CmdID

CmdID / Files

NgcIso.exe

Windows Hello Security Process file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real NgcIso.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Hello Security Process

4 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\NgcIso.exe · signed by Microsoft Windows

d6fcf04f23b92608e2255cf46edf26b47541435d7e5a8d5ab69b9bff8f13df0b

10.0.19041.84 (WinBuild.160101.0800) · C:\Windows\system32\NgcIso.exe · signed by Microsoft Windows

82e0752061075388aaa8a743c5f492eafe6fccd7b25319e04c6223f14f73b458

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\system32\NgcIso.exe · signed by Microsoft Windows

bebc95d47863245293261ddd67d273665cd485aee4df8562fe35e421925ebc4e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\NgcIso.exe · signed by Microsoft Windows

838bd78159a10b4bcf2391cd5133daedcdefaf57842c16f619f3563fbe355ea9

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.