CmdID

CmdID / Files

changepk.exe

Windows Activation file version info

Program on Windows 6 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real changepk.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Activation

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\changepk.exe · signed by Microsoft Windows

6a90159a258d58e6246bca231a69f3a4a3a0c303aced9d736df7f6b9aa3e9c56

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\changepk.exe · signed by Microsoft Windows

69644ab12ecc3a89bc2db5dc8198a506647d14f5b44745bced02eafac362e8cf

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\changepk.exe · signed by Microsoft Windows

d2bfc0dce8c97309fe5d8b95e25a419a001422424e48cd8578c6abcbcf99608c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\changepk.exe · signed by Microsoft Windows

0d07ec1eb0ff9dcabe175c93e5f354484ff2ba1ff5acce13ed3872a31e7fe22a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\changepk.exe · signed by Microsoft Windows

64708a3e27ee5acbeb14140a956aaf8f6472cf60d592c05bc564851be5cd42d5

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\changepk.exe · signed by Microsoft Windows

70ff5a0b20fca4226451174c3c079bef1cf9f35bdd776e20e846c08519d5671e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name changepk.exe
highUAC Bypass Using ChangePK and SLUIChristian Burkard (Nextron Systems)