cmd.exe - Windows Command Processor

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	cmd.exe
size	272896 (0x42a00)
md5	e08fe2de3ddd22123247d49a11b4f53d

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
147	30729	66
259	25203	3
260	25203	21
1	0	293
257	25203	5
261	25203	9
270	25203	40
255	25203	1
258	25203	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	7
TimeDateStamp	0x98a98a2d
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.10
SizeOfCode	0x2ce00
SizeOfInitializedData	0x31200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x16b00
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	10.0
ImageVersion	10.0
SubsystemVersion	10.0
Reserved1	0
SizeOfImage	0x63000
SizeOfHeaders	0x400
CheckSum	0x51bd1
Subsystem	3
DllCharacteristics	0xc160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0xfc000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x2cd28	0x2ce00	R-X CODE
.rdata	0x2e000	0xa390	0xa400	R-- IDATA
.data	0x39000	0x1bbc8	0x200	RW- IDATA
.pdata	0x55000	0x24a8	0x2600	R-- IDATA
.didat	0x58000	0x80	0x200	RW- IDATA
.rsrc	0x59000	0x84f8	0x8600	R-- IDATA
.reloc	0x62000	0x2c8	0x400	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x35f48	0x2d0
RESOURCE	0x59000	0x84f8
EXCEPTION	0x55000	0x24a8
SECURITY	0	0
BASERELOC	0x62000	0x2c8
DEBUG	0x315f0	0x54
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x2eae0	0x100
Bound_IAT	0	0
IAT	0x2f380	0x978
Delay_IAT	0x35c8c	0x60
CLR_Header	0	0

show previews

type	name	size
MUI	#1	216
ICON	#1	1640
ICON	#2	744
ICON	#3	296
ICON	#4	3752
ICON	#5	2216
ICON	#6	1384
ICON	#7	5790
ICON	#8	9640
ICON	#9	4264
ICON	#10	1128
GROUP_ICON	IDI_APPICON	146
VERSION	#1	904
MANIFEST	#1	1064

