» cmd.exe
Overview
Analysis
File Details
Behaviors (36)
Downloads (21)

cmd.exe

Windows Command Processor

Microsoft Corporation

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘AntiUsbWorm’. This is the uninstaller utility registered in the Windows Control Panel for the program EAGLE 6.5.0 by CadSoft Computer GmbH. It is installed with Windows 7.

File name:

cmd.exe

Publisher:

Microsoft Corporation

Product:

Microsoft® Windows® Operating System

Description:

Windows Command Processor

Part of the Windows 7 (with Service Pack 1) Operating System

Version:

6.1.7601.17514 (win7sp1_rtm.101119-1850)

MD5:

5746bd7e255dd6a8afa06f7c42c1ba41

SHA-1:

0f3c4ff28f354aede202d54e9d1c5529a3bf87d8

SHA-256:

db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)
Whitelisted (by digital signature)

Analysis date:

12/28/2024 8:36:31 PM UTC (today)

File size:

337 KB (345,088 bytes)

Product version:

6.1.7601.17514

Original file name:

Cmd.Exe.MUI

File type:

Executable application (Win64 EXE)

Language:

English (United States)

Common path:

C:\Windows\System32\cmd.exe

File PE Metadata

Compilation timestamp:

11/20/2010 4:46:13 AM

OS version:

6.1

OS bitness:

Win64

Subsystem:

Windows Console

Linker version:

9.0

CTPH (ssdeep):

6144:NVl7yDR2iaGcsVXFBM6IT77aVebJWC1jIdDWCoCX9Sm:jdyDRwpmFq6ITSebJWwjIdDbNS

Entry address:

0x90B4

Entry point:

48, 83, EC, 28, E8, 0F, 00, 00, 00, 48, 83, C4, 28, E9, A6, 07, 00, 00, 90, 90, 90, 90, 90, 90, 48, 89, 5C, 24, 18, 57, 48, 83, EC, 20, 48, 8B, 05, EB, 50, 02, 00, 48, 83, 64, 24, 30, 00, 48, BF, 32, A2, DF, 2D, 99, 2B, 00, 00, 48, 3B, C7, 0F, 85, F8, 6F, 01, 00, 48, 8D, 4C, 24, 30, FF, 15, FF, 03, 02, 00, 48, 8B, 5C, 24, 30, FF, 15, 1C, 06, 02, 00, 44, 8B, D8, 49, 33, DB, FF, 15, F8, 02, 02, 00, 44, 8B, D8, 49, 33, DB, FF, 15, 84, 01, 02, 00, 48, 8D, 4C, 24, 38, 44, 8B, D8, 49, 33, DB, FF, 15, 7B, 01, 02... 
[+]

Entropy:

4.6111

Code size:

156.5 KB (160,256 bytes)

7 Program Uninstaller

Program name:

EAGLE 6.5.0

Display publisher:

CadSoft Computer GmbH

Display version:

6.5.0

Uninstall string:

cmd.exe /c start "EAGLE Uninstaller" /min "C:\Program Files (x86)\EAGLE-6.5.0\bin\uninstall.bat" C:\Program Files (x86)\EAGLE-6.5.0\bin

Program name:

EAGLE 6.4.0

Display publisher:

CadSoft Computer GmbH

Display version:

6.4.0

Uninstall string:

cmd.exe /c start "EAGLE Uninstaller" /min "C:\Program Files (x86)\EAGLE-6.4.0\bin\uninstall.bat" C:\Program Files (x86)\EAGLE-6.4.0\bin

Program name:

Banking 4W

Display publisher:

Subsembly GmbH

Uninstall string:

cmd.exe /q /c ""C:\Program Files (x86)\TopBanking\AppRemove.bat" "C:\Program Files (x86)\TopBanking" TopBanking"

Program name:

EAGLE 7.1.0

Display publisher:

CadSoft Computer GmbH

Display version:

7.1.0

Uninstall string:

cmd.exe /c start "EAGLE Uninstaller" /min "C:\EAGLE-7.1.0\bin\uninstall.bat" C:\EAGLE-7.1.0\bin

Program name:

EAGLE 7.2.0

Display publisher:

CadSoft Computer GmbH

Display version:

7.2.0

Uninstall string:

cmd.exe /c start "EAGLE Uninstaller" /min "C:\EAGLE-7.2.0\bin\uninstall.bat" C:\EAGLE-7.2.0\bin

Program name:

> Chrome Search

Uninstall string:

cmd.exe /c move/y %WinDir%\system32\GroupPolicy\Machine\Registry.pol %WinDir%\system32\GroupPolicy\Machine\Registry.pol.old & move/y %WinDir%\system32\GroupPolicy\Machine\Registry.pol.bak %WinDir%\sys

Safe Boot Alternate Shell

Name:

cmd.exe

40 Scheduled Tasks

Task name:

BrowserSafeguard

Trigger:

Logon (Runs on logon)

Action:

cmd.exe \c start "" "C:\Program Files\browsersafegua

Description:

Runs your BrowserSafeguard software.

