CmdID

CmdID / Files

OpenWith.exe

Pick an app file version info

Program on Windows 16 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real OpenWith.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionPick an app

16 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\OpenWith.exe · signed by Microsoft Windows

29275c78478840089cdf68ef8f8cb9d7664a0946485184c5a158d3f3c1567cd4

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\OpenWith.exe · signed by Microsoft Windows

5c30cf9a2a8bbbb5443c2bb0ed86b734cf6dd0e0ce2535a16e7d2c1c90e84fe7

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\OpenWith.exe · signed by Microsoft Windows

cf70792bfc6fc236091237bad043f0be6bd398cae72ac97346e471df3d118031

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\SysWOW64\OpenWith.exe · signed by Microsoft Windows

3a796e0d682bd590b4c0ac50c8bcf80fadc6331fe83fbd6f2de67148b4da7005

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\OpenWith.exe · signed by Microsoft Windows

39289abe68243eaa414bb59f3f918befd358fa8465ee83a50ba93e33f8f9af64

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\OpenWith.exe · signed by Microsoft Windows

9cf635be9be023f6a24e885b369f7906eff772ac9e6d8c496d5d9786d4018745

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\OpenWith.exe · signed by Microsoft Windows

e108bac5a0d02952ea6b2ef4eafdcb38017934525175e85be70012d406476d22

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\OpenWith.exe · signed by Microsoft Windows

f2db6838b734264fab79d24e5f96a21e6528073360a8daaa8d7efb8bc5d5edb4

10.0.18362.693 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\OpenWith.exe · signed by Microsoft Windows

ffb5b7edee058645fabc99f1dabfcfd3aeaef02cf0fe373f07cea71966456626

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\OpenWith.exe · signed by Microsoft Windows

7f1231bbcb8b271aba5f6781c08c5cd43a1692fd72d9e3a51ee7db24ef27b28a

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\SysWOW64\OpenWith.exe · signed by Microsoft Windows

fcf7c8545cdc4763b0d74d94f06e29f0ddffdbadcabd096a35d82959b9f562e2

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\OpenWith.exe · signed by Microsoft Windows

79f13786b0ee6eb813ecd90c739ff48f078dfae6b8f7aedfeb526ffe86b81eb2

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\OpenWith.exe · signed by Microsoft Windows

05da72b7b1906c504482410e2f2f4d57d41ada140da833d1ab5b9195ab80a3e0

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\OpenWith.exe · signed by Microsoft Windows

e9f8eba1f42f60aacec65bc346af51a649f8c9bf625ab9493f17d98f4c6c22d9

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\OpenWith.exe · signed by Microsoft Windows

77378c8d09e7841cfcc31d42ecc2ac828898e2958240d2d0966d82c9229f641f

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\OpenWith.exe · signed by Microsoft Windows

d3bc9d22081eda2d6192ab50a7db3bb1372a979a13f22d29aafec4d325ccaf9f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name OpenWith.exe
highOpenWith.exe Executes Specified BinaryBeyu Denis, oscd.community (rule), @harr0ey (idea)

Sigma names OpenWith.exe in 3 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.