filename | cmd.exe | |
---|---|---|
size | 345088 (0x54400) | |
md5 | 5746bd7e255dd6a8afa06f7c42c1ba41 | |
type | PE32+ executable (console) x86-64, for MS Windows | |
mimetype | application/x-dosexec | |
clamav | OK | |
virustotal | → scan with virustotal.com | |
histogram |
MZ Header
signature | MZ |
bytes_in_last_block | 0x90 |
blocks_in_file | 3 |
num_relocs | 0 |
header_paragraphs | 4 |
min_extra_paragraphs | 0 |
max_extra_paragraphs | 0xffff |
ss | 0 |
sp | 0xb8 |
checksum | 0 |
ip | 0 |
cs | 0 |
reloc_table_offset | 0x40 |
overlay_number | 0 |
reserved0 | 0 |
oem_id | 0 |
oem_info | 0 |
reserved2 | 0 |
reserved3 | 0 |
reserved4 | 0 |
reserved5 | 0 |
reserved6 | 0 |
lfanew | 0xf0 |
Rich Header
lib id | version | times used |
---|---|---|
132 | 30729 | 1 |
149 | 30729 | 2 |
1 | 0 | 253 |
147 | 30729 | 9 |
131 | 30729 | 18 |
137 | 30729 | 39 |
148 | 30729 | 1 |
145 | 30729 | 1 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Sections
Data Directory
type | name | size | cp | |
---|---|---|---|---|
MUI | #1 | 216 | 0 | |
ICON | #1 | 1640 | 0 | |
ICON | #2 | 744 | 0 | |
ICON | #3 | 296 | 0 | |
ICON | #4 | 3752 | 0 | |
ICON | #5 | 2216 | 0 | |
ICON | #6 | 1384 | 0 | |
ICON | #7 | 5790 | 0 | |
ICON | #8 | 9640 | 0 | |
ICON | #9 | 4264 | 0 | |
ICON | #10 | 1128 | 0 | |
GROUP_ICON | IDI_APPICON | 146 | 0 | |
VERSION | #1 | 904 | 0 | |
MANIFEST | #1 | 898 | 0 |
module_name | hint | ord | function_name |
---|---|---|---|
msvcrt.dll | 1156 | memset | |
msvcrt.dll | 1152 | memcpy | |
msvcrt.dll | 1151 | memcmp | |
msvcrt.dll | 691 | _setjmp | |
msvcrt.dll | 48 | void __cdecl terminate(void) ?terminate@@YAXXZ | |
msvcrt.dll | 128 | __set_app_type | |
msvcrt.dll | 280 | _fmode | |
msvcrt.dll | 196 | _commode | |
msvcrt.dll | 130 | __setusermatherr | |
msvcrt.dll | 160 | _amsg_exit | |
msvcrt.dll | 364 | _initterm | |
msvcrt.dll | 179 | _cexit | |
msvcrt.dll | 255 | _exit | |
msvcrt.dll | 82 | _XcptFilter | |
msvcrt.dll | 83 | __C_specific_handler | |
msvcrt.dll | 113 | __getmainargs | |
msvcrt.dll | 1043 | calloc | |
msvcrt.dll | 1082 | free | |
msvcrt.dll | 893 | _wcslwr | |
msvcrt.dll | 1170 | qsort | |
msvcrt.dll | 239 | _dup2 | |
msvcrt.dll | 238 | _dup | |
msvcrt.dll | 194 | _close | |
msvcrt.dll | 641 | _open_osfhandle | |
msvcrt.dll | 1227 | swscanf | |
msvcrt.dll | 807 | _ultoa | |
msvcrt.dll | 647 | _pipe | |
msvcrt.dll | 1273 | wcsncmp | |
msvcrt.dll | 695 | _setmode | |
msvcrt.dll | 1056 | exit | |
msvcrt.dll | 1128 | iswxdigit | |
msvcrt.dll | 1234 | time | |
msvcrt.dll | 1194 | srand | |
msvcrt.dll | 1015 | _wtol | |
msvcrt.dll | 1063 | fflush | |
msvcrt.dll | 1282 | wcsstr | |
msvcrt.dll | 1117 | iswalpha | |
msvcrt.dll | 1289 | wcstoul | |
msvcrt.dll | 246 | _errno | |
msvcrt.dll | 1163 | printf | |
msvcrt.dll | 1173 | rand | |
msvcrt.dll | 367 | _iob | |
