CmdID

CmdID / Files

win32calc.exe

Windows Calculator file version info

Program on Windows 4 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real win32calc.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Calculator

4 known copies

10.0.17763.771 (WinBuild.160101.0800) · C:\Windows\system32\win32calc.exe · signed by Microsoft Windows

3e2300394c15b59a964eab45d9eb96d317650e2f7448fd1b4ae825a134402b7a

10.0.17763.771 (WinBuild.160101.0800) · C:\Windows\SysWOW64\win32calc.exe · signed by Microsoft Windows

4e0b5ade22d9efaba02635c2bacbdb942aecdba9b017927b33900409712d852b

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\win32calc.exe · signed by Microsoft Windows

84173f0b3176f68428a88a6870af6236f28faee117074fb36a0bcccfb55eb301

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\win32calc.exe · signed by Microsoft Windows

d7b378a4bc4deae748462d216d14a20ccb1bac1d3ffbc67711db2cc1d8b182b7

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name win32calc.exe
highSuspicious Process ParentsFlorian Roth (Nextron Systems)