CmdID

CmdID / Files

resmon.exe

Resource Monitor file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real resmon.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionResource Monitor

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\resmon.exe · signed by Microsoft Windows

48222fdb4f54de6cb2a3318b5bba6e8de3384f31c7d1cded1b9c39c89fa41c4d

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\resmon.exe · signed by Microsoft Windows

fe6cbdff1bdd11a239d1aac7a033c467fa48aac943c69c20d896e4a3454f7e80

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\resmon.exe · signed by Microsoft Windows

4c0bdf906af0c1fdbc9fa61bf2af95c708498f5afe8e05c65e865e99deac8716

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\resmon.exe · signed by Microsoft Windows

f3707c1d638f5487d1ef0a72173356023307dc6734dc738944c75f127fbcfd54

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\resmon.exe · signed by Microsoft Windows

8fa569f3faf05a116250786ae2779de2c924fc714d68bfa7f8ef611fa0ace904

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\resmon.exe · signed by Microsoft Windows

b5ce6fcc43b79f85d20d679b29ba54e9d618501ed7b39119383c570ebabd1f57

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\resmon.exe · signed by Microsoft Windows

10d4937d6d559d7b445af08dfcdc953bdb9079e78c02c3c54bf4343499fb66e5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\resmon.exe · signed by Microsoft Windows

956cd8b2c832e631917281b131ee9b137d2702ffc929aef6fc2c71ad1c761f8b

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\resmon.exe · signed by Microsoft Windows

0091dea72e25148784e5feb32c51142957b24ab66688747ef5b8bd74ac9817dc

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\resmon.exe · signed by Microsoft Windows

c5cd5c04c1538bfadf5d1d8db5230d8455f339909152d2d79f63aeccebe56add

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\resmon.exe · not signed

3368f84c5c1e52d416ae74615088b6af101adf2167b1fb009125bdcd4ca15bf0

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\resmon.exe · not signed

378fcdd22908b063fc8696bcfa25b5544a19c9ccb3b878bc968c690e1f75342e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name resmon.exe
lowNew Process Created Via Taskmgr.EXEFlorian Roth (Nextron Systems)