CmdID

CmdID / Files

sfc.exe

System Integrity Check and Repair file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it Command sfc

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real sfc.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSystem Integrity Check and Repair

12 known copies

10.0.22000.120 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\sfc.exe · signed by Microsoft Windows

b39d1b2d76b38d91a6e3a9be07946b4df946b8e8e0dcd9fdd282e2d419a3a4c6

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sfc.exe · signed by Microsoft Windows

60c693ff38cb19ea9faafa76a0ccfcc84196ee6212ca5a6c8b94e970c3e97a09

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\sfc.exe · signed by Microsoft Windows

167a282de037bcd2192205ec555890f849c4bf305cd284a763060f3332c453c6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sfc.exe · signed by Microsoft Windows

e7a57be660b32aebec5c59786d9f56de1dfb9e4bce2b1aaefea94caac5c63e42

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sfc.exe · signed by Microsoft Windows

786d3cb14f160e4795690f198278424648e3973dff9ca86317658714406cad87

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\sfc.exe · signed by Microsoft Windows

a47a972d2bac60913a318d34bd3974388b5e2ac4d3c3a58fcc38e3c51e805e02

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\sfc.exe · signed by Microsoft Windows

9947daf25487c97017038efc3e19f6b8d7f3208bbac05bd9c7de2cd0a37c48c4

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\sfc.exe · signed by Microsoft Windows

baf13ce3859fc727b767818b27262d549519870e6cca5e960eea266eb90e99c9

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\sfc.exe · signed by Microsoft Windows

6fb46313a33add50ff813d6eda76487beeec6000439c3f25a1f679e7dcfe47c4

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\sfc.exe · signed by Microsoft Windows

e4006f0cb1ee909a8cd04b8a56899c459473406c3a9a3da53b891e5ae8f7e609

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\sfc.exe · not signed

17efb7ca5f719d6a8c08791c355caecaf77b29b02383bc8badf078e086a0acc8

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\sfc.exe · not signed

95d582c79421497c848d8406757f18acf4e8cc690d6fb5096cdedad4de6db660

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names sfc.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.