CmdID

CmdID / Files

tracerpt.exe

Event Trace Report Tool file version info

Program on Windows 16 known copies with hashes Command tracerpt

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real tracerpt.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionEvent Trace Report Tool

16 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\tracerpt.exe · signed by Microsoft Windows

420c6f7b9423866bbe1a256334b4a64f627cacdd28ab657e988fe8a88082568b

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\tracerpt.exe · signed by Microsoft Windows

490108d1f0f5d60e777211f54fe15a47fd21b5a22f4ff4b9ac7942625a1d152d

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\SysWOW64\tracerpt.exe · signed by Microsoft Windows

a632c902e1e1161b19ec43d3a9f8b325a47e8f1f063b6396c8be43aefb88e8bc

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\tracerpt.exe · signed by Microsoft Windows

2ece870892bb1c19ae933a5411560d1fe4eb51dd6b6b510f82b05f2b1ba49851

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\tracerpt.exe · signed by Microsoft Windows

92b0511fa56e758d69b2b8861b8cf35f3adc0be2c127cc9476b75c6b2c3d53da

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\tracerpt.exe · signed by Microsoft Windows

d195eec1ceebc970ef9fd607667299d2c2a4d13cd0a26f57908cb7769476b4a7

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\tracerpt.exe · signed by Microsoft Windows

0dcdcfbae81868af18d3d1c845ca4e9dff8e72e2e91ea2345a309b1cc8e96943

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\tracerpt.exe · signed by Microsoft Windows

3302e07c2d128c66e825d8b8bef9904d2bb8fe365ccb161267e9c00cd92f767b

10.0.17763.1490 (WinBuild.160101.0800) · C:\Windows\SysWOW64\tracerpt.exe · signed by Microsoft Windows

18525850ba7b428af5760e65e2cc384e7638cce56365fd9adf8075afaf5e4379

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\tracerpt.exe · signed by Microsoft Windows

0290f06b08752ab0a02efb6708157b2d3fdbfe036ebba2a1619eaaaf7e894ac8

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\tracerpt.exe · signed by Microsoft Windows

0d65f590893a350d22f9287ddffb196ab452e8dd17287fd1a502e13ea8563da7

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\tracerpt.exe · signed by Microsoft Windows

a5525f7c0b0091a1f701db85d305768c4262f8f91ab40563712a2c3ad48f3005

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\tracerpt.exe · signed by Microsoft Windows

a4ef15c76b3e85bd013a31a8055cbc5515089b259c48f8bae0c78d33ef699241

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\tracerpt.exe · signed by Microsoft Windows

bd8a93fe516f15b90d96a0b0f550d9a8422a9d72b44544d179f51bd077f935dd

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\tracerpt.exe · not signed

6fe97c56d75dbb59ceb78d88bee42e0667fa28126a2063b6098a24dc5fbe95e6

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\tracerpt.exe · not signed

f2f7d2140d1daa29d29246760685b8880be02a5f01317f2c6590dafa54276b4b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.