CmdID

CmdID / Files

Narrator.exe

Screen Reader file version info

Program on Windows 9 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real Narrator.exe?

file version info and known copies
Original nameSR.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionScreen Reader

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Narrator.exe · signed by Microsoft Windows

d76555a28b771caa8f1ecfe5995ce91a661b48cdc3afca2857117c4d3ecb6132

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Narrator.exe · signed by Microsoft Windows

5012f2ac4ca5a6f8d49f97015c1e6cad6581979c386ec947bab64e193c82e877

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Narrator.exe · signed by Microsoft Windows

69b8c93d9b262b36e2bdc223cc0d6e312cc471b49d7cc36befbba1f863a05d83

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Narrator.exe · signed by Microsoft Windows

8eb5e82187f9ed8f0ec20605f7e3410d887e8c992b99f166e5fdde7f67a586a6

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Narrator.exe · signed by Microsoft Windows

f99c747b0a22172bef6158eb5855ea5a5b4f758f9de6274a5cf85593ecdcff8f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\Narrator.exe · signed by Microsoft Windows

7cb42636e62c41160bdc26882ac3347f30e277d54835ea30e1e847519e5cd229

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\Narrator.exe · signed by Microsoft Windows

245acf99ed057fd62fe0b1016f2d2d7b144a9246953be01580794c0c8559052e

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\Narrator.exe · not signed

503e77d13fbdb7ac2ae4070706cebc5ae50c141415eb0981f1b97c9264258498

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\Narrator.exe · not signed

59868a0b228cdd2a69efc6b46e2d252f8bf694491e437bb32618adc771541e51

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name Narrator.exe
criticalSticky Key Like Backdoor ExecutionFlorian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community
highSuspicious Debugger Registration CmdlineFlorian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro