comp.exe

File Path: C:\Windows\system32\comp.exe
Description: File Compare Utility

Hashes

Type	Hash
MD5	`2B195E666FB46D1B8DD32EB8733FACC4`
SHA1	`D3AFC299864820ADEC4321753BE20D87527DB51D`
SHA256	`663B831A79CE13D456C375D7CF28081164FC0E5CA513B7BEB3C07A0D1E1B1C4D`
SHA384	`1E61A278CBCFC9A06B344653760D96330A957DC1294FA8F087B696A5CA5C90D91BA571C0229CDB1CEF72D60E63A15553`
SHA512	`CD81E5009B33FE037A775EE36F7FFBED1DAE82D2DE8BEA95D4E9C036013AB85277DF9A16CCAF5F37D06EEDC362822AD843646030774C131089F0B29BEF17D64E`
SSDEEP	`384:Ax0+V/mMGgXRW/JhcyV6/LzCpkLi5FYhAey4xZjxONzWncW:R+NJSJh5SK+i5mhXjxO2`
IMP	`02B63B93BB0FF42FF5BEB4C6E62D06B7`
PESHA1	`E45C8BB4526EA3F60BA9AE668556B42DB5FA6449`
PE256	`B396FD7FC05857BAC8FE48C4551FAA02C8A2349F105E25A8337284188E8B29E9`

Runtime Data

Usage (stdout):

Compares the contents of two files or sets of files.

COMP [data1] [data2] [/D] [/A] [/L] [/N=number] [/C] [/OFF[LINE]] [/M]

  data1      Specifies location and name(s) of first file(s) to compare.
  data2      Specifies location and name(s) of second files to compare.
  /D         Displays differences in decimal format.
  /A         Displays differences in ASCII characters.
  /L         Displays line numbers for differences.
  /N=number  Compares only the first specified number of lines in each file.
  /C         Disregards case of ASCII letters when comparing files.
  /OFF[LINE] Do not skip files with offline attribute set.
  /M         Do not prompt for compare more files.

To compare sets of files, use wildcards in data1 and data2 parameters.

Usage (stderr):

Name of second file to compare: 

Child Processes:

conhost.exe

Open Handles:

Path	Type
(R-D) C:\Windows\System32\en-US\ulib.dll.mui	File
(RW-) C:\Users\user	File
\BaseNamedObjects\C:ProgramDataMicrosoftWindowsCaches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000004.db	Section
\BaseNamedObjects\C:ProgramDataMicrosoftWindowsCaches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000004.db	Section
\BaseNamedObjects\C:ProgramDataMicrosoftWindowsCaches*cversions.2.ro	Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0	Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0	Section

Loaded Modules:

Path
C:\Windows\system32\comp.exe
C:\Windows\SYSTEM32\fsutilext.dll
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\system32\ulib.dll

Signature

Status: Signature verified.
Serial: 33000001C422B2F79B793DACB20000000001C4
Thumbprint: AE9C1AE54763822EEC42474983D8B635116C8452
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: Comp.Exe.MUI
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.17763.1 (WinBuild.160101.0800)
Product Version: 10.0.17763.1
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.
Machine Type: 64-bit

File Scan

VirusTotal Detections: 0/70
VirusTotal Link: https://www.virustotal.com/gui/file/663b831a79ce13d456c375d7cf28081164fc0e5ca513b7beb3c07a0d1e1b1c4d/detection/

File Similarity (ssdeep match)

File	Score
C:\Windows\SysWOW64\comp.exe	29

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

comp

Compares the contents of two files or sets of files byte-by-byte. These files can be stored on the same drive or on different drives, and in the same directory or in different directories. When this command compares files, it displays their location and file names. If used without parameters, comp prompts you to enter the files to compare.

Syntax

comp [<data1>] [<data2>] [/d] [/a] [/l] [/n=<number>] [/c]

Parameters

Parameter	Description
`<data1>`	Specifies the location and name of the first file or set of files that you want to compare. You can use wildcard characters (* and ?) to specify multiple files.
`<data2>`	Specifies the location and name of the second file or set of files that you want to compare. You can use wildcard characters (* and ?) to specify multiple files.
/d	Displays differences in decimal format. (The default format is hexadecimal.)
/a	Displays differences as characters.
/l	Displays the number of the line where a difference occurs, instead of displaying the byte offset.
/n=`<number>`	Compares only the number of lines that are specified for each file, even if the files are different sizes.
/c	Performs a comparison that is not case-sensitive.
/off[line]	Processes files with the offline attribute set.
/?	Displays Help at the command prompt.

Remarks

During the comparison, comp displays messages that identify the locations of unequal information between the files. Each message indicates the offset memory address of the unequal bytes and the contents of the bytes (in hexadecimal notation unless the /a or /d command-line parameter is specified). Messages appear in the following format:
```
  Compare error at OFFSET xxxxxxxx
  file1 = xx
  file2 = xx
```
After ten unequal comparisons, comp stops comparing the files and displays the following message:

10 Mismatches - ending compare
If you omit necessary components of either data1 or data2, or if you omit data2 entirely, this command prompts you for the missing information.
If data1 contains only a drive letter or a directory name with no file name, this command compares all of the files in the specified directory to the file specified in data1.
If data2 contains only a drive letter or a directory name, the default file name for data2 becomes the same name as for data1.
If the comp command can’t find the specified files, it will prompt you with a message about whether you want to compare additional files.
The files that you compare can have the same file name, provided they’re in different directories or on different drives. You can use wildcard characters (* and ?) to specify file names.
You must specify /n to compare files of different sizes. If the file sizes are different and /n isn’t specified, the following message is displayed:
```
  Files are different sizes
  Compare more files (Y/N)?
```
To compare these files anyway, press N to stop the command. Then, run the comp command again, using the /n option to compare only the first portion of each file.
If you use wildcard characters (* and ?) to specify multiple files, comp finds the first file that matches data1 and compares it with the corresponding file in data2, if it exists. The comp command reports the results of the comparison for each file matching data1. When finished, comp displays the following message:

Compare more files (Y/N)?

To compare more files, press Y. The comp command prompts you for the locations and names of the new files. To stop the comparisons, press N. When you press Y, you’re prompted for which command-line options to use. If you don’t specify any command-line options, comp uses the ones you specified before.

Examples

To compare the contents of the directory c:\reports with the backup directory \\sales\backup\april, type:

comp c:\reports \\sales\backup\april

To compare the first ten lines of the text files in the \invoice directory and display the result in decimal format, type:

comp \invoice\*.txt \invoice\backup\*.txt /n=10 /d

Additional References

Command-Line Syntax Key