cabview.dll
Cabinet File Viewer Shell Extension file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real cabview.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionCabinet File Viewer Shell Extension
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\cabview.dll · signed by Microsoft Windows
69cfbae11d01e43f41db1d8a755cafbb84ae027011056f1bf9f729229b31e1c810.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cabview.dll · signed by Microsoft Windows
80cf8021ef5c1df30192c08d8fe1315c87469bf0d09f70584cbd47d5196f04beFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names cabview.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.