CmdID

CmdID / Files

netbtugc.exe

NetBT Unattend Generic Command file version info

Program on Windows 14 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real netbtugc.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionNetBT Unattend Generic Command

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\netbtugc.exe · signed by Microsoft Windows

80d9a6277ffec8288fff0ac8752318fc6ecfb2d9f1d347d966d72be28f6545f4

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\netbtugc.exe · signed by Microsoft Windows

d7852dccca7f2bbec776fda92ded6fa9b4af72606acdf240b1e0ccc7b7384153

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\netbtugc.exe · signed by Microsoft Windows

36d98bf2278bb62ed2340545cb0d5c5db25597445532f0b1f884a44e124f3d49

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\netbtugc.exe · signed by Microsoft Windows

8c04f0f006f4b441b288cb1735dec8a2396294fa75b4b027ffbd6a3256de1de1

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\netbtugc.exe · signed by Microsoft Windows

90662ed05d2e3f416b9e1482ecfc0d4265918152016354ed882922f660c64fc3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\netbtugc.exe · signed by Microsoft Windows

f6cd958c24ef7a6c7f8f02f53151bd313644a8243d03dcb836589792ca108f56

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\netbtugc.exe · signed by Microsoft Windows

c79d36cd0127f6694b1133ec0ae696c7dd0ee888b5819ea4554b6ff6e9cfbaf3

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\netbtugc.exe · signed by Microsoft Windows

ff282c83742b500a551f6d46f3eb7ec1ac40a70b7fd32f473a2d70f4afa5ab58

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\netbtugc.exe · signed by Microsoft Windows

040377cd45a4e0540fc5c3d4850cb01072d6668750e1379392e884e500748b69

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\netbtugc.exe · signed by Microsoft Windows

524a6f2366533c30c6f447215c7bccb6f5c8f20b7dc377c791a7b3e886ec1a76

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\netbtugc.exe · signed by Microsoft Windows

c10e915d8ce6346858cf53367e2e17ae4da5b117e833ad06650b909085ced650

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\netbtugc.exe · signed by Microsoft Windows

eb1a56a400487d079c2836872e3ea56004fc4fbce5a17ed4750435760bab6e52

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\netbtugc.exe · not signed

e0f6c8ff3a6ded441c4af101ff7ccd9ee1cea8a13c4d9ba128cf0d10a180764a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\netbtugc.exe · not signed

e226da8c5deab6b51c0cd90d0aa87ad25651edb6b2d6996e07de00978a35dcf5

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.