CmdID

CmdID / Files

gpresult.exe

Query Group Policy RSOP Data file version info

Program on Windows 14 known copies with hashes 1 Sigma rule names it Command gpresult

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real gpresult.exe?

file version info and known copies
Original namegprslt.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionQuery Group Policy RSOP Data

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\gpresult.exe · signed by Microsoft Windows

1a3b87c401395223df6645d1f2e1ea40c6caf2dbd474cc5f7eb7d38e8571b7fc

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\gpresult.exe · signed by Microsoft Windows

2971122ec4cb6f184d71a9e9b172b3e9c6f0294f250d847b8283a9e4a64b31fc

10.0.19041.906 (WinBuild.160101.0800) · C:\Windows\system32\gpresult.exe · signed by Microsoft Windows

678cf8bbd1b6aacadbaa8e14d7ebc42aa2a89a6b7736921287226c21158e5318

10.0.19041.906 (WinBuild.160101.0800) · C:\Windows\SysWOW64\gpresult.exe · signed by Microsoft Windows

d4c00fbee122390a208c732f0b0eeb93a02f1c4f44d8300638dd329c79a78758

10.0.19041.117 (WinBuild.160101.0800) · C:\Windows\system32\gpresult.exe · signed by Microsoft Windows

cbe6468f73f39f84915eb810d23dcc6539f348fe82456567297f9f1cf7de5423

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\gpresult.exe · signed by Microsoft Windows

2bac97558fa6700178ebf89ad80db4492e21a6c92692f89956fdab2aa5899d57

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\gpresult.exe · signed by Microsoft Windows

880228d722d778b11cf5017bd7341034ad9c6b76c6eb0c295fdf3b1fd6f13e8a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\gpresult.exe · signed by Microsoft Windows

88795dd89e4f3d7bdf4011846cfc863031d9217d7ab996a8ed8c488a1c73009f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\gpresult.exe · signed by Microsoft Windows

3286f3271943104e023e36323f0abbb114c2c59e3a95d64951b1aafe964272a0

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\gpresult.exe · signed by Microsoft Windows

e71a9e7d0b66976b97a7e6411d5f15581698b48aac2d225b98f0c70b2859b451

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\gpresult.exe · signed by Microsoft Windows

02629ec2c3224b6ebe90e0ad49a192b5fd7c9cef256ecd3f6048eee504a4a274

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\gpresult.exe · signed by Microsoft Windows

0b50d2ee2453dc08c8734f4b9de2f4fffa8db8bc9c4bee6741c6f1217a3c3fc6

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\gpresult.exe · not signed

07c4e2f63f946ab1027a468f6977f15e5a64a99b75733d1ecb628ca38bbc9fc1

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\gpresult.exe · not signed

da9933ad0a30d1a978f7f7b3eaac46047829fe3200ef29ff363cb1131428a441

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name gpresult.exe
mediumGpresult Display Group Policy Informationfrack113