CmdID

CmdID / Files

py.exe

Python file version info

Program on Windows 2 known copies with hashes 1 Sigma rule names it Command py

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real py.exe?

file version info and known copies
Installed inC:\Windows\
Signed byPython Software Foundation
ProductPython, Python Software Foundation
DescriptionPython

2 known copies

3.10.0 · C:\Windows\py.exe · signed by Python Software Foundation

a401bccfb176072c5ff8fb9d45b8d01eced317e17d6dda32f7c923aa6f624ae9

3.8.5 · C:\Windows\py.exe · signed by Python Software Foundation

3fb48f90da0aedef025507267d2018e585b1b9cb4543216ed44633c2e637223b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name py.exe
highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali