CmdID

CmdID / Files

csvde.exe

NT5DS file version info

Program on Windows 2 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real csvde.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionNT5DS

2 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\csvde.exe · signed by Microsoft Windows

6cd703b0fa9f4f771f74006af109db80fb634209b57c3d5cc10a97363979f29d

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\csvde.exe · signed by Microsoft Windows

f916b38169cd76fc866f4594bf9ba48513f520c43baeeca7bd0e03cf98c94c42

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name csvde.exe
mediumActive Directory Structure Export Via Csvde.EXENasreddine Bencherchali (Nextron Systems)