CmdID

CmdID / Files

slui.exe

Windows Activation Client file version info

Program on Windows 9 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real slui.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Activation Client

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\slui.exe · signed by Microsoft Windows

1721b942dee057c5cf45c455096557173f2cc261bca542bd70aa201090133c4e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\slui.exe · signed by Microsoft Windows

25e7624d469a592934ab8c509d12c153c2799e604c2a4b8a83650a7268577dff

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\slui.exe · signed by Microsoft Windows

fc4d1fd06a10682e53170d388cdfc9053af70001e57f3d8b84d666e9d95560b7

10.0.18362.693 (WinBuild.160101.0800) · C:\WINDOWS\system32\slui.exe · signed by Microsoft Windows

39d924020ba5c09bb5ab2021c973b86c29e756b5f6d3b3fcd0f3cf5c74636ce4

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\slui.exe · signed by Microsoft Windows

3b406849a07295bfe60d959f713e323b2b2ffead0c6a96b55cb8d74fd708481d

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\system32\slui.exe · signed by Microsoft Windows

42b6bbece4cde24c4bd93d3d640b9300589e8311ff6232e02558952854484c41

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\slui.exe · signed by Microsoft Windows

a9e691d1e6763b8895168e8eb3fcc7f9a072c7e46c216f4deda3f246edbc3438

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\slui.exe · signed by Microsoft Windows

462e1576643d2303202bb15d0e74bcbac17b90db1e20003b60e022033fcf4542

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\slui.exe · not signed

d192199bfb64e0bf52e6df248718101fe12e33cbe20d9660fea037204e774278

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name slui.exe
highUAC Bypass Using ChangePK and SLUIChristian Burkard (Nextron Systems)
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)