filename | wscript.exe | |
---|---|---|
size | 141824 (0x22a00) | |
md5 | d1ab72db2bedd2f255d35da3da0d4b16 | |
type | PE32 executable (GUI) Intel 80386, for MS Windows | |
mimetype | application/x-dosexec | |
clamav | OK | |
virustotal | → scan with virustotal.com | |
histogram |
MZ Header
signature | MZ |
bytes_in_last_block | 0x90 |
blocks_in_file | 3 |
num_relocs | 0 |
header_paragraphs | 4 |
min_extra_paragraphs | 0 |
max_extra_paragraphs | 0xffff |
ss | 0 |
sp | 0xb8 |
checksum | 0 |
ip | 0 |
cs | 0 |
reloc_table_offset | 0x40 |
overlay_number | 0 |
reserved0 | 0 |
oem_id | 0 |
oem_info | 0 |
reserved2 | 0 |
reserved3 | 0 |
reserved4 | 0 |
reserved5 | 0 |
reserved6 | 0 |
lfanew | 0xf0 |
Rich Header
lib id | version | times used |
---|---|---|
149 | 30729 | 9 |
131 | 30729 | 66 |
147 | 30729 | 15 |
1 | 0 | 257 |
132 | 30729 | 58 |
126 | 50727 | 1 |
146 | 30729 | 1 |
148 | 30729 | 1 |
145 | 30729 | 1 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Sections
name | va | vsize | raw size | flags | |
---|---|---|---|---|---|
.text | 0x1000 | 0x1757c | 0x17600 | R-X CODE | |
.data | 0x19000 | 0x4dc | 0x600 | RW- IDATA | |
.rsrc | 0x1a000 | 0x94b8 | 0x9600 | R-- IDATA | |
.reloc | 0x24000 | 0x13d4 | 0x1400 | R-- IDATA DISCARDABLE |
Data Directory
id | lang | string |
---|---|---|
1 | 1033 | Windows Script Host |
3 | 1033 | Windows Script Host (debugging disabled) |
20 | 1033 | Windows Script Host Error |
21 | 1033 | Windows Script Host Input Error |
22 | 1033 | This Unicode version of Windows Script Host will only execute under Windows NT. Please use the ANSI version of Windows Script Host." |
30 | 1033 | Usage: |
31 | 1033 | Options: |
32 | 1033 | value |
1001 | 1033 | wsh |
2501 | 1033 | Windows Script Host |
2502 | 1033 | Windows Script Host (debugging disabled) |
2510 | 1033 | Usage: WScript scriptname.extension [option...] [arguments...] Options: //B Batch mode: Suppresses script errors and prompts from displaying //D Enable Active Debugging //E:engine Use engine for executing script //H:CScript Changes the default script host to CScript.exe //H:WScript Changes the default script host to WScript.exe (default) //I Interactive mode (default, opposite of //B) //Job:xxxx Execute a WSF job //Logo Display logo (default) //Nologo Prevent logo display: No banner will be shown at execution time //S Save current command line options for this user //T:nn Time out in seconds: Maximum time a script is permitted to run //X Execute script in debugger |
2520 | 1033 | WScript Error - Windows Script Host |
2521 | 1033 | Input Error - Windows Script Host |
2522 | 1033 | This Unicode version of WScript will only execute under Windows NT. Please use the ANSI version of WScript. |
2600 | 1033 | Script: %1!ls! Line: %2!lu! Char: %3!ld! Error: %4!ls! Code: %5!lX! Source: %6!ls! |
2601 | 1033 | WScript - Script Execution Error |
2602 | 1033 | Windows Script Host Remote Script |
