label.exe

  • File Path: C:\WINDOWS\SysWOW64\label.exe
  • Description: Disk Label Utility

Hashes

Type Hash
MD5 BAC3AC41FE9036749BCDA78237CBA3B9
SHA1 EC5E4E40EF5904C3642348E2EEDADB6FCF1735B3
SHA256 EC7CE686D1EAF97C2709A1C8BD98698F12B8E82D55751A9BB83F4D10FFF016A0
SHA384 16693460095E620FA85DB7D7E48E61EA3ECDECDC5340D72A5141650696DE42F8DCE597DD1E85C3492FE9F354FDEB2469
SHA512 B63532AD802BAB1627A3C7F3C1286EDC4595D290D3BEB36BA6A1477E4EC794E91F99E0F89E898D8F99E760F9AF4A0CA24D47FB6FC90B62E15FEB9186AB32D980
SSDEEP 192:5fia8SAZnrut9dl7il8XO2zit1A5uYgLhYnkikQWS5jWrMpd10WZ:5fiNShv48XRzi05iIkQWS5jWrEX
IMP 2DFF96A00DEE83E667DC424359E9647D
PESHA1 D3B73DB7260CB25CEFAD17B6380AF7BFB274F72E
PE256 D011932976B03B14B62BBC35566B417EB5067EBC761DC9F0B329A052D3779491

Runtime Data

Usage (stdout):

Creates, changes, or deletes the volume label of a disk.

LABEL [drive:][label]
LABEL [/MP] [volume] [label]

  drive:          Specifies the drive letter of a drive.
  label           Specifies the label of the volume.
  /MP             Specifies that the volume should be treated as a
                  mount point or volume name.
  volume          Specifies the drive letter (followed by a colon),
                  mount point, or volume name.  If volume name is specified,
                  the /MP flag is unnecessary.

Loaded Modules:

Path
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\wow64.dll
C:\WINDOWS\System32\wow64base.dll
C:\WINDOWS\System32\wow64con.dll
C:\WINDOWS\System32\wow64cpu.dll
C:\WINDOWS\System32\wow64win.dll
C:\WINDOWS\SysWOW64\label.exe

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: Label.Exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/73
  • VirusTotal Link: https://www.virustotal.com/gui/file/ec7ce686d1eaf97c2709a1c8bd98698f12b8e82d55751a9bb83f4d10fff016a0/detection

Possible Misuse

The following table contains possible examples of label.exe being misused. While label.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
signature-base apt_apt29_grizzly_steppe.yar $ = “\x0D\x0AVolume label: “ CC BY-NC 4.0
signature-base gen_Excel4Macro_Sharpshooter.yar // ‘ 0018 23 LABEL : Cell Value, String Constant - build-in-name 1 Auto_Open CC BY-NC 4.0
signature-base gen_win_privesc.yar $s1 = “<Label x:Name="lblPort" Content="Port:" HorizontalAlignment="Left" Height="28" Margin="10,0,0,0" Width="35"/>” fullword ascii CC BY-NC 4.0

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


label

Creates, changes, or deletes the volume label (that is, the name) of a disk. If used without parameters, the label command changes the current volume label or deletes the existing label.

Syntax

label [/mp] [<volume>] [<label>]

Parameters

Parameter Description
/mp Specifies that the volume should be treated as a mount point or volume name.
<volume> Specifies a drive letter (followed by a colon), mount point, or volume name. If a volume name is specified, the /mp parameter is unnecessary.
<label> Specifies the label for the volume.
/? Displays help at the command prompt.

Remarks

  • Windows displays the volume label and serial number (if it has one) as part of the directory listing.

  • An NTFS volume label can be up to 32 characters in length, including spaces. NTFS volume labels retain and display the case that was used when the label was created.

Examples

To label a disk in drive A that contains sales information for July, type:

label a:sales-july

To view and delete the current label for drive C, follow these steps:

  1. At the command prompt, type:

    label
    

    Output similar to the following should be displayed:

    Volume in drive C: is Main Disk
    Volume Serial Number is 6789-ABCD
    Volume label (32 characters, ENTER for none)?
    
  2. Press ENTER. The following prompt should be displayed:

    Delete current volume label (Y/N)?
    
  3. Press Y to delete the current label, or N if you want to keep the existing label.

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.