module_name	hint	function_name
msvcrt.dll	1201	setlocale
msvcrt.dll	910	_wcslwr
msvcrt.dll	1100	free
msvcrt.dll	1061	calloc
msvcrt.dll	85	_XcptFilter
msvcrt.dll	174	_amsg_exit
msvcrt.dll	127	__getmainargs
msvcrt.dll	1245	swscanf
msvcrt.dll	934	_wcsupr
msvcrt.dll	1259	towlower
msvcrt.dll	1139	iswdigit
msvcrt.dll	906	_wcsicmp
msvcrt.dll	1144	iswspace
msvcrt.dll	1281	wcschr
msvcrt.dll	824	_ultoa
msvcrt.dll	1084	fgets
msvcrt.dll	661	_pclose
msvcrt.dll	1080	ferror
msvcrt.dll	664	_pipe
msvcrt.dll	142	__set_app_type
msvcrt.dll	270	_exit
msvcrt.dll	1291	wcsncmp
msvcrt.dll	712	_setmode
msvcrt.dll	1079	feof
msvcrt.dll	987	_wpopen
msvcrt.dll	1181	printf
msvcrt.dll	658	_open_osfhandle
msvcrt.dll	1074	exit
msvcrt.dll	916	_wcsnicmp
msvcrt.dll	1304	wcstol
msvcrt.dll	193	_cexit
msvcrt.dll	1146	iswxdigit
msvcrt.dll	261	_errno
msvcrt.dll	75	_CxxThrowException
msvcrt.dll	341	_get_osfhandle
msvcrt.dll	1170	memcpy
msvcrt.dll	18	public: virtual __cdecl type_info::~type_info(void) __ptr64 ??1type_info@@UEAA@XZ
msvcrt.dll	1191	rand
msvcrt.dll	352	_getch
msvcrt.dll	1260	towupper
msvcrt.dll	1188	qsort
msvcrt.dll	1093	fprintf
msvcrt.dll	1252	time
msvcrt.dll	1193	realloc
msvcrt.dll	208	_close
msvcrt.dll	1212	srand
msvcrt.dll	254	_dup2
msvcrt.dll	1299	wcsspn
msvcrt.dll	144	__setusermatherr
msvcrt.dll	381	_initterm
msvcrt.dll	805	_tell
msvcrt.dll	295	_fmode
msvcrt.dll	210	_commode
msvcrt.dll	35	void __cdecl operator delete[](void * __ptr64) ??_V@YAXPEAX@Z
msvcrt.dll	1157	longjmp
msvcrt.dll	1033	_wtol
msvcrt.dll	486	_lock
msvcrt.dll	87	__C_specific_handler
msvcrt.dll	253	_dup
msvcrt.dll	1307	wcstoul
msvcrt.dll	1296	wcsrchr
msvcrt.dll	20	void __cdecl operator delete(void * __ptr64) ??3@YAXPEAX@Z
msvcrt.dll	1135	iswalpha
msvcrt.dll	481	_local_unwind
msvcrt.dll	708	_setjmp
msvcrt.dll	1169	memcmp
msvcrt.dll	1174	memset
msvcrt.dll	91	__CxxFrameHandler3
msvcrt.dll	1081	fflush
msvcrt.dll	47	void __cdecl terminate(void) ?terminate@@YAXXZ
msvcrt.dll	873	_vsnwprintf
msvcrt.dll	1300	wcsstr
msvcrt.dll	1172	memmove
msvcrt.dll	656	_onexit
msvcrt.dll	123	__dllonexit
msvcrt.dll	1171	memcpy_s
msvcrt.dll	833	_unlock
msvcrt.dll	129	__iob_func
msvcrt.dll	1158	malloc
msvcrt.dll	191	_callnewh
msvcrt.dll	670	_purecall
msvcrt.dll	10	public: __cdecl exception::exception(char const * __ptr64 const & __ptr64) __ptr64 ??0exception@@QEAA@AEBQEBD@Z
msvcrt.dll	11	public: __cdecl exception::exception(char const * __ptr64 const & __ptr64, int) __ptr64 ??0exception@@QEAA@AEBQEBDH@Z
msvcrt.dll	12	public: __cdecl exception::exception(class exception const & __ptr64) __ptr64 ??0exception@@QEAA@AEBV0@@Z
msvcrt.dll	17	public: virtual __cdecl exception::~exception(void) __ptr64 ??1exception@@UEAA@XZ
msvcrt.dll	49	public: virtual char const * __ptr64 __cdecl exception::what(void)const __ptr64 ?what@exception@@UEBAPEBDXZ
msvcrt.dll	1282	wcscmp
ntdll.dll	1505	RtlVirtualUnwind
ntdll.dll	1215	RtlLookupFunctionEntry
ntdll.dll	417	NtOpenProcessToken
ntdll.dll	467	NtQueryInformationToken
ntdll.dll	248	NtClose
ntdll.dll	426	NtOpenThreadToken
ntdll.dll	741	RtlCaptureContext
ntdll.dll	983	RtlFreeHeap
ntdll.dll	351	NtFsControlFile
ntdll.dll	895	RtlDosPathNameToNtPathName_U
ntdll.dll	961	RtlFindLeastSignificantBit
ntdll.dll	989	RtlFreeUnicodeString
ntdll.dll	1322	RtlReleaseRelativeName
ntdll.dll	404	NtOpenFile
