CmdID

CmdID / Files

tracewpp.exe

WMI Tracing C/C++ preprocessor file version info

Program on Windows 3 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real tracewpp.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\
Signed byMicrosoft Corporation
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWMI Tracing C/C++ preprocessor

3 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\tracewpp.exe · signed by Microsoft Corporation

057b0fe2ce5212830e24993914c83fcf1301a0adcf3337f40c554ae32de1497a

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\tracewpp.exe · signed by Microsoft Corporation

2709f23a14af7e9318959f1b5375de9d910e55d5d9316c598e4243e698658894

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\tracewpp.exe · signed by Microsoft Windows Kits Publisher

d4281a5acdde6c34ba2a4fe872b1a69ea16582be749a27a41f989d99619a6019

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.