Task name:

RocketTab

Trigger:

Logon (Runs on logon)

Action:

cmd.exe \c start "" "C:\Program Files\rockettab\clie

Description:

Runs your RocketTab software.

Task name:

GeniusBox

Trigger:

Time (Next runs on 8/22/2015 at 4:20 AM)

Action:

cmd.exe \c start "" "C:\users\{user}\appdata\local\browse

Task name:

iolo DelOnReboot

Trigger:

Boot (Runs on boot)

Action:

cmd.exe \c del \f C:\ProgramData\iolo\ops\smrr.dll

Task name:

Ninite - Air

Trigger:

Weekly (Runs weekly on Tuesdays at 9:59 AM)

Task name:

Ninite - Audacity

Trigger:

Weekly (Runs weekly on Tuesdays at 9:28 AM)

7 Startup Files (User Run)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

AntiUsbWorm

Command:

C:\Windows\System32\cmd.exe \c start C:\google\autoit3.exe \autoit3executescript C:\google\googleupdate.a3x & exit

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

Bomgar_Cleanup_ZD191346117911

Command:

cmd.exe \c rd \s \q "C:\ProgramData\bomgar-scc-0x55d39f65" & reg.exe delete hkcu\software\microsoft\windows\currentversion\run \v bomgar_cleanup_zd191346117911 \f

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

Bomgar_Cleanup_ZD2020364355

Command:

cmd.exe \c rd \s \q "C:\ProgramData\bomgar-scc-0x55d34feb" & reg.exe delete hkcu\software\microsoft\windows\currentversion\run \v bomgar_cleanup_zd2020364355 \f

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

Bomgar_Cleanup_ZD12780386943

Command:

cmd.exe \c rd \s \q "C:\ProgramData\bomgar-scc-0x55d3691e" & reg.exe delete hkcu\software\microsoft\windows\currentversion\run \v bomgar_cleanup_zd12780386943 \f

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

Bomgar_Cleanup_ZD1438650512438

Command:

cmd.exe \c rd \s \q "C:\ProgramData\bomgar-scc-0x55b80606" & reg delete hkcu\software\microsoft\windows\currentversion\run \v bomgar_cleanup_zd1438650512438 \f

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

Bomgar_Cleanup_ZD136273262900

Command:

cmd.exe \c rd \s \q "C:\ProgramData\bomgar-scc-0x55db452f" & reg delete hkcu\software\microsoft\windows\currentversion\run \v bomgar_cleanup_zd136273262900 \f

124 Startup Files (User Run Once)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Name:

uninstall C:\users\{user}\appdata\local\microsoft\skydrive\16.4.3347.0416\amd64

Command:

C:\Windows\System32\cmd.exe \q \c rmdir \s \q "C:\users\{user}\appdata\local\microsoft\skydrive\16.4.3347.0416\amd64"

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Name:

uninstall C:\users\{user}\appdata\local\microsoft\skydrive\16.4.4111.0525\amd64

Command:

C:\Windows\System32\cmd.exe \q \c rmdir \s \q "C:\users\{user}\appdata\local\microsoft\skydrive\16.4.4111.0525\amd64"

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Name:

uninstall C:\users\{user}\appdata\local\microsoft\skydrive\16.4.6003.0710\amd64

Command:

C:\Windows\System32\cmd.exe \q \c rmdir \s \q "C:\users\{user}\appdata\local\microsoft\skydrive\16.4.6003.0710\amd64"

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Name:

uninstall C:\users\{user}\appdata\local\microsoft\skydrive\16.4.6006.0718\amd64

Command:

C:\Windows\System32\cmd.exe \q \c rmdir \s \q "C:\users\{user}\appdata\local\microsoft\skydrive\16.4.6006.0718\amd64"

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Name:

uninstall C:\users\{user}\appdata\local\microsoft\skydrive\16.4.6010.0727\amd64

Command:

C:\Windows\System32\cmd.exe \q \c rmdir \s \q "C:\users\{user}\appdata\local\microsoft\skydrive\16.4.6010.0727\amd64"

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Name:

uninstall C:\users\{user}\appdata\local\microsoft\skydrive\16.4.6013.0910\amd64

Command:

C:\Windows\System32\cmd.exe \q \c rmdir \s \q "C:\users\{user}\appdata\local\microsoft\skydrive\16.4.6013.0910\amd64"

4 Startup Files (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

AMD AVT

Command:

cmd.exe \c start "amd accelerated video transcoding device initialization" \min "C:\Program Files\amd avt\bin\kdbsync.exe" aml

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

Adobe Flash Player SU

Command:

C:\Windows\System32\cmd.exe \k if %datC:~6,4%%datC:~3,2%%datC:~0,2% leq 20130606 (exit) else (start httC:\lyll.net && exit)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

AntiUsbWorm

Command:

C:\Windows\System32\cmd.exe \c start C:\google\autoit3.exe \autoit3executescript C:\google\googleupdate.a3x & exit

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

CMD

Command:

cmd.exe \k if %datC:~6,4%%datC:~3,2%%datC:~0,2% leq 20130909 (exit) else (start httC:\alt-rutor.org && exit)

67 Startup Files (All Users Run Once)

Registry location: