CmdID

CmdID / Files

efsui.exe

EFS UI Application file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real efsui.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionEFS UI Application

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\efsui.exe · signed by Microsoft Windows

0199e1e3770b8ac0d2b82deabba4da4e72d823841650d5f73297b2369bf49f12

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\efsui.exe · signed by Microsoft Windows

67152577ed8081f59b80d86a455ff5f08d9e82d531771a5fd74206961e3554a6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\efsui.exe · signed by Microsoft Windows

15d3d82211fe83fee501d2efacd0168301ce73dcb7cc08f1ca7bc2ee94a61fc7

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\efsui.exe · signed by Microsoft Windows

ec1dc1a2ee200da0c787328df4fb91a2b978fd09ca1f83f3e55994c0f9ba1d11

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\efsui.exe · signed by Microsoft Windows

4c311f6a62818a0378238dab39eed6fa529b389d6c488358439f1cff0a8fed96

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\efsui.exe · signed by Microsoft Windows

af4be58d137b6f7b316398cf7e79f9176ff3ab6112c7bf6f4247497360b9392f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\efsui.exe · signed by Microsoft Windows

7f9304a0b0492f3e18c46ea4d17ee1323b9ab27ee584ff4f25487f1d04820a6e

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\efsui.exe · signed by Microsoft Windows

fe57813687d951ffa8acc02bd4ca2ad8d7d4bc70584072db66c46a404186ddf3

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\efsui.exe · signed by Microsoft Windows

1106ce6ae6edffa752d71f5eff9faab53360cffc6b224957760fbdc0a7d4ff17

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\efsui.exe · signed by Microsoft Windows

2e49f609b04a7bc6a521e33622f94c3e09f6ea961983064044c8812dd431b042

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\efsui.exe · not signed

89fd614790612ad4945ff46aa8eb83e8bd4a8945482fc23efe68073f62322ff3

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\efsui.exe · not signed

d65ca02d87071677f8e847bbb98fbc5647a1597e86e6fe157f77640753681949

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names efsui.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.