2603 | 1033 | Remote script object can only be executed once. |
2604 | 1033 | Unable to execute remote script. |
3050 | 1033 | The Windows Script Host settings have been reset to default. |
3051 | 1033 | Command line options are saved. |
3052 | 1033 | The default script host is now set to "wscript.exe". |
3053 | 1033 | The default script host is now set to "cscript.exe". |
3054 | 1033 | Successful execution of Windows Script Host. |
3055 | 1033 | Successful remote execution of Windows Script Host. |
3100 | 1033 | Script execution time was exceeded on script "%1!ls!". Script execution was terminated. |
3101 | 1033 | Could not locate automation class named "%1!ls!". |
3102 | 1033 | Could not connect object. |
3103 | 1033 | Could not create object named "%1!ls!". |
3200 | 1033 | Initialization of the Windows Script Host failed. |
3201 | 1033 | Can't find script engine "%2!ls!" for script "%1!ls!". |
3202 | 1033 | Can't change default script host. |
3203 | 1033 | An attempt at saving your settings via the //S option failed. |
3204 | 1033 | Loading script "%1!ls!" failed (%2!ls!). |
3205 | 1033 | Loading your settings failed. |
3206 | 1033 | Execution of the Windows Script Host failed. |
3207 | 1033 | Unexpected error of the Windows Script Host. |
3208 | 1033 | Windows Script Host access is disabled on this machine. Contact your administrator for details. |
3209 | 1033 | Attempt to execute Windows Script Host while it is disabled. |
3210 | 1033 | Attempt to execute Windows Script Host remotely while remote execution is disabled. |
3300 | 1033 | //T option requires timeout value. |
3301 | 1033 | Invalid timeout value for //T option. |
3302 | 1033 | Unknown option "%1!ls!" specified. |
3303 | 1033 | Extra argument specified to option "%1!ls!". |
3304 | 1033 | There is no script file specified. |
3305 | 1033 | Command line option mismatch. |
3306 | 1033 | There is no file extension in "%1!ls!". |
3307 | 1033 | //H option requires host name. |
3308 | 1033 | Host name for //H option must be "cscript" or "wscript". |
3309 | 1033 | There is no script engine for file extension "%1!ls!". |
3310 | 1033 | Can not find script file "%1!ls!". |
3311 | 1033 | Invalid pathname. |
3312 | 1033 | Need -E option. |
3313 | 1033 | -E option requires name of script engine. |
3314 | 1033 | Can't read script from stdin. |
3315 | 1033 | //CP option requires code page value. |
3316 | 1033 | Invalid code page value for //CP option. |
3317 | 1033 | Missing job name. |
3318 | 1033 | Unicode is not supported on this platform. |
3319 | 1033 | Unable to find job "%1!ls!". |
3400 | 1033 | Script setting file "%1!ls!" is invalid. |
3401 | 1033 | Invalid #codepage directive. |
3500 | 1033 | Win32 Error 0x%X |
3501 | 1033 | %1!ls! (%2!ls!) |
module_name | hint | ord | function_name |
---|---|---|---|
ADVAPI32.dll | 567 | RegCreateKeyA | |
ADVAPI32.dll | 560 | RegCloseKey | |
