cmd.exe - Windows Command Processor

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	cmd.exe
size	404992 (0x62e00)
md5	bf93a2f9901e9b3dfca8a7982f4a9868

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
147	30729	54
189	30716	1
187	30716	2
1	0	265
185	30716	9
188	30716	22
197	30716	37
183	30716	1
186	30716	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x50108a15
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	10.10
SizeOfCode	0x36a00
SizeOfInitializedData	0x2c000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1b584
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.2
ImageVersion	6.2
SubsystemVersion	6.2
Reserved1	0
SizeOfImage	0x67000
SizeOfHeaders	0x400
CheckSum	0x68ccd
Subsystem	3
DllCharacteristics	0x8160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0xfc000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x369f8	0x36a00	R-X CODE
.data	0x38000	0x1c300	0x1c400	RW- IDATA
.pdata	0x55000	0x4848	0x4a00	R-- IDATA
.idata	0x5a000	0x28a0	0x2a00	R-- IDATA
.rsrc	0x5d000	0x8450	0x8600	R-- IDATA
.reloc	0x66000	0x138	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x5a868	0x280
RESOURCE	0x5d000	0x8450
EXCEPTION	0x55000	0x4848
SECURITY	0	0
BASERELOC	0x66000	0x138
DEBUG	0x32c34	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x32700	0x70
Bound_IAT	0	0
IAT	0x5a000	0x868
Delay_IAT	0x3297c	0x60
CLR_Header	0	0

show previews

type	name	size
MUI	#1	216
ICON	#1	1640
ICON	#2	744
ICON	#3	296
ICON	#4	3752
ICON	#5	2216
ICON	#6	1384
ICON	#7	5790
ICON	#8	9640
ICON	#9	4264
ICON	#10	1128
GROUP_ICON	IDI_APPICON	146
VERSION	#1	896
MANIFEST	#1	898

