home

cmd.exe

Sistema Operacional Microsoft Windows

Microsoft Corporation

This is a setup program which is used to install the application. It is installed as part of Windows 8. The file has been seen being downloaded from matematica.uespi.br and multiple other hosts.
Publisher:
Microsoft Corporation

Product:
Sistema Operacional Microsoft® Windows®

Description:
Processador de comandos do Windows

 
Part of the Windows 8 Operating System

Version:
6.2.9200.16384 (win8_rtm.120725-1247)

MD5:
5996c79fb52bde3fa10f77396654ae42

SHA-1:
ac4d87e771010698cdc82116f289abfcf7d67027

SHA-256:
910d521315b83bb0d805eaceac3c83169aa791d1d1e64b417077c01ae21feb66

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
11/6/2024 2:43:07 AM UTC  (today)

File size:
341.5 KB (349,696 bytes)

Product version:
6.2.9200.16384

Copyright:
© Microsoft Corporation. Todos os direitos reservados.

Original file name:
Cmd.Exe.MUI

File type:
Executable application (Win32 EXE)

Language:
Brazilian Portuguese

Common path:
C:\windows\syswow64\cmd.exe

File PE Metadata
Compilation timestamp:
7/25/2012 9:08:33 PM

OS version:
6.2

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
10.10

CTPH (ssdeep):
6144:11t/YwMUDC5gje+ixYNmFl5WXsXKYGEDKpZUi4YmMPg:11t/YwBC5gje+Aem/UXmKUUUit7

Entry address:
0x11F3B

Entry point:
E8, 75, FF, FF, FF, 6A, 0C, 68, 28, 20, 41, 00, E8, A5, FF, FF, FF, 33, DB, 89, 5D, FC, 64, A1, 18, 00, 00, 00, 8B, 70, 04, 8B, FB, 53, 56, 68, F4, E1, 42, 00, FF, 15, F0, A3, 44, 00, 85, C0, 0F, 85, D2, 02, 00, 00, 33, F6, 46, 39, 35, 38, E1, 42, 00, 0F, 84, E1, 02, 00, 00, 39, 1D, 38, E1, 42, 00, 75, 7B, 89, 35, 38, E1, 42, 00, 68, 24, 20, 41, 00, 68, 18, 20, 41, 00, E8, CF, FE, FF, FF, 59, 59, 85, C0, 0F, 85, C7, 02, 00, 00, 39, 35, 38, E1, 42, 00, 75, 1B, 68, 14, 20, 41, 00, 68, 0C, 20, 41, 00, E8, 50...
 
[+]

Code size:
177.5 KB (181,760 bytes)

The file cmd.exe has been seen being distributed by the following 50 URLs.

http://matematica.uespi.br/moodle/file.php/15/moddata/assignment/156/.../cmd.exe

https://senaintro.blackboard.com/webapps/assignment//download?course_id=_1647472_1&attempt_id=_31134891_1&file_id=_78913391_1&fileName=cmd.exe

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-RlqM4Wp595daBi7_I3AQCnCsAs-GMax_GVI_G1MBGkgJSTWan0Ff7kEvakj1-dgK-OZtZrw2rULBXQ-scIJXZQ/messages/@.id==AFnuw0MAOzqpWGuFCwoteO2Lf0A/content/parts/@.id==2/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBaMhJUaq9ajYALXxcRyf3r9pd-6xfgEr-VcsC_vdT3lfJp5IjMkrQyexzYboiQKVew6y0cZDZK87O4GU8LnZAz6&error=https://mg.mail.yahoo.com/.../iframemsg?id=cadb9a11-e7a7-ff0b-df1e-68c35875e596&ymreqid=2dce5e2d-4124-d0c0-01d8-13009e010000

https://onedrive.live.com/download.aspx?cid=A2C1426127238E8B&authKey=!AA8t-4q1scbfV-Q&resid=A2C1426127238E8B!238&canary=2POgVMBjJreHFidrc7zzsyU1tq4lsuNwBNcy Tz5tqI=5

