CmdID

CmdID / Files

SnippingTool.exe

Snipping Tool file version info

Program on Windows 5 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SnippingTool.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Users\user\AppData\Local\Microsoft\WindowsApps\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSnipping Tool

5 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SnippingTool.exe · signed by Microsoft Windows

6b7b9973b5c5099626a97cc45b70ba6456ef6615692cde1149fbd06022aa4856

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SnippingTool.exe · signed by Microsoft Windows

83be001996cd4d9e5a1a8cd130e17e5b5ee81c9b5cf1b9d9196d8a39fbf7506d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SnippingTool.exe · signed by Microsoft Windows

6635e48ad3f02fe5cac9669f974d27ec2fa77b1f6b519f09616630b6531a6ca8

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\SnippingTool.exe · signed by Microsoft Windows

9f769e52ac15ae1d0b6a3da293f612ac24303882b1d49ef7a5105ed1b24210d3

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\SnippingTool.exe · signed by Microsoft Windows

e85959f25f0b055272c1ee513b6a00abe966c691def9354e1fdd94f3eed30c1c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name SnippingTool.exe
highPotential CVE-2026-33829 Exploitation - Windows Snipping Tool Remote File Path URISamir Bousseaden, Swachchhanda Shrawan Poudel (Nextron Systems)

Sigma names SnippingTool.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.