module_name	hint	function_name
msvcrt.dll	1155	memcmp
msvcrt.dll	1156	memcpy
msvcrt.dll	1290	wcstol
msvcrt.dll	647	_pclose
msvcrt.dll	338	_getch
msvcrt.dll	48	void __cdecl terminate(void) ?terminate@@YAXXZ
msvcrt.dll	196	_commode
msvcrt.dll	281	_fmode
msvcrt.dll	83	__C_specific_handler
msvcrt.dll	367	_initterm
msvcrt.dll	130	__setusermatherr
msvcrt.dll	179	_cexit
msvcrt.dll	1267	wcschr
msvcrt.dll	256	_exit
msvcrt.dll	128	__set_app_type
msvcrt.dll	113	__getmainargs
msvcrt.dll	160	_amsg_exit
msvcrt.dll	694	_setjmp
msvcrt.dll	467	_local_unwind
msvcrt.dll	1143	longjmp
msvcrt.dll	1047	calloc
msvcrt.dll	1086	free
msvcrt.dll	896	_wcslwr
msvcrt.dll	1174	qsort
msvcrt.dll	1125	iswdigit
msvcrt.dll	240	_dup2
msvcrt.dll	239	_dup
msvcrt.dll	194	_close
msvcrt.dll	644	_open_osfhandle
msvcrt.dll	1231	swscanf
msvcrt.dll	1130	iswspace
msvcrt.dll	810	_ultoa
msvcrt.dll	650	_pipe
msvcrt.dll	1277	wcsncmp
msvcrt.dll	1066	ferror
msvcrt.dll	698	_setmode
msvcrt.dll	1187	setlocale
msvcrt.dll	1245	towlower
msvcrt.dll	1060	exit
msvcrt.dll	1132	iswxdigit
msvcrt.dll	1246	towupper
msvcrt.dll	1238	time
msvcrt.dll	1198	srand
msvcrt.dll	1019	_wtol
msvcrt.dll	1067	fflush
msvcrt.dll	920	_wcsupr
msvcrt.dll	1286	wcsstr
msvcrt.dll	1285	wcsspn
msvcrt.dll	1121	iswalpha
msvcrt.dll	1158	memmove
msvcrt.dll	892	_wcsicmp
msvcrt.dll	1070	fgets
msvcrt.dll	859	_vsnwprintf
msvcrt.dll	791	_tell
msvcrt.dll	902	_wcsnicmp
msvcrt.dll	1293	wcstoul
msvcrt.dll	1065	feof
msvcrt.dll	247	_errno
msvcrt.dll	1167	printf
msvcrt.dll	1177	rand
msvcrt.dll	82	_XcptFilter
msvcrt.dll	327	_get_osfhandle
msvcrt.dll	973	_wpopen
msvcrt.dll	370	_iob
msvcrt.dll	1079	fprintf
msvcrt.dll	1282	wcsrchr
msvcrt.dll	1179	realloc
msvcrt.dll	1160	memset
ntdll.dll	1366	RtlVirtualUnwind
ntdll.dll	1103	RtlLookupFunctionEntry
ntdll.dll	688	RtlCaptureContext
ntdll.dll	910	RtlFreeHeap
ntdll.dll	398	NtOpenThreadToken
ntdll.dll	237	NtClose
ntdll.dll	390	NtOpenProcessToken
ntdll.dll	436	NtQueryInformationToken
ntdll.dll	332	NtFsControlFile
ntdll.dll	832	RtlDosPathNameToNtPathName_U
ntdll.dll	891	RtlFindLeastSignificantBit
ntdll.dll	915	RtlFreeUnicodeString
ntdll.dll	1203	RtlReleaseRelativeName
ntdll.dll	378	NtOpenFile
ntdll.dll	835	RtlDosPathNameToRelativeNtPathName_U_WithStatus
ntdll.dll	532	NtSetInformationFile
ntdll.dll	467	NtQueryVolumeInformationFile
ntdll.dll	536	NtSetInformationProcess
ntdll.dll	433	NtQueryInformationProcess
ntdll.dll	1122	RtlNtStatusToDosError
ntdll.dll	233	NtCancelSynchronousIoFile
ntdll.dll	772	RtlCreateUnicodeStringFromAsciiz
api-ms-win-core-kernel32-legacy-l1-1-0.dll	185	CopyFileW
api-ms-win-core-memory-l1-1-1.dll	936	ReadProcessMemory
api-ms-win-core-memory-l1-1-1.dll	1310	VirtualAlloc
api-ms-win-core-memory-l1-1-1.dll	1318	VirtualQuery
api-ms-win-core-memory-l1-1-1.dll	1313	VirtualFree
api-ms-win-core-localization-l1-2-0.dll	329	GetCPInfo
api-ms-win-core-localization-l1-2-0.dll	428	GetLocaleInfoW
api-ms-win-core-localization-l1-2-0.dll	1148	SetThreadLocale
