CmdID

CmdID / Files

tracefmt.exe

Format Message traces to text file version info

Program on Windows 3 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real tracefmt.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\
Signed byMicrosoft Corporation
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionFormat Message traces to text

3 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\tracefmt.exe · signed by Microsoft Windows Kits Publisher

0d94799ccba906b3732a15358272563ffbe8d7fd63bd9a7df5d86c66aeab1ad4

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\tracefmt.exe · signed by Microsoft Corporation

6c84033b6a0df638bb5b37a66b6b4597a140cb0778dd4781eedd3752de8e92ab

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\tracefmt.exe · signed by Microsoft Corporation

879575b33789469a92d9a12301b9014ca3fa3152b9715cbbcfea1ae2bf6d379d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.