CmdID

CmdID / Files

ntkd.exe

Windows Kernel Debugger file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ntkd.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\
Signed byMicrosoft Windows Kits Publisher
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Kernel Debugger

4 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\ntkd.exe · signed by Microsoft Windows Kits Publisher

482ca0a7cd1bdaf795458b9cd679093cb452fcaacc6c39c2fc9c0c5e96436a0d

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\ntkd.exe · signed by Microsoft Windows Kits Publisher

9bd4eed254f301301f4fbba8b99ab9f1c732c0349e44c601b27d4fc450307174

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\ntkd.exe · signed by Microsoft Corporation

bede8de4fcf51b74e14ab2970861503ceb91c251b81e3cdb97ce2ee4fb8b6688

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\ntkd.exe · signed by Microsoft Corporation

f39933a516e9398c243609406fd44ea7b01afb14e89603d60cff680f961c840b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.