msvcrt.dll | 1075 | fprintf | |
msvcrt.dll | 1278 | wcsrchr | |
msvcrt.dll | 1175 | realloc | |
msvcrt.dll | 1241 | towlower | |
msvcrt.dll | 1183 | setlocale | |
msvcrt.dll | 916 | _wcsupr | |
msvcrt.dll | 1121 | iswdigit | |
msvcrt.dll | 889 | _wcsicmp | |
msvcrt.dll | 1126 | iswspace | |
msvcrt.dll | 1263 | wcschr | |
msvcrt.dll | 1154 | memmove | |
msvcrt.dll | 1066 | fgets | |
msvcrt.dll | 644 | _pclose | |
msvcrt.dll | 1062 | ferror | |
msvcrt.dll | 1061 | feof | |
msvcrt.dll | 969 | _wpopen | |
msvcrt.dll | 899 | _wcsnicmp | |
msvcrt.dll | 856 | _vsnwprintf | |
msvcrt.dll | 1286 | wcstol | |
msvcrt.dll | 324 | _get_osfhandle | |
msvcrt.dll | 335 | _getch | |
msvcrt.dll | 1242 | towupper | |
msvcrt.dll | 1281 | wcsspn | |
msvcrt.dll | 788 | _tell | |
msvcrt.dll | 1139 | longjmp | |
msvcrt.dll | 464 | _local_unwind | |
ntdll.dll | 635 | RtlCaptureContext | |
ntdll.dll | 1026 | RtlLookupFunctionEntry | |
ntdll.dll | 1265 | RtlVirtualUnwind | |
ntdll.dll | 843 | RtlFreeHeap | |
ntdll.dll | 298 | NtFsControlFile | |
ntdll.dll | 364 | NtOpenThreadToken | |
ntdll.dll | 214 | NtClose | |
ntdll.dll | 356 | NtOpenProcessToken | |
ntdll.dll | 402 | NtQueryInformationToken | |
ntdll.dll | 768 | RtlDosPathNameToNtPathName_U | |
ntdll.dll | 825 | RtlFindLeastSignificantBit | |
ntdll.dll | 498 | NtSetInformationProcess | |
ntdll.dll | 399 | NtQueryInformationProcess | |
ntdll.dll | 1045 | RtlNtStatusToDosError | |
KERNEL32.dll | 668 | GetTimeFormatW | |
KERNEL32.dll | 664 | GetTickCount | |
KERNEL32.dll | 934 | QueryPerformanceCounter | |
KERNEL32.dll | 1199 | SetUnhandledExceptionFilter | |
KERNEL32.dll | 1213 | Sleep | |
KERNEL32.dll | 206 | DelayLoadFailureHook | |
KERNEL32.dll | 831 | LoadLibraryExA | |
KERNEL32.dll | 359 | FreeLibrary | |
KERNEL32.dll | 147 | CreateHardLinkW | |
KERNEL32.dll | 177 | CreateSymbolicLinkW | |
KERNEL32.dll | 690 | GetVolumePathNameW | |
KERNEL32.dll | 657 | GetThreadLocale | |
KERNEL32.dll | 1043 | ResumeThread | |
KERNEL32.dll | 1159 | SetProcessAffinityMask | |
KERNEL32.dll | 560 | GetNumaNodeProcessorMaskEx | |
KERNEL32.dll | 653 | GetThreadGroupAffinity | |
KERNEL32.dll | 313 | FindFirstFileExW | |
KERNEL32.dll | 468 | GetDiskFreeSpaceExW | |
KERNEL32.dll | 331 | FindNextStreamW | |
KERNEL32.dll | 320 | FindFirstStreamW | |
KERNEL32.dll | 224 | DeviceIoControl | |
KERNEL32.dll | 96 | CompareFileTime | |
KERNEL32.dll | 1027 | RemoveDirectoryW | |
KERNEL32.dll | 452 | GetCurrentDirectoryW | |
KERNEL32.dll | 485 | GetExitCodeProcess | |
KERNEL32.dll | 1285 | WaitForSingleObject | |
KERNEL32.dll | 1227 | TerminateProcess | |
KERNEL32.dll | 1112 | SetCurrentDirectoryW | |
KERNEL32.dll | 1140 | SetFileTime | |
KERNEL32.dll | 214 | DeleteFileW | |
KERNEL32.dll | 1118 | SetEndOfFile | |
KERNEL32.dll | 1131 | SetFileAttributesW | |
