CmdID

CmdID / Files

pythonw.exe

Python file version info

Program on Windows 14 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real pythonw.exe?

file version info and known copies
Original namepy.exe in the file’s header: a renamed copy still carries it
Installed inC:\program files\Blender Foundation\Blender 2.83\2.83\python\lib\venv\scripts\nt\
C:\Program Files\Inkscape\bin\
C:\Program Files (x86)\Python310-32\
Signed byPython Software Foundation
ProductPython, Python Software Foundation
DescriptionPython

14 known copies

3.10.0 · C:\Program Files\Python310\pythonw.exe · signed by Python Software Foundation

040d121a3179f49cd3f33f4bc998bc8f78b7f560bfd93f279224d69e76a06e92

3.10.0 · C:\Program Files (x86)\Python310-32\pythonw.exe · signed by Python Software Foundation

62779e382a5e5d099b2d5aee648b8dd4987114910495cf21dedd4fa6d6c51892

3.10.0 · C:\Program Files\Python310\Lib\venv\scripts\nt\pythonw.exe · signed by Python Software Foundation

8f67a7ae6f44fa2c2892ad83757baaf18b5b3be9f6becac66d6d6fea41c19819

3.10.0 · C:\Program Files (x86)\Python310-32\Lib\venv\scripts\nt\pythonw.exe · signed by Python Software Foundation

f5d4d657b9bf2d2332ed48699bb3fb752d1a25cf1ee4a6fa1534dca64abc346e

3.8.5 · C:\program files (x86)\Python38-32\pythonw.exe · signed by Python Software Foundation

2504c3eb12b8d0b7369ca3c387b6e875b0c20337adb4cfd23293df7ece550b38

3.8.5 · C:\program files (x86)\Python38-32\Lib\venv\scripts\nt\pythonw.exe · signed by Python Software Foundation

a0c0ffb73747c69160e0e05d8ca953ade25753fb71085ca9e87092bfb0a94cf7

3.8.5 · C:\Program Files\Python38\Lib\venv\scripts\nt\pythonw.exe · signed by Python Software Foundation

a2c24e369a1df747c41a3c0b8c879546b6bb79f94f6903785591007cd6a6ad08

3.8.5 · C:\Program Files\Python38\pythonw.exe · signed by Python Software Foundation

a98a2baf2065cc2ebd24a398b1c57f9bbca84e447132bd2b1be983ec831b54f7

3.8.5 · C:\Program Files\Inkscape\bin\pythonw.exe · not signed

d3c2ff52c22d7f2abd3dbee644311dee3f1f2c44c6a3eeae2d6477eba1fae067

3.8.2 · C:\program files\Inkscape\bin\pythonw.exe · not signed

9ad526ff7ee61dd2c312f84963ecf5c636c52e5891e9208c0ba5ec1cec1bacd3

3.7.7 · C:\Program Files\Blender Foundation\Blender 2.90\2.90\python\lib\venv\scripts\nt\pythonw.exe · signed by Stichting Blender Foundation

643cc34af7bb2cb95e1ba738626630cec3b0434844a9f43ea6e3d51e33c06bec

3.7.4 · C:\Program Files\Blender Foundation\Blender 2.83\2.83\python\lib\venv\scripts\nt\pythonw.exe · signed by Stichting Blender Foundation

ce805a6196f44c47e5e8ff59f07dcb817aff1861487653ae7ed698fb906ad92f

3.7.4 · C:\program files\Blender Foundation\Blender 2.83\2.83\python\lib\venv\scripts\nt\pythonw.exe · signed by Stichting Blender Foundation

ea0f00f26a97013f7d868c86211ed05dfb6e648431ab8a4019b647f9b5e2551a

Version not recorded · C:\program files\GIMP 2\bin\pythonw.exe · not signed

e971cbc554dffe1de1b36fb0f38874fa66c7b77aa2d3540d7fbc010873d4be24

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name pythonw.exe
highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali