CmdID

CmdID / Files

winver.exe

Version Reporter Applet file version info

Program on Windows 12 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real winver.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionVersion Reporter Applet

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\winver.exe · signed by Microsoft Windows

9d3b7af75ad2cea3ed7b41b9bb68b795c44e06b0a2a755e215a3a53893c9bc5c

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\winver.exe · signed by Microsoft Windows

d0a1bddf1896c08f460addaff63230a3fdec1eec5e78f93e369a82e23e61e874

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\winver.exe · signed by Microsoft Windows

0f588a098af640a29c1651d17cafe662814943a4aad3bf4d043177f8298ede68

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\winver.exe · signed by Microsoft Windows

e8086c9fa7a33e4e6445dab05f79edf8e843945764b21b1024ad2fdb724037dc

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\winver.exe · signed by Microsoft Windows

b690e2e5d88755c443bda539df1a5e4a7b8357ca2d3fdb2ac905ad97954183a3

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\winver.exe · signed by Microsoft Windows

fe85e2b4a47940585a29c4680d1331a85ece3bdfb8ded7a28875e6aff2c13048

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\winver.exe · signed by Microsoft Windows

71e5e4b68b93e8b557fe0651e3d39c57279e694d07b42c67269224e2fc603aee

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\winver.exe · signed by Microsoft Windows

97c23b8888ffe8f4a9d9a0de8eda27cbe029049cf07e1164c2e79c3623139e42

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\winver.exe · signed by Microsoft Windows

08183eae546c9ec534f42cae05b8182c241551e032e7363f2f6a058f10e0a060

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\winver.exe · signed by Microsoft Windows

92e878d7767fe6e6f21c8d8c064b9601a3e7fbffb9874f995038db406ac08aec

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\winver.exe · not signed

cb6ffda6b795a63eeb2176cfe42f9de3209c973373417560e785647324e0e3e6

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\winver.exe · not signed

f71c8f75c886b60689574a7353fe79f3a140ea5c2263595354af7f8959ab485f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name winver.exe
highSuspicious Process ParentsFlorian Roth (Nextron Systems)
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)