CmdID

CmdID / Files

Utilman.exe

Utility Manager file version info

Program on Windows 16 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real Utilman.exe?

file version info and known copies
Original nameutilman2.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionUtility Manager

16 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Utilman.exe · signed by Microsoft Windows

a86203121c16fefa7b22ebca332eeaae2fe320e230ba0295807ca7856249f7e0

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Utilman.exe · signed by Microsoft Windows

ef6074adef9da1cca918668221e1cc8e44dc9c82f954f524c58a745a9c41c0da

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Utilman.exe · signed by Microsoft Windows

15690da8f4651c5f67170d672b54f463faf664e43903f35ac0db0b0176db61ae

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Utilman.exe · signed by Microsoft Windows

9320fa0d6f39ef9650b0bbacaf413977d0d9d8beda578e75eb30c2e73f5011b2

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Utilman.exe · signed by Microsoft Windows

20f42dbd52a5ed36212e818fa6aead8beb132e79bd8e24f3d8e3eb02e27a8dd2

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Utilman.exe · signed by Microsoft Windows

29e406a9926da88330a9ca81bb16732e6b1693a61701e641b62634b71c384430

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Utilman.exe · signed by Microsoft Windows

b5bc4fce58403ea554691db678e6c8c448310fe59990990f0e37cd4357567d37

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Utilman.exe · signed by Microsoft Windows

fc6dfd41f75bb4640767be808a2d890ac7654aaf2c505455732d9f6290f9a030

10.0.18362.449 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Utilman.exe · signed by Microsoft Windows

c90b74a19a4ba412f70734ecd5cb27b35e8383fae1b15241842ea4d4af8e205b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Utilman.exe · signed by Microsoft Windows

877fb7458dbe7d8adf4849c5157915d66f1ae0abe08b4787fb4369e0822456a2

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\Utilman.exe · signed by Microsoft Windows

006eab15d43639b420ac7380a923230cb47d96f35a0b0377538ff49725efc23e

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Utilman.exe · signed by Microsoft Windows

8a05a4990c0370142ddfec7d489737ccc4b96fafe0a80e06af7ae04a1c7be722

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\Utilman.exe · signed by Microsoft Windows

0f1f018863bf9b2afadd6861f290be90d6b28981756d93499aa7c87f5bdafb23

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\Utilman.exe · signed by Microsoft Windows

4b4b20bb9bfcf79c2aa4edc39c649ca6244851b95b1f3842a187450d4e2bebe1

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\Utilman.exe · not signed

bc805cd4495d26926171d3ac40d6730870d8c81880dbd0d4ab5f9a25b3fcebdd

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\Utilman.exe · not signed

e45961a8602ebf4bfd718b2390ea37a823e0fe201f1873889454a838fbd29f21

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name Utilman.exe
criticalSticky Key Like Backdoor ExecutionFlorian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community
highSuspicious Debugger Registration CmdlineFlorian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro