CmdID

CmdID / Files

Everything.exe

Everything file version info

Program on Windows 2 known copies with hashes 4 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real Everything.exe?

file version info and known copies
Installed inC:\Program Files\Everything\
Signed byvoidtools
ProductEverything, voidtools
DescriptionEverything

2 known copies

1.4.1.992 · C:\Program Files\Everything\Everything.exe · signed by voidtools

71be6da3f9e4d7b9f965bbe5c77ab77c22c09557683d271e452eb2b9f4ed588a

1.4.1.988 · C:\program files\Everything\Everything.exe · signed by voidtools

a8e8a69c6adbdee716b58d3768e65ae14ea52af6b2667cbf998b379756b5597e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name Everything.exe
mediumUse Short Name Path in Command Linefrack113, Nasreddine Bencherchali

Sigma names Everything.exe in 4 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.