filename | cscript.exe | |
---|---|---|
size | 135168 (0x21000) | |
md5 | 23d42c651f89420f7232aeb7a2a43d03 | |
type | PE32 executable (console) Intel 80386, for MS Windows | |
mimetype | application/x-dosexec | |
clamav | OK | |
virustotal | → scan with virustotal.com | |
histogram |
MZ Header
signature | MZ |
bytes_in_last_block | 0x90 |
blocks_in_file | 3 |
num_relocs | 0 |
header_paragraphs | 4 |
min_extra_paragraphs | 0 |
max_extra_paragraphs | 0xffff |
ss | 0 |
sp | 0xb8 |
checksum | 0 |
ip | 0 |
cs | 0 |
reloc_table_offset | 0x40 |
overlay_number | 0 |
reserved0 | 0 |
oem_id | 0 |
oem_info | 0 |
reserved2 | 0 |
reserved3 | 0 |
reserved4 | 0 |
reserved5 | 0 |
reserved6 | 0 |
lfanew | 0xf8 |
Rich Header
lib id | version | times used |
---|---|---|
125 | 50727 | 9 |
109 | 50727 | 67 |
123 | 50727 | 15 |
1 | 0 | 241 |
110 | 50727 | 53 |
126 | 50727 | 1 |
122 | 50727 | 1 |
124 | 50727 | 1 |
120 | 50727 | 1 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Sections
name | va | vsize | raw size | flags | |
---|---|---|---|---|---|
.text | 0x1000 | 0x14fac | 0x15000 | R-X CODE | |
.data | 0x16000 | 0x4d4 | 0x1000 | RW- IDATA | |
.rsrc | 0x17000 | 0x7df0 | 0x8000 | R-- IDATA | |
.reloc | 0x1f000 | 0x1174 | 0x2000 | R-- IDATA DISCARDABLE |
Data Directory
id | lang | string |
---|---|---|
1 | 1033 | Windows Script Host |
3 | 1033 | Windows Script Host (debugging disabled) |
20 | 1033 | Windows Script Host Error |
21 | 1033 | Windows Script Host Input Error |
22 | 1033 | This Unicode version of Windows Script Host will only execute under Windows NT. Please use the ANSI version of Windows Script Host." |
30 | 1033 | Usage: |
31 | 1033 | Options: |
32 | 1033 | value |
1001 | 1033 | wsh |
2001 | 1033 | Windows Script Host |
2003 | 1033 | Windows Script Host (debugging disabled) |
2010 | 1033 | Usage: CScript scriptname.extension [option...] [arguments...] Options: //B Batch mode: Suppresses script errors and prompts from displaying //D Enable Active Debugging //E:engine Use engine for executing script //H:CScript Changes the default script host to CScript.exe //H:WScript Changes the default script host to WScript.exe (default) //I Interactive mode (default, opposite of //B) //Job:xxxx Execute a WSF job //Logo Display logo (default) //Nologo Prevent logo display: No banner will be shown at execution time //S Save current command line options for this user //T:nn Time out in seconds: Maximum time a script is permitted to run //X Execute script in debugger //U Use Unicode for redirected I/O from the console |
2011 | 1033 | Usage: CScript scriptname.extension [option...] [arguments...] Options: //B Batch mode: Suppresses script errors and prompts from displaying //D Enable Active Debugging //E:engine Use engine for executing script //H:CScript Changes the default script host to CScript.exe //H:WScript Changes the default script host to WScript.exe (default) //I Interactive mode (default, opposite of //B) //Job:xxxx Execute a WSF job //Logo Display logo (default) //Nologo Prevent logo display: No banner will be shown at execution time //S Save current command line options for this user //T:nn Time out in seconds: Maximum time a script is permitted to run //X Execute script in debugger |