api-ms-win-core-localization-l1-2-0.dll	315	GetACP
api-ms-win-core-localization-l1-2-0.dll	302	FormatMessageW
api-ms-win-core-localization-l1-2-0.dll	531	GetThreadLocale
api-ms-win-core-localization-l1-2-0.dll	551	GetUserDefaultLCID
api-ms-win-core-console-l1-1-0.dll	1357	WriteConsoleW
api-ms-win-core-console-l1-1-0.dll	350	GetConsoleOutputCP
api-ms-win-core-console-l1-1-0.dll	349	GetConsoleMode
api-ms-win-core-console-l1-1-0.dll	1088	SetConsoleMode
api-ms-win-core-console-l1-1-0.dll	1083	SetConsoleCtrlHandler
api-ms-win-core-console-l1-1-0.dll	931	ReadConsoleW
api-ms-win-core-libraryloader-l1-1-1.dll	709	LoadLibraryExW
api-ms-win-core-libraryloader-l1-1-1.dll	446	GetModuleHandleW
api-ms-win-core-libraryloader-l1-1-1.dll	468	GetProcAddress
api-ms-win-core-libraryloader-l1-1-1.dll	442	GetModuleFileNameW
api-ms-win-core-file-l1-2-0.dll	563	GetVolumeInformationW
api-ms-win-core-file-l1-2-0.dll	378	GetDriveTypeW
api-ms-win-core-file-l1-2-0.dll	121	CreateDirectoryW
api-ms-win-core-file-l1-2-0.dll	131	CreateFileW
api-ms-win-core-file-l1-2-0.dll	402	GetFileSize
api-ms-win-core-file-l1-2-0.dll	271	FindClose
api-ms-win-core-file-l1-2-0.dll	285	FindNextFileW
api-ms-win-core-file-l1-2-0.dll	295	FlushFileBuffers
api-ms-win-core-file-l1-2-0.dll	396	GetFileAttributesW
api-ms-win-core-file-l1-2-0.dll	1110	SetFileAttributesW
api-ms-win-core-file-l1-2-0.dll	1100	SetEndOfFile
api-ms-win-core-file-l1-2-0.dll	565	GetVolumePathNameW
api-ms-win-core-file-l1-2-0.dll	278	FindFirstFileW
api-ms-win-core-file-l1-2-0.dll	405	GetFileType
api-ms-win-core-file-l1-2-0.dll	264	FileTimeToLocalFileTime
api-ms-win-core-file-l1-2-0.dll	277	FindFirstFileExW
api-ms-win-core-file-l1-2-0.dll	375	GetDiskFreeSpaceExW
api-ms-win-core-file-l1-2-0.dll	414	GetFullPathNameW
api-ms-win-core-file-l1-2-0.dll	102	CompareFileTime
api-ms-win-core-file-l1-2-0.dll	1009	RemoveDirectoryW
api-ms-win-core-file-l1-2-0.dll	180	DeleteFileW
api-ms-win-core-file-l1-2-0.dll	1112	SetFilePointer
api-ms-win-core-file-l1-2-0.dll	1358	WriteFile
api-ms-win-core-file-l1-2-0.dll	1113	SetFilePointerEx
api-ms-win-core-file-l1-2-0.dll	933	ReadFile
api-ms-win-core-file-l1-2-0.dll	1115	SetFileTime
api-ms-win-core-file-l1-2-0.dll	395	GetFileAttributesExW
api-ms-win-core-errorhandling-l1-1-1.dll	1104	SetErrorMode
api-ms-win-core-errorhandling-l1-1-1.dll	1266	UnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-1.dll	1165	SetUnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-1.dll	422	GetLastError
api-ms-win-core-errorhandling-l1-1-1.dll	1121	SetLastError
api-ms-win-core-handle-l1-1-0.dll	92	CloseHandle
api-ms-win-core-handle-l1-1-0.dll	200	DuplicateHandle
api-ms-win-core-string-l1-1-0.dll	737	MultiByteToWideChar
api-ms-win-core-string-l1-1-0.dll	1346	WideCharToMultiByte
api-ms-win-core-processenvironment-l1-2-0.dll	305	FreeEnvironmentStringsW
api-ms-win-core-processenvironment-l1-2-0.dll	1069	SearchPathW
api-ms-win-core-processenvironment-l1-2-0.dll	385	GetEnvironmentStringsW
