CmdID

CmdID / Files

SystemPropertiesAdvanced.exe

Advanced System Settings file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SystemPropertiesAdvanced.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionAdvanced System Settings

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\SystemPropertiesAdvanced.exe · signed by Microsoft Windows

2012767a5996711e79f4f8eb20a10b4706c799b8992dad9a8e008f5d877b0c1a

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SystemPropertiesAdvanced.exe · signed by Microsoft Windows

936e27d6d970a50a9a8b520b9922733dfc15cb438be85f92d4e53e80d197853b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe · signed by Microsoft Windows

3c52e817a18efd5670c1b8a2febba53673dc70875271933c075116990ef0c255

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SystemPropertiesAdvanced.exe · signed by Microsoft Windows

c61fa0f8c5d8d61110adbcceaa453a6c1d31255b3244dc7e3b605a4a931c245c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\SystemPropertiesAdvanced.exe · signed by Microsoft Windows

ba3d4468f5abc84d2088c3ac69e4d17b1b95618f0f47ce8655a8f154f55384fd

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SystemPropertiesAdvanced.exe · signed by Microsoft Windows

fbd13bbaf279f7e7e006659f9e02e68528ec8fab02e93891139d805aedc48e85

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe · signed by Microsoft Windows

86c7db0e662ca65f8e5989a629e00b03354cc385a9aee8bed7aaae28672d0a5f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\SystemPropertiesAdvanced.exe · signed by Microsoft Windows

8d7826605d9c8428efe3fc374c32c6dace4a574462192f4a8dd187c6916d31c0

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe · signed by Microsoft Windows

008aa893ac6c129390b25437810563bdb1c0288b959b11f84821009e71626870

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\SystemPropertiesAdvanced.exe · signed by Microsoft Windows

0aa8c07a382405ed6c58eed6656592e3319811b38a819fa6530c8ea92d3be313

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\SystemPropertiesAdvanced.exe · not signed

62ce44c554e60e10e22cbd574c7669bab610fa44fbf281c3ec370bed2b5f03ba

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\SystemPropertiesAdvanced.exe · not signed

e90178cd5d69d17835e09664d22a7e33c7f202ff93a819d6967a555aee776699

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names SystemPropertiesAdvanced.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.