2020 | 1033 | CScript Error |
2021 | 1033 | Input Error |
2022 | 1033 | This Unicode version of CScript will only execute under Windows NT. Please use the ANSI version of CScript." |
2023 | 1033 | %1!ls!(%2!u!, %3!u!) %4!ls!: %5!ls! |
2100 | 1033 | Microsoft (R) Windows Script Host Version %1!u!.%2!u! Copyright (C) Microsoft Corporation. All rights reserved. |
3050 | 1033 | The Windows Script Host settings have been reset to default. |
3051 | 1033 | Command line options are saved. |
3052 | 1033 | The default script host is now set to "wscript.exe". |
3053 | 1033 | The default script host is now set to "cscript.exe". |
3054 | 1033 | Successful execution of Windows Script Host. |
3055 | 1033 | Successful remote execution of Windows Script Host. |
3100 | 1033 | Script execution time was exceeded on script "%1!ls!". Script execution was terminated. |
3101 | 1033 | Could not locate automation class named "%1!ls!". |
3102 | 1033 | Could not connect object. |
3103 | 1033 | Could not create object named "%1!ls!". |
3200 | 1033 | Initialization of the Windows Script Host failed. |
3201 | 1033 | Can't find script engine "%2!ls!" for script "%1!ls!". |
3202 | 1033 | Can't change default script host. |
3203 | 1033 | An attempt at saving your settings via the //S option failed. |
3204 | 1033 | Loading script "%1!ls!" failed (%2!ls!). |
3205 | 1033 | Loading your settings failed. |
3206 | 1033 | Execution of the Windows Script Host failed. |
3207 | 1033 | Unexpected error of the Windows Script Host. |
3208 | 1033 | Windows Script Host access is disabled on this machine. Contact your administrator for details. |
3209 | 1033 | Attempt to execute Windows Script Host while it is disabled. |
3210 | 1033 | Attempt to execute Windows Script Host remotely while remote execution is disabled. |
3300 | 1033 | //T option requires timeout value. |
3301 | 1033 | Invalid timeout value for //T option. |
3302 | 1033 | Unknown option "%1!ls!" specified. |
3303 | 1033 | Extra argument specified to option "%1!ls!". |
3304 | 1033 | There is no script file specified. |
3305 | 1033 | Command line option mismatch. |
3306 | 1033 | There is no file extension in "%1!ls!". |
3307 | 1033 | //H option requires host name. |
3308 | 1033 | Host name for //H option must be "cscript" or "wscript". |
3309 | 1033 | There is no script engine for file extension "%1!ls!". |
3310 | 1033 | Can not find script file "%1!ls!". |
3311 | 1033 | Invalid pathname. |
3312 | 1033 | Need -E option. |
3313 | 1033 | -E option requires name of script engine. |
3314 | 1033 | Can't read script from stdin. |