KERNEL32.dll | 117 | CopyFileW | |
KERNEL32.dll | 129 | CreateDirectoryW | |
KERNEL32.dll | 1105 | SetConsoleTextAttribute | |
KERNEL32.dll | 299 | FillConsoleOutputAttribute | |
KERNEL32.dll | 1062 | ScrollConsoleScreenBufferW | |
KERNEL32.dll | 365 | GetACP | |
KERNEL32.dll | 355 | FormatMessageW | |
KERNEL32.dll | 348 | FlushFileBuffers | |
KERNEL32.dll | 235 | DuplicateHandle | |
KERNEL32.dll | 732 | HeapSize | |
KERNEL32.dll | 730 | HeapReAlloc | |
KERNEL32.dll | 1269 | VirtualAlloc | |
KERNEL32.dll | 1272 | VirtualFree | |
KERNEL32.dll | 731 | HeapSetInformation | |
KERNEL32.dll | 458 | GetCurrentThreadId | |
KERNEL32.dll | 901 | OpenThread | |
KERNEL32.dll | 491 | GetFileAttributesExW | |
KERNEL32.dll | 473 | GetDriveTypeW | |
KERNEL32.dll | 681 | GetVersion | |
KERNEL32.dll | 827 | LeaveCriticalSection | |
KERNEL32.dll | 241 | EnterCriticalSection | |
KERNEL32.dll | 535 | GetModuleFileNameW | |
KERNEL32.dll | 694 | GetWindowsDirectoryW | |
KERNEL32.dll | 1080 | SetConsoleCtrlHandler | |
KERNEL32.dll | 747 | InitializeCriticalSection | |
KERNEL32.dll | 290 | ExpandEnvironmentStringsW | |
KERNEL32.dll | 68 | CancelSynchronousIo | |
KERNEL32.dll | 686 | GetVolumeInformationW | |
KERNEL32.dll | 706 | GlobalFree | |
KERNEL32.dll | 699 | GlobalAlloc | |
KERNEL32.dll | 1137 | SetFilePointerEx | |
KERNEL32.dll | 1329 | WriteFile | |
KERNEL32.dll | 1064 | SearchPathW | |
KERNEL32.dll | 842 | LocalFree | |
KERNEL32.dll | 1107 | SetConsoleTitleW | |
KERNEL32.dll | 865 | MoveFileExW | |
KERNEL32.dll | 868 | MoveFileW | |
KERNEL32.dll | 929 | QueryFullProcessImageNameW | |
KERNEL32.dll | 963 | ReadProcessMemory | |
KERNEL32.dll | 833 | LoadLibraryW | |
KERNEL32.dll | 1004 | RegSetValueExW | |
KERNEL32.dll | 967 | RegCreateKeyExW | |
KERNEL32.dll | 1247 | UnhandledExceptionFilter | |
KERNEL32.dll | 453 | GetCurrentProcess | |
KERNEL32.dll | 638 | GetSystemTimeAsFileTime | |
KERNEL32.dll | 1277 | VirtualQuery | |
KERNEL32.dll | 92 | CmdBatNotification | |
KERNEL32.dll | 375 | GetCPInfo | |
KERNEL32.dll | 437 | GetConsoleOutputCP | |
KERNEL32.dll | 1185 | SetThreadLocale | |
KERNEL32.dll | 585 | GetProcAddress | |
KERNEL32.dll | 539 | GetModuleHandleW | |
KERNEL32.dll | 82 | CloseHandle | |
KERNEL32.dll | 517 | GetLastError | |
KERNEL32.dll | 1136 | SetFilePointer | |
KERNEL32.dll | 511 | GetFullPathNameW | |
KERNEL32.dll | 318 | FindFirstFileW | |
KERNEL32.dll | 330 | FindNextFileW | |
KERNEL32.dll | 307 | FindClose | |
KERNEL32.dll | 143 | CreateFileW | |
KERNEL32.dll | 960 | ReadFile | |
KERNEL32.dll | 872 | MultiByteToWideChar | |
KERNEL32.dll | 500 | GetFileSize | |
KERNEL32.dll | 1309 | WideCharToMultiByte | |
KERNEL32.dll | 1365 | lstrcmpiW | |
KERNEL32.dll | 1362 | lstrcmpW | |
KERNEL32.dll | 617 | GetStdHandle | |
KERNEL32.dll | 347 | FlushConsoleInputBuffer | |
