CmdID

CmdID / Files

where.exe

Where - Lists location of files file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it Command where

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real where.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWhere - Lists location of files

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\where.exe · signed by Microsoft Windows

5c6e1b1aa94bab489ef1e42d9da921602a34c690be99eb77fd167becd9d4b6b6

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\where.exe · signed by Microsoft Windows

d2cf8a98d52c4f15e63a5b5bc925768f15606cf3f477eeb7effa39d408286e45

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\where.exe · signed by Microsoft Windows

a19f7b783bc5611095d577f5eccc12069ca2b5e92bbe37f415429bb72c09792c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\where.exe · signed by Microsoft Windows

d591f730f356d7623d8b6dfe5df48cb994322ca98f88ce2278efd4090767dfa0

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\where.exe · signed by Microsoft Windows

0da0911372136e3a1e78a4e118f51c7b82a6e1e71580d44daa4c529d4ecd65d8

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\where.exe · signed by Microsoft Windows

2d6548ef07be461a9849655debe8a2cafafa48e6f40d14e09f4bafd630051566

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\where.exe · signed by Microsoft Windows

e4220435f20b966623b7646c247397ddaf5ce0d8a2a5ef2bc9915e6d111ea765

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\where.exe · signed by Microsoft Windows

fd9d35cae2120c38cb96d38f040737ca80e41f1fc59b1b02324efb7e091aa255

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\where.exe · signed by Microsoft Windows

ec3f1675fa9dc29391ac76f37ef9ade0c437524a256f52c9bd820d53cbb77c75

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\where.exe · signed by Microsoft Windows

f949863f5e351eeb5054f04f181fe582e98cb322100956ed938538523258440c

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\where.exe · not signed

7bd13c1348f438e3ef20a69d46316ebbf2af2e73da23f643e38cf0290785560e

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\where.exe · not signed

9323d73e1129eebda48815d13b944098bf4fba87713a086c49dd53bf2ed70103

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name where.exe
lowSuspicious Where Executionfrack113, Nasreddine Bencherchali (Nextron Systems)