3315 | 1033 | //CP option requires code page value. |
3316 | 1033 | Invalid code page value for //CP option. |
3317 | 1033 | Missing job name. |
3318 | 1033 | Unicode is not supported on this platform. |
3319 | 1033 | Unable to find job "%1!ls!". |
3400 | 1033 | Script setting file "%1!ls!" is invalid. |
3401 | 1033 | Invalid #codepage directive. |
3500 | 1033 | Win32 Error 0x%X |
3501 | 1033 | %1!ls! (%2!ls!) |
module_name | hint | ord | function_name |
---|---|---|---|
KERNEL32.dll | 546 | GetProcAddress | |
KERNEL32.dll | 927 | SearchPathW | |
KERNEL32.dll | 314 | FindResourceW | |
KERNEL32.dll | 629 | GetUserDefaultUILanguage | |
KERNEL32.dll | 584 | GetSystemDefaultUILanguage | |
KERNEL32.dll | 635 | GetVersionExW | |
KERNEL32.dll | 491 | GetLocaleInfoW | |
KERNEL32.dll | 125 | CreateFileMappingW | |
KERNEL32.dll | 760 | LoadLibraryExW | |
KERNEL32.dll | 313 | FindResourceExW | |
KERNEL32.dll | 763 | LoadResource | |
KERNEL32.dll | 1012 | SetLastError | |
KERNEL32.dll | 128 | CreateFileW | |
KERNEL32.dll | 469 | GetFileSize | |
KERNEL32.dll | 122 | CreateFileMappingA | |
KERNEL32.dll | 783 | MapViewOfFile | |
KERNEL32.dll | 1099 | UnmapViewOfFile | |
KERNEL32.dll | 537 | GetPrivateProfileIntW | |
KERNEL32.dll | 536 | GetPrivateProfileIntA | |
KERNEL32.dll | 543 | GetPrivateProfileStringW | |
KERNEL32.dll | 542 | GetPrivateProfileStringA | |
KERNEL32.dll | 480 | GetFullPathNameW | |
KERNEL32.dll | 477 | GetFullPathNameA | |
KERNEL32.dll | 489 | GetLocaleInfoA | |
KERNEL32.dll | 759 | LoadLibraryExA | |
KERNEL32.dll | 761 | LoadLibraryW | |
KERNEL32.dll | 681 | HeapReAlloc | |
KERNEL32.dll | 585 | GetSystemDirectoryA | |
KERNEL32.dll | 606 | GetTempPathA | |
KERNEL32.dll | 121 | CreateFileA | |
KERNEL32.dll | 322 | FlushFileBuffers | |
KERNEL32.dll | 626 | GetUserDefaultLCID | |
KERNEL32.dll | 703 | InterlockedCompareExchange | |
KERNEL32.dll | 706 | InterlockedExchange | |
KERNEL32.dll | 634 | GetVersionExA | |
KERNEL32.dll | 756 | LeaveCriticalSection | |
KERNEL32.dll | 218 | EnterCriticalSection | |
KERNEL32.dll | 705 | InterlockedDecrement | |
KERNEL32.dll | 709 | InterlockedIncrement | |
KERNEL32.dll | 115 | CreateEventA | |
KERNEL32.dll | 164 | CreateThread | |
KERNEL32.dll | 68 | CloseHandle | |
KERNEL32.dll | 987 | SetEvent | |
KERNEL32.dll | 502 | GetModuleFileNameW | |
KERNEL32.dll | 501 | GetModuleFileNameA | |
KERNEL32.dll | 333 | FreeLibrary | |
KERNEL32.dll | 1215 | lstrlenA | |
KERNEL32.dll | 191 | DeleteCriticalSection | |
KERNEL32.dll | 697 | InitializeCriticalSection | |
KERNEL32.dll | 758 | LoadLibraryA | |
KERNEL32.dll | 329 | FormatMessageW | |
KERNEL32.dll | 766 | LocalAlloc | |
KERNEL32.dll | 770 | LocalFree | |
KERNEL32.dll | 328 | FormatMessageA | |
KERNEL32.dll | 463 | GetFileAttributesW | |
KERNEL32.dll | 293 | FindFirstFileW | |
KERNEL32.dll | 458 | GetFileAttributesA | |
KERNEL32.dll | 286 | FindFirstFileA | |
