CmdID

CmdID / Files

OOBENetworkConnectionFlow.exe

OOBE Network Connection Flow file version info

Program on Windows 2 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real OOBENetworkConnectionFlow.exe?

file version info and known copies
Installed inC:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionOOBE Network Connection Flow

2 known copies

10.0.22000.120 (WinBuild.160101.0800) · C:\WINDOWS\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe · signed by Microsoft Windows

fc33f1c5796eb5fce36e1e8874a07f6ea6a0d30e08c3725de8bf5074fbf79676

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe · signed by Microsoft Windows

e96ee7fa4c6efd9558b8bef071a93026b0a8d07d943e349ad85dbcb2bdb66a67

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.