ntdll.dll	898	RtlDosPathNameToRelativeNtPathName_U_WithStatus
ntdll.dll	567	NtSetInformationFile
ntdll.dll	499	NtQueryVolumeInformationFile
ntdll.dll	571	NtSetInformationProcess
ntdll.dll	464	NtQueryInformationProcess
ntdll.dll	1234	RtlNtStatusToDosError
ntdll.dll	243	NtCancelSynchronousIoFile
ntdll.dll	830	RtlCreateUnicodeStringFromAsciiz
api-ms-win-core-kernel32-legacy-l1-1-0.dll	6	CopyFileW
api-ms-win-core-libraryloader-l1-2-0.dll	24	LoadLibraryExW
api-ms-win-core-libraryloader-l1-2-0.dll	15	GetModuleFileNameA
api-ms-win-core-libraryloader-l1-2-0.dll	16	GetModuleFileNameW
api-ms-win-core-libraryloader-l1-2-0.dll	20	GetModuleHandleW
api-ms-win-core-libraryloader-l1-2-0.dll	19	GetModuleHandleExW
api-ms-win-core-libraryloader-l1-2-0.dll	21	GetProcAddress
api-ms-win-core-synch-l1-1-0.dll	36	ReleaseSRWLockExclusive
api-ms-win-core-synch-l1-1-0.dll	29	LeaveCriticalSection
api-ms-win-core-synch-l1-1-0.dll	17	EnterCriticalSection
api-ms-win-core-synch-l1-1-0.dll	24	InitializeCriticalSection
api-ms-win-core-synch-l1-1-0.dll	9	CreateMutexExW
api-ms-win-core-synch-l1-1-0.dll	11	CreateSemaphoreExW
api-ms-win-core-synch-l1-1-0.dll	33	OpenSemaphoreW
api-ms-win-core-synch-l1-1-0.dll	1	AcquireSRWLockShared
api-ms-win-core-synch-l1-1-0.dll	37	ReleaseSRWLockShared
api-ms-win-core-synch-l1-1-0.dll	38	ReleaseSemaphore
api-ms-win-core-synch-l1-1-0.dll	54	WaitForSingleObject
api-ms-win-core-synch-l1-1-0.dll	35	ReleaseMutex
api-ms-win-core-synch-l1-1-0.dll	55	WaitForSingleObjectEx
api-ms-win-core-synch-l1-1-0.dll	49	TryAcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0.dll		GetProcessHeap
api-ms-win-core-heap-l1-1-0.dll	11	HeapSize
api-ms-win-core-heap-l1-1-0.dll	2	HeapAlloc
api-ms-win-core-heap-l1-1-0.dll	6	HeapFree
api-ms-win-core-heap-l1-1-0.dll	9	HeapReAlloc
api-ms-win-core-heap-l1-1-0.dll	10	HeapSetInformation
api-ms-win-core-errorhandling-l1-1-0.dll	13	SetLastError
api-ms-win-core-errorhandling-l1-1-0.dll	5	GetLastError
api-ms-win-core-errorhandling-l1-1-0.dll	15	SetUnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-0.dll	17	UnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-0.dll	12	SetErrorMode
api-ms-win-core-processthreads-l1-1-0.dll	19	GetExitCodeProcess
api-ms-win-core-processthreads-l1-1-0.dll	17	GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-0.dll	45	InitializeProcThreadAttributeList
api-ms-win-core-processthreads-l1-1-0.dll	56	ResumeThread
api-ms-win-core-processthreads-l1-1-0.dll	12	GetCurrentProcess
api-ms-win-core-processthreads-l1-1-0.dll	77	TerminateProcess
api-ms-win-core-processthreads-l1-1-0.dll	7	DeleteProcThreadAttributeList
api-ms-win-core-processthreads-l1-1-0.dll	32	GetStartupInfoW
api-ms-win-core-processthreads-l1-1-0.dll	2	CreateProcessAsUserW
api-ms-win-core-processthreads-l1-1-0.dll	3	CreateProcessW
api-ms-win-core-processthreads-l1-1-0.dll	83	UpdateProcThreadAttribute
api-ms-win-core-processthreads-l1-1-0.dll	50	OpenThread
api-ms-win-core-processthreads-l1-1-0.dll	13	GetCurrentProcessId
api-ms-win-core-localization-l1-2-0.dll	32	GetUserDefaultLCID
api-ms-win-core-localization-l1-2-0.dll	28	GetThreadLocale
api-ms-win-core-localization-l1-2-0.dll	56	SetThreadLocale
api-ms-win-core-localization-l1-2-0.dll	8	FormatMessageW
api-ms-win-core-localization-l1-2-0.dll	9	GetACP
api-ms-win-core-localization-l1-2-0.dll	10	GetCPInfo
api-ms-win-core-localization-l1-2-0.dll	19	GetLocaleInfoW
