CmdID

CmdID / Files

HelpPane.exe

Microsoft Help and Support file version info

Program on Windows 7 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real HelpPane.exe?

file version info and known copies
Installed inC:\Windows\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Help and Support

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\HelpPane.exe · signed by Microsoft Windows

c78ed77036d2eacc60052a51dfdd1140e3c7607385669787f9b0bab1609614a0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\HelpPane.exe · signed by Microsoft Windows

42c2c94edf6f5e2e75556f455039cacd8a23bc825e8beef864b8572c3007db5a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\HelpPane.exe · signed by Microsoft Windows

587943f7a42fc21d636b3bae0cad17d66e9aa919f0689730a01a77035f7bd767

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\HelpPane.exe · signed by Microsoft Windows

552016ef8396341e1b9ff6309ef256d0d1eb4bc864ee70fdf1601d25a5cf1535

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\HelpPane.exe · signed by Microsoft Windows

61a42c1904275294e6d1446f53275c64a752d0bfe362b03ed5f4ecc7dcbfa7b3

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\HelpPane.exe · signed by Microsoft Windows

f6eaa159fc107b8f98a31dcea4eca8c98b0cab71c28eb81de3dee14e9c611009

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\HelpPane.exe · not signed

a80f927c1cf42200a2777121d013c2a4a09403e3fe15559b857cbc6eb489b66e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name HelpPane.exe
highSuspicious Debugger Registration CmdlineFlorian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro

Sigma names HelpPane.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.