CmdID

CmdID / Files

rc.exe

Microsoft Resource Compiler file version info

Program on Windows 3 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real rc.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\
Signed byMicrosoft Corporation
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Resource Compiler

3 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\rc.exe · signed by Microsoft Windows Kits Publisher

a7861cdc34b610e8dbe141370a234dc76165d46cd706d140f89a4956d3aec9ae

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\rc.exe · signed by Microsoft Corporation

ce6079ce8557c4dbe1f611b19919d70bb6fa9317c426801cc4a1e3b72646f532

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\rc.exe · signed by Microsoft Corporation

d48522470fa7dcca448c79781b8e7091ce16521dceb2ab97bf0f62e7dfd137bc

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name rc.exe
highPotential PlugX ActivityFlorian Roth (Nextron Systems)