CmdID

CmdID / Files

tpmvscmgr.exe

TPM Virtual Smartcard Setup Utility file version info

Program on Windows 6 known copies with hashes 1 Sigma rule names it Command tpmvscmgr

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real tpmvscmgr.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionTPM Virtual Smartcard Setup Utility

6 known copies

4.00 (winblue_rtm.130821-1623) · C:\windows\system32\tpmvscmgr.exe · not signed

7191ba350f924cd2c059f0244a2a933656d19a66e99e05d079d7e95bd2634b92

4.00 (rs1_release.160715-1616) · C:\Windows\system32\tpmvscmgr.exe · signed by Microsoft Windows

61f2f6757dbb57213e7391841cf342bca2cf0bfeb904a9bb273fb1d9aaa7beb6

4.00 (WinBuild.160101.0800) · C:\WINDOWS\system32\tpmvscmgr.exe · signed by Microsoft Windows

340a8afbc9249095e01a719af753e8e6f78b7c0d7515b8e31ba514ad25023861

4.00 (WinBuild.160101.0800) · C:\Windows\system32\tpmvscmgr.exe · signed by Microsoft Windows

4363b665cb1b4b724716d7e287fe770d8c38c76aa78fa0d1cbcd1c9bc1c2b02c

4.00 (WinBuild.160101.0800) · C:\Windows\system32\tpmvscmgr.exe · signed by Microsoft Windows

93bac4d5013074dbe590beded6cf4a9cff601ac0dacfaafa79d8cfb698fe7b4c

4.00 (WinBuild.160101.0800) · C:\WINDOWS\system32\tpmvscmgr.exe · signed by Microsoft Windows

c31a0574845887a49371b1a26520768e32c3e46644e6e9fc8d3443a0537c9ab5

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name tpmvscmgr.exe
mediumNew Virtual Smart Card Created Via TpmVscMgr.EXENasreddine Bencherchali (Nextron Systems)