filenamecmd.exe
size345088 (0x54400)
md55746bd7e255dd6a8afa06f7c42c1ba41
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
132307291
149307292
10253
147307299
1313072918
1373072939
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x4ce798e5
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion9.0
SizeOfCode0x27200
SizeOfInitializedData0x2ce00
SizeOfUninitializedData0
AddressOfEntryPoint0x90b4
BaseOfCode0x1000
ImageBase0x4ad00000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x59000
SizeOfHeaders0x400
CheckSum0x5bdec
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0xfc000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x270cc0x27200R-X CODE
.rdata0x290000x49100x4a00R-- IDATA
.data0x2e0000x1d3980x1d400RW- IDATA
.pdata0x4c0000x26dc0x2800R-- IDATA
.rsrc0x4f0000x84580x8600R-- IDATA
.reloc0x580000x1240x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x2a7580x64
RESOURCE0x4f0000x8458
EXCEPTION0x4c0000x26dc
SECURITY00
BASERELOC0x580000x124
DEBUG0x280700x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2e80x9c
IAT0x290000x748
Delay_IAT0x2a42c0xa0
CLR_Header00
typenamesizecp
MUI#12160
ICON#116400
ICON#27440
ICON#32960
ICON#437520
ICON#522160
ICON#613840
ICON#757900
ICON#896400
ICON#942640
ICON#1011280
GROUP_ICONIDI_APPICON1460
VERSION#19040
MANIFEST#18980
module_namehintordfunction_name
msvcrt.dll1156memset
msvcrt.dll1152memcpy
msvcrt.dll1151memcmp
msvcrt.dll691_setjmp
msvcrt.dll48void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll128__set_app_type
msvcrt.dll280_fmode
msvcrt.dll196_commode
msvcrt.dll130__setusermatherr
msvcrt.dll160_amsg_exit
msvcrt.dll364_initterm
msvcrt.dll179_cexit
msvcrt.dll255_exit
msvcrt.dll82_XcptFilter
msvcrt.dll83__C_specific_handler
msvcrt.dll113__getmainargs
msvcrt.dll1043calloc
msvcrt.dll1082free
msvcrt.dll893_wcslwr
msvcrt.dll1170qsort
msvcrt.dll239_dup2
msvcrt.dll238_dup
msvcrt.dll194_close
msvcrt.dll641_open_osfhandle
msvcrt.dll1227swscanf
msvcrt.dll807_ultoa
msvcrt.dll647_pipe
msvcrt.dll1273wcsncmp
msvcrt.dll695_setmode
msvcrt.dll1056exit
msvcrt.dll1128iswxdigit
msvcrt.dll1234time
msvcrt.dll1194srand
msvcrt.dll1015_wtol
msvcrt.dll1063fflush
msvcrt.dll1282wcsstr
msvcrt.dll1117iswalpha
msvcrt.dll1289wcstoul
msvcrt.dll246_errno
msvcrt.dll1163printf
msvcrt.dll1173rand
msvcrt.dll367_iob
msvcrt.dll1075fprintf
msvcrt.dll1278wcsrchr
msvcrt.dll1175realloc
msvcrt.dll1241towlower
msvcrt.dll1183setlocale
msvcrt.dll916_wcsupr
msvcrt.dll1121iswdigit
msvcrt.dll889_wcsicmp
msvcrt.dll1126iswspace
msvcrt.dll1263wcschr
msvcrt.dll1154memmove
msvcrt.dll1066fgets
msvcrt.dll644_pclose
msvcrt.dll1062ferror
msvcrt.dll1061feof
msvcrt.dll969_wpopen
msvcrt.dll899_wcsnicmp
msvcrt.dll856_vsnwprintf
msvcrt.dll1286wcstol
msvcrt.dll324_get_osfhandle
msvcrt.dll335_getch
msvcrt.dll1242towupper
msvcrt.dll1281wcsspn
msvcrt.dll788_tell
