CmdID

CmdID / Files

pipanel.exe

Microsoft Tablet PC Component file version info

Program on Windows 2 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real pipanel.exe?

file version info and known copies
Original nameDummy.exe in the file’s header: a renamed copy still carries it
Installed inC:\Program Files (x86)\Common Files\microsoft shared\Ink\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Tablet PC Component

2 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe · signed by Microsoft Windows

5b86f9c50ea65d80beb33ba795d990cae58d4c0feb9a731ba27793516c441d7b

10.0.17763.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Common Files\microsoft shared\Ink\pipanel.exe · signed by Microsoft Windows

8da6e35e2095f405debed1f4128717d035ac0e4888f49a9e6b5945d4c8bc2157

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.