CmdID

CmdID / Files

Installer.exe

Opera Installer file version info

Program on Windows 9 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real Installer.exe?

file version info and known copies
Original nameZoom Installer in the file’s header: a renamed copy still carries it
Installed inC:\Program Files (x86)\Zoom\bin\
C:\Program Files\Amazon\XenTools\
C:\Program Files\Opera\70.0.3728.106\
Signed byOpera Software AS
ProductOpera Installer, Opera Software
DescriptionOpera Installer

9 known copies

81.0.4196.31 · C:\Program Files\Opera\81.0.4196.31\installer.exe · signed by Opera Software AS

890bcf519ce4b652e9f730fce5f3b538ebd2532e50dbe7fb02fafe6fa570b95a

71.0.3770.171 · C:\Program Files\Opera\71.0.3770.171\installer.exe · signed by Opera Software AS

1b7d637c08ee73b7d37d2ba59ff53524a304c077ebdf54af7d8b1acffc38a3f4

70.0.3728.133 · C:\program files\Opera\70.0.3728.133\installer.exe · signed by Opera Software AS

115aa498ad8d43deb73ed994c7c165d4ad9b8acc7332bfe02411a166c97da1db

70.0.3728.106 · C:\Program Files\Opera\70.0.3728.106\installer.exe · signed by Opera Software AS

fb69a47ea13b645bb4b124e3c2613667a9d7a98e79be5d57e8e07bf62ca72840

8.3.4 · C:\Program Files\Amazon\XenTools\Installer.exe · signed by Amazon.com Services LLC

491daec01109e949162a2b97c550060f2c03c86c3f8b9acdb8018ffc0b005a3e

5,8,3,1581 · C:\Program Files (x86)\Zoom\bin\Installer.exe · signed by Zoom Video Communications

7311d17df078a4c4f1a7ac47baf1f8b3da2c254e0f1983f1851d6d285fffd770

5,3,52670,0921 · C:\Program Files (x86)\Zoom\bin\Installer.exe · signed by Zoom Video Communications

079d617a8f224f0c925db9fa599a0ed2d13f413ceddba8cf1eafc0dce580ea4b

5,2,44052,0816 · C:\program files (x86)\Zoom\bin\Installer.exe · signed by Zoom Video Communications

50a889cb5b068e9df9646665b63cdef97e8f1133df7bc2870e22eb1fa20ba6d0

5,2,42619,0804 · C:\Program Files (x86)\Zoom\bin\Installer.exe · signed by Zoom Video Communications

8c87cfad1e166eef3801b4b0567f569912efdf8ce20bccfafb61886161a89790

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names Installer.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.