KERNEL32.dll | 282 | FindClose | |
KERNEL32.dll | 339 | GetACP | |
KERNEL32.dll | 348 | GetCPInfo | |
KERNEL32.dll | 1055 | SetUnhandledExceptionFilter | |
KERNEL32.dll | 1096 | UnhandledExceptionFilter | |
KERNEL32.dll | 426 | GetCurrentProcess | |
KERNEL32.dll | 550 | GetProcessHeap | |
KERNEL32.dll | 678 | HeapFree | |
KERNEL32.dll | 674 | HeapAlloc | |
KERNEL32.dll | 503 | GetModuleHandleA | |
KERNEL32.dll | 261 | ExitProcess | |
KERNEL32.dll | 369 | GetCommandLineW | |
KERNEL32.dll | 368 | GetCommandLineA | |
KERNEL32.dll | 799 | MultiByteToWideChar | |
KERNEL32.dll | 574 | GetStdHandle | |
KERNEL32.dll | 1216 | lstrlenW | |
KERNEL32.dll | 487 | GetLastError | |
KERNEL32.dll | 1174 | WriteConsoleW | |
KERNEL32.dll | 1175 | WriteFile | |
KERNEL32.dll | 1156 | WideCharToMultiByte | |
KERNEL32.dll | 604 | GetTempFileNameA | |
KERNEL32.dll | 406 | GetConsoleMode | |
KERNEL32.dll | 857 | QueryPerformanceCounter | |
KERNEL32.dll | 618 | GetTickCount | |
KERNEL32.dll | 430 | GetCurrentThreadId | |
KERNEL32.dll | 427 | GetCurrentProcessId | |
KERNEL32.dll | 595 | GetSystemTimeAsFileTime | |
KERNEL32.dll | 831 | OutputDebugStringA | |
KERNEL32.dll | 922 | RtlUnwind | |
KERNEL32.dll | 1079 | TerminateProcess | |
msvcrt.dll | 974 | _vsnwprintf | |
msvcrt.dll | 895 | _swab | |
msvcrt.dll | 1376 | wcsrchr | |
msvcrt.dll | 563 | _itow | |
msvcrt.dll | 968 | _vsnprintf | |
msvcrt.dll | 176 | __mb_cur_max | |
msvcrt.dll | 475 | _iob | |
msvcrt.dll | 1262 | memset | |
msvcrt.dll | 1258 | memcpy | |
msvcrt.dll | 1260 | memmove | |
msvcrt.dll | 1246 | malloc | |
msvcrt.dll | 1190 | free | |
msvcrt.dll | 1017 | _wcsnicmp | |
msvcrt.dll | 1007 | _wcsicmp | |
msvcrt.dll | 1371 | wcsncmp | |
msvcrt.dll | 20 | void __cdecl operator delete(void *) ??3@YAXPAX@Z | |
msvcrt.dll | 18 | void * __cdecl operator new(unsigned int) ??2@YAPAXI@Z | |
msvcrt.dll | 342 | _errno | |
msvcrt.dll | 1255 | mbtowc | |
msvcrt.dll | 1218 | isleadbyte | |
msvcrt.dll | 815 | _snprintf | |
msvcrt.dll | 561 | _itoa | |
msvcrt.dll | 1390 | wctomb | |
msvcrt.dll | 1172 | ferror | |
msvcrt.dll | 133 | __badioinfo | |
msvcrt.dll | 207 | __pioinfo | |
msvcrt.dll | 367 | _fileno | |
msvcrt.dll | 587 | _lseeki64 | |
msvcrt.dll | 1096 | _write | |
msvcrt.dll | 478 | _isatty | |
msvcrt.dll | 1154 | bsearch | |
OLEAUT32.dll | 9 | ||
OLEAUT32.dll | 201 | ||
OLEAUT32.dll | 202 | ||
OLEAUT32.dll | 10 | ||
OLEAUT32.dll | 8 | ||
OLEAUT32.dll | 4 | ||
OLEAUT32.dll | 150 | ||
OLEAUT32.dll | 161 | ||
OLEAUT32.dll | 12 | ||
OLEAUT32.dll | 25 | ||
OLEAUT32.dll | 7 | ||
OLEAUT32.dll | 6 | ||
OLEAUT32.dll | 19 | ||
OLEAUT32.dll | 16 | ||
OLEAUT32.dll | 26 | ||
OLEAUT32.dll | 15 | ||
OLEAUT32.dll | 162 | ||
OLEAUT32.dll | 27 | ||
OLEAUT32.dll | 20 | ||
OLEAUT32.dll | 2 | ||
ole32.dll | 61 | CoInitialize | |
ole32.dll | 107 | CoUninitialize | |
ole32.dll | 37 | CoGetClassObject | |
ole32.dll | 211 | MkParseDisplayName | |
