CmdID

CmdID / Files

ntoskrnl.exe

NT Kernel & System file version info

Program on Windows 13 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ntoskrnl.exe?

file version info and known copies
Original namentkrnlmp.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionNT Kernel & System

13 known copies

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\system32\ntoskrnl.exe · signed by Microsoft Windows

77761ae0821caa94c42d5a4cf9d18126a729ef1acc6c1fd7a137e89b076d9f65

10.0.19041.685 (WinBuild.160101.0800) · C:\Windows\system32\ntoskrnl.exe · signed by Microsoft Windows

acec36b1c1a3665ca16349a928b36f2f90335e4d1d385f7239af2474d7ac25b9

10.0.19041.610 (WinBuild.160101.0800) · C:\Windows\system32\ntoskrnl.exe · signed by Microsoft Windows

adba735e87f72021a87d10e67710f15b44486a0720711a324e03849da528834b

10.0.19041.508 (WinBuild.160101.0800) · C:\Windows\system32\ntoskrnl.exe · signed by Microsoft Windows

a577850d67d1b4df94e64b3309169e20f3850d4bfa54c40dc9f4f09722e2f5ea

10.0.19041.450 (WinBuild.160101.0800) · C:\Windows\system32\ntoskrnl.exe · signed by Microsoft Windows

1878b3aef56db720fda0307fe88d4283849b08af6a7a97d42f3cc8b10081f61b

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\system32\ntoskrnl.exe · signed by Microsoft Windows

9923b54ed79b57e1fd609b8226bac634d5167a1afcd0eb06bc79d1f1c274d496

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\system32\ntoskrnl.exe · signed by Microsoft Windows

7dd334edd7db7fc6f8c170f3338c92e2cf30a621cdf5b50727d210d8434974ee

10.0.18362.836 (WinBuild.160101.0800) · C:\WINDOWS\system32\ntoskrnl.exe · signed by Microsoft Windows

cccfda078a89d2adb3bd6e93f30a031b24fd37fbf2caf3d2a6bb39f2e790d13b

10.0.17763.1518 (WinBuild.160101.0800) · C:\Windows\system32\ntoskrnl.exe · signed by Microsoft Windows

0e039c3bbd86d31ceb8f3fd2046134d067ee41ebd974597e59f6518b4d9b60b7

10.0.17763.1397 (WinBuild.160101.0800) · C:\Windows\system32\ntoskrnl.exe · signed by Microsoft Windows

fbebb420fce2056e992e97b396dbfd11d856c61003619a8b68cfdc330f94012b

10.0.17763.1282 (WinBuild.160101.0800) · C:\windows\system32\ntoskrnl.exe · signed by Microsoft Windows

0d72b46a5b1bc55bb7fbe916f3eb2db5b0e9d75e07f1b8fc3774976695d93327

10.0.14393.3686 (rs1_release.200504-1524) · C:\Windows\system32\ntoskrnl.exe · signed by Microsoft Windows

7e50d19b89b4b29259625b58f5eb4696b37eef69820c2227ab2a19457187f836

6.3.9600.19724 (winblue_ltsb_escrow.200519-1914) · C:\windows\system32\ntoskrnl.exe · signed by Microsoft Windows

474a3fba47aa1505036d12c329787d85c175e5cb53a90ffd06c0db4b1864ee17

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name ntoskrnl.exe
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)