CmdID

CmdID / Files

mobsync.exe

Microsoft Sync Center file version info

Program on Windows 10 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real mobsync.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Sync Center

10 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\mobsync.exe · signed by Microsoft Windows

3d072ea7f4586cb0440b57f6575afd8c8b8e110d5073b70b6015cc1e97f0284f

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\mobsync.exe · signed by Microsoft Windows

cc2316416cd1c8ba5c88241552ae70034ec7fea26bf95ebe11067891dad9eac5

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mobsync.exe · signed by Microsoft Windows

244b65dc083f033047f8bdcbfe128d6d118d72c113d1dc21e0d2fd16c09a735a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\mobsync.exe · signed by Microsoft Windows

6e83030a6a3e447acb1d38cc07035c1fd5bd2c9e136a57ce99f3ac1be45a7d3d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\mobsync.exe · signed by Microsoft Windows

04fe9960d579a3ecfc947928ccb6800d3249216e8b50e74e8b4ae1d20a134941

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\mobsync.exe · signed by Microsoft Windows

9b4f0c3f3aa65da01641909996e5455d8030340671b8631a41c5429ceaf35e26

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\mobsync.exe · signed by Microsoft Windows

61248f04a068b1ff16c3609e1454b8e787dd40bff57cc46f4fc18db40ffb8028

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mobsync.exe · signed by Microsoft Windows

a584b2dd163daabdc51f9e41ab3ef154b3e880d17c06dc3fdafd62fc6e266c4f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\mobsync.exe · signed by Microsoft Windows

2455b74524ea8f12aee8c6b47ce9a463bfd1e1de1bdec0b2a60abd28bcf357e1

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\mobsync.exe · signed by Microsoft Windows

65c2a4ad1e69454bad5c2be41828e0025749f132786f394f0d38679ea0c68931

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names mobsync.exe in 2 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.