ADVAPI32.dll | 636 | RegSetValueA | |
ADVAPI32.dll | 607 | RegOpenKeyA | |
ADVAPI32.dll | 620 | RegQueryValueA | |
ADVAPI32.dll | 573 | RegDeleteKeyA | |
ADVAPI32.dll | 638 | RegSetValueExW | |
ADVAPI32.dll | 622 | RegQueryValueExW | |
ADVAPI32.dll | 569 | RegCreateKeyExW | |
ADVAPI32.dll | 568 | RegCreateKeyExA | |
ADVAPI32.dll | 609 | RegOpenKeyExW | |
ADVAPI32.dll | 371 | ImpersonateLoggedOnUser | |
ADVAPI32.dll | 643 | RegisterEventSourceW | |
ADVAPI32.dll | 357 | GetUserNameW | |
ADVAPI32.dll | 399 | LookupAccountNameW | |
ADVAPI32.dll | 655 | ReportEventW | |
ADVAPI32.dll | 219 | DeregisterEventSource | |
ADVAPI32.dll | 384 | IsTextUnicode | |
ADVAPI32.dll | 621 | RegQueryValueExA | |
ADVAPI32.dll | 590 | RegEnumKeyExA | |
ADVAPI32.dll | 608 | RegOpenKeyExA | |
ADVAPI32.dll | 637 | RegSetValueExA | |
KERNEL32.dll | 390 | GetCommandLineA | |
KERNEL32.dll | 1358 | lstrlenW | |
KERNEL32.dll | 391 | GetCommandLineW | |
KERNEL32.dll | 715 | HeapAlloc | |
KERNEL32.dll | 719 | HeapFree | |
KERNEL32.dll | 586 | GetProcessHeap | |
KERNEL32.dll | 581 | GetProcAddress | |
KERNEL32.dll | 1053 | SearchPathW | |
KERNEL32.dll | 670 | GetUserDefaultUILanguage | |
KERNEL32.dll | 622 | GetSystemDefaultUILanguage | |
KERNEL32.dll | 518 | GetLocaleInfoW | |
KERNEL32.dll | 676 | GetVersionExW | |
KERNEL32.dll | 140 | CreateFileMappingW | |
KERNEL32.dll | 830 | LoadLibraryExW | |
KERNEL32.dll | 1139 | SetLastError | |
KERNEL32.dll | 833 | LoadResource | |
KERNEL32.dll | 333 | FindResourceExW | |
KERNEL32.dll | 143 | CreateFileW | |
KERNEL32.dll | 496 | GetFileSize | |
KERNEL32.dll | 137 | CreateFileMappingA | |
KERNEL32.dll | 855 | MapViewOfFile | |
KERNEL32.dll | 1238 | UnmapViewOfFile | |
KERNEL32.dll | 572 | GetPrivateProfileIntW | |
KERNEL32.dll | 571 | GetPrivateProfileIntA | |
KERNEL32.dll | 578 | GetPrivateProfileStringW | |
KERNEL32.dll | 577 | GetPrivateProfileStringA | |
KERNEL32.dll | 507 | GetFullPathNameW | |
KERNEL32.dll | 504 | GetFullPathNameA | |
KERNEL32.dll | 516 | GetLocaleInfoA | |
KERNEL32.dll | 829 | LoadLibraryExA | |
KERNEL32.dll | 831 | LoadLibraryW | |
KERNEL32.dll | 722 | HeapReAlloc | |
KERNEL32.dll | 612 | GetStdHandle | |
KERNEL32.dll | 428 | GetConsoleMode | |
KERNEL32.dll | 623 | GetSystemDirectoryA | |
KERNEL32.dll | 644 | GetTempPathA | |
KERNEL32.dll | 642 | GetTempFileNameA | |
KERNEL32.dll | 136 | CreateFileA | |
KERNEL32.dll | 1317 | WriteFile | |
KERNEL32.dll | 343 | FlushFileBuffers | |
KERNEL32.dll | 667 | GetUserDefaultLCID | |
KERNEL32.dll | 370 | GetCPInfo | |
KERNEL32.dll | 490 | GetFileAttributesW | |
KERNEL32.dll | 313 | FindFirstFileW | |
KERNEL32.dll | 485 | GetFileAttributesA | |
KERNEL32.dll | 306 | FindFirstFileA | |
KERNEL32.dll | 302 | FindClose | |
KERNEL32.dll | 360 | GetACP | |
KERNEL32.dll | 130 | CreateEventA | |
KERNEL32.dll | 181 | CreateThread | |
KERNEL32.dll | 82 | CloseHandle | |
KERNEL32.dll | 1113 | SetEvent | |
