File details
File name: cmd.exe
Name: Windows Command Processor
Description: Microsoft® Windows® Operating System
Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
Product version: 6.1.7601.17514
Size: 337 KB
Original file name: Cmd.Exe.MUI
Windows file protection:
Yes
Resource utilization
 | CPU utilization averages |
Total CPU: 0.0003378011%
Privileged CPU:
0.0002309847%

User CPU:
0.00010681640179%

Privileged CPU time: 23.4 ms
Privileged CPU time /min: 0 ms
CPU cycle count:
40,343,090
 | Memory utilization averages |
Committed memory:
38.81 MB
Peak committed memory: 39.94 MB
Paged memory:
2.47 MB
Peak paged memory: 3.54 MB
Paged system memory:
78.78 KB
Non-paged system memory: 4.45 KB
Working set memory:
3.07 MB
Peak working set memory: 3.09 MB
Min working set memory: 3.04 MB
Private memory:
2.47 MB
Page faults:
816
Page faults /min: 0
 | Process I/O averages |
Total read operations:
2
Total read transfer: 5.36 KB
Total other operations:
629
Total other transfer: 3.18 KB
 | GUI Object Averages |
GDI objects:
4
Peak GDI objects: 4
USER objects:
1
Peak USER objects: 1
Resources
Handle count average: 24
Thread count average: 1
Thread resource averages
Total CPU: 0.002618546695%
Privileged CPU: 0.001759850755%
User CPU: 0.000858695940%
CPU Cycle count /sec: 36,757
Module memory size: 356 KB
Process details
Runs as (owner): User
Integrety level: Medium
Windows platform: 64-bit
Parent Process
Child Process
Process Commands
cmd /c ""C:\users\user\desktop\Minecraft Server\run.bat" "
"C:\Windows\system32\cmd.exe"
Startup files (all users) run once details
Name: Del1203196625
Command: cmd.exe /Q /D /c del "C:\users\user\appdata\Local\Temp\0.del"
Startup files (user) run once details
Name: Uninstall C:\Users\Darlene\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112
Command: C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\users\user\appdata\Local\Microsoft\SkyDrive\17.0.2003.1112"
Startup files (all users) run details
Name: Adobe Flash Player SU
Command: C:\Windows\System32\cmd.exe /k start httC://3zz.info/ && exit
Startup files (user) run details
Name: Bomgar_Cleanup_ZD12543155818005
Command: cmd.exe /C rd /S /Q "C:\ProgramData\bomgar-au" & reg delete HKCU\Software\Microsoft\Windows\ CurrentVersion\Run /v Bomgar_Cleanup_ZD12543155818005 /f
Scheduled task details
Name: BoostApp
Command: \BoostApp
Image hashes
MD5: 5746bd7e255dd6a8afa06f7c42c1ba41
SHA-1: 0f3c4ff28f354aede202d54e9d1c5529a3bf87d8
SHA-256: db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386
PE image details
Subsystem: Windows Console
Langauge*: Microsoft Visual C++
File packed: No
Import Table
advapi32.dll

RevertToSelf
SaferRecordEventLogEntry
ImpersonateLoggedOnUser
SaferCloseLevel
SaferComputeTokenFromLevel
SaferIdentifyLevel
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyW
RegDeleteValueW
RegOpenKeyW
RegDeleteKeyW
RegSetValueW
CreateProcessAsUserW
RegSetValueExW
RegCreateKeyExW
LookupAccountSidW
GetSecurityDescriptorOwner
GetFileSecurityW
kernel32.dll

FlushConsoleInputBuffer
LoadLibraryA
InterlockedExchange
FreeLibrary
LocalAlloc
GetVDMCurrentDirectories
CmdBatNotification
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetThreadLocale
GetDiskFreeSpaceExW
CompareFileTime
RemoveDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
CopyFileW
SetFileAttributesW
DeleteFileW
SetFileTime
CreateDirectoryW
FillConsoleOutputAttribute
SetConsoleTextAttribute
ScrollConsoleScreenBufferW
FormatMessageW
DuplicateHandle
FlushFileBuffers
HeapReAlloc
HeapSize
GetFileAttributesExW
LocalFree
GetDriveTypeW
InitializeCriticalSection
SetConsoleCtrlHandler
GetWindowsDirectoryW
GetConsoleTitleW
GetModuleFileNameW
GetVersion
EnterCriticalSection
LeaveCriticalSection
ExpandEnvironmentStringsW
SearchPathW
WriteFile
GetVolumeInformationW
SetLastError
MoveFileW
SetConsoleTitleW
MoveFileExW
GetBinaryTypeW
GetFileAttributesW
GetCurrentThreadId
CreateProcessW
LoadLibraryW
ReadProcessMemory
SetErrorMode
GetConsoleMode
SetConsoleMode
VirtualAlloc
VirtualFree
SetEnvironmentVariableW
GetEnvironmentVariableW
GetCommandLineW
GetEnvironmentStringsW
GetLocalTime
GetTimeFormatW
FileTimeToLocalFileTime
GetDateFormatW
GetLastError
CloseHandle
SetThreadLocale
GetProcAddress
GetModuleHandleW
SetFilePointer
lstrcmpW
lstrcmpiW
HeapAlloc
GetProcessHeap
HeapFree
MultiByteToWideChar
ReadFile
WriteConsoleW
FillConsoleOutputCharacterW
SetConsoleCursorPosition
ReadConsoleW
GetConsoleScreenBufferInfo
GetStdHandle
GetFileType
VirtualQuery
RaiseException
GetCPInfo
GetConsoleOutputCP
WideCharToMultiByte
GetFileSize
CreateFileW
FindClose
FindNextFileW
FindFirstFileW
GetFullPathNameW
GetUserDefaultLCID
GetLocaleInfoW
SetLocalTime
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
FreeEnvironmentStringsW
SetEnvironmentStringsW
GetConsoleWindow
GetStartupInfoW
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
NeedCurrentDirectoryForExePathW
SetFilePointerEx
CancelSynchronousIo
HeapSetInformation
OpenThread
SetEndOfFile
FindNextStreamW
FindFirstStreamW
DeviceIoControl
ResumeThread
SetProcessAffinityMask
GetSystemInfo
GetVolumePathNameW
CreateSymbolicLinkW
CreateHardLinkW
InterlockedCompareExchange
Sleep
LoadLibraryExA
DelayLoadFailureHook
GetThreadGroupAffinity
GetNumaNodeProcessorMaskEx
FindFirstFileExW
GetACP
GlobalAlloc
GlobalFree
GetNumaHighestNodeNumber
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyExW
QueryFullProcessImageNameW
RegSetValueExW
RegCreateKeyExW
msvcrt.dll
ntdll.dll

RtlDosPathNameToNtPathName_U
NtFsControlFile
RtlFreeHeap
NtQueryInformationProcess
NtSetInformationProcess
RtlNtStatusToDosError
NtQueryInformationToken
NtClose
NtOpenProcessToken
NtOpenThreadToken
RtlFindLeastSignificantBit
user32.dll

GetUserObjectInformationW
GetThreadDesktop
MessageBeep
GetProcessWindowStation
winbrand.dll
