CmdID

CmdID / Files

mspaint.exe

Paint file version info

Program on Windows 11 known copies with hashes 5 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real mspaint.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
C:\Users\user\AppData\Local\Microsoft\WindowsApps\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionPaint

11 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mspaint.exe · signed by Microsoft Windows

8bd3c3d2a3e6285d004afd50262d80939fa588b39c5ecb404d12d364216e73b2

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\mspaint.exe · signed by Microsoft Windows

94aa32a2c9c1d2db78318d9c68262c2f834abe26b6e9a661700324b55fdd5709

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\mspaint.exe · signed by Microsoft Windows

fdb5a84bf619cfdb6bbf6c88d657724574ec67393afad56443f0c173bf1afef5

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\mspaint.exe · signed by Microsoft Windows

56c40b4339f6bc2a5215d87f6090d2200fb998321097499b28edaac5299c89c0

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\mspaint.exe · signed by Microsoft Windows

f1e3d8851c7b41e3838eae69a95224c92abd9a33117238ef9730233b5b14cdc2

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\mspaint.exe · signed by Microsoft Windows

615cffe98cad0db5f7f261ce915f13bbbc22378bb2a80591d38205d5658a8092

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mspaint.exe · signed by Microsoft Windows

c6ca40efb55f70c704b7686de8ff1db7cc9b1c8dfe1754cb046f77df73d99fb4

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\mspaint.exe · signed by Microsoft Windows

5e832c11fba0b0f2bcab3b105ff7d63ac7a1a766d11282d50ecee9bb038771f5

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\mspaint.exe · signed by Microsoft Windows

a0f9da1f12975c7ddb6366110a92c69e5a95c4b8362ee28777d4a52e71d2454e

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\mspaint.exe · not signed

7e1dc886af729071fc931c631815ec6ce25bee7e58e775055d60f728f9b62aed

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\mspaint.exe · not signed

db3516dbf69d16183421429b8005a01affaef361c6d1fa5a06591ea0eb38854e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name mspaint.exe
mediumSuspicious Cross-User Process SpawnSwachchhanda Shrawan Poudel (Nextron Systems)

Sigma names mspaint.exe in 5 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.