CmdID

CmdID / Files

rdpclip.exe

RDP Clipboard Monitor file version info

Program on Windows 8 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real rdpclip.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRDP Clipboard Monitor

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rdpclip.exe · signed by Microsoft Windows

afc25936f02ceef4df988e7ec4ab497b6e8119a5306a3045dbb9e93a4441ef9f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpclip.exe · signed by Microsoft Windows

013cc1072338b426faf2a953e56a8950849adda308600fa1627de6495e924941

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpclip.exe · signed by Microsoft Windows

8ab6e280b961d73082c5f6c67e843cb2f8b666dffa4104995dafc454432847d6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpclip.exe · signed by Microsoft Windows

9d5be181d9309dea98039d2ce619afe745fc8a9a1b1c05cf860b3620b5203308

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rdpclip.exe · signed by Microsoft Windows

01dc9fd40e8206da63a9b921383348ecc3ebb7b72e38e0a1e5befa292a793085

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpclip.exe · signed by Microsoft Windows

af5cae4b514215e530643a7fea2d7a47a1b15f6e5610347b217d1abfa4ae0f92

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\rdpclip.exe · signed by Microsoft Windows

acfa1128b4edd953f6364fa6216337a59c0522a01349263a11259a827838a56f

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\rdpclip.exe · not signed

b66d93926841e798f5ae1ef97158e74d79263745c81501bf342aa9d0672419d8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name rdpclip.exe
highTerminal Service Process SpawnFlorian Roth (Nextron Systems)