CmdID

CmdID / Files

NAPSTAT.EXE

Network Access Protection Client UI file version info

Program on Windows 2 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real NAPSTAT.EXE?

file version info and known copies
Installed inC:\windows\system32\
C:\windows\SysWOW64\
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionNetwork Access Protection Client UI

2 known copies

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\NAPSTAT.EXE · not signed

7082e3882487e1c2221a9dab6dc3c9cc25754bd424d49d1e5b422672632e96dd

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\NAPSTAT.EXE · not signed

b5b68c60981ff9355a44ac9055c6021f1f5b5b52d1bbfd2f1e1ee1403d97c545

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.