CmdID

CmdID / Files

evntcmd.exe

Event Translator Configuration Tool file version info

Program on Windows 4 known copies with hashes Command evntcmd

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real evntcmd.exe?

file version info and known copies
Original nameeventcmd.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionEvent Translator Configuration Tool

4 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\evntcmd.exe · signed by Microsoft Windows

c02b9e15e135c1119f57bc0cdc6746b278d7eb18e0ce644bb456f368948288e5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\evntcmd.exe · signed by Microsoft Windows

dbbe94e27257934cf774da22095fbf9f8ed373a53f995e7d94902ffacff5a535

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\evntcmd.exe · not signed

cb335c39b8bd2da55071e3fb19fc516f26cb1df10e8113daae7a2537e4834f85

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\evntcmd.exe · not signed

ea27a505810c078f090c319b060b084146ade77b03bf95d95196bb430e996ef6

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.