CmdID

CmdID / Files

OOBENetworkCaptivePortal.exe

OOBE Captive Portal Flow file version info

Program on Windows 2 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real OOBENetworkCaptivePortal.exe?

file version info and known copies
Original nameOOBECaptivePortalFlow.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionOOBE Captive Portal Flow

2 known copies

10.0.22000.120 (WinBuild.160101.0800) · C:\WINDOWS\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe · signed by Microsoft Windows

fd651e890e9567892c100506abbc28e6028ad01dbc66dfdbb0d8f298f63b517e

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe · signed by Microsoft Windows

d450e23f4813e5e059377cd7cbb4bd459930266980480bc161f8720e1330742c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.