CmdID

CmdID / Files

SearchApp.exe

Search application file version info

Program on Windows 3 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SearchApp.exe?

file version info and known copies
Installed inC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSearch application

3 known copies

10.0.22000.120 (WinBuild.160101.0800) · C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe · signed by Microsoft Windows

62bb35c7570be33a4fd44a04d3e18eccef32a666d19456c2dc57ea465ec2c56d

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe · signed by Microsoft Windows

be1c4326648531600d4edaff0383ac6d1022844557b5ab4d89bab71760113c41

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe · signed by Microsoft Windows

f05a77c204cd09f9a21028e36c01faed7dca76ec68da4ee85c2488d9a77b393e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names SearchApp.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.