CmdID

CmdID / Files

TSTheme.exe

TSTheme Server Module file version info

Program on Windows 14 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real TSTheme.exe?

file version info and known copies
Original nameTSThemeS.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionTSTheme Server Module

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\TSTheme.exe · signed by Microsoft Windows

1e80eb01f65b9352f184846fdeedc2d0fdf9838c261151c8e3aafe3ec3d3d3cb

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\TSTheme.exe · signed by Microsoft Windows

89a145da05986fa6870f19e37750417c9184ef4120102de9c6d07f35c9860a56

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\TSTheme.exe · signed by Microsoft Windows

d574a6ca42d1a50b3115a916e62a4cc5ab92833dff4a3f2ccf85a2ea2512a6f3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\TSTheme.exe · signed by Microsoft Windows

0a827cb624fb1dd5743dd5706a60ffed477988d4e939c6876bbce398f2574065

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\TSTheme.exe · signed by Microsoft Windows

31114f153f14d9aabd425d75a0f3f87d68a3a4c30e6185d9c040b86ae6470cee

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\TSTheme.exe · signed by Microsoft Windows

8c43c3947c1d6599e9f115eb82c6e6829fa3affd993f0b4207a1e3bf023d1fe8

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\TSTheme.exe · signed by Microsoft Windows

3f9befad2fdad5d2dc4cebd61a909f45f5ef5e900256bba51fe30d8fe2d63cb6

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\TSTheme.exe · signed by Microsoft Windows

718f32125a1f03daa778cb3a01bd18e782b653d613add53670e6670775c018b2

10.0.17763.771 (WinBuild.160101.0800) · C:\Windows\SysWOW64\TSTheme.exe · signed by Microsoft Windows

e518e9415190bc504c9e4fe8b477006d9f8ca6901b9d4888a5b09c848c5c1246

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\TSTheme.exe · signed by Microsoft Windows

0da195aecd8794062ab5cb3bdef2be0230c1e76050c7b11cf609e4f3f23a9ddc

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\TSTheme.exe · signed by Microsoft Windows

5edb8f164b5cacaefc551e3d0ea0971e5da1ab144ab66fe429bc7e5dcb2fcc3c

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\TSTheme.exe · signed by Microsoft Windows

b220104b36a01f1202efe45beaeec3227927dcdaf364239cff90724430b2bca0

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\TSTheme.exe · not signed

d4af506c47ab433de90ca6e9fe81eee8ff12997a601c5ea923cc10e3f992b087

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\TSTheme.exe · not signed

dbdf0c85b1a39656e616e428fcefedc930761acc5cf2846bbf8e60610016142a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names TSTheme.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.