KERNEL32.dll | 723 | HeapAlloc | |
KERNEL32.dll | 590 | GetProcessHeap | |
KERNEL32.dll | 727 | HeapFree | |
KERNEL32.dll | 439 | GetConsoleScreenBufferInfo | |
KERNEL32.dll | 958 | ReadConsoleW | |
KERNEL32.dll | 1084 | SetConsoleCursorPosition | |
KERNEL32.dll | 301 | FillConsoleOutputCharacterW | |
KERNEL32.dll | 1328 | WriteConsoleW | |
KERNEL32.dll | 503 | GetFileType | |
KERNEL32.dll | 674 | GetUserDefaultLCID | |
KERNEL32.dll | 521 | GetLocaleInfoW | |
KERNEL32.dll | 1151 | SetLocalTime | |
KERNEL32.dll | 636 | GetSystemTime | |
KERNEL32.dll | 1224 | SystemTimeToFileTime | |
KERNEL32.dll | 297 | FileTimeToLocalFileTime | |
KERNEL32.dll | 298 | FileTimeToSystemTime | |
KERNEL32.dll | 462 | GetDateFormatW | |
KERNEL32.dll | 973 | RegDeleteValueW | |
KERNEL32.dll | 518 | GetLocalTime | |
KERNEL32.dll | 433 | GetConsoleMode | |
KERNEL32.dll | 1096 | SetConsoleMode | |
KERNEL32.dll | 482 | GetEnvironmentVariableW | |
KERNEL32.dll | 396 | GetCommandLineW | |
KERNEL32.dll | 557 | GetNumaHighestNodeNumber | |
KERNEL32.dll | 480 | GetEnvironmentStringsW | |
KERNEL32.dll | 358 | FreeEnvironmentStringsW | |
KERNEL32.dll | 1122 | SetEnvironmentVariableW | |
KERNEL32.dll | 1120 | SetEnvironmentStringsW | |
KERNEL32.dll | 443 | GetConsoleTitleW | |
KERNEL32.dll | 680 | GetVDMCurrentDirectories | |
KERNEL32.dll | 1123 | SetErrorMode | |
KERNEL32.dll | 750 | InitializeProcThreadAttributeList | |
KERNEL32.dll | 1257 | UpdateProcThreadAttribute | |
KERNEL32.dll | 215 | DeleteProcThreadAttributeList | |
KERNEL32.dll | 616 | GetStartupInfoW | |
KERNEL32.dll | 167 | CreateProcessW | |
KERNEL32.dll | 444 | GetConsoleWindow | |
KERNEL32.dll | 494 | GetFileAttributesW | |
KERNEL32.dll | 874 | NeedCurrentDirectoryForExePathW | |
KERNEL32.dll | 374 | GetBinaryTypeW | |
KERNEL32.dll | 992 | RegOpenKeyExW | |
KERNEL32.dll | 965 | RegCloseKey | |
KERNEL32.dll | 1148 | SetLastError | |
KERNEL32.dll | 997 | RegQueryValueExW | |
KERNEL32.dll | 969 | RegDeleteKeyExW | |
KERNEL32.dll | 454 | GetCurrentProcessId | |
WINBRAND.dll | BrandingFormatString |
StringTable 040904B0
CompanyName | Microsoft Corporation |
FileDescription | Windows Command Processor |
FileVersion | 6.1.7601.17514 (win7sp1_rtm.101119-1850) |
InternalName | cmd |
LegalCopyright | © Microsoft Corporation. All rights reserved. |
OriginalFilename | Cmd.Exe |
ProductName | Microsoft® Windows® Operating System |
ProductVersion | 6.1.7601.17514 |
VS_FIXEDFILEINFO
FileVersion | 6.1.7601.17514 |
ProductVersion | 6.1.7601.17514 |
StrucVersion | 0x10000 |
FileFlagsMask | 0x3f |
FileFlags | 0 |
FileOS | 0x40004 |
FileType | 1 |
FileSubtype | 0 |
Please donate some bucks to keep this site up and running: | |
Ko-fi | |
---|---|
Yandex.Money | |
Thank you! |
[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x2e8