSER.dll93SetGadgetMessageFilter
DUSER.dll101SetGadgetStyle
DUSER.dll28DUserSendEvent
MSIMG32.dll2GradientFill
MSIMG32.dllAlphaBlend
MSIMG32.dll3TransparentBlt
OLEACC.dll19LresultFromObject
OLEACC.dll3AccessibleObjectFromWindow
OLEACC.dll4CreateStdAccessibleObject

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows Logon UI
FileVersion6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
InternalNameLOGONUI
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameLOGONUI.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.00.2900.2180

VS_FIXEDFILEINFO

FileVersion6.0.2900.2180
ProductVersion6.0.2900.2180
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
0514560EXE08/04/2004 06:02:57#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x248