File details
File name: cmd.exe
Name: Windows Command Processor
Description: Microsoft® Windows® Operating System
Version: 5.1.2600.5512 (xpsp.080413-2111)
Product version: 5.1.2600.5512
Size: 380 KB
Original file name: Cmd.Exe.MUI
Windows file protection:
Yes
Resource utilization
 | CPU utilization averages |
Total CPU: 0.0003748695%
Privileged CPU:
0.0002268277%

User CPU:
0.00014804178344%

Privileged CPU time: 321.88 ms
Privileged CPU time /min: 0 ms
 | Memory utilization averages |
Committed memory:
29.75 MB
Peak committed memory: 36.22 MB
Paged memory:
2.01 MB
Peak paged memory: 2.23 MB
Paged system memory:
57.77 KB
Non-paged system memory: 2.23 KB
Working set memory:
1.7 MB
Peak working set memory: 2.75 MB
Min working set memory: 1.63 MB
Private memory:
2.01 MB
Page faults:
821
Page faults /min: 2
 | Process I/O averages |
Total read operations:
3
Read operations /min: 1
Total read transfer: 16.97 KB
Read transfer /min: 24 Bytes
Total write operations:
5
Write operations /min: 1
Total write transfer: 251.11 KB
Write transfer /min: 735 Bytes
Total other operations:
813
Other operations /min: 2
Total other transfer: 131.33 KB
Other Transfer /min: 122 Bytes
 | GUI Object Averages |
GDI objects:
5
USER objects:
1
Resources
Handle count average: 32
Thread count average: 1
Thread resource averages
Total CPU: 0.002160390759%
Privileged CPU: 0.001571694263%
User CPU: 0.000588696495%
Module memory size: 388 KB
Process details
Runs as (owner): User
Integrety level: Undefined
Windows platform: 32-bit
Parent Process
Child Process
Process Commands
"C:\WINDOWS\system32\CMD.exe"
"C:\WINDOWS\system32\cmd.exe"
"C:\WINDOWS\system32\cmd.exe" /c set /p x= & del /f /s "C:\DOCUME~1\user\LocalS~1\Temp\Bunndle\BUNNDL~1.DLL"
Startup files (all users) run once details
Name: Del1203196625
Command: cmd.exe /Q /D /c del "C:\users\user\appdata\Local\Temp\0.del"
Startup files (user) run once details
Name: Uninstall C:\Users\Darlene\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112
Command: C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\users\user\appdata\Local\Microsoft\SkyDrive\17.0.2003.1112"
Startup files (all users) run details
Name: Adobe Flash Player SU
Command: C:\Windows\System32\cmd.exe /k start httC://3zz.info/ && exit
Startup files (user) run details
Name: Bomgar_Cleanup_ZD12543155818005
Command: cmd.exe /C rd /S /Q "C:\ProgramData\bomgar-au" & reg delete HKCU\Software\Microsoft\Windows\ CurrentVersion\Run /v Bomgar_Cleanup_ZD12543155818005 /f
Scheduled task details
Name: BoostApp
Command: \BoostApp
Image hashes
MD5: 6d778e0f95447e6546553eeea709d03c
SHA-1: 811a005cf787c6ccbe0d9f1c36c1d49a9cb71fd1
SHA-256: 62abed7d45040381bbced97ea7b6c697b418448fd3322fd4bfb2bbfdb6155eb4
PE image details
Subsystem: Windows Console
Langauge*: Microsoft Visual C++
File packed: No
Import Table
advapi32.dll

RevertToSelf
SaferRecordEventLogEntry
ImpersonateLoggedOnUser
SaferCloseLevel
SaferComputeTokenFromLevel
SaferIdentifyLevel
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyW
RegDeleteValueW
RegOpenKeyW
RegDeleteKeyW
RegSetValueW
CreateProcessAsUserW
RegSetValueExW
RegCreateKeyExW
LookupAccountSidW
GetSecurityDescriptorOwner
GetFileSecurityW
kernel32.dll

FlushConsoleInputBuffer
LoadLibraryA
InterlockedExchange
FreeLibrary
LocalAlloc
GetVDMCurrentDirectories
CmdBatNotification
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetThreadLocale
GetDiskFreeSpaceExW
CompareFileTime
RemoveDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
CopyFileW
SetFileAttributesW
DeleteFileW
SetFileTime
CreateDirectoryW
FillConsoleOutputAttribute
SetConsoleTextAttribute
ScrollConsoleScreenBufferW
FormatMessageW
DuplicateHandle
FlushFileBuffers
HeapReAlloc
HeapSize
GetFileAttributesExW
LocalFree
GetDriveTypeW
InitializeCriticalSection
SetConsoleCtrlHandler
GetWindowsDirectoryW
GetConsoleTitleW
GetModuleFileNameW
GetVersion
EnterCriticalSection
LeaveCriticalSection
ExpandEnvironmentStringsW
SearchPathW
WriteFile
GetVolumeInformationW
SetLastError
MoveFileW
SetConsoleTitleW
MoveFileExW
GetBinaryTypeW
GetFileAttributesW
GetCurrentThreadId
CreateProcessW
LoadLibraryW
ReadProcessMemory
SetErrorMode
GetConsoleMode
SetConsoleMode
VirtualAlloc
VirtualFree
SetEnvironmentVariableW
GetEnvironmentVariableW
GetCommandLineW
GetEnvironmentStringsW
GetLocalTime
GetTimeFormatW
FileTimeToLocalFileTime
GetDateFormatW
GetLastError
CloseHandle
SetThreadLocale
GetProcAddress
GetModuleHandleW
SetFilePointer
lstrcmpW
lstrcmpiW
HeapAlloc
GetProcessHeap
HeapFree
MultiByteToWideChar
ReadFile
WriteConsoleW
FillConsoleOutputCharacterW
SetConsoleCursorPosition
ReadConsoleW
GetConsoleScreenBufferInfo
GetStdHandle
GetFileType
VirtualQuery
RaiseException
GetCPInfo
GetConsoleOutputCP
WideCharToMultiByte
GetFileSize
CreateFileW
FindClose
FindNextFileW
FindFirstFileW
GetFullPathNameW
GetUserDefaultLCID
GetLocaleInfoW
SetLocalTime
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
FreeEnvironmentStringsW
SetEnvironmentStringsW
GetConsoleWindow
GetStartupInfoW
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
NeedCurrentDirectoryForExePathW
SetFilePointerEx
CancelSynchronousIo
HeapSetInformation
OpenThread
SetEndOfFile
FindNextStreamW
FindFirstStreamW
DeviceIoControl
ResumeThread
SetProcessAffinityMask
GetSystemInfo
GetVolumePathNameW
CreateSymbolicLinkW
CreateHardLinkW
InterlockedCompareExchange
Sleep
LoadLibraryExA
DelayLoadFailureHook
GetThreadGroupAffinity
GetNumaNodeProcessorMaskEx
FindFirstFileExW
GetACP
GlobalAlloc
GlobalFree
GetNumaHighestNodeNumber
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyExW
QueryFullProcessImageNameW
RegSetValueExW
RegCreateKeyExW
msvcrt.dll
ntdll.dll

RtlDosPathNameToNtPathName_U
NtFsControlFile
RtlFreeHeap
NtQueryInformationProcess
NtSetInformationProcess
RtlNtStatusToDosError
NtQueryInformationToken
NtClose
NtOpenProcessToken
NtOpenThreadToken
RtlFindLeastSignificantBit
user32.dll

GetUserObjectInformationW
GetThreadDesktop
MessageBeep
GetProcessWindowStation
winbrand.dll
