CmdID

CmdID / Files

eventcreate.exe

Event Create - Creates a custom event in an event log file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it Command eventcreate

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real eventcreate.exe?

file version info and known copies
Original nameevcreate.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionEvent Create - Creates a custom event in an event log

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\eventcreate.exe · signed by Microsoft Windows

4b9e6664d87ece17de79af7655a819f2ddb31987d22375cb13c7853c007af18a

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\eventcreate.exe · signed by Microsoft Windows

b91c6b90c4f28cbb848a5d0c9d65ad0d5274956ab8a15d259edc71cf259672ad

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\eventcreate.exe · signed by Microsoft Windows

7cc501292377dc849a34214f017f62a7331f44f96bc6fe3e566253a9918bf811

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\eventcreate.exe · signed by Microsoft Windows

ab6d407d07d35aff98e3f59f8715b1c2a820b2d76e24e4d8cedc13f00d1aba31

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\eventcreate.exe · signed by Microsoft Windows

afcb15b1f200134db8e7537e3d535a292c9c87418f13d84d02b9b98f40ac3bce

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\eventcreate.exe · signed by Microsoft Windows

cc68c3d269c62282a4fdaf1ea4faa18aebc4a03d7e27c7c898eb726b9b5f9cb4

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\eventcreate.exe · signed by Microsoft Windows

cf7f814331696e120864d5d8227ee5abc3ba8b2e46d7e7df20dc317dfa1d1434

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\eventcreate.exe · signed by Microsoft Windows

f8a2de8135a402bedbdc3dbeb87677b70793e4afeef8a66b9792ea0c0315302e

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\eventcreate.exe · signed by Microsoft Windows

066f8e55d0c082287cc7460499301b8a88d6210fbff965646aa1ceb44de4199a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\eventcreate.exe · signed by Microsoft Windows

ad90d99135b3e443f3deea5b40199ce5b83ccb0964fd9ac3f11b9224766ed7ba

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\eventcreate.exe · not signed

8c7ad7303b8e4addafc174b46ee951fc063db116deb7abfb6aeebf733b84d87c

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\eventcreate.exe · not signed

95e14793fa57f97a8fc73f5860a070cdae667546a7a04c82b2b3dbae94d2da0c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names eventcreate.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.