CmdID

CmdID / Files

winpty-agent.exe

Program on Windows 5 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real winpty-agent.exe?

file version info and known copies
Installed inC:\Program Files\Microsoft VS Code\resources\app\node_modules.asar.unpacked\node-pty\build\Release\
C:\Program Files\Amazon\SSM\Plugins\SessionManagerShell\
Signed byMicrosoft Corporation

5 known copies

Version not recorded · C:\Program Files\Microsoft VS Code\resources\app\node_modules.asar.unpacked\node-pty\build\Release\winpty-agent.exe · signed by Microsoft Corporation

07ff867ade3f9b871fdd8d9bcb0ecd642f89a60b48f4ee9709370d3ef038b466

Version not recorded · C:\program files\Microsoft VS Code\resources\app\node_modules.asar.unpacked\node-pty\build\Release\winpty-agent.exe · signed by Microsoft Corporation

2463fb575da68ef4fd1fff3baae4fba3e8af773e6e380476b45fd89aa1702ff3

Version not recorded · C:\Program Files\Amazon\SSM\Plugins\SessionManagerShell\winpty-agent.exe · not signed

2c4e65e18115fc0672e2b2e017073cc01e26735e2c93fc291c6875ebe19431b3

Version not recorded · C:\Program Files\Microsoft VS Code\resources\app\node_modules.asar.unpacked\node-pty\build\Release\winpty-agent.exe · signed by Microsoft Corporation

a5682bee7fbf24489944fd7c6abcff7dbda996586a3bcacb34e96d5eed385b80

Version not recorded · C:\Program Files\Microsoft VS Code\resources\app\node_modules.asar.unpacked\node-pty\build\Release\winpty-agent.exe · signed by Microsoft Corporation

ef91fd24a65e6dd4e7285257fbef9369547522f82b0f6c1d47272e57c5c054a6

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.