https://webmail.mdb.com.br/service/home/.../cmd.exe

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-DqdLDCT53f1x113Jd5LMbW7A-Gxst7bnxSBEghDOT9sStk36YUZZXQ6gI2SPt0Sjyqtsdt-jko-uK0ko8KHOrw/messages/@.id==ANeti2IAABJOVsNWgQENiGCwtl0/content/parts/@.id==3/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBbmzeYwmDNM2BeTL9Z1Ge8VgJ_Zntfp38pNt8rsRpyN9Q&error=https://us-mg6.mail.yahoo.com/.../iframemsg?id=1ecc61c3-2dde-deb2-2c51-9c77e8853231&ymreqid=4379666b-566e-65dc-0193-85000b010000

https://onedrive.live.com/download.aspx?cid=A5AF251CE0324ADA&authKey=!AC79GrgjxKcXzoU&resid=A5AF251CE0324ADA!194&ithint=.exe

https://mg.mail.yahoo.com/ya/.../EQcoCPyLWKM&fid=Inbox&pid=2&clean=0&appid=YahooMailNeo&ymreqid=a5e15823-9722-2562-01f7-ee0008010000

https://mail.google.com/mail/u/.../?ui=2&ik=ea050dff08&view=att&th=14495befb9ddeb7e&attid=0.1&disp=safe&realattid=f_hsfk6y0v0&zw

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_3_103524_AC3kimIAAA90VNOKTwau8MOjsRI&fid=Draft&pid=2&clean=0&appid=YahooMailNeo

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_3_61223_AIMJDNkAAFqXVlt8EApv4FfqdvQ&fid=Draft&pid=2&clean=0&appid=YahooMailNeo

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-iFYQqTr_HF2TDcPOGMK89FjhkTgz2W1m84M1IUBMKVjIBT8wx3QDj7x5oFalcUUONpGjDVDkmtMSEF33GYFulw/messages/@.id==AHQaDUwAAAfKUt6yAQAAAEIccSY/content/parts/@.id==2/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBbAziYQDZ9XRLYFMeNoR_1q94RqEYOlP3NI0vbjdAnrdw&error=https://mx-mg6.mail.yahoo.com/.../iframemsg?id=7663c001-d672-d0c6-26fd-bb7ecaf9fb30&ymreqid=e2e78434-988e-8b5d-014d-44011c010000

https://mail.ambiente.gob.ec/service/home/.../cmd.exe

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-ZR9KCig-N-MEgfIMvvKELMk56Ud2umYJ8cbqk_hfYC-EGFk9EouO_GuizhkLvaV5yqtsdt-jko-uK0ko8KHOrw/messages/@.id==AG9K2kIABi8LV6A9oQXf6MoT054/content/parts/@.id==2/raw?appid=YahooMailNeo&ymreqid=d43eb5cb-c0e8-3a1d-0107-15003d010000&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBY2xmcBAzxNBzjNUjZbHJyI9GrNM8U_4PC6YRc4p8YeZA&error=https://us-mg6.mail.yahoo.com/.../iframemsg?id=094a802f-27df-d049-2c19-b8397f48fe76

https://doc-14-7c-docs.googleusercontent.com/docs/securesc/avg0vq7bj2l384a2ub7hamtrqeab396a/n5mkps4htmamho5llhrn50pbb2ah7sag/1477245600000/.../16776314476138162287/0B7hTA5ax-kdcTmc5TG9CUVZZS0k?e=download

http://200.76.34.202/moodle/file.php/36682/.../cmd.exe

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_3_27328_AIko5C4AAA sUqC jgAAAAxOo2E&fid=Draft&pid=2&clean=0&appid=YahooMailNeo

http://us-mg5.mail.yahoo.com/.../download?mid=2_0_0_1_15218897_AHdUimIAAAbzUdw1JAAAAAhdLxI&fid=Inbox&pid=2&clean=0&appid=YahooMailNeo

https://doc-14-1o-docs.googleusercontent.com/docs/securesc/jfgl6ocik4m2abt57ennujrijhujcsto/a811t9kp7a25cbieho0v83spitdfhv5a/1446307200000/.../13345761137993577577/0B2FmzIPgQXl1U0R3T0NLVzFkWTQ?e=download

