CmdID

CmdID / Files

CompatTelRunner.exe

Microsoft Compatibility Telemetry file version info

Program on Windows 9 known copies with hashes 6 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real CompatTelRunner.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Compatibility Telemetry

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\CompatTelRunner.exe · signed by Microsoft Windows

97502076754d0da3ffcae9064198244e1f9874494fbc65630a3c580bd469538d

10.0.19645.1046 (WinBuild.160101.0800) · C:\Windows\system32\CompatTelRunner.exe · signed by Microsoft Windows

c52b831c4471e30ef6bd816db7b62fefeb3fa4ef0ce2cf46d70e527f624abe2d

10.0.19645.1016 (WinBuild.160101.0800) · C:\Windows\system32\CompatTelRunner.exe · signed by Microsoft Windows

2967699a953d5690222655124fbb79accdbbe7714f7698fcadc1815b1684e81b

10.0.19645.1016 (WinBuild.160101.0800) · C:\Windows\system32\CompatTelRunner.exe · signed by Microsoft Windows

c0a5986a4dd6d7cacf09c5a980df634c44ff73028206d99cb561e64a74a0958a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\CompatTelRunner.exe · signed by Microsoft Windows

d4c583bc6efd5f24adf5c70421ba3fdcf6a53b010bc6a0d96147a6c7c3adbc0c

10.0.18362.1035 (WinBuild.160101.0800) · C:\windows\system32\CompatTelRunner.exe · signed by Microsoft Corporation

5f7b85d4e6ac19e16d3c32042ecde9ef32cdde0b4021fe4d609d096ef5dc972f

10.0.18362.1035 (WinBuild.160101.0800) · C:\WINDOWS\system32\CompatTelRunner.exe · signed by Microsoft Windows

924405fd4df46b0a1d955aa492f441b938f051cc830ab494e88398def701fc1f

10.0.18362.1035 (WinBuild.160101.0800) · C:\Windows\system32\CompatTelRunner.exe · signed by Microsoft Windows

b1f8a6ae285a2485ac2d876dfc135b985450a887dfdb42c2bddc414ccb487e46

10.0.18362.1035 (WinBuild.160101.0800) · C:\Windows\system32\CompatTelRunner.exe · signed by Microsoft Windows

f38ea7112fea4e469883ef0935c9b47e31386e6a992494eac12f1067bb45e86a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name CompatTelRunner.exe
highPotential WinAPI Calls Via CommandLineNasreddine Bencherchali (Nextron Systems)
lowNon Interactive PowerShell Process SpawnedRoberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements)
lowPotential Executable Run Itself As Sacrificial Processfrack113

Sigma names CompatTelRunner.exe in 6 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.