CmdID

CmdID / Files

wbxreport.exe

WBXReport Module file version info

Program on Windows 1 known copy with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wbxreport.exe?

file version info and known copies
Installed inC:\ProgramData\WebEx\WebEx\T33_TC\
Signed byCisco WebEx LLC
ProductWBXReport Module, Cisco Webex LLC
DescriptionWBXReport Module

1 known copy

3303.0.1806.2000 · C:\ProgramData\WebEx\WebEx\T33_TC\wbxreport.exe · signed by Cisco WebEx LLC

8a7d2ceb79578718f6053ffc91719fcdee16189277bfdd0d27e098424a171979

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name wbxreport.exe
mediumUse Short Name Path in Command Linefrack113, Nasreddine Bencherchali