api-ms-win-core-processenvironment-l1-2-0.dll	1103	SetEnvironmentVariableW
api-ms-win-core-processenvironment-l1-2-0.dll	503	GetStdHandle
api-ms-win-core-processenvironment-l1-2-0.dll	342	GetCommandLineW
api-ms-win-core-processenvironment-l1-2-0.dll	1097	SetCurrentDirectoryW
api-ms-win-core-processenvironment-l1-2-0.dll	261	ExpandEnvironmentStringsW
api-ms-win-core-processenvironment-l1-2-0.dll	739	NeedCurrentDirectoryForExePathW
api-ms-win-core-processenvironment-l1-2-0.dll	1101	SetEnvironmentStringsW
api-ms-win-core-processenvironment-l1-2-0.dll	358	GetCurrentDirectoryW
api-ms-win-core-processenvironment-l1-2-0.dll	387	GetEnvironmentVariableW
api-ms-win-core-console-l2-1-0.dll	266	FillConsoleOutputAttribute
api-ms-win-core-console-l2-1-0.dll	353	GetConsoleTitleW
api-ms-win-core-console-l2-1-0.dll	1092	SetConsoleTextAttribute
api-ms-win-core-console-l2-1-0.dll	268	FillConsoleOutputCharacterW
api-ms-win-core-console-l2-1-0.dll	1085	SetConsoleCursorPosition
api-ms-win-core-console-l2-1-0.dll	1093	SetConsoleTitleW
api-ms-win-core-console-l2-1-0.dll	1067	ScrollConsoleScreenBufferW
api-ms-win-core-console-l2-1-0.dll	351	GetConsoleScreenBufferInfo
api-ms-win-core-console-l2-1-0.dll	294	FlushConsoleInputBuffer
api-ms-win-core-heap-l1-2-0.dll	585	HeapReAlloc
api-ms-win-core-heap-l1-2-0.dll	586	HeapSetInformation
api-ms-win-core-heap-l1-2-0.dll	578	HeapAlloc
api-ms-win-core-heap-l1-2-0.dll	472	GetProcessHeap
api-ms-win-core-heap-l1-2-0.dll	582	HeapFree
api-ms-win-core-heap-l1-2-0.dll	587	HeapSize
api-ms-win-security-base-l1-2-0.dll	494	GetSecurityDescriptorOwner
api-ms-win-security-base-l1-2-0.dll	401	GetFileSecurityW
api-ms-win-security-base-l1-2-0.dll	1022	RevertToSelf
api-ms-win-core-synch-l1-2-0.dll	1004	ReleaseSRWLockShared
api-ms-win-core-synch-l1-2-0.dll	1172	Sleep
api-ms-win-core-synch-l1-2-0.dll	1325	WaitForSingleObject
api-ms-win-core-synch-l1-2-0.dll	705	LeaveCriticalSection
api-ms-win-core-synch-l1-2-0.dll	208	EnterCriticalSection
api-ms-win-core-synch-l1-2-0.dll	605	InitializeCriticalSection
api-ms-win-core-synch-l1-2-0.dll	8	AcquireSRWLockShared
api-ms-win-core-synch-l1-2-0.dll	1003	ReleaseSRWLockExclusive
api-ms-win-core-synch-l1-2-0.dll	1260	TryAcquireSRWLockExclusive
api-ms-win-core-sysinfo-l1-2-0.dll	519	GetSystemTime
api-ms-win-core-sysinfo-l1-2-0.dll	1122	SetLocalTime
api-ms-win-core-sysinfo-l1-2-0.dll	424	GetLocalTime
api-ms-win-core-sysinfo-l1-2-0.dll	537	GetTickCount
api-ms-win-core-sysinfo-l1-2-0.dll	521	GetSystemTimeAsFileTime
api-ms-win-core-sysinfo-l1-2-0.dll	559	GetVersion
api-ms-win-core-sysinfo-l1-2-0.dll	569	GetWindowsDirectoryW
api-ms-win-core-timezone-l1-1-0.dll	265	FileTimeToSystemTime
api-ms-win-core-timezone-l1-1-0.dll	1244	SystemTimeToFileTime
api-ms-win-core-datetime-l1-1-1.dll	541	GetTimeFormatW
api-ms-win-core-datetime-l1-1-1.dll	368	GetDateFormatW
api-ms-win-core-systemtopology-l1-1-0.dll	456	GetNumaNodeProcessorMaskEx
