CmdID

CmdID / Files

action_runner.exe

PowerToys ActionRunner file version info

Program on Windows 2 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real action_runner.exe?

file version info and known copies
Installed inC:\Program Files\PowerToys\
C:\Users\user\AppData\Local\Temp\
Signed byMicrosoft Corporation
ProductPowerToys, Microsoft Corporation
DescriptionPowerToys ActionRunner

2 known copies

0.23.2.0 · C:\Program Files\PowerToys\action_runner.exe · signed by Microsoft Corporation

63ca35d2c97520eeb96265a1d90449d2138597f43baceee8d3f126a222191c4a

0.23.0.0 · C:\Users\user\AppData\Local\Temp\action_runner.exe · signed by Microsoft Corporation

6587ba1f05405a2e5655e8b4c95d6d70d543894a00451f418ac548e6bb5d320b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.