CmdID

CmdID / Files

winrs.exe

winrs file version info

Program on Windows 12 known copies with hashes 2 Sigma rules name it Command winrs

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real winrs.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
Descriptionwinrs

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\winrs.exe · signed by Microsoft Windows

a15fc3dff119890c80ecdd68dfa976c1b739fbad4b5344968401185437dd863f

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\winrs.exe · signed by Microsoft Windows

f7e425caef7f3f3fb7f42c9236256873a1f1f0fabf86f399baf136c52a0dbe2e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\winrs.exe · signed by Microsoft Windows

00b00f9e2a62550136f2d80428bdce22c8fe718784b7f8dafc29c18bfd782bdf

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\winrs.exe · signed by Microsoft Windows

c0dd2782705893496765cd83ba9be23c8c1b279f5b943756c380219a5be15a6e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\winrs.exe · signed by Microsoft Windows

700acd72ebc15130b66048b7e7d3282a17a8aba24092d871620955883a1160a6

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\winrs.exe · signed by Microsoft Windows

b7e282fbd9c7ca9916f5148449035273629ccd133e109e4b62c6ea11e8e18baf

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\winrs.exe · signed by Microsoft Windows

02abc26a1f1fb25cb24992bf62eeab05b570e1310f64aaa1cb1433f7ba77b3bb

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\winrs.exe · signed by Microsoft Windows

83790021f6315747decce5a9e15006dcda7a7e7003660b5b3d07d1862261e73a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\winrs.exe · signed by Microsoft Windows

27bdfc7b4733c7ed80ebb3682ecd556226cf7e6467c1c1b674160e6b4cb64381

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\winrs.exe · signed by Microsoft Windows

6d4d5950d1effb6004aa02ddd9fe0b58e953ebfcee6466e96c1051830d266b3d

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\winrs.exe · not signed

00696555cbf6db83af785f8acb2270b9411cfc75e7f6d3ece0ec1ae146ad5acf

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\winrs.exe · not signed

72a6b1395f06e655efc00db5181d04a1f38b48bf378fefe111ea7a04ba1bbc05

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name winrs.exe
highWinrs Local Command ExecutionLiran Ravich, Nasreddine Bencherchali

Sigma names winrs.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.