CmdID

CmdID / Files

AppVClient.exe

Microsoft Application Virtualization Client Service file version info

Program on Windows 6 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real AppVClient.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Application Virtualization Client Service

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\AppVClient.exe · signed by Microsoft Windows

fb8d9f041442a59d73b8a694a8fea97cdb2ff773f629971dde0137df76cd1bf4

10.0.19041.84 (WinBuild.160101.0800) · C:\Windows\system32\AppVClient.exe · signed by Microsoft Windows

03bc40c526ba6c67474df13a61d724f7e01c39342d66c5f4be7fc3f8a0f5a662

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\system32\AppVClient.exe · signed by Microsoft Windows

6e17899e7d3c7bf80cdc31dbdda8e9b880b54ecbf5842c907e764a267adffcc0

10.0.18362.628 (WinBuild.160101.0800) · C:\WINDOWS\system32\AppVClient.exe · signed by Microsoft Windows

ac0249b6b6a7e05cafcfc490b84ae9a7de5515b3a58ee6ac1cfefabe790fb6a1

10.0.17763.1007 (WinBuild.160101.0800) · C:\Windows\system32\AppVClient.exe · signed by Microsoft Windows

b9d349c732032c405415b2f85a9365526d3eae3007e404042957b73d647f534a

10.0.14393.3471 (rs1_release_1.191218-1729) · C:\Windows\system32\AppVClient.exe · signed by Microsoft Windows

51e3b575fb7a4d6469d4217399118414c8f377a03fc7fef715af90612144dbd8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name AppVClient.exe
highMavinject Inject DLL Into Running Processfrack113, Florian Roth