CmdID

CmdID / Files

ktpass.exe

Kerberos keytab tool file version info

Program on Windows 6 known copies with hashes Command ktpass

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ktpass.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionKerberos keytab tool

6 known copies

10.0.17763.652 (WinBuild.160101.0800) · C:\Windows\system32\ktpass.exe · signed by Microsoft Windows

167598e4a40a414f075c1b7ede6bc21da208ebc736af8ce222a865a54e98af26

10.0.17763.652 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ktpass.exe · signed by Microsoft Windows

48b30eafc82dc388dfe5bbd55c26c863fc3ec53abef16b2b8bb42bc7ad471885

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\ktpass.exe · signed by Microsoft Windows

2af1fe66d0a9181f8bedaf83dff3ab7d58d36490355147a69047f240bcdbdacd

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\ktpass.exe · signed by Microsoft Windows

697c8d6e990cc234539836b572d4f45ef88f11d0257d92be8b466d71359b6869

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\ktpass.exe · not signed

3edff1058b2134342da0c161c739d8f4665883dc3407434b46ca966982922f74

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\ktpass.exe · not signed

aeb6e5ba6a6faeb9acdc989c7e7177d8800ee21b5539c88885b3392c37d61e3d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.