CmdID

CmdID / Files

notepad.exe

Notepad file version info

Program on Windows 14 known copies with hashes 15 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real notepad.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
C:\Users\user\AppData\Local\Microsoft\WindowsApps\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionNotepad

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\notepad.exe · signed by Microsoft Windows

17c972846e7994e3614a31abf09980ef6e85f8a3214e8848dc2f974959a4e4b7

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\notepad.exe · signed by Microsoft Windows

a0a21df8603efafa3ee50e318b9fb2790eef1f66a2391b35f754c899e2f1a979

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\notepad.exe · signed by Microsoft Windows

236f5a0247ba02eab637157dc792ada4af59347b2f07ed754124e22280dc5258

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\notepad.exe · signed by Microsoft Windows

2f3daf08b248b0a8aa0c47ba81864be7d379a0229599cdec3b93281b57fcd280

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\notepad.exe · signed by Microsoft Windows

87f53bc444c05230ce439dbb127c03f2e374067d6fb08e91c834371fd9ecf661

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\notepad.exe · signed by Microsoft Windows

ca2837031952c32bc1639a416f5c2adceebf33507d216e554a3b47b17c52e9b1

10.0.18362.693 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\notepad.exe · signed by Microsoft Windows

669c3895574bfb3892362c55343661752a472a279c418d67b90015a947d0907c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\notepad.exe · signed by Microsoft Windows

e5d90beeb6f13f4613c3153dabbd1466f4a062b7252d931f37210907a7f914f7

10.0.17763.475 (WinBuild.160101.0800) · C:\Windows\SysWOW64\notepad.exe · signed by Microsoft Windows

2cc3ec4f97e1a018b2f5a92e088775214aa2b0abf2814dca8242414fa2a88718

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\notepad.exe · signed by Microsoft Windows

a92056d772260b39a876d01552496b2f8b4610a0b1e084952fe1176784e2ce77

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\notepad.exe · signed by Microsoft Windows

9cd1c3d00ae15068ddb5f9103c517768fdc9c2ed8d7f6a729cde9314c591874a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\notepad.exe · signed by Microsoft Windows

da0acee8f60a460cfb5249e262d3d53211ebc4c777579e99c8202b761541110a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\notepad.exe · not signed

0f8a84968fac3cadc04471c1ee5c4644414491c89a4a7149845c170258b6a6d1

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\notepad.exe · not signed

7fbfab17fe55578159f482a3c9741f02ef5c15c939f4bf1c7b164faa0ab6dda3

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name notepad.exe
highPotentially Suspicious Child Process Of Regsvr32elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
highSuspicious Child Process Of BgInfo.EXENasreddine Bencherchali (Nextron Systems)
highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)
highSuspicious Child Process of AspNetCompilerNasreddine Bencherchali (Nextron Systems)
highSuspicious Process ParentsFlorian Roth (Nextron Systems)
highSuspicious Provlaunch.EXE Child ProcessNasreddine Bencherchali (Nextron Systems)
mediumPotential Provlaunch.EXE Binary Proxy Execution AbuseNasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel
mediumPotentially Suspicious Child Process Of ClickOnce ApplicationNasreddine Bencherchali (Nextron Systems)
mediumSuspicious Cross-User Process SpawnSwachchhanda Shrawan Poudel (Nextron Systems)
lowNotepad Password Files DiscoveryThe DFIR Report

Sigma names notepad.exe in 15 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.