CmdID

CmdID / Files

iexpress.exe

Wizard file version info

Program on Windows 12 known copies with hashes 2 Sigma rules name it Command iexpress

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real iexpress.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductInternet Explorer, Microsoft Corporation
DescriptionWizard

12 known copies

11.00.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\iexpress.exe · signed by Microsoft Windows

8537584e3272016a99cc4d3baf354f3df19c5974740ff57d45d6ed362ab8682d

11.00.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\iexpress.exe · signed by Microsoft Windows

caf27a833974d8b907bd21a783369861f089c329f10f668724d1ae9ab47d93f6

11.00.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\iexpress.exe · signed by Microsoft Windows

d070b79fa254c528babb73d607a7a8fd53db89795d751f42fc0a283b61a76fd3

11.00.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\iexpress.exe · signed by Microsoft Windows

dd2c185deae89d41f42fb9903aa274ae70b103ea2285184c4565f39b69df945f

11.00.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\iexpress.exe · signed by Microsoft Windows

e9fac70a8201ad2cda3b66dd2931bbc9275109c6e6e955f352fbec08e33d9d24

11.00.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\iexpress.exe · signed by Microsoft Windows

f466eaa54de5163fbc78716115e016b5b5fb2d61591cd47ce7570242acb4d002

11.00.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\iexpress.exe · signed by Microsoft Windows

333cc4a72f1fc71300678fd35906aea6ae908c384a97e01f24055b2bf5115cb5

11.00.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\iexpress.exe · signed by Microsoft Windows

7e125b3af9e9bc1faf52c24e5e0a4e287d362ec07af491fa8d7f27609befbe43

11.00.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\iexpress.exe · signed by Microsoft Windows

bde274c0e0ad135062e7746842d79ec34c9715608266d6faa1400158ec0989ff

11.00.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\iexpress.exe · signed by Microsoft Windows

ddcbfc5cc1aedb026c53fdc334d5d03250be9748861da72f6e22cb723f756d86

11.00.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\iexpress.exe · not signed

1ca4a4be522779f72d15ac02340217aad0dade973d11f21386d1843daf546982

11.00.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\iexpress.exe · not signed

9aaddc499cedaa3c759632e8dfa15e4ba3dd7425696f5f8adf22a89f224c92ba

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name iexpress.exe
highSelf Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious LocationJoseliyo Sanchez, @Joseliyo_Jstnk, Nasreddine Bencherchali (Nextron Systems)
mediumNew Self Extracting Package Created Via IExpress.EXEJoseliyo Sanchez, @Joseliyo_Jstnk