CmdID

CmdID / Files

tabcal.exe

Digitizer Calibration Tool file version info

Program on Windows 6 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real tabcal.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDigitizer Calibration Tool

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\tabcal.exe · signed by Microsoft Windows

dba30624408cef0a75d589083bf32060b80278de0b117150b53b97c2a42bce3d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\tabcal.exe · signed by Microsoft Windows

f31b4c751dbca276446119ba775787c3eb032da72eabcd40ad96a55826a3f33c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\tabcal.exe · signed by Microsoft Windows

e2600706a518b67a5f2d14484da2bbcfbbc58d4b92d85e82fde3271e85c00efd

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\tabcal.exe · signed by Microsoft Windows

093270617770de311aef2126236ad404f114bc5c75aab1f954444683526d6626

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\tabcal.exe · signed by Microsoft Windows

e738c5f4790b780da2267c5043204b21eb4e45ffe2c6310edbe791592b04f276

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\tabcal.exe · not signed

f8bb94e382806820f6493ded8466f2ae8045a3b06b66fecbeaa9239bd0a32754

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names tabcal.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.