CmdID

CmdID / Files

PkgMgr.exe

Windows Package Manager file version info

Program on Windows 12 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real PkgMgr.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Package Manager

12 known copies

10.0.22000.120 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\PkgMgr.exe · signed by Microsoft Windows

3b8849eefda6edd84f962aaabc790b0e45fd55542429ef54860279659440ed12

10.0.22000.120 (WinBuild.160101.0800) · C:\WINDOWS\system32\PkgMgr.exe · signed by Microsoft Windows

fb865203ac6257abe20d9bc09321e9106e389742ff9e2cd562a1bab50d7237bc

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\PkgMgr.exe · signed by Microsoft Windows

add78c9574ca3c5913bde91097a2c9130125c7e09657e54e456c450117945c4a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\PkgMgr.exe · signed by Microsoft Windows

cbf7c8a6f52735ca8c1118d65c1fe96a5345987f3b81726e2f8356e22ac5e088

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\PkgMgr.exe · signed by Microsoft Windows

986fec137eb41a90aa72a7ef290b8d1d9df0207b69a401a2ba60dfdbbf30a8b9

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\PkgMgr.exe · signed by Microsoft Windows

b3bd72e57aea758b0e1780d5cf9455ca9737ffa8bfcf8a93532c196bcdea46ab

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\PkgMgr.exe · signed by Microsoft Windows

5bed2aa29ecb2aef1a41e8b33a0cefd32ddefbfa1f7767430a311c064cf13d67

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\PkgMgr.exe · signed by Microsoft Windows

a1f495fb35cc72823bf0c556c59c0a1e7589f7109a3b287abaa5f803c652009e

10.0.14393.2457 (rs1_release_inmarket.180822-1743) · C:\Windows\SysWOW64\PkgMgr.exe · signed by Microsoft Windows

8afd78cb0befd7badaf66bbdef884fbce6b9bfcb41291b78df1939227103766d

10.0.14393.2457 (rs1_release_inmarket.180822-1743) · C:\Windows\system32\PkgMgr.exe · signed by Microsoft Windows

c48cd3943ac941e88c089cf3245f4c7903030ea5b7dbaf59b8d6e69cf454a06d

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\PkgMgr.exe · not signed

833db9236ca1471180d12d1edf5655fcf8959ba839ca8df07141bb8af52d2a5c

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\PkgMgr.exe · not signed

fa461a210d64c65243ba9ffdcd39d5f7d7e433e666abc895b674d5136d1a59a0

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name PkgMgr.exe
highUAC Bypass Using MSConfig Token Modification - ProcessChristian Burkard (Nextron Systems)
highUAC Bypass Using PkgMgr and DISMChristian Burkard (Nextron Systems)

Sigma names PkgMgr.exe in 3 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.