Odd results from file name query

Content Authoring
1

As part of a quick false pos test, I copied svchost.exe from the system32 folder to the desktop, rename it to vmchost.exe and copied it back to the system32 folder…

I then , in q&A entered.

exists file “C”\windows\System32\svchost.exe"
and the answer came back true.

Soo… I then did exactly the same for vmchost.exe and it came back false.

I also did a files of folder “c:\windows\system32” and svchost.exe was there but vmchost.exe wasnt…
Also I noticed another file called VSSVC.exe and plugged that in, again, it returned False as did w32time.dll

Am I missing something really simple here?.. I tied upper and lowercase etc… I even used the client relevance builder to make sure I wasnt seeing things,

2

Is a 64Bits OS platform?
I could be due to WOW64 Redirection…

3

I wish… Yes it is Win 10 64 bit
I tried
exists file “svchost.exe” of system folder and got true
I then tried "exists file “vmchost.exe” of system folder and got false…
to check, i then tried
system folder in q&A and got back C:\WINDOWS\system32

4

what if you do:

exists x64 file "C:\Windows\System32\vmchost.exe"

It seems the file lives in C:\Windows\SysWOW64 and not in the C:\Windows\System32 directory.

1 Like
5

Thanks… That works but…
(sha1 of it) of ( files of descendant folders of folder “C:\Windows”) whose (name of it = “vmchost.exe”)
would need some tweaking .

6

Aha… i think I found it… jgStew’s page is of great help.

The Final answer is…
q:(sha1 of it) of ( files of descendant folders of folder “C:\Windows”; files of descendant folders of x64 folder “C:\Windows” ) whose (name of it = “vmchost.exe”)

1 Like