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-3kjoFboSOhl5JZO607pILkAOjM9hqCW6GvkcGxpnmgtZjFKyW4LOAC3pDIs_74z6YT-BFeO9hNkNnfv0lDPMIQ/messages/@.id==AH0aDUwAAAiUUpOrZgAAAE8IcKw/content/parts/.../raw?appid=YahooMailBasic&ymreqid=2f52f4e4-b262-9702-1306-890000010000&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBa1bTXnvtB0nTOPlt5zNQlvqZidCVqGcX8mof8aUkBqmQ

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_1_7748650_AGd2w0MAACXyU AZ3gAAAFRqe88&fid=Inbox&pid=2&clean=0&appid=YahooMailNeo

https://doc-0c-1g-docs.googleusercontent.com/docs/securesc/5cudbjou3bfj15dtnm9pgaif4fkadkd9/d7bba22bnk8l4c2ilf1vbtpoqv794oqe/1478844000000/.../09154597282969915230/0ByyZ7gmM69HLVlk3LXM3ODdmYjQ?e=download

https://mg.mail.yahoo.com/ya/.../VTMBlw1WEAp1daA&fid=Sent&pid=2&clean=0&appid=YahooMailNeo&ymreqid=d7169edc-2466-f40a-0158-36004f010000

https://www.passeidireto.com/download/.../4954868

https://doc-0g-10-docs.googleusercontent.com/docs/securesc/bi9o00iq3everea21q5qbtdj5khh4u8n/b37msufl95ia8rub14pl1gr9mo7toaii/1477317600000/.../04426455144238190514/0B7xG2KSX1TsQYm5iaWV4ZkVTRUE?e=download

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-0jvEkPg94nXY6XqnslvwD_ylvGG0AOREcVzjaUh8vOHcRiIr-wOgqf42rTtq4WsIq2B7MtMVu5YN8JowUs90aw/messages/@.id==AO31i2IAABASUpt0OAAAAH8h7bw/content/parts/@.id==2/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBbiSVBE4job4BGal-gAW5hEd0yWrOIZ8h9SYoeXgslloYMdUTpTS0EEEztadKCrIoEtyccGwJugiegwDfsUa0tf&error=https://br-mg4.mail.yahoo.com/.../iframemsg?id=32d026c6-b36f-cf14-2e8e-791e0f6a1525&ymreqid=41c20fc9-57af-b5e5-0135-be0050010000

https://app.schoology.com/system/files/drop_items/m/201610/course/.../cmd_580006e980b47.exe

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-GBW4k53HzNtByw1BmYCsIfaC2-mQU_j77uWQeCDkk0AdjG4bQPxg1CP0Z4-AUOi1ocHMoV2YCK8k22Gq10oMTw/messages/@.id==AL9hUtQAAgxrV5q_cADikMlP19c/content/parts/@.id==3/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBaald145OIw8-PyC95s1RrdSocf0eWRgoVWo5jNe0gnjQ&error=https://es-mg42.mail.yahoo.com/.../iframemsg?id=2cf93917-3f10-d546-2b4e-20e65ab6e22a&ymreqid=f0c8dd4a-de74-5bcc-0198-15003c010000

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-UhzcFndGgLClvW3-2GgAxsyMyfSyAVQTNgsz01bGeDk4ieYr2Z7sk4BX-rxzljFw4QS589m2ULn4HOf3kMCF_g/messages/@.id==AIx2imIADhGEV7r3rgk_MI71cOM/content/parts/@.id==4/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBbVKDXUjiGUmjQUYdZGjfO-4NAZa7QCBYDFTrlmm_6HEVY-cKg6iJbp_Vn_Y9DAL7UeyA0yUyvLV41E3vzXBcTu&error=https://us-mg5.mail.yahoo.com/.../iframemsg?id=0464a50f-b4e8-11ed-b83e-067d53bce00b&ymreqid=687e94cb-8ab3-b09e-01a8-5f000d010000

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_3_30145_AEruw0MAABfbVXAI5gf6 Lo1rdc&fid=Draft&pid=3&clean=0&appid=YahooMailNeo

Latest 30 of 52 download URLs

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.