CmdID

CmdID / Files

grpconv.exe

Windows Progman Group Converter file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real grpconv.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Progman Group Converter

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\grpconv.exe · signed by Microsoft Windows

120a97f285de6c386301f7208f8194f813d3a14abf09475173fbf929fc6ae220

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\grpconv.exe · signed by Microsoft Windows

d53a071c85a1a645c9ee40c599a1bdf65fbd92f366cbb07adb1813f0f8a46d06

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\grpconv.exe · signed by Microsoft Windows

3b496786568a0a35780b0af76ac486c24fefa867c663dd931a86db6a263e992c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\grpconv.exe · signed by Microsoft Windows

a248e327b89f8574cb7df9f34cd7120c0508ca1541c5520bd72f0830f85a0cec

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\grpconv.exe · signed by Microsoft Windows

924b500bb243679f16dec51a705a01cff53f02f1584a7b5b5d8e2de839203861

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\grpconv.exe · signed by Microsoft Windows

bffcd5f21fcad5d54a29cf657cd8eb620250e9134a1b870deb3d77ed5ee83048

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\grpconv.exe · signed by Microsoft Windows

542c4b92d2fa26e0c26771a3624440df3ef09ccd2eaf1a2873486ce461f9dc30

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\grpconv.exe · signed by Microsoft Windows

8b188b7050533ba36335aa17dfbfc579935eaf0a9bd5009a524754513216a978

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\grpconv.exe · signed by Microsoft Windows

128f8b664c418b03615a74dfd2bc9a5663eefa345fe7c0cb445cb4b261f69914

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\grpconv.exe · signed by Microsoft Windows

dc0f3e3a852bc334b148d5f2f0d9d20e4c99839f81831d42305b455a97d53163

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\grpconv.exe · not signed

8bcd93852eb3d0609ff10721e4862f17f25d4add54f3f9da891d14022ab81f8b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\grpconv.exe · not signed

df338dacbaa9d5c3cbee0263de5ab11115945a872c5e1cbb57588576e191ddcb

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name grpconv.exe
highSuspicious GrpConv ExecutionFlorian Roth (Nextron Systems)