ole32.dll | 6 | CLSIDFromProgID | |
ole32.dll | 8 | CLSIDFromString | |
ole32.dll | 120 | CreateBindCtx | |
ole32.dll | 16 | CoCreateInstance | |
ole32.dll | 85 | CoRegisterMessageFilter | |
ole32.dll | 63 | CoInitializeSecurity | |
ole32.dll | 125 | CreateFileMoniker | |
VERSION.dll | 2 | GetFileVersionInfoSizeA | |
VERSION.dll | 13 | VerQueryValueW | |
VERSION.dll | 5 | GetFileVersionInfoW | |
VERSION.dll | 4 | GetFileVersionInfoSizeW | |
VERSION.dll | GetFileVersionInfoA | ||
VERSION.dll | 12 | VerQueryValueA | |
ADVAPI32.dll | 616 | RegQueryValueExW | |
ADVAPI32.dll | 563 | RegCreateKeyExW | |
ADVAPI32.dll | 562 | RegCreateKeyExA | |
ADVAPI32.dll | 603 | RegOpenKeyExW | |
ADVAPI32.dll | 365 | ImpersonateLoggedOnUser | |
ADVAPI32.dll | 378 | IsTextUnicode | |
ADVAPI32.dll | 637 | RegisterEventSourceW | |
ADVAPI32.dll | 351 | GetUserNameW | |
ADVAPI32.dll | 393 | LookupAccountNameW | |
ADVAPI32.dll | 649 | ReportEventW | |
ADVAPI32.dll | 215 | DeregisterEventSource | |
ADVAPI32.dll | 615 | RegQueryValueExA | |
ADVAPI32.dll | 584 | RegEnumKeyExA | |
ADVAPI32.dll | 561 | RegCreateKeyA | |
ADVAPI32.dll | 602 | RegOpenKeyExA | |
ADVAPI32.dll | 631 | RegSetValueExA | |
ADVAPI32.dll | 554 | RegCloseKey | |
ADVAPI32.dll | 632 | RegSetValueExW | |
USER32.dll | 670 | SetTimer | |
USER32.dll | 149 | DefWindowProcA | |
USER32.dll | 544 | PostQuitMessage | |
USER32.dll | 461 | KillTimer | |
USER32.dll | 232 | EnumThreadWindows | |
USER32.dll | 676 | SetWindowLongA | |
USER32.dll | 542 | PostMessageA | |
USER32.dll | 606 | SendMessageA | |
USER32.dll | 518 | MsgWaitForMultipleObjects | |
USER32.dll | 539 | PeekMessageA | |
USER32.dll | 725 | TranslateMessage | |
USER32.dll | 168 | DispatchMessageA | |
USER32.dll | 341 | GetParent | |
USER32.dll | 266 | GetClassNameA | |
USER32.dll | 385 | GetWindowLongA | |
USER32.dll | 330 | GetMessageA | |
USER32.dll | 103 | CreateWindowExA | |
USER32.dll | 563 | RegisterClassA | |
USER32.dll | 260 | GetClassInfoA | |
USER32.dll | 249 | GetActiveWindow | |
USER32.dll | 45 | CharNextA | |
USER32.dll | 483 | LoadStringA | |
USER32.dll | 484 | LoadStringW | |
USER32.dll | 458 | IsWindowVisible |
StringTable 040904B0
CompanyName | Microsoft Corporation |
FileDescription | Microsoft (R) Console Based Script Host |
FileVersion | 5.7.0.18066 |
InternalName | cscript.exe |
LegalCopyright | Copyright (C) Microsoft Corp. 1996-2006, All Rights Reserved |
OriginalFilename | cscript.exe |
ProductName | Microsoft (R) Windows Script Host |
ProductVersion | 5.7.0.18066 |
VS_FIXEDFILEINFO
FileVersion | 5.7.0.18066 |
ProductVersion | 5.7.0.18066 |
StrucVersion | 0x10000 |
FileFlagsMask | 3 |
FileFlags | 0 |
FileOS | 4 |
FileType | 1 |
FileSubtype | 0 |
Please donate some bucks to keep this site up and running: | |
Ko-fi | |
---|---|
Yandex.Money | |
Thank you! |
[?] can't find file_offset of VA 0x290
[?] can't find file_offset of VA 0x0