CmdID

CmdID / Files

VC_redist.x64.exe

Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23506 file version info

Program on Windows 3 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real VC_redist.x64.exe?

file version info and known copies
Installed inC:\ProgramData\Package Cache\00000000-0000-0000-0000-000000000000\packages\vcRedistD14\
C:\ProgramData\Package Cache\{00000000-0000-0000-0000-000000000000}\
Signed byMicrosoft Corporation
ProductMicrosoft Visual C++ 2015 Redistributable (x64) - 14.0.23506, Microsoft Corporation
DescriptionMicrosoft Visual C++ 2015 Redistributable (x64) - 14.0.23506

3 known copies

14.24.28127.4 · C:\ProgramData\Package Cache\{00000000-0000-0000-0000-000000000000}\VC_redist.x64.exe · signed by Microsoft Corporation

de1acbb1df68a39a5b966303ac1b609dde2688b28ebf3eba8d2adeeb3d90bf5e

14.0.23506.0 · C:\ProgramData\Package Cache\00000000-0000-0000-0000-000000000000\packages\vcRedistD14\VC_redist.x64.exe · signed by Microsoft Corporation

4504cd3bbccdd7efb9ec68261d57a04c2c8d704812c56856f4786ac90f7f00a8

14.0.23026.0 · C:\ProgramData\Package Cache\00000000-0000-0000-0000-000000000000\packages\vcRedistD14\VC_redist.x64.exe · signed by Microsoft Corporation

5eea714e1f22f1875c1cb7b1738b0c0b1f02aec5ecb95f0fdb1c5171c6cd93a3

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names VC_redist.x64.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.