msvcrt.dll1139longjmp
msvcrt.dll464_local_unwind
ntdll.dll635RtlCaptureContext
ntdll.dll1026RtlLookupFunctionEntry
ntdll.dll1265RtlVirtualUnwind
ntdll.dll843RtlFreeHeap
ntdll.dll298NtFsControlFile
ntdll.dll364NtOpenThreadToken
ntdll.dll214NtClose
ntdll.dll356NtOpenProcessToken
ntdll.dll402NtQueryInformationToken
ntdll.dll768RtlDosPathNameToNtPathName_U
ntdll.dll825RtlFindLeastSignificantBit
ntdll.dll498NtSetInformationProcess
ntdll.dll399NtQueryInformationProcess
ntdll.dll1045RtlNtStatusToDosError
KERNEL32.dll668GetTimeFormatW
KERNEL32.dll664GetTickCount
KERNEL32.dll934QueryPerformanceCounter
KERNEL32.dll1199SetUnhandledExceptionFilter
KERNEL32.dll1213Sleep
KERNEL32.dll206DelayLoadFailureHook
KERNEL32.dll831LoadLibraryExA
KERNEL32.dll359FreeLibrary
KERNEL32.dll147CreateHardLinkW
KERNEL32.dll177CreateSymbolicLinkW
KERNEL32.dll690GetVolumePathNameW
KERNEL32.dll657GetThreadLocale
KERNEL32.dll1043ResumeThread
KERNEL32.dll1159SetProcessAffinityMask
KERNEL32.dll560GetNumaNodeProcessorMaskEx
KERNEL32.dll653GetThreadGroupAffinity
KERNEL32.dll313FindFirstFileExW
KERNEL32.dll468GetDiskFreeSpaceExW
KERNEL32.dll331FindNextStreamW
KERNEL32.dll320FindFirstStreamW
KERNEL32.dll224DeviceIoControl
KERNEL32.dll96CompareFileTime
KERNEL32.dll1027RemoveDirectoryW
KERNEL32.dll452GetCurrentDirectoryW
KERNEL32.dll485GetExitCodeProcess
KERNEL32.dll1285WaitForSingleObject
KERNEL32.dll1227TerminateProcess
KERNEL32.dll1112SetCurrentDirectoryW
KERNEL32.dll1140SetFileTime
KERNEL32.dll214DeleteFileW
KERNEL32.dll1118SetEndOfFile
KERNEL32.dll1131SetFileAttributesW
KERNEL32.dll117CopyFileW
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll1105SetConsoleTextAttribute
KERNEL32.dll299FillConsoleOutputAttribute
KERNEL32.dll1062ScrollConsoleScreenBufferW
KERNEL32.dll365GetACP
KERNEL32.dll355FormatMessageW
KERNEL32.dll348FlushFileBuffers
KERNEL32.dll235DuplicateHandle
KERNEL32.dll732HeapSize
KERNEL32.dll730HeapReAlloc
KERNEL32.dll1269VirtualAlloc
KERNEL32.dll1272VirtualFree
KERNEL32.dll731HeapSetInformation
KERNEL32.dll458GetCurrentThreadId
KERNEL32.dll901OpenThread
KERNEL32.dll491GetFileAttributesExW
KERNEL32.dll473GetDriveTypeW
KERNEL32.dll681GetVersion
KERNEL32.dll827LeaveCriticalSection
KERNEL32.dll241EnterCriticalSection
KERNEL32.dll535GetModuleFileNameW
KERNEL32.dll694GetWindowsDirectoryW
KERNEL32.dll1080SetConsoleCtrlHandler
KERNEL32.dll747InitializeCriticalSection
KERNEL32.dll290ExpandEnvironmentStringsW
KERNEL32.dll68CancelSynchronousIo
KERNEL32.dll686GetVolumeInformationW
KERNEL32.dll706GlobalFree
KERNEL32.dll699GlobalAlloc
KERNEL32.dll1137SetFilePointerEx
KERNEL32.dll1329WriteFile
KERNEL32.dll1064SearchPathW
KERNEL32.dll842LocalFree
KERNEL32.dll1107SetConsoleTitleW
KERNEL32.dll865MoveFileExW
KERNEL32.dll868MoveFileW
KERNEL32.dll929QueryFullProcessImageNameW
KERNEL32.dll963ReadProcessMemory
KERNEL32.dll833LoadLibraryW
KERNEL32.dll1004RegSetValueExW
KERNEL32.dll967RegCreateKeyExW
KERNEL32.dll1247UnhandledExceptionFilter
KERNEL32.dll453GetCurrentProcess
KERNEL32.dll638GetSystemTimeAsFileTime
KERNEL32.dll1277VirtualQuery
KERNEL32.dll92CmdBatNotification
KERNEL32.dll375GetCPInfo
KERNEL32.dll437GetConsoleOutputCP
KERNEL32.dll1185SetThreadLocale
KERNEL32.dll585GetProcAddress
KERNEL32.dll539GetModuleHandleW
KERNEL32.dll82CloseHandle
KERNEL32.dll517GetLastError
KERNEL32.dll1136SetFilePointer
KERNEL32.dll511GetFullPathNameW
KERNEL32.dll318FindFirstFileW
KERNEL32.dll330FindNextFileW
KERNEL32.dll307FindClose
KERNEL32.dll143CreateFileW
KERNEL32.dll960ReadFile
KERNEL32.dll872MultiByteToWideChar
KERNEL32.dll500GetFileSize
KERNEL32.dll1309WideCharToMultiByte
KERNEL32.dll1365lstrcmpiW
KERNEL32.dll1362lstrcmpW
KERNEL32.dll617GetStdHandle
KERNEL32.dll347FlushConsoleInputBuffer
KERNEL32.dll723HeapAlloc
KERNEL32.dll590GetProcessHeap
KERNEL32.dll727HeapFree
KERNEL32.dll439GetConsoleScreenBufferInfo
KERNEL32.dll958ReadConsoleW
KERNEL32.dll1084SetConsoleCursorPosition
KERNEL32.dll301FillConsoleOutputCharacterW
KERNEL32.dll1328WriteConsoleW
KERNEL32.dll503GetFileType
KERNEL32.dll674GetUserDefaultLCID
KERNEL32.dll521GetLocaleInfoW
KERNEL32.dll1151SetLocalTime
KERNEL32.dll636GetSystemTime
KERNEL32.dll1224SystemTimeToFileTime
KERNEL32.dll297FileTimeToLocalFileTime
KERNEL32.dll298FileTimeToSystemTime
KERNEL32.dll462GetDateFormatW
KERNEL32.dll973RegDeleteValueW
KERNEL32.dll518GetLocalTime
KERNEL32.dll433GetConsoleMode
KERNEL32.dll1096SetConsoleMode
KERNEL32.dll482GetEnvironmentVariableW
KERNEL32.dll396GetCommandLineW
KERNEL32.dll557GetNumaHighestNodeNumber
KERNEL32.dll480GetEnvironmentStringsW
KERNEL32.dll358FreeEnvironmentStringsW
KERNEL32.dll1122SetEnvironmentVariableW
KERNEL32.dll1120SetEnvironmentStringsW
KERNEL32.dll443GetConsoleTitleW
KERNEL32.dll680GetVDMCurrentDirectories
KERNEL32.dll1123SetErrorMode
KERNEL32.dll750InitializeProcThreadAttributeList
KERNEL32.dll1257UpdateProcThreadAttribute
KERNEL32.dll215DeleteProcThreadAttributeList
KERNEL32.dll616GetStartupInfoW
KERNEL32.dll167CreateProcessW
KERNEL32.dll444GetConsoleWindow
KERNEL32.dll494GetFileAttributesW
KERNEL32.dll874NeedCurrentDirectoryForExePathW
KERNEL32.dll374GetBinaryTypeW
KERNEL32.dll992RegOpenKeyExW
KERNEL32.dll965RegCloseKey
KERNEL32.dll1148SetLastError
KERNEL32.dll997RegQueryValueExW
KERNEL32.dll969RegDeleteKeyExW
KERNEL32.dll454GetCurrentProcessId
WINBRAND.dllBrandingFormatString

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows Command Processor
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNamecmd
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameCmd.Exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
4ea085790PNG(256 x 256)#
500a617242BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x2e8