api-ms-win-core-debug-l1-1-0.dll	4	DebugBreak
api-ms-win-core-debug-l1-1-0.dll	5	IsDebuggerPresent
api-ms-win-core-debug-l1-1-0.dll	7	OutputDebugStringW
api-ms-win-core-handle-l1-1-0.dll		CloseHandle
api-ms-win-core-handle-l1-1-0.dll	2	DuplicateHandle
api-ms-win-core-memory-l1-1-0.dll	36	VirtualAlloc
api-ms-win-core-memory-l1-1-0.dll	40	VirtualFree
api-ms-win-core-memory-l1-1-0.dll	25	ReadProcessMemory
api-ms-win-core-memory-l1-1-0.dll	46	VirtualQuery
api-ms-win-core-console-l1-1-0.dll	10	SetConsoleCtrlHandler
api-ms-win-core-console-l1-1-0.dll	13	WriteConsoleW
api-ms-win-core-console-l1-1-0.dll	9	ReadConsoleW
api-ms-win-core-console-l1-1-0.dll	11	SetConsoleMode
api-ms-win-core-console-l1-1-0.dll	3	GetConsoleOutputCP
api-ms-win-core-console-l1-1-0.dll	2	GetConsoleMode
api-ms-win-core-file-l1-1-0.dll	76	SetEndOfFile
api-ms-win-core-file-l1-1-0.dll	11	FileTimeToLocalFileTime
api-ms-win-core-file-l1-1-0.dll	47	GetFileType
api-ms-win-core-file-l1-1-0.dll	9	DeleteFileW
api-ms-win-core-file-l1-1-0.dll	85	SetFileTime
api-ms-win-core-file-l1-1-0.dll	75	RemoveDirectoryW
api-ms-win-core-file-l1-1-0.dll	1	CompareFileTime
api-ms-win-core-file-l1-1-0.dll	35	GetDiskFreeSpaceExW
api-ms-win-core-file-l1-1-0.dll	18	FindFirstFileExW
api-ms-win-core-file-l1-1-0.dll	80	SetFileAttributesW
api-ms-win-core-file-l1-1-0.dll	71	ReadFile
api-ms-win-core-file-l1-1-0.dll	6	CreateFileW
api-ms-win-core-file-l1-1-0.dll	12	FindClose
api-ms-win-core-file-l1-1-0.dll	26	FindNextFileW
api-ms-win-core-file-l1-1-0.dll	20	FindFirstFileW
api-ms-win-core-file-l1-1-0.dll	51	GetFullPathNameW
api-ms-win-core-file-l1-1-0.dll	83	SetFilePointer
api-ms-win-core-file-l1-1-0.dll	65	GetVolumePathNameW
api-ms-win-core-file-l1-1-0.dll	3	CreateDirectoryW
api-ms-win-core-file-l1-1-0.dll	30	FlushFileBuffers
api-ms-win-core-file-l1-1-0.dll	41	GetFileAttributesExW
api-ms-win-core-file-l1-1-0.dll	38	GetDriveTypeW
api-ms-win-core-file-l1-1-0.dll	42	GetFileAttributesW
api-ms-win-core-file-l1-1-0.dll	63	GetVolumeInformationW
api-ms-win-core-file-l1-1-0.dll	89	WriteFile
api-ms-win-core-file-l1-1-0.dll	44	GetFileSize
api-ms-win-core-file-l1-1-0.dll	84	SetFilePointerEx
api-ms-win-core-string-l1-1-0.dll	6	MultiByteToWideChar
api-ms-win-core-string-l1-1-0.dll	7	WideCharToMultiByte
api-ms-win-core-processenvironment-l1-1-0.dll	9	GetEnvironmentStringsW
api-ms-win-core-processenvironment-l1-1-0.dll	16	SearchPathW
api-ms-win-core-processenvironment-l1-1-0.dll	19	SetEnvironmentStringsW
api-ms-win-core-processenvironment-l1-1-0.dll	3	FreeEnvironmentStringsW
api-ms-win-core-processenvironment-l1-1-0.dll	11	GetEnvironmentVariableW
api-ms-win-core-processenvironment-l1-1-0.dll	18	SetCurrentDirectoryW
api-ms-win-core-processenvironment-l1-1-0.dll	1	ExpandEnvironmentStringsW
api-ms-win-core-processenvironment-l1-1-0.dll	7	GetCurrentDirectoryW
api-ms-win-core-processenvironment-l1-1-0.dll	12	GetStdHandle
api-ms-win-core-processenvironment-l1-1-0.dll	5	GetCommandLineW
api-ms-win-core-processenvironment-l1-1-0.dll	21	SetEnvironmentVariableW
api-ms-win-core-console-l2-1-0.dll	2	FillConsoleOutputAttribute
api-ms-win-core-console-l2-1-0.dll	20	ScrollConsoleScreenBufferW
api-ms-win-core-console-l2-1-0.dll	5	FlushConsoleInputBuffer
api-ms-win-core-console-l2-1-0.dll	9	GetConsoleScreenBufferInfo
