subst.exe

File Path: C:\WINDOWS\SysWOW64\subst.exe
Description: Subst Utility

Hashes

Type	Hash
MD5	`E191E17FF2D060CDAD7041089A08D990`
SHA1	`B60D572B09C4C0FF5DAA590995B183AB0E0B8D3E`
SHA256	`C74F772A78CD3146912D8FEBC4BBB6E859A0F44D5F84E456664341C953772B76`
SHA384	`F397C1E3FFA4FE93E346FB86E229C13A1421C869C912AC39EC685EDE0384C60F226638B990B20934DD4AFC374F77EB1F`
SHA512	`857C522DD2B03DF0706374421C37980885530B082B7C7D71D2AC244E49F98C28F43B6890C99AC104E0AA2026DB61639E7C6178FF111896A22E174D248829A039`
SSDEEP	`192:PV+cdqRAs942Cw/q2DsWBE/d6FYghkNbKk5W8GWYIOj:9+cERAs9M4MWBEl67h+5W8GWYIOj`
IMP	`7DD76573763F447C2EF4E1C30B281996`
PESHA1	`B91E98E6804DE14B385A50C78189EAE2894DF500`
PE256	`2CD89DE17D560CF7A0C3965032AA42C0D10048AFC348AE0F98B6E41739DAD5E5`

Runtime Data

Usage (stdout):

Associates a path with a drive letter.

SUBST [drive1: [drive2:]path]
SUBST drive1: /D

  drive1:        Specifies a virtual drive to which you want to assign a path.
  [drive2:]path  Specifies a physical drive and path you want to assign to
                 a virtual drive.
  /D             Deletes a substituted (virtual) drive.

Type SUBST with no parameters to display a list of current virtual drives.

Child Processes:

perfmon.exe

Loaded Modules:

Path
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\wow64.dll
C:\WINDOWS\System32\wow64base.dll
C:\WINDOWS\System32\wow64con.dll
C:\WINDOWS\System32\wow64cpu.dll
C:\WINDOWS\System32\wow64win.dll
C:\WINDOWS\SysWOW64\subst.exe

Signature

Status: Signature verified.
Serial: 33000002ED2C45E4C145CF48440000000002ED
Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: Subst.Exe
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.22000.1 (WinBuild.160101.0800)
Product Version: 10.0.22000.1
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.
Machine Type: 32-bit

File Scan

VirusTotal Detections: 0/73
VirusTotal Link: https://www.virustotal.com/gui/file/c74f772a78cd3146912d8febc4bbb6e859a0f44d5f84e456664341c953772b76/detection

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

subst

Associates a path with a drive letter. If used without parameters, subst displays the names of the virtual drives in effect.

Syntax

subst [<drive1>: [<drive2>:]<path>]
subst <drive1>: /d

Parameters

Parameter	Description
`<drive1>:`	Specifies the virtual drive to which you want to assign a path.
`[<drive2>:]<path>`	Specifies the physical drive and path that you want to assign to a virtual drive.
/d	Deletes a substituted (virtual) drive.
/?	Displays help at the command prompt.

Remarks

The following commands don’t work and must not be used on drives specified in the subst command:
- chkdsk command
  
  diskcomp command
  
  diskcopy command
  
  format command
  
  label command
  
  recover command
The <drive1> parameter must be within the range that is specified by the lastdrive command. If not, subst displays the following error message: Invalid parameter - drive1:

Examples

To create a virtual drive z for the path b:\user\betty\forms, type:

subst z: b:\user\betty\forms

Instead of typing the full path, you can reach this directory by typing the letter of the virtual drive followed by a colon as follows:

z:

Additional References

Command-Line Syntax Key