CmdID

CmdID / Files

taskkill.exe

Terminates Processes file version info

Program on Windows 12 known copies with hashes 3 Sigma rules name it Command taskkill

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real taskkill.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionTerminates Processes

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\taskkill.exe · signed by Microsoft Windows

705ec4a1b9fd9651d84d3680afa74f4d73a4924710c68bbb5017004f62e96d02

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\taskkill.exe · signed by Microsoft Windows

7865857217786dc3dd1fa0b04ba410c7e2dff0b25ae512ff0b069a810b5b7adc

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\taskkill.exe · signed by Microsoft Windows

4e664b35e8de6c6b38e3231dfaf00744435ffb806e00355fece1e0cc1d2121c1

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\taskkill.exe · signed by Microsoft Windows

56f8cc2c1790c389394733b84c3fb55e10977e9f0fe0c08110ac11f0fe47f05e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\taskkill.exe · signed by Microsoft Windows

89d9bdf537ec43228448187779299ac347449361e067b0ad453bb54ad7edb37e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\taskkill.exe · signed by Microsoft Windows

d9e29313d2127ff1983a050d84626765d01682edb2c1c5d5f209dda20c3eab87

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\taskkill.exe · signed by Microsoft Windows

942e94f84340fa275fecfe87bc1caec8f667e9eea29e67f72e3f2e2546bb3197

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\taskkill.exe · signed by Microsoft Windows

9472f2da48163a7bf36af3d5a923957788721dce35a3da543cc5e7a1f5ca5475

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\taskkill.exe · signed by Microsoft Windows

0ea8c0267a76b543302c4258b78bc477aa8876767b7a526549cce34eef6d859f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\taskkill.exe · signed by Microsoft Windows

2e14a03c36069cd771b7296dbd3bb5b2194d6753d3d5ae1bc50a7d29aeecb667

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\taskkill.exe · not signed

031fa2ab892dd560fcfb87377eac92e0252b2026634c0530d2ed60c39b35d948

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\taskkill.exe · not signed

864d801aec0b788eb0880a4de45b202796273867cf08daf247b672a25704035b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name taskkill.exe
highSdiagnhost Calling Suspicious Child ProcessNextron Systems, @Kostastsale
highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)
lowProcess Terminated Via Taskkillfrack113, MalGamy (Nextron Systems), Nasreddine Bencherchali