CmdID

CmdID / Files

hnsdiag.exe

Hyper-V Host Network Service Diagnostics Tool file version info

Program on Windows 2 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real hnsdiag.exe?

file version info and known copies
Original nameHyper-V Host Network Service Diagnostics Tool in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionHyper-V Host Network Service Diagnostics Tool

2 known copies

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\hnsdiag.exe · signed by Microsoft Windows

f9825b75bcd149f5b7a73ad65509a5fb330ed342368dbb955789392051957f64

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\hnsdiag.exe · signed by Microsoft Windows

4f666ac7e6b728c8f75b995d3c86a62b947a63b78cc68ad63e9a4871bc3872cd

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.