CmdID

CmdID / Files

waitfor.exe

waitfor - wait/send a signal over a network file version info

Program on Windows 12 known copies with hashes Command waitfor

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real waitfor.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
Descriptionwaitfor - wait/send a signal over a network

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\waitfor.exe · signed by Microsoft Windows

4ee58eda5b4b163ac80bbe862575c857d407afff4ed13c4aa5c4de4022351372

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\waitfor.exe · signed by Microsoft Windows

bb97e4bab12679a25d3169b358541ddd313e7c13711d787cd2a6c559d2ce5dbc

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\waitfor.exe · signed by Microsoft Windows

1ed4bdfbbe7e27856d1b3d6d743efab72e5727bae7b6c02492f8890c97ae602f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\waitfor.exe · signed by Microsoft Windows

d9e9dd5a87e171dcbef7ca034e3a7dfb5c37a7f70aa7db99a0ccad24f16c97dc

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\waitfor.exe · signed by Microsoft Windows

4c2f9efa10013d1e95810973dc5a47795c0b62af923165e4cc232399a89e5767

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\waitfor.exe · signed by Microsoft Windows

daaa464b6db46dbd0b81329f563993736a8f92c590716aa2c65dc5593d8f9034

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\waitfor.exe · signed by Microsoft Windows

1b2ec8189777f5592a003c5ad8114848f0300590e034face6107d78e2ee8fb97

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\waitfor.exe · signed by Microsoft Windows

a414e8721a683ec797508eb8db094398ba35d4980416deaeaec9683c813bb844

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\waitfor.exe · signed by Microsoft Windows

189d57ab52075d172425a2c4c0ad6ff97d72cc76285bf7c3b87a86bd9f65da51

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\waitfor.exe · signed by Microsoft Windows

963a39d3a7194a7bbeedcb36dc32c5e809d2b78872161b94e157d0a57c67deb0

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\waitfor.exe · not signed

09cc91b6997d3c2432aa73d0d021856b8603304dae9b315e10289ccf941b5a21

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\waitfor.exe · not signed

09fd55427a57887f92ae5b22ca3b6d75b81ea4ed5ce34fa891d0d49602022da5

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.