api-ms-win-core-systemtopology-l1-1-0.dll	455	GetNumaHighestNodeNumber
api-ms-win-core-processthreads-l1-1-1.dll	1043	OpenThread
api-ms-win-core-processthreads-l1-1-1.dll	239	CreateProcessW
api-ms-win-core-processthreads-l1-1-1.dll	236	CreateProcessAsUserW
api-ms-win-core-processthreads-l1-1-1.dll	734	GetStartupInfoW
api-ms-win-core-processthreads-l1-1-1.dll	558	GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-1.dll	1406	TerminateProcess
api-ms-win-core-processthreads-l1-1-1.dll	588	GetExitCodeProcess
api-ms-win-core-processthreads-l1-1-1.dll	293	DeleteProcThreadAttributeList
api-ms-win-core-processthreads-l1-1-1.dll	1455	UpdateProcThreadAttribute
api-ms-win-core-processthreads-l1-1-1.dll	881	InitializeProcThreadAttributeList
api-ms-win-core-processthreads-l1-1-1.dll	1209	ResumeThread
api-ms-win-core-processthreads-l1-1-1.dll	554	GetCurrentProcessId
api-ms-win-core-processthreads-l1-1-1.dll	553	GetCurrentProcess
api-ms-win-core-registry-l1-1-0.dll	948	RegDeleteKeyExW
api-ms-win-core-registry-l1-1-0.dll	939	RegCloseKey
api-ms-win-core-registry-l1-1-0.dll	981	RegOpenKeyExW
api-ms-win-core-registry-l1-1-0.dll	986	RegQueryValueExW
api-ms-win-core-registry-l1-1-0.dll	952	RegDeleteValueW
api-ms-win-core-registry-l1-1-0.dll	944	RegCreateKeyExW
api-ms-win-core-registry-l1-1-0.dll	993	RegSetValueExW
api-ms-win-core-registry-l1-1-0.dll	955	RegEnumKeyExW
api-ms-win-core-file-l2-1-0.dll	154	CreateSymbolicLinkW
api-ms-win-core-file-l2-1-0.dll	132	CreateHardLinkW
api-ms-win-core-file-l2-1-0.dll	736	MoveFileWithProgressW
api-ms-win-core-file-l2-1-0.dll	734	MoveFileExW
api-ms-win-core-file-l2-1-0.dll	398	GetFileInformationByHandleEx
api-ms-win-core-io-l1-1-1.dll	305	DeviceIoControl
api-ms-win-core-processtopology-l1-1-0.dll	528	GetThreadGroupAffinity
api-ms-win-core-profile-l1-1-0.dll	907	QueryPerformanceCounter
api-ms-win-core-string-obsolete-l1-1-0.dll	1576	lstrcmpiW
api-ms-win-core-string-obsolete-l1-1-0.dll	1573	lstrcmpW
api-ms-win-core-heap-obsolete-l1-1-0.dll	837	GlobalFree
api-ms-win-core-heap-obsolete-l1-1-0.dll	976	LocalFree
api-ms-win-core-heap-obsolete-l1-1-0.dll	830	GlobalAlloc
api-ms-win-core-processtopology-obsolete-l1-1-0.dll	1328	SetProcessAffinityMask
api-ms-win-core-apiquery-l1-1-0.dll	18	ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1.dll	1205	ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-1.dll	284	DelayLoadFailureHook

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Windows Command Processor
FileVersion	6.2.9200.16384 (win8_rtm.120725-1247)
InternalName	cmd
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	Cmd.Exe
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.2.9200.16384

VS_FIXEDFILEINFO

FileVersion	6.2.9200.16384
ProductVersion	6.2.9200.16384
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
5d408	5790	PNG	(256 x 256)	#
5eaa6	17242	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

cmd.exe-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

cmd.exe
-