xargs.exe
- File Path:
C:\Users\user\AppData\Local\GitHubDesktop\app-2.5.3\resources\app\git\usr\bin\xargs.exe
Hashes
| Type | Hash |
|---|---|
| MD5 | 99CE47BE6C8B47572088399D09F8A9B4 |
| SHA1 | A7CB5C76A8EC17B5AD361DCADA3DE7F11F5C5C66 |
| SHA256 | C8455127DB3C721E6BB443DE5A743307221B08A6082C299875C1D00AA29890B1 |
| SHA384 | A5C3DEC3B7F6E1B8F849DE906D5B83BD30B7276BB401E770713C36FE34E231EB3F7A8BC39A23A514354FB165097F225E |
| SHA512 | D7C3FD0C1D46EE74A34914ACA8F981C1083B33BC43E10F7D98197574EDE5BD9025CD17C390A233C5C39824F324816972A8E617A1C113BDC3FDE272DCDEEA300A |
| SSDEEP | 1536:tRG4VHdTfDJcyzsf0zmpPAZZhD7egTPcCoLTWOFF9+xUfp:7Tf1cyzsf+wQZJygfzOFF9+S |
Runtime Data
Usage (stdout):
For more information on a specific command, type HELP command-name
ASSOC Displays or modifies file extension associations.
ATTRIB Displays or changes file attributes.
BREAK Sets or clears extended CTRL+C checking.
BCDEDIT Sets properties in boot database to control boot loading.
CACLS Displays or modifies access control lists (ACLs) of files.
CALL Calls one batch program from another.
CD Displays the name of or changes the current directory.
CHCP Displays or sets the active code page number.
CHDIR Displays the name of or changes the current directory.
CHKDSK Checks a disk and displays a status report.
CHKNTFS Displays or modifies the checking of disk at boot time.
CLS Clears the screen.
CMD Starts a new instance of the Windows command interpreter.
COLOR Sets the default console foreground and background colors.
COMP Compares the contents of two files or sets of files.
COMPACT Displays or alters the compression of files on NTFS partitions.
CONVERT Converts FAT volumes to NTFS. You cannot convert the
current drive.
COPY Copies one or more files to another location.
DATE Displays or sets the date.
DEL Deletes one or more files.
DIR Displays a list of files and subdirectories in a directory.
DISKPART Displays or configures Disk Partition properties.
DOSKEY Edits command lines, recalls Windows commands, and
creates macros.
DRIVERQUERY Displays current device driver status and properties.
ECHO Displays messages, or turns command echoing on or off.
ENDLOCAL Ends localization of environment changes in a batch file.
ERASE Deletes one or more files.
EXIT Quits the CMD.EXE program (command interpreter).
FC Compares two files or sets of files, and displays the
differences between them.
FIND Searches for a text string in a file or files.
FINDSTR Searches for strings in files.
FOR Runs a specified command for each file in a set of files.
FORMAT Formats a disk for use with Windows.
FSUTIL Displays or configures the file system properties.
FTYPE Displays or modifies file types used in file extension
associations.
GOTO Directs the Windows command interpreter to a labeled line in
a batch program.
GPRESULT Displays Group Policy information for machine or user.
GRAFTABL Enables Windows to display an extended character set in
graphics mode.
HELP Provides Help information for Windows commands.
ICACLS Display, modify, backup, or restore ACLs for files and
directories.
IF Performs conditional processing in batch programs.
LABEL Creates, changes, or deletes the volume label of a disk.
MD Creates a directory.
MKDIR Creates a directory.
MKLINK Creates Symbolic Links and Hard Links
MODE Configures a system device.
MORE Displays output one screen at a time.
MOVE Moves one or more files from one directory to another
directory.
OPENFILES Displays files opened by remote users for a file share.
PATH Displays or sets a search path for executable files.
PAUSE Suspends processing of a batch file and displays a message.
POPD Restores the previous value of the current directory saved by
PUSHD.
PRINT Prints a text file.
PROMPT Changes the Windows command prompt.
PUSHD Saves the current directory then changes it.
RD Removes a directory.
RECOVER Recovers readable information from a bad or defective disk.
REM Records comments (remarks) in batch files or CONFIG.SYS.
REN Renames a file or files.
RENAME Renames a file or files.
REPLACE Replaces files.
RMDIR Removes a directory.
ROBOCOPY Advanced utility to copy files and directory trees
SET Displays, sets, or removes Windows environment variables.
SETLOCAL Begins localization of environment changes in a batch file.
SC Displays or configures services (background processes).
SCHTASKS Schedules commands and programs to run on a computer.
