CmdID

CmdID / Files

fodhelper.exe

Features On Demand Helper file version info

Program on Windows 5 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real fodhelper.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionFeatures On Demand Helper

5 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\fodhelper.exe · signed by Microsoft Windows

2b5089d56eb0ec9b2854102b5fe984f5be96756a170cc46774021e36b315edc3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\fodhelper.exe · signed by Microsoft Windows

c546e05d705ffdd5e1e18d40e2e7397f186a7c47fa5fc21f234222d057227cf5

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\fodhelper.exe · signed by Microsoft Windows

7e80da8d839dcf05e30317256460ed7a4ee25cab2750d768569aaab35e1e8c64

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\fodhelper.exe · signed by Microsoft Windows

b1223b86d03c3583b84e46a9a6ad009d770fc4114640402ede19793167593a8f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\fodhelper.exe · signed by Microsoft Windows

4346962b31d93dd4e8b5164e6167bb030fc0ca7c77ec0bb6ab798a1e8cd9488e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name fodhelper.exe
highRaspberry Robin Subsequent Execution of Commands@kostastsale

Sigma names fodhelper.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.