CmdID

CmdID / Files

SpeechModelDownload.exe

Speech Model Download Executable file version info

Program on Windows 16 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SpeechModelDownload.exe?

file version info and known copies
Installed inC:\Windows\system32\Speech_OneCore\common\
C:\Windows\SysWOW64\Speech_OneCore\Common\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSpeech Model Download Executable

16 known copies

10.0.22000.37 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe · signed by Microsoft Windows

1b818d5196aa341f6de5ac7c7357aa4a39654f3bb3a8596635ae9f3a7fefde43

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Speech_OneCore\common\SpeechModelDownload.exe · signed by Microsoft Windows

3bc142494dad7d451290e20dbc506e5fb55ca6a2195064ca603f66fb675b3e6a

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe · signed by Microsoft Windows

04a16f385d2992cf329f73bab3bcb8dd76acf132c9944d98b2eee9a05605ed0a

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\system32\Speech_OneCore\common\SpeechModelDownload.exe · signed by Microsoft Windows

ca8768b01d16068f88fb1e6df7de9c7d8d46c034aa85f6fc38645131f9670ed4

10.0.19041.1081 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe · signed by Microsoft Windows

38d33cfb157446602b5fe48e01d38207bc2e750f13efa3ea9c9d6538b6012ec2

10.0.19041.1081 (WinBuild.160101.0800) · C:\Windows\system32\Speech_OneCore\common\SpeechModelDownload.exe · signed by Microsoft Windows

90ea450f5bfd1bb382cdacd32c0280083dbbdd3266821922270cad3bd473bdd7

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe · signed by Microsoft Windows

373fafd132b5b41e98aa9a158826c66b3360283534b3d5744983af002c87e00c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Speech_OneCore\common\SpeechModelDownload.exe · signed by Microsoft Windows

80996ad51a32725914e461f8726b09cdaf2ecd84444b32adf8833e903a1dd602

10.0.18362.693 (WinBuild.160101.0800) · C:\WINDOWS\system32\Speech_OneCore\common\SpeechModelDownload.exe · signed by Microsoft Windows

30b1f4fee5c1949cec3975c797e829f7691020f51d8c60fae71314310f7a503a

10.0.18362.693 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe · signed by Microsoft Windows

a3814e9116ccc93d6c52cc03d5fdffd24b12570f03f92b6a26db1450f5b6ad91

10.0.17763.1369 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Speech_OneCore\common\SpeechModelDownload.exe · signed by Microsoft Windows

7a6e9a6b0551052b74a74f789ca2be13570757c326d10b212edbeaa0e171a0a9

10.0.17763.1369 (WinBuild.160101.0800) · C:\Windows\system32\Speech_OneCore\common\SpeechModelDownload.exe · signed by Microsoft Windows

963fd9dc1b82c44d00eb91d61e2cb442af7357e3a603c23d469df53a6376f073

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\SysWOW64\Speech_OneCore\common\SpeechModelDownload.exe · signed by Microsoft Windows

0a33b7629ac61cbf5f813bf29cb723bd84df41fe4447d7725d9817454d100ede

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\system32\Speech_OneCore\common\SpeechModelDownload.exe · signed by Microsoft Windows

d5d65106d297610ea11e7eec6b19e70ca6c7960d24a61920a322057a06611793

10.0.14393.67 (rs1_release.160804-2231) · C:\Windows\system32\Speech_OneCore\Common\SpeechModelDownload.exe · signed by Microsoft Windows

472fb4b413344d2753c145237fcb83c4d3f1fb555f7330092fba59ad63ac8622

10.0.14393.67 (rs1_release.160804-2231) · C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe · signed by Microsoft Windows

bf52b5baf1d780d6dcd18b0c0c1d7c86c388548fc77f0f53e1a4f58bb8c53a3b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names SpeechModelDownload.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.