CmdID

CmdID / Files

mc.exe

Windows Message Compiler file version info

Program on Windows 3 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real mc.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\
Signed byMicrosoft Corporation
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Message Compiler

3 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\mc.exe · signed by Microsoft Windows Kits Publisher

1a0793bfb8f0f8e14592591ce61369432aede5731564550246b33fb9821b4025

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\mc.exe · signed by Microsoft Corporation

7ea8bd997394c33fb04f1466f667a28ae5df62b8457b43abf6be106682d842d5

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\mc.exe · signed by Microsoft Corporation

8f6403f5c28e71d9db6b0a20ec73048d8642e71c4d13fdf39cde10c5a6bea863

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name mc.exe
highPotential PlugX ActivityFlorian Roth (Nextron Systems)