CmdID

CmdID / Files

setup16.exe

MS-Setup Setup Exe file version info

Program on Windows 8 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real setup16.exe?

file version info and known copies
Original nameSETUP.EXE in the file’s header: a renamed copy still carries it
Installed inC:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMS-Setup Setup Exe

8 known copies

3.01 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\setup16.exe · not signed

a3e5923616cf61016d976e7e202ea987d0753b36bf85e5f4fb013af75d74b77c

3.01 (rs1_release.160715-1616) · C:\Windows\SysWOW64\setup16.exe · signed by Microsoft Windows

85ea5ce06a5616cc9ccd8706b53d7f627930ad60937d30549aaa9fce206f3a6a

3.01 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\setup16.exe · signed by Microsoft Windows

0b8f35275fe08bc2a0d139bfcb47a964e30dafe3859a4ddcb579b4c9d771dab1

3.01 (WinBuild.160101.0800) · C:\Windows\SysWOW64\setup16.exe · signed by Microsoft Windows

3d244e2bd05619fe4272e9e30c183e440cff48bcda8e24d62b12cab68c9957e3

3.01 (WinBuild.160101.0800) · C:\Windows\SysWOW64\setup16.exe · signed by Microsoft Windows

68fd20dd46557480edab5507fa41d3c15357cf4a62778f59a8cbde54cd7d9300

3.01 (WinBuild.160101.0800) · C:\Windows\SysWOW64\setup16.exe · signed by Microsoft Windows

6ff2fa645dcc6db79972b2415a712565debffc2e43d5289daf3d6219ed5e6087

3.01 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\setup16.exe · signed by Microsoft Windows

94e2af85f59ffa5b42d64561e4be990a74cf2c84917921eae91008165763eaec

3.01 (WinBuild.160101.0800) · C:\Windows\SysWOW64\setup16.exe · signed by Microsoft Windows

c725cb0647f00946b7370e2f899dea5d97fd31fd5ab5c6a7d9cd39d8c3b07e50

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name setup16.exe
mediumSetup16.EXE Execution With Custom .Lst Filefrack113