KERNEL32.dll | 350 | FormatMessageW | |
KERNEL32.dll | 836 | LocalAlloc | |
KERNEL32.dll | 840 | LocalFree | |
KERNEL32.dll | 349 | FormatMessageA | |
KERNEL32.dll | 675 | GetVersionExA | |
KERNEL32.dll | 532 | GetModuleFileNameW | |
KERNEL32.dll | 828 | LoadLibraryA | |
KERNEL32.dll | 354 | FreeLibrary | |
KERNEL32.dll | 1357 | lstrlenA | |
KERNEL32.dll | 1189 | SetUnhandledExceptionFilter | |
KERNEL32.dll | 1235 | UnhandledExceptionFilter | |
KERNEL32.dll | 448 | GetCurrentProcess | |
KERNEL32.dll | 1216 | TerminateProcess | |
KERNEL32.dll | 1048 | RtlUnwind | |
KERNEL32.dll | 905 | OutputDebugStringA | |
KERNEL32.dll | 633 | GetSystemTimeAsFileTime | |
KERNEL32.dll | 449 | GetCurrentProcessId | |
KERNEL32.dll | 659 | GetTickCount | |
KERNEL32.dll | 935 | QueryPerformanceCounter | |
KERNEL32.dll | 738 | InitializeCriticalSection | |
KERNEL32.dll | 209 | DeleteCriticalSection | |
KERNEL32.dll | 238 | EnterCriticalSection | |
KERNEL32.dll | 825 | LeaveCriticalSection | |
KERNEL32.dll | 453 | GetCurrentThreadId | |
KERNEL32.dll | 751 | InterlockedIncrement | |
KERNEL32.dll | 745 | InterlockedCompareExchange | |
KERNEL32.dll | 748 | InterlockedExchange | |
KERNEL32.dll | 747 | InterlockedDecrement | |
KERNEL32.dll | 281 | ExitProcess | |
KERNEL32.dll | 533 | GetModuleHandleA | |
KERNEL32.dll | 610 | GetStartupInfoA | |
KERNEL32.dll | 514 | GetLastError | |
KERNEL32.dll | 1297 | WideCharToMultiByte | |
KERNEL32.dll | 871 | MultiByteToWideChar | |
KERNEL32.dll | 531 | GetModuleFileNameA | |
USER32.dll | 345 | GetMessageA | |
USER32.dll | 174 | DispatchMessageA | |
USER32.dll | 256 | GetActiveWindow | |
USER32.dll | 533 | MessageBoxW | |
USER32.dll | 568 | PostThreadMessageA | |
USER32.dll | 356 | GetParent | |
USER32.dll | 764 | TranslateMessage | |
USER32.dll | 562 | PeekMessageA | |
USER32.dll | 540 | MsgWaitForMultipleObjects | |
USER32.dll | 631 | SendMessageA | |
USER32.dll | 565 | PostMessageA | |
USER32.dll | 506 | LoadStringW | |
USER32.dll | 505 | LoadStringA | |
USER32.dll | 47 | CharNextA | |
USER32.dll | 267 | GetClassInfoA | |
USER32.dll | 587 | RegisterClassA | |
USER32.dll | 109 | CreateWindowExA | |
USER32.dll | 405 | GetWindowLongA | |
USER32.dll | 707 | SetWindowLongA | |
USER32.dll | 699 | SetTimer | |
USER32.dll | 155 | DefWindowProcA | |
USER32.dll | 567 | PostQuitMessage | |
USER32.dll | 483 | KillTimer | |
USER32.dll | 239 | EnumThreadWindows | |
USER32.dll | 480 | IsWindowVisible | |
USER32.dll | 273 | GetClassNameA | |
msvcrt.dll | 475 | _iob | |
msvcrt.dll | 974 | _vsnwprintf | |
msvcrt.dll | 342 | _errno | |
msvcrt.dll | 968 | _vsnprintf | |
msvcrt.dll | 270 | _beginthread | |
msvcrt.dll | 1258 | memcpy | |
msvcrt.dll | 1260 | memmove | |
msvcrt.dll | 1246 | malloc | |
msvcrt.dll | 1190 | free | |
msvcrt.dll | 1255 | mbtowc | |
msvcrt.dll | 1218 | isleadbyte | |
msvcrt.dll | 815 | _snprintf | |
msvcrt.dll | 561 | _itoa | |
