Another cmdagent.exe question

I go to the Firewall tab and then Common Tasks and the View Active Connections to see what is active.
I am not in a web browser or email etc. so it shows me nothing.
I use a utility called CurrPorts and I have anywhere between 2 and 4 entries for cmdagent.exe showing as connected.
Why the difference?


I believe that the connections that are deemed safe are not reported to avoid confusion. Similarly, some connections are not logged unless you take some trouble to write rules to force logging. Cports.exe also reports a number of internal communications on IP’s like and and if they are not blocked by CIS. None of those are reported as connections by CIS for clarity as well.