CmdID

CmdID / Files

Integrator.exe

Glary Utilities 5 file version info

Program on Windows 5 known copies with hashes 8 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real Integrator.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Glary Utilities 5\
C:\Program Files (x86)\Microsoft Office\root\Integration\
C:\ProgramData\Microsoft\ClickToRun\{00000000-0000-0000-0000-000000000000}\
Signed byGlarysoft LTD
ProductGlary Utilities, Glarysoft Ltd
DescriptionGlary Utilities 5

5 known copies

5, 151, 0, 177 · C:\Program Files (x86)\Glary Utilities 5\Integrator.exe · signed by Glarysoft LTD

68ab46406b1ce1147344eeef64eba5ee767dd6f5271d3306ba5897b052ba4a2c

5, 149, 0, 175 · C:\program files (x86)\Glary Utilities 5\Integrator.exe · signed by Glarysoft LTD

eb991bf365ebe06da3017f9bb7c1c2dbfd958c5a2d7f21f94ab8a2450cf7e259

5, 148, 0, 174 · C:\Program Files (x86)\Glary Utilities 5\Integrator.exe · signed by Glarysoft LTD

3a3985f822a2744de8bef4d18b49b5add15f55d34bdf6c235abe807917234419

16.0.12730.20144 · C:\ProgramData\Microsoft\ClickToRun\{00000000-0000-0000-0000-000000000000}\integrator.exe · signed by Microsoft Corporation

93c30776cc96bf9155ead76401be400fdfd6e66b8e22abeacecfe4753d5f70ee

16.0.12527.20470 · C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe · signed by Microsoft Corporation

9949299e32613fc679b3b6b6b07de7530576a744fecda757db5f05ca70f4395d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name Integrator.exe
lowScheduled Task Creation Via Schtasks.EXEFlorian Roth (Nextron Systems)

Sigma names Integrator.exe in 8 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.