CmdID

CmdID / Files

Taskmgr.exe

Task Manager file version info

Program on Windows 18 known copies with hashes 10 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real Taskmgr.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionTask Manager

18 known copies

10.0.22000.65 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Taskmgr.exe · signed by Microsoft Windows

efc4a6fb997c06367d39b536fa47ff1456587a8bd5aaee74a1da6b263674a585

10.0.22000.184 (WinBuild.160101.0800) · C:\WINDOWS\system32\Taskmgr.exe · signed by Microsoft Windows

d5d9ff3aabfb524d80bfd5f457b40a3bd1ee757cd93806f88fba57b7cae88a2a

10.0.19041.662 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Taskmgr.exe · signed by Microsoft Windows

5c5c162b1b5688faa1928380829e4bdb12a84e07893a6c1ec39fedba1464d81d

10.0.19041.662 (WinBuild.160101.0800) · C:\Windows\system32\Taskmgr.exe · signed by Microsoft Windows

793ca2ed06301d0ae8bb590254380e71a91e0efdedce825fb9367d31d02b1d27

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Taskmgr.exe · signed by Microsoft Windows

2cd93add1272e528e4d46a24f06cafe4dac90efdc509b49e168ea164be495803

10.0.19041.1202 (WinBuild.160101.0800) · C:\Windows\system32\Taskmgr.exe · signed by Microsoft Windows

4e305198f15bafd5728b5fb8e7ff48d9f312399c744ecfea0ecac79d93c5e478

10.0.19041.1202 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Taskmgr.exe · signed by Microsoft Windows

4f5ce43a424f1970c3a4d53ebd57c158180f30d60c71db329ee9eac772ef3bfa

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Taskmgr.exe · signed by Microsoft Windows

1ab19c256e8141381b16bd17a9673ca6f7802a21e0be11360aef8a01a8cdf9ea

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Taskmgr.exe · signed by Microsoft Windows

83c76db0cc6940e9c653f346a560090be2b782168b3e04ad8bbac791d33272fa

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Taskmgr.exe · signed by Microsoft Windows

9095106c3229e14fb7f2b61f45abf93e9b51f0cdab4540b5e8fb9df1ea399ed4

10.0.18362.693 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Taskmgr.exe · signed by Microsoft Windows

f7610c1d3eb0462c38982c2aaf48a1fc5dedb73131651eaf3ed3a0ef45ec1b1d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Taskmgr.exe · signed by Microsoft Windows

0af6b3f8628e38b1551ec76277e482f8a2605b661f57c164c47acebb14b1a81b

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Taskmgr.exe · signed by Microsoft Windows

b24f923d5a76b34b519f1065c6fbb533f2e52a372a2aec2f844bc3f1540a1dd5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\Taskmgr.exe · signed by Microsoft Windows

8a6b7bce25506a2d7b2b4449404cc312794051db3aa1bb964cdac956e930cad5

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\Taskmgr.exe · signed by Microsoft Windows

ccd091f425bb9b09da3e293e33385786f1c9157dcde60cf774fc55530760f537

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\Taskmgr.exe · signed by Microsoft Windows

de72dcb5e14f7d6a4b3e55b273a10a16c6de77dbb7a6f8575ea14e52aa58583c

1, 0, 0, 1 · C:\Windows\SysWOW64\Taskmgr.exe · signed by Microsoft Windows

4100f871176efaa670405c7804a5abc05e22539135a69da811e5ca869c7579fd

1, 0, 0, 1 · C:\Windows\system32\Taskmgr.exe · signed by Microsoft Windows

4c18494b7e20c8cfff308b5196f10d4c14cd81579ec14ed53013d05f54a7f5a4

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name Taskmgr.exe
highPotential BlackByte Ransomware ActivityFlorian Roth (Nextron Systems)
highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
highTaskmgr as LOCAL_SYSTEMFlorian Roth (Nextron Systems)
lowNew Process Created Via Taskmgr.EXEFlorian Roth (Nextron Systems)

Sigma names Taskmgr.exe in 10 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.