CmdID

CmdID / Files

doskey.exe

Keyboard History Utility file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it Command doskey

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real doskey.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionKeyboard History Utility

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\doskey.exe · signed by Microsoft Windows

7bcf23b25c73d8a66b7a6e30dc8d6268f073286cb4672edcfdaa33d7575abfb2

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\doskey.exe · signed by Microsoft Windows

ecbc5ae82c6e2e21f6ecf11fc8e55a0319999ac7d3f543d4d7a1486c746c7153

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\doskey.exe · signed by Microsoft Windows

543819e74fd619ea3d45d1ad1640907b16b576813f0f8df9ea0c63b48dc4e323

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\doskey.exe · signed by Microsoft Windows

9d9568d16da949eedfe608e40f92433a3340a6676fc0d9ebd027d13ef18ac3cf

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\doskey.exe · signed by Microsoft Windows

38ae625f758f29c77b225a152d970f6472896cd9763a958ad5101c9c08682803

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\doskey.exe · signed by Microsoft Windows

4ec657b1f81e765637d6337e8f18159418921068ddffafd4d103e2f4c36c557d

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\doskey.exe · signed by Microsoft Windows

59f8910653ef69dccd0e1c4ef13fd13e5162afd8eae96d8dd75f73a7f0a4d442

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\doskey.exe · signed by Microsoft Windows

65182ea1e90cba3c6369f6111afe050699966309010f72eba7707222d949d836

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\doskey.exe · signed by Microsoft Windows

618d1a19d8ded46aad536216afdd5e5fc9787807435bb63fa130ab712b268d0c

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\doskey.exe · signed by Microsoft Windows

dbf2e1e11fd57dd0fbb2accb08778e6d838f272b3d5e814260044f0b0866b5a1

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\doskey.exe · not signed

386ca84bad61431c446b34e22b331eeb202b9acbd0465ce804a0de71a0b03112

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\doskey.exe · not signed

94457f9006427e5279f61d4cc5575fbc7c5af56457f36d9909a08b5646885a24

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name doskey.exe
mediumRecon Information for Export with Command Promptfrack113