CmdID

CmdID / Files

pip.exe

Program on Windows 7 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real pip.exe?

file version info and known copies
Installed inC:\Program Files\Python38\Scripts\
C:\program files (x86)\Python38-32\Scripts\
C:\Program Files (x86)\Python310-32\Scripts\

7 known copies

Version not recorded · C:\program files (x86)\Python38-32\Scripts\pip.exe · not signed

0da39b9f3573f390a31b3e6304672759e32899c0e627dd94321d5be9a035bb1f

Version not recorded · C:\Program Files\Python38\Scripts\pip.exe · not signed

11ece83d9a682aadb1d0d417c20a2e7ef26404abf04d57a11c9577f2fffb7337

Version not recorded · C:\Program Files (x86)\Python310-32\Scripts\pip.exe · not signed

152003bde24245002e90026a5eba84ef74163fc68cefae0e65d6705521fc141c

Version not recorded · C:\Program Files\Python310\Scripts\pip.exe · not signed

3444476030c58687242bdb62a4ebcba3f921671b0eeaba52472f84200f26d0d0

Version not recorded · C:\program files\Python38\Scripts\pip.exe · not signed

956f38244983a7eb7aa5bcade087e50a5cdeb315ff037771ebf01014cd965d66

Version not recorded · C:\Program Files\Python38\Scripts\pip.exe · not signed

f43dcc99bb95934078b6281a98f9ac1f8910cbca644bea07fbe53568fea2bd16

Version not recorded · C:\Program Files (x86)\Python38-32\Scripts\pip.exe · not signed

fdcaf7fc9ee259bd32ea7aa86a12864f9be60acda75a3d8d00f3206c7775ca4b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names pip.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.