CmdID

CmdID / Files

ntprint.exe

Printer driver software installation file version info

Program on Windows 14 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ntprint.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionPrinter driver software installation

14 known copies

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ntprint.exe · signed by Microsoft Windows

0f1e126250d5dd5af4a35056f58a689e49a37ed58905f5b88341e77b1a212c99

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ntprint.exe · signed by Microsoft Windows

b84c0de83904c1f01bbe20bd03e80b732579a0cdb7f7d3e4959c8578c79d0bfd

10.0.19041.1288 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ntprint.exe · signed by Microsoft Windows

64af478f82d33510a4b3b8241b97f516130e871474848829cf0022d107e0822c

10.0.19041.1023 (WinBuild.160101.0800) · C:\Windows\system32\ntprint.exe · signed by Microsoft Windows

0209a7e9fd4fdb646a9bb85ce2d15fcac93999932a5c707420dcdf1ed56d50ec

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ntprint.exe · signed by Microsoft Windows

24be330ac87cdcffd09f2f6ab8ca17415ec22e8f28b80c9d2b3b0c804d571834

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ntprint.exe · signed by Microsoft Windows

da9c3c6745f1a186c3f2938f98ec5f8432058139607acb6d684a4879881b6df0

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ntprint.exe · signed by Microsoft Windows

93c8f2d73da586a50fbe729ab720247a1257bc571d516f02f9e437ce9850e492

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ntprint.exe · signed by Microsoft Windows

b01163c098c051d6871343cecea2a5cc287642e49852e623864933dbc76067b5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\ntprint.exe · signed by Microsoft Windows

2393676c8c888142363980e0e72279e6f9743ca5215c88be2cb13f89540f3a70

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ntprint.exe · signed by Microsoft Windows

cc0500c90955a751ae3e2ed274422b2b2b5ca586d610ee1d71e006dd07687ecc

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\ntprint.exe · signed by Microsoft Windows

3062341b690b293d8496f508de7d6686daf38be42d451b52284657807bc5ec68

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\ntprint.exe · signed by Microsoft Windows

430edef77fcebeeddc33bd48f51391ad48685b82762712e996532b2fc9b68b4b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\ntprint.exe · not signed

7c26a8f5ff70da6f45f6db6f961efb2875f970d7614115c93e104920f7c5634b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\ntprint.exe · not signed

92c355138fec3314aac791501316b6487b72c610c068d0f166af115bd234eb8d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.