CmdID

CmdID / Files

WinSAT.exe

Windows System Assessment Tool file version info

Program on Windows 6 known copies with hashes 4 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real WinSAT.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows System Assessment Tool

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WinSAT.exe · signed by Microsoft Windows

938cb65aca949a1f0fe2cc2cc4eb75a709178ee8572626fa7cf751a99857bc85

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WinSAT.exe · signed by Microsoft Windows

cc31fdcdce05144ef750b01233d57614cda7364a73ca26ff68886ebdc650e367

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WinSAT.exe · signed by Microsoft Windows

d25b452ccc0fe3a5e39b9baecd913afd15758428b52b0c1f50ac85aca2d3405a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WinSAT.exe · signed by Microsoft Windows

e75d84511e577234fc62bf43894db0f3995dc06dac2148722b9c9a81f9c182ff

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\WinSAT.exe · signed by Microsoft Windows

2380049e6e56b969990c598a3731e8322e8def86b08dfe44e452392cf529498d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\WinSAT.exe · signed by Microsoft Windows

4793022c1474ad98e1f8f075111afa2a01bffdfb995802bff878458852c44787

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names WinSAT.exe in 4 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.