CmdID

CmdID / Files

kd.exe

Windows Kernel Debugger file version info

Program on Windows 4 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real kd.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\
Signed byMicrosoft Windows Kits Publisher
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Kernel Debugger

4 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\kd.exe · signed by Microsoft Corporation

09314c1c537d8a31458aa08cc308449eb10c0fec5af3f9022419c4816f822ef2

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\kd.exe · signed by Microsoft Windows Kits Publisher

23150ceb2ff1ca823095f297aca32bc1b1ea3993e030c8cf0b48da92094c7113

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\kd.exe · signed by Microsoft Corporation

bd240f684f9e6d1bf03a88c75fa9c6d84bf84f823a9f0e6ebb7da14b46748b16

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\kd.exe · signed by Microsoft Windows Kits Publisher

ce3a7f8a083b1290b524c79614c86d9e1deb22e4ecc94123259cfee18ae2b90f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name kd.exe
mediumWindows Kernel Debugger ExecutionNasreddine Bencherchali (Nextron Systems)