CmdID

CmdID / Files

oleview.exe

OLE/COM Object Viewer file version info

Program on Windows 3 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real oleview.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\
Signed byMicrosoft Corporation
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionOLE/COM Object Viewer

3 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\oleview.exe · signed by Microsoft Windows Kits Publisher

1bdd5c86ad166ea5a61dcb79e57622aa11ad33b95f3ce50d0be296d94296cb76

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\oleview.exe · signed by Microsoft Corporation

2ad8f23459416a2c1efa5e333c5fe90d26a3f67a37ce9986cc7a9384b8888ba5

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\oleview.exe · signed by Microsoft Corporation

fcd9002c8cb103b8e28a399075068b7713a3696350c0c2aaf8dd7642711a1481

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name oleview.exe
highPotential PlugX ActivityFlorian Roth (Nextron Systems)

Sigma names oleview.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.