CmdID

CmdID / Files

msoobe.exe

MSOOBE EXE file version info

Program on Windows 9 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real msoobe.exe?

file version info and known copies
Installed inC:\Windows\system32\oobe\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMSOOBE EXE

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\oobe\msoobe.exe · signed by Microsoft Windows

1c1c81221f5e73fe7103b46f53376a3cd0f7dbc1d28e61287987ac5f62a4cdb6

10.0.19041.572 (WinBuild.160101.0800) · C:\Windows\system32\oobe\msoobe.exe · signed by Microsoft Windows

41013c4e65d37d1af2e95b581a766e99a222f1e4e9d347363ddb7b557703fa73

10.0.19041.1266 (WinBuild.160101.0800) · C:\Windows\system32\oobe\msoobe.exe · signed by Microsoft Windows

640749afc382acb9a6e03f077f0e31a42bbb82c7e76f3a25e4addb14d16ab55b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\msoobe.exe · signed by Microsoft Windows

ee7013246bb3a3e88d8708c1ca498dfa1c4d23da43da9251af02de1dd2b95bdd

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\oobe\msoobe.exe · signed by Microsoft Windows

0a3a7be26c7afa8c217e9e788299f9ffd02a61fcde033fcf73e1d53f61204043

10.0.17763.1490 (WinBuild.160101.0800) · C:\Windows\system32\oobe\msoobe.exe · signed by Microsoft Windows

82dfda730af302a9af30cf61f74b6a3976d9b3bde8c49c54632c566dedcd69e9

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\system32\oobe\msoobe.exe · signed by Microsoft Windows

438841be8a667090bf5ecb7df89100b931073c7577dad90d88a1345425570bb2

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\oobe\msoobe.exe · signed by Microsoft Windows

9f56890cb9dcdd963db47e185d0241059177b8bb3bf28fe5a14f1d2439a128f5

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\oobe\msoobe.exe · not signed

06b7686f74e05c67aeeef7ef2e672b8ee8f8ed1011d31d9f5aa1fdcc9ec72b38

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names msoobe.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.