CmdID

CmdID / Files

powercfg.exe

Power Settings Command-Line Tool file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it Command powercfg

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real powercfg.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionPower Settings Command-Line Tool

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\powercfg.exe · signed by Microsoft Windows

4906337efd205f5ac2527f6e6a84e4a252b78d220990a9ba39b4a9a4648aa203

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\powercfg.exe · signed by Microsoft Windows

c9c9a9125df638ccb97167a3c4580c117e6d97cce6cb55b35dfae4d7019dc6e8

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\powercfg.exe · signed by Microsoft Windows

7b48d1d9eb8ecc4e59f76cabac1a9e009e5a39f0524fa8eea29a3acbc8cd32c1

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\powercfg.exe · signed by Microsoft Windows

cb2459971a56cee45a30346281ff3b0eccea0c2bee1ae6b8477712404d2e6ae1

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\powercfg.exe · signed by Microsoft Windows

d0d908da775da267c0a3f76586bb463dd8bb62b8d0b05efd23bc1de248e8e47a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\powercfg.exe · signed by Microsoft Windows

ff7895ddc7d4dfb528b431b95001c6ad44178ed697fa5c29a77bfd033d73800c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\powercfg.exe · signed by Microsoft Windows

80a8911bd52933500d8f2e554e7cf0954c250df13d151d080011c2be3a5aff68

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\powercfg.exe · signed by Microsoft Windows

a6e1a555d365ab5f57de1b077012b2b7af65d7d9dd2500e6354ce47448ee7a1a

10.0.14393.351 (rs1_release_inmarket.161014-1755) · C:\Windows\system32\powercfg.exe · signed by Microsoft Windows

34808b32dae08fb92de643f86931c3f06c39bf3ddcf1a88eb0fe2daf7f112cb0

10.0.14393.351 (rs1_release_inmarket.161014-1755) · C:\Windows\SysWOW64\powercfg.exe · signed by Microsoft Windows

65944eef8abaa6fa30150b17589a78dde595e96bae581e99166e8835e95801b6

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\powercfg.exe · not signed

069271f8b51d3f29390d960687e5a251e131e3b974c1a8ba78ce664e2f605978

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\powercfg.exe · not signed

4c1b9be18f15309fb1686d4d8e680543a4aabeb7b8e4583218f370f2cd8b776c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name powercfg.exe
mediumSuspicious Powercfg Execution To Change Lock Screen Timeoutfrack113