CmdID

CmdID / Files

aspnet_wp.exe

aspnet_wp.exe file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real aspnet_wp.exe?

file version info and known copies
Installed inC:\Windows\Microsoft.NET\Framework64\v4.0.30319\
C:\Windows\Microsoft.NET\Framework\v4.0.30319\
Signed byMicrosoft Corporation
ProductMicrosoft .NET Framework, Microsoft Corporation
Descriptionaspnet_wp.exe

6 known copies

4.8.4341.0 built by: NET48REL1LAST_C · C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe · signed by Microsoft Windows

44e771ff9365ed2132770cc89a6be0e12ce7ad7ec2509aa771458817a21dac82

4.8.4341.0 built by: NET48REL1LAST_C · C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe · signed by Microsoft Windows

5591b37dd8b5a7ecaeab3455c647e9e9fed5bb1ae8baa6d6c2fe98bba0c11427

4.8.4330.0 built by: NET48REL1LAST_B · C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe · signed by Microsoft Corporation

889ac8008671bed948223742862effdb0b8dabb28d7de4cf386e2ab2b5a21bfa

4.8.4330.0 built by: NET48REL1LAST_B · C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe · signed by Microsoft Corporation

91acc3ef3cc5901764b3db15c4f3fac2d7b06531282be7cadfebb0ea202943df

4.8.4250.0 built by: NET48REL1LAST_C · C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe · signed by Microsoft Corporation

83f96b69b125e09b4529aa449c643fd8e821a4e5187210a07c911836e6baa3dc

4.8.4250.0 built by: NET48REL1LAST_C · C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe · signed by Microsoft Corporation

b4e267fa56ee9aba91f5f645b6a62c9b31ac4a8e530843ef2d3a6af3c4ae5ba9

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.