CmdID

CmdID / Files

NetEvtFwdr.exe

Event Forwarder file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real NetEvtFwdr.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionEvent Forwarder

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\NetEvtFwdr.exe · signed by Microsoft Windows

d92b0a8a1fb43eade95490b8990f2dee5349806b677a98108a7343b51c1c4311

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\NetEvtFwdr.exe · signed by Microsoft Windows

d0a85d5d71c08149325e4a2d34c5c42de5505b2790a96880bf839b39f3cac717

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\NetEvtFwdr.exe · signed by Microsoft Windows

020e99f48330b6ca21eed0dcd1214f24593d7b48c163415c2c078cead6fcc243

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\NetEvtFwdr.exe · signed by Microsoft Windows

c1d31010bb094ed0208e9c177c865b49976f23ec22c67373600746109801efe8

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\NetEvtFwdr.exe · signed by Microsoft Windows

db6e21eda0cc254fa0a2b613c9a369dd4cacfdee98b0f5942f56f40926b66d75

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\NetEvtFwdr.exe · not signed

e8d2f5cc9fcf1c3080897d9d6c4228216da8dc98f17232af2519e2b18e6a0122

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.