CmdID

CmdID / Files

SpeechRuntime.exe

Speech Runtime Executable file version info

Program on Windows 8 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SpeechRuntime.exe?

file version info and known copies
Installed inC:\Windows\system32\Speech_OneCore\common\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSpeech Runtime Executable

8 known copies

10.0.22000.51 (WinBuild.160101.0800) · C:\WINDOWS\system32\Speech_OneCore\common\SpeechRuntime.exe · signed by Microsoft Windows

8dc913847be78d52194d81f725a63293cd0ef3090bdc6d7efadd1dcaaf3858a8

10.0.19041.450 (WinBuild.160101.0800) · C:\Windows\system32\Speech_OneCore\common\SpeechRuntime.exe · signed by Microsoft Windows

bce8dd332be145d80c4d32354aaa68590c964d50ce4d2f83f6b775a03011feec

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\system32\Speech_OneCore\common\SpeechRuntime.exe · signed by Microsoft Windows

eed32ab57caf78e5df5ea1beea0e51b787d9c50d299e7cb71f03f9d58dde09a1

10.0.19041.1266 (WinBuild.160101.0800) · C:\Windows\system32\Speech_OneCore\common\SpeechRuntime.exe · signed by Microsoft Windows

71f03c728a5a28c8416ecc4ff02257a9196d4ec6c8addfe605d5cc434d07b154

10.0.18362.628 (WinBuild.160101.0800) · C:\WINDOWS\system32\Speech_OneCore\common\SpeechRuntime.exe · signed by Microsoft Windows

d68610a1b25a3b5e7e2f0a791ddef7949c8dd6f341b19b48443fed9d3b16e9cb

10.0.17763.1397 (WinBuild.160101.0800) · C:\Windows\system32\Speech_OneCore\common\SpeechRuntime.exe · signed by Microsoft Windows

c3e4880ace893ee607d4401179ee7920ed7d2116ab6bac427e9f4c9160217f5e

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\system32\Speech_OneCore\common\SpeechRuntime.exe · signed by Microsoft Windows

19ae878e2a5c9abeb915b950da847fcd3a093e639b084b7297d1e65fbb300237

10.0.14393.2608 (rs1_release.181024-1742) · C:\Windows\system32\Speech_OneCore\Common\SpeechRuntime.exe · signed by Microsoft Windows

0e15e1cc3983306eea33311f6adb0c064063ff372e33e9db353caed8a3600cf8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names SpeechRuntime.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.