CmdID

CmdID / Files

evntwin.exe

Event Translator Config Tool file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real evntwin.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionEvent Translator Config Tool

4 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\evntwin.exe · signed by Microsoft Windows

51b944d3ee32c3afbb6f90e84b7432c4e2a9d8cfbd854649ee609b08c7f8ca23

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\evntwin.exe · signed by Microsoft Windows

98f1cf6afddc29dffb184550744a5231ba430ce46e3ac90bc8b51a69e0a94cb3

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\evntwin.exe · not signed

df092b301f223a5b7af6277db9f9165194cfe9b4aa0c921b13279ade008943e5

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\evntwin.exe · not signed

e8ab0ec18237256a8d86521617103d547038add17070f28bd8087f16a82eb81f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.