CmdID

CmdID / Files

WinRTNetMUAHostServer.exe

WinRTNet MUA HostServer EXE file version info

Program on Windows 8 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real WinRTNetMUAHostServer.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWinRTNet MUA HostServer EXE

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\WinRTNetMUAHostServer.exe · signed by Microsoft Windows

0989d675690742b93294ec8966105c7d0ae00535ba676b6a16e1d933a4abc71c

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WinRTNetMUAHostServer.exe · signed by Microsoft Windows

7c970a0ebe97a2c142dc6ef6a10091cf75e17187a88b39c7697cbef198a632fc

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\WinRTNetMUAHostServer.exe · signed by Microsoft Windows

125ed1da6800e0f3ef61a81ef05fbb517a8b1424f5fbb51aa8f3149e0f683248

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe · signed by Microsoft Windows

7d571b976294a32ec7602b287f99319d8aa9218147eb5d3219a95c40faeba171

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WinRTNetMUAHostServer.exe · signed by Microsoft Windows

0763b8a990bab988bdbd3aab258b587a634fcdadc204a9b36b9abe10cdaf4a83

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe · signed by Microsoft Windows

2167d6c0bdf6067f35e2928d6a8fb96d5ce13dd2a0967e03534ffd3d3dd6e0a8

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\WinRTNetMUAHostServer.exe · signed by Microsoft Windows

ab2c203d7c4d0ce260c09760e0cafa3706f02826b17d140b5a31b2662ef6e4d8

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WinRTNetMUAHostServer.exe · signed by Microsoft Windows

f851e890a7ac01b7fdc12abb355c5e321a1c579f8a385235a77dbfdc20b43d4b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names WinRTNetMUAHostServer.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.