CmdID

CmdID / Files

SystemSettingsAdminFlows.exe

Settings file version info

Program on Windows 9 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SystemSettingsAdminFlows.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSettings

9 known copies

10.0.22000.184 (WinBuild.160101.0800) · C:\WINDOWS\system32\SystemSettingsAdminFlows.exe · signed by Microsoft Windows

c4a16b59cdbb46171e19953e64b430c7416843cc403353b4e34d4fd7e0ab6f88

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SystemSettingsAdminFlows.exe · signed by Microsoft Windows

1bf68447cd5c0d63224de11650ef913f672894a2818ef2294b5a63c5d630ecb0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SystemSettingsAdminFlows.exe · signed by Microsoft Windows

72d72f950fb618710f91da59361cf4b8b6bb703610efb5da2501987a28fffc84

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SystemSettingsAdminFlows.exe · signed by Microsoft Windows

a7a2e7122d27308df37b7ab718ef3ac239e4216669f51331e34e205f59fb0aec

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SystemSettingsAdminFlows.exe · signed by Microsoft Windows

f4235b47a8d5d43dcde8abf5219bc80ddfb8da34ae44bace23653799b48ffffb

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SystemSettingsAdminFlows.exe · signed by Microsoft Windows

9f06b26977bf18bd8d8c149b2b100d0f1510d80e39b6d6108e0f09958854aba1

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\SystemSettingsAdminFlows.exe · signed by Microsoft Windows

893c0583ca6425d21a658e96bb6d6e7bd0f2b7e9269c1d1bf327bef9c2d38baa

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\SystemSettingsAdminFlows.exe · signed by Microsoft Windows

c93ef792b92d6d5f4423abcfda9fe1b2b2c60be247447d80b6efd7c58ada4478

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\SystemSettingsAdminFlows.exe · signed by Microsoft Windows

10ad604a4975ffd35649048e37267f9abf7bbe074a990cbbda7c18fac5e22a60

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name SystemSettingsAdminFlows.exe
highPotential Signing Bypass Via Windows Developer FeaturesNasreddine Bencherchali (Nextron Systems)
highWindows Defender Disabled Via SystemSettingsAdminFlows.EXEChirag Damani (KPMG India), Swachchhanda Shrawan Poudel (Nextron Systems)