CmdID

CmdID / Files

dotNetFx-Web.exe

Microsoft .NET Framework 4.6.1 Developer Pack file version info

Program on Windows 1 known copy with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dotNetFx-Web.exe?

file version info and known copies
Original nameNDP461-DevPack-KB3105179-ENU.exe in the file’s header: a renamed copy still carries it
Installed inC:\ProgramData\Package Cache\NetFxWeb394271\packages\dotNetFramework\
Signed byMicrosoft Corporation
ProductMicrosoft .NET Framework 4.6.1 Developer Pack, Microsoft Corporation
DescriptionMicrosoft .NET Framework 4.6.1 Developer Pack

1 known copy

4.6.1055 · C:\ProgramData\Package Cache\NetFxWeb394271\packages\dotNetFramework\dotNetFx-Web.exe · signed by Microsoft Corporation

0c32151c7b29e7dcde9524db04ac6fa86f4532cb99c747639d05f7c335ee95ae

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.