CmdID

CmdID / Files

sdbinst.exe

Application Compatibility Database Installer file version info

Program on Windows 16 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real sdbinst.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionApplication Compatibility Database Installer

16 known copies

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\sdbinst.exe · signed by Microsoft Windows

ec03b0231b3899d3512de459a9e87e5c621e77c79ca26c58279f376b61f88dbe

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sdbinst.exe · signed by Microsoft Windows

bb62c5070224a26cc213f1ab20187f9003fed9c84c388b5b14c519cd85c3f584

10.0.19041.572 (WinBuild.160101.0800) · C:\Windows\SysWOW64\sdbinst.exe · signed by Microsoft Windows

20e69eea897d3abfd5cd7df2ffecd6083961e9231feb3d4ed1f029315e5fa88d

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\SysWOW64\sdbinst.exe · signed by Microsoft Windows

bb28e2d992b439a01fc6385be08c78254a304dd867c2c725a5eac39f67b0c44b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sdbinst.exe · signed by Microsoft Windows

5c07d2d008652a173b05460570f5b73763cc7e2e094391320e3741c9448ae0f8

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sdbinst.exe · signed by Microsoft Windows

a4dfdcba5a7f55af325f8deb61f35fc98ea70924bb94c1b0fbaef815ba8026de

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sdbinst.exe · signed by Microsoft Windows

a64ebfeaa892ee807f2c3fe39e5a396d7129a78fa3cc358e93dfdd6e0bfebfd3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\sdbinst.exe · signed by Microsoft Windows

f26bfc0b4fef00a7dff35fac89139bb96cae1052bbacf7fe1d858f8917f8b232

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\sdbinst.exe · signed by Microsoft Windows

1b0883da2cc4c1959d3fe8f6de63ff9ad85f7cf9b229879c6f54b734e2c5f14d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sdbinst.exe · signed by Microsoft Windows

794db11ef7cab2a0fa3d1e2128b26c2785a37e0bc7b12fb2da371f61fded3495

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\sdbinst.exe · signed by Microsoft Windows

837c16c1ca64e6db32421fc56efbd80bfca8e9c8888e9240ab859c43adac1442

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\sdbinst.exe · signed by Microsoft Windows

e4f4f22e877c3a417eea12e7b94cb014ca44cdcdd8f28e3875d90def937f182d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\sdbinst.exe · signed by Microsoft Windows

05c2b18046fd436e9d726c25bf39d62410ca5b295ee5bfd473607e125672076d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\sdbinst.exe · signed by Microsoft Windows

3586b73fc4c1260a17ba9c67f2b270179a8ca7f5c820c412758c66b13aeeef9f

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\sdbinst.exe · not signed

820ae49d5ca9b263a6b1c54cc0bc69654cded6591c37924e8cb116b2a5566179

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\sdbinst.exe · not signed

e60ed7874ca8e2e7646d37ef828695dd8cd33ff8590ef9d9b730b55c64888820

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name sdbinst.exe
mediumPotential Shim Database Persistence via Sdbinst.EXEMarkus Neis
mediumUncommon Extension Shim Database Installation Via Sdbinst.EXENasreddine Bencherchali (Nextron Systems)