CmdID

CmdID / Files

BrowserCore.exe

BrowserCore file version info

Program on Windows 3 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real BrowserCore.exe?

file version info and known copies
Installed inC:\Program Files\Windows Security\BrowserCore\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionBrowserCore

3 known copies

10.0.19041.1151 (WinBuild.160101.0800) · C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe · signed by Microsoft Windows

a76d230e57f7c5c40af3d527954e3155869d1a4dd628b6c0d6192c6c6ef109e2

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe · signed by Microsoft Windows

17ed5618b83bb82a4cbe8927ab365706826153e903bbe726e989f0710c1cc41c

10.0.17763.1 (WinBuild.160101.0800) · C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe · signed by Microsoft Windows

210513bc15a0dc19a74614c294b7b056d1baf82c5a25b60d374aee9cf59cab07

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name BrowserCore.exe
highRenamed BrowserCore.EXE ExecutionMax Altgelt (Nextron Systems)