CmdID

CmdID / Files

python.exe

Python file version info

Program on Windows 19 known copies with hashes 11 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real python.exe?

file version info and known copies
Installed inC:\program files\Blender Foundation\Blender 2.83\2.83\python\bin\
C:\program files\Blender Foundation\Blender 2.83\2.83\python\lib\venv\scripts\nt\
C:\Program Files\Inkscape\bin\
Signed byPython Software Foundation
ProductPython, Python Software Foundation
DescriptionPython

19 known copies

7.0.0.3 · C:\program files\LibreOffice\program\python.exe · signed by The Document Foundation

71df1128e67794ec1009ae98469d0e75475cbfc7596cc1e7b94045719c3d2599

3.10.0 · C:\Program Files\Python310\python.exe · signed by Python Software Foundation

94a83686261e9364cf3386b61a01a9f70936e8547da8962d16f1f850226b8954

3.10.0 · C:\Program Files (x86)\Python310-32\python.exe · signed by Python Software Foundation

afb4086e05efb086481f8faa67541157d54eddf0a13f1b3bc6ff884500db3a1d

3.10.0 · C:\Program Files\Python310\Lib\venv\scripts\nt\python.exe · signed by Python Software Foundation

beefaea165effa6069ba50bdd4d3a5cb7bcd6173629dd879af45985129e9038b

3.10.0 · C:\Program Files (x86)\Python310-32\Lib\venv\scripts\nt\python.exe · signed by Python Software Foundation

f93c1acd1da60f2cac188f1e42f1a9569ea207447d0b9b9a90fec368591072bc

3.8.5 · C:\Program Files\Python38\python.exe · signed by Python Software Foundation

052f8b35eee3a2b59ca479cf5a9f2d95c08f2394f1730d0233cc79c5cebaa3df

3.8.5 · C:\program files (x86)\Python38-32\python.exe · signed by Python Software Foundation

8e7f8fdf83e117ecd8b0a403608c8d17cc3c7c6cac66d9f07ca66d6322a465cf

3.8.5 · C:\Program Files\Python38\Lib\venv\scripts\nt\python.exe · signed by Python Software Foundation

a472a9f70621ffc769109ca47edf3e55d67c3d7ed2e2e1883445f73675aba795

3.8.5 · C:\Program Files\Inkscape\bin\python.exe · not signed

c0f76acf40f5fffcba80e645dcb427c80e140b0471702c83da381dca08cc3ef5

3.8.5 · C:\program files (x86)\Python38-32\Lib\venv\scripts\nt\python.exe · signed by Python Software Foundation

cc6ea536f3c518f288fa9b702f76532b1d19d27f271c6ccd249523d01f822006

3.8.2 · C:\program files\Inkscape\bin\python.exe · not signed

91dd763b7d0ab19f12930190837e2e354e05d092d6db113380761c54f1aec7db

3.7.7 · C:\Program Files\Blender Foundation\Blender 2.90\2.90\python\bin\python.exe · signed by Stichting Blender Foundation

137d3b3426a0699d7c8696530abaaea82a5abff00db27d6258c297acb6fe3800

3.7.7 · C:\program files\LibreOffice\program\python-core-3.7.7\bin\python.exe · not signed

592038fd66af784be28fddcd55a0b98a1c9140a8847105a713e3b8dbdbaac7c7

3.7.7 · C:\Program Files\Blender Foundation\Blender 2.90\2.90\python\lib\venv\scripts\nt\python.exe · signed by Stichting Blender Foundation

603d9f0696d6500d4168cb6f5a3ae6d07915e6bf215b97985909151c72713f7c

3.7.4 · C:\program files\Blender Foundation\Blender 2.83\2.83\python\lib\venv\scripts\nt\python.exe · signed by Stichting Blender Foundation

6d74a93c1d217d40673bfdfee212f7887ef8359082c09f6707df0950e39bb237

3.7.4 · C:\program files\Blender Foundation\Blender 2.83\2.83\python\bin\python.exe · signed by Stichting Blender Foundation

b5b7ada52838f95760854848c14654e74d65b7496abe476ccb35f1ab4be686ed

3.7.4 · C:\Program Files\Blender Foundation\Blender 2.83\2.83\python\lib\venv\scripts\nt\python.exe · signed by Stichting Blender Foundation

e21ba13b212dd3638383a5c7dd1ac3e1f139c670c3fef2256442e965f25235c7

3.7.4 · C:\Program Files\Blender Foundation\Blender 2.83\2.83\python\bin\python.exe · signed by Stichting Blender Foundation

fdd16c500862b6943dbc17c5ac85946e1372813efc6e34edbed5ce6d0f0a19bb

Version not recorded · C:\program files\GIMP 2\bin\python.exe · not signed

233fdebe086722c8b46b244632bd1d30c586d6d14e0472b888e9a9ae5492601e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name python.exe
highHackTool - Pypykatz Credentials Dumping Activityfrack113
highPython Spawning Pretty TTY on WindowsNextron Systems
highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
mediumPython Inline Command ExecutionNasreddine Bencherchali (Nextron Systems)
mediumSuspicious Child Process of SAP NetWeaverElastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
mediumSuspicious Msbuild Execution By Uncommon Parent Processfrack113
lowPUA - Adidnsdump Executionfrack113

Sigma names python.exe in 11 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.