CmdID

CmdID / Files

vcredist_x64.exe

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 file version info

Program on Windows 3 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real vcredist_x64.exe?

file version info and known copies
Installed inC:\ProgramData\Package Cache\{00000000-0000-0000-0000-000000000000}\
C:\ProgramData\Package Cache\00000000-0000-0000-0000-000000000000\packages\vcRedistD12\1033\
Signed byMicrosoft Corporation
ProductMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.21005, Microsoft Corporation
DescriptionMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.21005

3 known copies

12.0.21005.1 · C:\ProgramData\Package Cache\{00000000-0000-0000-0000-000000000000}\vcredist_x64.exe · signed by Microsoft Corporation

49c7d9d18847a3e956bfeda2a0916b55bd1f8e10cbe87a261a9c128276accbf8

12.0.21005.1 · C:\ProgramData\Package Cache\00000000-0000-0000-0000-000000000000\packages\vcRedistD12\1033\vcredist_x64.exe · signed by Microsoft Corporation

e8f443960b2f4a588902c3ed1603b07e29366b35d6cd1f06bc2544345d270d72

11.0.61030.0 · C:\ProgramData\Package Cache\{00000000-0000-0000-0000-000000000000}\vcredist_x64.exe · signed by Microsoft Corporation

507bdc3ab5a6d9ddba2df68aff6f59572180134252f5eb8cb46f9bb23006b496

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names vcredist_x64.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.