CmdID

CmdID / Files

fsquirt.exe

Program on Windows 10 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real fsquirt.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation

10 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\fsquirt.exe · signed by Microsoft Windows

41d6558a505079c1a3a9ee868358894079d20856dcfad21a0e0d9ed2c6cf9c0f

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\fsquirt.exe · signed by Microsoft Windows

9ed4e18f5114c03229035d6f4d03250425476aa8e7dd2271d689add5cd7af9b9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fsquirt.exe · signed by Microsoft Windows

323d09a48b982f2e880f4bc529f6756bbe53cb59ced8deabbf3705cd5de935e2

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\fsquirt.exe · signed by Microsoft Windows

b088a402467d54206254050a5d754f8b6313a670b350de8f28cab416095c894f

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\fsquirt.exe · signed by Microsoft Windows

44bab285f7ccdbebacd13ba2b6c007e11186ba6579519dd4eb6811d7a6bcf198

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\fsquirt.exe · signed by Microsoft Windows

4b1063bb7acec424addae50ab159249122d00435dec779ae4cef5c7c583c8790

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\fsquirt.exe · signed by Microsoft Windows

6224e08c0d005dcafa87763eda77cd85e851703e49527fb26713b4eb895502b5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fsquirt.exe · signed by Microsoft Windows

e1491b1f6921849fcde3bc4b5cbb5d07890a997ed18f0051abba3407b8c0f39b

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\fsquirt.exe · signed by Microsoft Windows

cf339aefd05ff0db32a6bb76a5e7fe7d6b58d1cabe10b67c2cfb7c2f76552abf

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\fsquirt.exe · signed by Microsoft Windows

e967007da2930d50deeaf7ca9595485701b11ee9aad31cc9c4a3116791055bd6

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name fsquirt.exe
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Sigma names fsquirt.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.