CmdID

CmdID / Files

dialer.exe

Microsoft Windows Phone Dialer file version info

Program on Windows 12 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dialer.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Windows Phone Dialer

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\dialer.exe · signed by Microsoft Windows

8c9289e2183ca2dd594363bfcd79bca3a44e878ae7a158fedb82d3b2df3ea147

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dialer.exe · signed by Microsoft Windows

b9642b8e05cf4138b372d497250b67d4bb022d1a4b35547885b7ff98a855c3d1

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dialer.exe · signed by Microsoft Windows

179584e64148751549e5f25a127293fd6e0ac7c2ceaed78e53669397a005bae7

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dialer.exe · signed by Microsoft Windows

e3ac5e6196f3a98c1946d85c653866c318bb2a86dd865deffa7b52f665d699bb

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\dialer.exe · signed by Microsoft Windows

47d7d5a19663db1e10a9f7d6ba0e1a57bbb5f4cd4aa6e771c164dba53baf9506

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dialer.exe · signed by Microsoft Windows

e4acbdd469a17690208043beae674459993b2a61d5db87043a28d4bd1ec517bb

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dialer.exe · signed by Microsoft Windows

366857de6e835ca6a12e33503f6726a2e8528e7f1f9ac74435e2a6bd3c3ed481

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dialer.exe · signed by Microsoft Windows

d628e54194e14f8077b283adc60ef069b4d43543fa7d7be55e1a60e65ac52c01

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\dialer.exe · signed by Microsoft Windows

4f4bf6fc3338e2bb14cc6814db8ccd9ccef1f39938ec051a77dd31f69badc600

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\dialer.exe · signed by Microsoft Windows

70d8ef4026d54e14835a8e760b98d3c34a9df7de6ddf089469a57543d5302d30

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\dialer.exe · not signed

3694913609062fd45cce3733eecac8e6cf6b9100164d94218d378916cf86c6ec

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\dialer.exe · not signed

ad708ecff2ff1740daf220ea253a661e1339f469930699c527b148dfb2e8ed83

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names dialer.exe in 2 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.