api-ms-win-core-console-l2-1-0.dll	11	GetConsoleTitleW
api-ms-win-core-console-l2-1-0.dll	24	SetConsoleCursorPosition
api-ms-win-core-console-l2-1-0.dll	4	FillConsoleOutputCharacterW
api-ms-win-core-console-l2-1-0.dll	28	SetConsoleTextAttribute
api-ms-win-core-console-l2-1-0.dll	29	SetConsoleTitleW
api-ms-win-security-base-l1-1-0.dll	59	GetSecurityDescriptorOwner
api-ms-win-security-base-l1-1-0.dll	51	GetFileSecurityW
api-ms-win-security-base-l1-1-0.dll	89	RevertToSelf
api-ms-win-core-sysinfo-l1-1-0.dll	18	GetSystemTime
api-ms-win-core-sysinfo-l1-1-0.dll	38	SetLocalTime
api-ms-win-core-sysinfo-l1-1-0.dll	20	GetSystemTimeAsFileTime
api-ms-win-core-sysinfo-l1-1-0.dll	26	GetVersion
api-ms-win-core-sysinfo-l1-1-0.dll	24	GetTickCount
api-ms-win-core-sysinfo-l1-1-0.dll	5	GetLocalTime
api-ms-win-core-sysinfo-l1-1-0.dll	30	GetWindowsDirectoryW
api-ms-win-core-timezone-l1-1-0.dll	8	SystemTimeToFileTime
api-ms-win-core-timezone-l1-1-0.dll	1	FileTimeToSystemTime
api-ms-win-core-datetime-l1-1-0.dll	2	GetDateFormatW
api-ms-win-core-datetime-l1-1-0.dll	6	GetTimeFormatW
api-ms-win-core-systemtopology-l1-1-0.dll	1	GetNumaNodeProcessorMaskEx
api-ms-win-core-systemtopology-l1-1-0.dll		GetNumaHighestNodeNumber
api-ms-win-core-processenvironment-l1-2-0.dll	14	NeedCurrentDirectoryForExePathW
api-ms-win-core-registry-l1-1-0.dll	30	RegOpenKeyExW
api-ms-win-core-registry-l1-1-0.dll	11	RegDeleteValueW
api-ms-win-core-registry-l1-1-0.dll	5	RegDeleteKeyExW
api-ms-win-core-registry-l1-1-0.dll	14	RegEnumKeyExW
api-ms-win-core-registry-l1-1-0.dll	3	RegCreateKeyExW
api-ms-win-core-registry-l1-1-0.dll	46	RegSetValueExW
api-ms-win-core-registry-l1-1-0.dll		RegCloseKey
api-ms-win-core-registry-l1-1-0.dll	37	RegQueryValueExW
api-ms-win-core-file-l2-1-0.dll	6	CreateSymbolicLinkW
api-ms-win-core-file-l2-1-0.dll	8	MoveFileExW
api-ms-win-core-file-l2-1-0.dll	5	CreateHardLinkW
api-ms-win-core-file-l2-1-0.dll	9	MoveFileWithProgressW
api-ms-win-core-file-l2-1-0.dll	7	GetFileInformationByHandleEx
api-ms-win-core-heap-l2-1-0.dll	1	GlobalFree
api-ms-win-core-heap-l2-1-0.dll	3	LocalFree
api-ms-win-core-heap-l2-1-0.dll		GlobalAlloc
api-ms-win-core-io-l1-1-0.dll	4	DeviceIoControl
api-ms-win-core-processtopology-l1-1-0.dll	1	GetThreadGroupAffinity
api-ms-win-core-synch-l1-2-0.dll	45	Sleep
api-ms-win-core-profile-l1-1-0.dll		QueryPerformanceCounter
api-ms-win-core-string-obsolete-l1-1-0.dll	5	lstrcmpiW
api-ms-win-core-string-obsolete-l1-1-0.dll	3	lstrcmpW
api-ms-win-core-processtopology-obsolete-l1-1-0.dll	4	SetProcessAffinityMask
api-ms-win-core-apiquery-l1-1-0.dll		ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1.dll	1	ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0.dll		DelayLoadFailureHook

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Windows Command Processor
FileVersion	10.0.16299.15 (WinBuild.160101.0800)
InternalName	cmd
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	Cmd.Exe
ProductName	Microsoft® Windows® Operating System
ProductVersion	10.0.16299.15

VS_FIXEDFILEINFO

FileVersion	10.0.16299.15
ProductVersion	10.0.16299.15
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
3cea8	5790	PNG	(256 x 256)	#
3e546	17594	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

cmd.exe- Windows Command Processor

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

cmd.exe
- Windows Command Processor