CmdID

CmdID / Files

HOSTNAME.EXE

Hostname APP file version info

Program on Windows 12 known copies with hashes 2 Sigma rules name it Command hostname

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real HOSTNAME.EXE?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionHostname APP

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\HOSTNAME.EXE · signed by Microsoft Windows

4411072b3153b90d45e368710e672992c7909f4d20ab1baa6f0dd02c3821d2a1

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\HOSTNAME.EXE · signed by Microsoft Windows

d0f690b8912737c6760095949c0fd30500dd96c35bc28f278bf28d1b5ed4d4c2

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\HOSTNAME.EXE · signed by Microsoft Windows

379cba8d0a1288e316126ac75a354c03be76a61ead6bd5ec6c72ed7da3dc49d9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\HOSTNAME.EXE · signed by Microsoft Windows

a90c3fb350a11c6f6a6efa9607987d924d1de65e09ca9faf2e0e0e00531ee335

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\HOSTNAME.EXE · signed by Microsoft Windows

76bfa38d580c3b2982c4f78df7c7ccbcc6a9383753e34f9968727bac7b53b6b2

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\HOSTNAME.EXE · signed by Microsoft Windows

f88f37bfeffc80d563b87ad6de0f65d52d5760882013aba5ecbe9fad08d36777

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\HOSTNAME.EXE · signed by Microsoft Windows

1bff2907c456f99277f45f9b2a21b1b3f11f6c01587d9e6d6f0b2b5f1472fe92

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\HOSTNAME.EXE · signed by Microsoft Windows

5fb2d17787ffec622ab296775632f9b7a4be42cc06d3da92b4cd6bc288ad035c

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\HOSTNAME.EXE · signed by Microsoft Windows

5af3f93786332b1038792e7fd34c0ff75d3f9420df4b723207c59146233d67bf

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\HOSTNAME.EXE · signed by Microsoft Windows

b8da5a3ae4371e63dfd2f468e29cc23aa6f98a6a357a67955996f8f61e58fba1

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\HOSTNAME.EXE · not signed

8db9dc2896f6220cbfe25c60a2581e88f3ba6637ea905c55127da70307bc827c

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\HOSTNAME.EXE · not signed

ca40bb9470e8e73767f3aa43ddf51f814481167dec6c2faa1996c18ab2c621db

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name HOSTNAME.EXE
highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
lowSuspicious Execution of Hostnamefrack113