msvcrt.dll | 1390 | wctomb | |
msvcrt.dll | 1172 | ferror | |
msvcrt.dll | 895 | _swab | |
msvcrt.dll | 1376 | wcsrchr | |
msvcrt.dll | 563 | _itow | |
msvcrt.dll | 133 | __badioinfo | |
msvcrt.dll | 207 | __pioinfo | |
msvcrt.dll | 367 | _fileno | |
msvcrt.dll | 587 | _lseeki64 | |
msvcrt.dll | 1096 | _write | |
msvcrt.dll | 478 | _isatty | |
msvcrt.dll | 20 | void __cdecl operator delete(void *) ??3@YAXPAX@Z | |
msvcrt.dll | 1371 | wcsncmp | |
msvcrt.dll | 1017 | _wcsnicmp | |
msvcrt.dll | 1007 | _wcsicmp | |
msvcrt.dll | 176 | __mb_cur_max | |
msvcrt.dll | 18 | void * __cdecl operator new(unsigned int) ??2@YAPAXI@Z | |
msvcrt.dll | 1262 | memset | |
msvcrt.dll | 338 | _endthread | |
msvcrt.dll | 1154 | bsearch | |
OLEAUT32.dll | 20 | ||
OLEAUT32.dll | 150 | ||
OLEAUT32.dll | 201 | ||
OLEAUT32.dll | 202 | ||
OLEAUT32.dll | 9 | ||
OLEAUT32.dll | 10 | ||
OLEAUT32.dll | 8 | ||
OLEAUT32.dll | 27 | ||
OLEAUT32.dll | 15 | ||
OLEAUT32.dll | 26 | ||
OLEAUT32.dll | 161 | ||
OLEAUT32.dll | 12 | ||
OLEAUT32.dll | 25 | ||
OLEAUT32.dll | 19 | ||
OLEAUT32.dll | 6 | ||
OLEAUT32.dll | 4 | ||
OLEAUT32.dll | 16 | ||
OLEAUT32.dll | 186 | ||
OLEAUT32.dll | 183 | ||
OLEAUT32.dll | 2 | ||
OLEAUT32.dll | 162 | ||
OLEAUT32.dll | 7 | ||
ole32.dll | 8 | CLSIDFromString | |
ole32.dll | 6 | CLSIDFromProgID | |
ole32.dll | 212 | MkParseDisplayName | |
ole32.dll | 38 | CoGetClassObject | |
ole32.dll | 64 | CoInitializeSecurity | |
ole32.dll | 126 | CreateFileMoniker | |
ole32.dll | 121 | CreateBindCtx | |
ole32.dll | 73 | CoMarshalInterThreadInterfaceInStream | |
ole32.dll | 49 | CoGetInterfaceAndReleaseStream | |
ole32.dll | 108 | CoUninitialize | |
ole32.dll | 62 | CoInitialize | |
ole32.dll | 16 | CoCreateInstance | |
ole32.dll | 95 | CoRevokeClassObject | |
ole32.dll | 83 | CoRegisterClassObject | |
ole32.dll | 376 | StringFromCLSID | |
ole32.dll | 50 | CoGetMalloc | |
ole32.dll | 86 | CoRegisterMessageFilter | |
VERSION.dll | 5 | GetFileVersionInfoSizeW | |
VERSION.dll | GetFileVersionInfoA | ||
VERSION.dll | 13 | VerQueryValueA | |
VERSION.dll | 6 | GetFileVersionInfoW | |
VERSION.dll | 14 | VerQueryValueW | |
VERSION.dll | 3 | GetFileVersionInfoSizeA |
StringTable 040904B0
CompanyName | Microsoft Corporation |
FileDescription | Microsoft ® Windows Based Script Host |
FileVersion | 5.8.7600.16385 |
InternalName | wscript.exe |
LegalCopyright | © Microsoft Corporation. All rights reserved. |
OriginalFilename | wscript.exe |
ProductName | Microsoft ® Windows Script Host |
ProductVersion | 5.8.7600.16385 |
VS_FIXEDFILEINFO
FileVersion | 5.8.7600.16385 |
ProductVersion | 5.8.7600.16385 |
StrucVersion | 0x10000 |
FileFlagsMask | 3 |
FileFlags | 0 |
FileOS | 4 |
FileType | 1 |
FileSubtype | 0 |
Please donate some bucks to keep this site up and running: | |
Ko-fi | |
---|---|
Yandex.Money | |
Thank you! |
[?] can't find file_offset of VA 0x288
[?] can't find file_offset of VA 0x0