CmdID

CmdID / Files

dfrgui.exe

Microsoft Drive Optimizer file version info

Program on Windows 14 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dfrgui.exe?

file version info and known copies
Original namelhdfrgui.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Drive Optimizer

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dfrgui.exe · signed by Microsoft Windows

8bdfb7688d3bf5b4e97d9b9c586c95ff994a0d67d80d450d0eee4a919ec28d80

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\dfrgui.exe · signed by Microsoft Windows

8c35ed513bb70d66c2a83e0e13686c5a3c7d50b2ec5085ebdad5571897876528

10.0.19041.84 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dfrgui.exe · signed by Microsoft Windows

a52de4cdca80e744c587166f8df1ab25790dba3d9c8b6478187f397791d3d183

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dfrgui.exe · signed by Microsoft Windows

dcc533e4c91ccfeae676b1eb4cb50902433d440028581f05c3b77831bc646c7c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dfrgui.exe · signed by Microsoft Windows

348ff9e7a8d17e76ab4e8e3f3f6e3573232b71cd0bb8a94ca78896ada9211317

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dfrgui.exe · signed by Microsoft Windows

f45129d7f036de281fdcd47a10e590dcf208021901eee0e60b7207408854dcd6

10.0.18362.657 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\dfrgui.exe · signed by Microsoft Windows

6032ecf28f57cc0365bba6e307ca15404e1ce71c36a09f6e9d66cb6001685397

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dfrgui.exe · signed by Microsoft Windows

5aec0ee34014512663f45bdc0431efb20cc24778c03592201b405c5965d288b3

10.0.17763.1039 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dfrgui.exe · signed by Microsoft Windows

8b74f00eb983dc749438861ac524955d7241633b6973778bbee73d9904304705

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dfrgui.exe · signed by Microsoft Windows

9487bab1ad799898c56f328fd74d92a99e8fe9983b33d5e60a70c58069310d60

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\dfrgui.exe · signed by Microsoft Windows

c6e3421307a7107bea7a08331e8b58f2f43ca745107d0f462ce55a800eb43cbf

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\dfrgui.exe · signed by Microsoft Windows

d5e151e700b5ac51ac3b0bec9ba1b8e57dc332e151a6881bf190a41f4149d879

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\dfrgui.exe · not signed

353a798807d0825b216a821c6344220d25518c2b4e6fb32da97fca3b1ae31a08

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\dfrgui.exe · not signed

61dc9578476295f03996c5a1f352bd0600fbdc172a750f1f424ab3f5a547a100

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name dfrgui.exe
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Sigma names dfrgui.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.