SHIFT Shifts the position of replaceable parameters in batch files.
SHUTDOWN Allows proper local or remote shutdown of machine.
SORT Sorts input.
START Starts a separate window to run a specified program or command.
SUBST Associates a path with a drive letter.
SYSTEMINFO Displays machine specific properties and configuration.
TASKLIST Displays all currently running tasks including services.
TASKKILL Kill or stop a running process or application.
TIME Displays or sets the system time.
TITLE Sets the window title for a CMD.EXE session.
TREE Graphically displays the directory structure of a drive or
path.
TYPE Displays the contents of a text file.
VER Displays the Windows version.
VERIFY Tells Windows whether to verify that your files are written
correctly to a disk.
VOL Displays a disk volume label and serial number.
XCOPY Copies files and directory trees.
WMIC Displays WMI information inside interactive command shell.
For more information on tools see the command-line reference in the online help.
Usage (stderr):
xargs: unknown option -- h
Usage: /usr/bin/xargs [OPTION]... COMMAND [INITIAL-ARGS]...
Run COMMAND with arguments INITIAL-ARGS and more arguments read from input.
Mandatory and optional arguments to long options are also
mandatory or optional for the corresponding short option.
-0, --null items are separated by a null, not whitespace;
disables quote and backslash processing and
logical EOF processing
-a, --arg-file=FILE read arguments from FILE, not standard input
-d, --delimiter=CHARACTER items in input stream are separated by CHARACTER,
not by whitespace; disables quote and backslash
processing and logical EOF processing
-E END set logical EOF string; if END occurs as a line
of input, the rest of the input is ignored
(ignored if -0 or -d was specified)
-e, --eof[=END] equivalent to -E END if END is specified;
otherwise, there is no end-of-file string
-I R same as --replace=R
-i, --replace[=R] replace R in INITIAL-ARGS with names read
from standard input; if R is unspecified,
assume {}
-L, --max-lines=MAX-LINES use at most MAX-LINES non-blank input lines per
command line
-l[MAX-LINES] similar to -L but defaults to at most one non-
blank input line if MAX-LINES is not specified
-n, --max-args=MAX-ARGS use at most MAX-ARGS arguments per command line
-P, --max-procs=MAX-PROCS run at most MAX-PROCS processes at a time
-p, --interactive prompt before running commands
--process-slot-var=VAR set environment variable VAR in child processes
-r, --no-run-if-empty if there are no arguments, then do not run COMMAND;
if this option is not given, COMMAND will be
run at least once
-s, --max-chars=MAX-CHARS limit length of command line to MAX-CHARS
--show-limits show limits on command-line length
-t, --verbose print commands before executing them
-x, --exit exit if the size (see -s) is exceeded
--help display this help and exit
--version output version information and exit
Report bugs to <bug-findutils@gnu.org>.
Signature
- Status: Signature verified.
- Serial:
045D8F14A82147641722D4FAFC66BC80 - Thumbprint:
FB713A60A7FA79DFC03CB301CA05D4E8C1BDD431 - Issuer: CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US
- Subject: CN=”GitHub, Inc.”, O=”GitHub, Inc.”, L=San Francisco, S=California, C=US
File Metadata
- Original Filename:
- Product Name:
- Company Name:
- File Version:
- Product Version:
- Language:
- Legal Copyright:
Possible Misuse
The following table contains possible examples of xargs.exe being misused. While xargs.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.
| Source | Source File | Example | License |
|---|---|---|---|
| sigma | sigma-test.yml | run: 'grep -ERl "^status: deprecated" rules \| xargs -r rm -v' |
DRL 1.0 |
| malware-ioc | mumblehard | ps -ef \| grep -e ' httpd$' -e ' mail$' -e ' init$' \| awk '{print $2}' \| xargs -I '{}' ls -l '/proc/{}/exe' \| grep perl \| cut -d/ -f 3 |
© ESET 2014-2018 |
| malware-ioc | windigo | pgrep -x "crond" \| xargs -I '{}' ls -la "/proc/{}/exe" |
© ESET 2014-2018 |
| signature-base | apt_eqgrp_apr17.yar | $x1 = “exec("xterm $xargs -e /current/tmp/promptkill.kid.$tag $pid");” fullword ascii | CC BY-NC 4.0 |
| signature-base | apt_eqgrp_apr17.yar | $x2 = “$xargs="-title \"Kill process $pid?\" -name \"Kill process $pid?\" -bg white -fg red -geometry 202x19+0+0" ;” fullword ascii | CC BY-NC 4.0 |
MIT License. Copyright (c) 2020-2021 Strontic.