CmdID

CmdID / Files

hvsievaluator.exe

Microsoft Defender Application Guard Policy Evaluator file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real hvsievaluator.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Defender Application Guard Policy Evaluator

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\hvsievaluator.exe · signed by Microsoft Windows

51ce59723aca1c196c641b24e364f41c42cd6011b2cd6a4a4d94de97389e7b2e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\hvsievaluator.exe · signed by Microsoft Windows

0a986b925052646e94e7d002d4437d46b672fe288ec7c1be2fb1e04c02ac7c13

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\hvsievaluator.exe · signed by Microsoft Windows

1524376de0cf0ddd81e1d2596e4f7fc303016c7773b577ef8ba8c50c11cb50a2

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\hvsievaluator.exe · signed by Microsoft Windows

bffda0fc8da8f4307847fadb38770885e6a2e25b6dddec5474d68d8debdae823

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\hvsievaluator.exe · signed by Microsoft Windows

ea55dfabb7a47bd450ed3050f88e3b6a64fdc0b918b93211aaf35a430d3648cc

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\hvsievaluator.exe · signed by Microsoft Windows

4c44b65cbeac0e6f7c484409e0a912bc558367eee4ad84af62a103316037a24e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.