CmdID

CmdID / Files

msinfo32.exe

System Information file version info

Program on Windows 14 known copies with hashes 1 Sigma rule names it Command msinfo32

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real msinfo32.exe?

file version info and known copies
Original namemsinfo.dll in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSystem Information

14 known copies

10.0.22000.71 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\msinfo32.exe · signed by Microsoft Windows

f14e711b23c0aeea051b4c6d468ca01d23dfaa8ee4175c9d3b0ee1486bc44e71

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\msinfo32.exe · signed by Microsoft Windows

c2bcd1cc65ba2944d8f6fee75db2c65a97a6ca4c814650a55d64bb1a6e042bd9

10.0.19041.1110 (WinBuild.160101.0800) · C:\Windows\SysWOW64\msinfo32.exe · signed by Microsoft Windows

7c84c55ea7df524e972bef93cddf8b8f62c23790fd8b2d3e239455635fa65948

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\msinfo32.exe · signed by Microsoft Windows

5cf1604d2473661266e08fc0e4e144ea98f99b7584c43585eb2b01551130fd14

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\msinfo32.exe · signed by Microsoft Windows

68390551bc3bbc372ae64b5860dcbac3e74866595f05577a7c19365384b5d6cb

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\msinfo32.exe · signed by Microsoft Windows

7c9587bad9050e03f13ab1f46e4f02f350cdd0a6ea893f70d52436e3849b2985

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\msinfo32.exe · signed by Microsoft Windows

1fda48c3353d7837c2ca986d0f79cb6d615bd95cee37f50f8cd9f28d1731e66c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\msinfo32.exe · signed by Microsoft Windows

b09193ebc6f828035a5c712cb804b0d60bceccfdcc86674b9ee95a2ea9507f5a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\msinfo32.exe · signed by Microsoft Windows

9d9efb1655826bc2cc5f0767c2f461bbe6d8e743113eb6b396b5966740373dec

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\msinfo32.exe · signed by Microsoft Windows

b3b40cf1227f21ed74de6904c99e346ee1dc2b7d5e949d0f44fdcb1d10423307

10.0.14393.351 (rs1_release_inmarket.161014-1755) · C:\Windows\SysWOW64\msinfo32.exe · signed by Microsoft Windows

6860e80226ef8a8470b090a2969d834ab32d48b1821167628bb32b970a2dde80

10.0.14393.351 (rs1_release_inmarket.161014-1755) · C:\Windows\system32\msinfo32.exe · signed by Microsoft Windows

73ecad12e19a04662eff1f81a65b56209c30cd0a4c344a73fa4df9d74f9d3cdb

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\msinfo32.exe · not signed

9b468bc8c55a8cff66dda42c5a25a0a3e4915536887b8f489de59db87703c3d9

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\msinfo32.exe · not signed

d711890ad8087743df590fbfaf67d8c7c1972d2c3911fa1a9daffb7ef8280b4f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names msinfo32.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.