CmdID

CmdID / Files

DeviceCensus.exe

Device Census file version info

Program on Windows 8 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real DeviceCensus.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDevice Census

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\DeviceCensus.exe · signed by Microsoft Windows

3747338d09d623c859b48af7784cdb95783910675857cb49e061ed805a25905d

10.0.19645.1046 (WinBuild.160101.0800) · C:\Windows\system32\DeviceCensus.exe · signed by Microsoft Windows

76490be66e4d2ebf054c9d536b02c82a5c6bb97209f8e4cffc69974a04fa7bd7

10.0.19645.1016 (WinBuild.160101.0800) · C:\Windows\system32\DeviceCensus.exe · signed by Microsoft Windows

1041623963e1a109b80312cbfe4dc4544cbac478c2eb2597ca040e1c78585a3e

10.0.19645.1016 (WinBuild.160101.0800) · C:\Windows\system32\DeviceCensus.exe · signed by Microsoft Windows

afd0d80a782e9392664ca32811055b958bd4d373f4f2ba52bfa8f7fe9c893190

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\DeviceCensus.exe · signed by Microsoft Windows

d26defa5d3e01eac5e4ccadd9ba79f21c6b044eb2381642043a1be34b14c0599

10.0.18362.1035 (WinBuild.160101.0800) · C:\WINDOWS\system32\DeviceCensus.exe · signed by Microsoft Windows

42d05239f096fb64197cd00bacce0c0b390d9889bd108638ba792de35bc2562e

10.0.18362.1035 (WinBuild.160101.0800) · C:\Windows\system32\DeviceCensus.exe · signed by Microsoft Windows

8210c4f78f6beffb8be252988f80a34bc7f49d583c710e34611f0427faf02c95

10.0.18362.1035 (WinBuild.160101.0800) · C:\Windows\system32\DeviceCensus.exe · signed by Microsoft Windows

dbea7473d5e7b3b4948081dacc6e35327d5a588f4fd0a2d68184bffd10439296

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names DeviceCensus.exe in 2 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.