filenamenetcfg.exe
size37376 (0x9200)
md501504f3b8b252f5619c94fd65dc52842
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
259274122
2602741222
261274126
2572741213
1099
264274129
255274121
258274121

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections7
TimeDateStamp0x95cc2125
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.20
SizeOfCode0x5000
SizeOfInitializedData0x6400
SizeOfUninitializedData0
AddressOfEntryPoint0x5450
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion10.0
ImageVersion10.0
SubsystemVersion10.0
Reserved10
SizeOfImage0x10000
SizeOfHeaders0x400
CheckSum0xbc4a
Subsystem3
DllCharacteristics0xc160
SizeOfStackReserve0x80000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x4e400x5000R-X CODE
.rdata0x60000x272e0x2800R-- IDATA
.data0x90000x27f00x200RW- IDATA
.pdata0xc0000x4200x600R-- IDATA
.didat0xd0000x180x200RW- IDATA
.rsrc0xe0000x8100xa00R-- IDATA
.reloc0xf0000x700x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x7d480x78
RESOURCE0xe0000x810
EXCEPTION0xc0000x420
SECURITY00
BASERELOC0xf0000x70
DEBUG0x6bd00x54
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x60600x118
Bound_IAT00
IAT0x61d80x2e0
Delay_IAT0x7cac0x40
CLR_Header00
typenamesizecp
MUI#12000
VERSION#19240
MANIFEST#16900
module_namehintordfunction_name
ADVAPI32.dll289EventRegister
ADVAPI32.dll655RegOpenKeyW
ADVAPI32.dll603RegCloseKey
ADVAPI32.dll297EventWriteTransfer
ADVAPI32.dll290EventSetInformation
KERNEL32.dll431FormatMessageW
KERNEL32.dll1388SetThreadPreferredUILanguages
KERNEL32.dll520GetConsoleOutputCP
KERNEL32.dll856HeapSetInformation
KERNEL32.dll640GetModuleHandleW
KERNEL32.dll617GetLastError
KERNEL32.dll358ExitProcess
KERNEL32.dll817GetWindowsDirectoryW
KERNEL32.dll848HeapAlloc
KERNEL32.dll701GetProcessHeap
KERNEL32.dll852HeapFree
KERNEL32.dll969LoadLibraryExW
KERNEL32.dll695GetProcAddress
KERNEL32.dll968LoadLibraryExA
KERNEL32.dll1501VirtualProtect
KERNEL32.dll784GetTickCount
KERNEL32.dll754GetSystemTimeAsFileTime
KERNEL32.dll548GetCurrentThreadId
KERNEL32.dll544GetCurrentProcessId
KERNEL32.dll1105QueryPerformanceCounter
KERNEL32.dll1436TerminateProcess
KERNEL32.dll543GetCurrentProcess
KERNEL32.dll1405SetUnhandledExceptionFilter
KERNEL32.dll1470UnhandledExceptionFilter
KERNEL32.dll1250RtlVirtualUnwind
KERNEL32.dll1243RtlLookupFunctionEntry
KERNEL32.dll1236RtlCaptureContext
KERNEL32.dll1421Sleep
KERNEL32.dllAcquireSRWLockExclusive
KERNEL32.dll1127RaiseException
KERNEL32.dll748GetSystemInfo
KERNEL32.dll435FreeLibrary
KERNEL32.dll1503VirtualQuery
KERNEL32.dll1207ReleaseSRWLockExclusive
msvcrt.dll381_initterm
msvcrt.dll87__C_specific_handler
msvcrt.dll295_fmode
msvcrt.dll210_commode
msvcrt.dll18public: virtual __cdecl type_info::~type_info(void) __ptr64

??1type_info@@UEAA@XZ

msvcrt.dll47void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll144__setusermatherr
msvcrt.dll1170memcpy
msvcrt.dll1312wprintf
msvcrt.dll49public: virtual char const * __ptr64 __cdecl exception::what(void)const __ptr64

?what@exception@@UEBAPEBDXZ

msvcrt.dll906_wcsicmp
msvcrt.dll193_cexit
msvcrt.dll270_exit
msvcrt.dll142__set_app_type
msvcrt.dll1100free
msvcrt.dll174_amsg_exit
msvcrt.dll85_XcptFilter
msvcrt.dll13public: __cdecl exception::exception(void) __ptr64

??0exception@@QEAA@XZ

msvcrt.dll75_CxxThrowException
msvcrt.dll191_callnewh
msvcrt.dll11public: __cdecl exception::exception(char const * __ptr64 const & __ptr64, int) __ptr64

??0exception@@QEAA@AEBQEBDH@Z

msvcrt.dll1281wcschr
msvcrt.dll1285wcscpy_s
msvcrt.dll1074exit
msvcrt.dll1257tolower
msvcrt.dll1142iswprint
msvcrt.dll1002_wsetlocale
msvcrt.dll676_putws
msvcrt.dll873_vsnwprintf
msvcrt.dll1173memmove_s
msvcrt.dll1171memcpy_s
msvcrt.dll12public: __cdecl exception::exception(class exception const & __ptr64) __ptr64

??0exception@@QEAA@AEBV0@@Z

msvcrt.dll17public: virtual __cdecl exception::~exception(void) __ptr64

??1exception@@UEAA@XZ

msvcrt.dll10public: __cdecl exception::exception(char const * __ptr64 const & __ptr64) __ptr64

??0exception@@QEAA@AEBQEBD@Z

msvcrt.dll91__CxxFrameHandler3
msvcrt.dll1158malloc
msvcrt.dll157__wgetmainargs
msvcrt.dll1174memset
ole32.dll144CoUninitialize
ole32.dll97CoInitializeEx
ole32.dll140CoTaskMemFree
ole32.dll43CoCreateInstance
SETUPAPI.dll273SetupCopyOEMInfW
SETUPAPI.dll361SetupDiGetDeviceInstanceIdW
SETUPAPI.dll370SetupDiGetDeviceRegistryPropertyW
SETUPAPI.dll317SetupDiDestroyDeviceInfoList
SETUPAPI.dll340SetupDiGetClassDevsW
SETUPAPI.dll320SetupDiEnumDeviceInfo

StringTable 000004B0

CompanyNameMicrosoft Corporation
FileDescriptionWinPE network installer
FileVersion10.0.19041.1 (WinBuild.160101.0800)
InternalNamesnetcfg.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamenetcfg.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion10.0.19041.1

VS_FIXEDFILEINFO

FileVersion10.0.19041.1
ProductVersion10.0.19041.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d031792BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK