CmdID

CmdID / Files

cleanmgr.exe

Disk Space Cleanup Manager for Windows file version info

Program on Windows 12 known copies with hashes 3 Sigma rules name it Command cleanmgr

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real cleanmgr.exe?

file version info and known copies
Original nameCLEANMGR.DLL in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDisk Space Cleanup Manager for Windows

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\cleanmgr.exe · signed by Microsoft Windows

7680a91e801c261b4ecb13775198b44efc89acbbd88e8a297e4d03ec9e2481ac

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\cleanmgr.exe · signed by Microsoft Windows

a67253db88a05850034e557ade406f70d66b8a527b524ad1122737c2fb16d845

10.0.19041.1266 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cleanmgr.exe · signed by Microsoft Windows

a06c4c073bf300f1f18014d4f2d082698d1005912b632742375c0e50a03ea488

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cleanmgr.exe · signed by Microsoft Windows

21737f8a48f1a7fb7873dfed26836382613ddc9e1db860d71250b5067c011d82

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\cleanmgr.exe · signed by Microsoft Windows

a43c79ecae0d4726157fbb2e9e2e314d3622201678b56db514aae50ea84a09f9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\cleanmgr.exe · signed by Microsoft Windows

acd2cbfb4c9fb8fe20c21a7ec99445d1426cee90ff3091115eb4c9484b69ea9d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\cleanmgr.exe · signed by Microsoft Windows

6c022d6c10c4d662424db025a8f9fc3dad85c64b6a1194c37d98e406a9f115da

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\cleanmgr.exe · signed by Microsoft Windows

b8555df84be369161fd26a72c416e981de1259c319c9bd08e576f24dd43c8684

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\cleanmgr.exe · signed by Microsoft Windows

1bdab94440132410d1ab623ded8f2427b34c233a063a150617af271b9394025b

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cleanmgr.exe · signed by Microsoft Windows

5502bc3dd8f997bee50dbc9a3445c3b0e6407e916503589e3fda06a8759c0de3

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\cleanmgr.exe · signed by Microsoft Windows

5217983d54417be82bf8780c3a1fbc49181570fb179e707ca64827cc57a59586

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\cleanmgr.exe · signed by Microsoft Windows

a12a5393fafd1b373bbb9aba6384dd84d8a8de8f306a331380355b945d6918f8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name cleanmgr.exe
highUAC Bypass Using Disk CleanupChristian Burkard (Nextron Systems)
mediumUse Short Name Path in Command Linefrack113, Nasreddine Bencherchali
mediumUse Short Name Path in Imagefrack113, Nasreddine Bencherchali