CmdID

CmdID / Files

CertEnrollCtrl.exe

Certificate Enrollment Control file version info

Program on Windows 14 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real CertEnrollCtrl.exe?

file version info and known copies
Original nameEnrollComServer.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionCertificate Enrollment Control

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\CertEnrollCtrl.exe · signed by Microsoft Windows

0eb34a835624dd749e46ab0ab0db82bdf3fc952b28beccad241a1fa341f13a04

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\CertEnrollCtrl.exe · signed by Microsoft Windows

ff386aaca11e44348d8fac298e658d8060f8e8d2c0a22275fd80e91d6330dc48

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\SysWOW64\CertEnrollCtrl.exe · signed by Microsoft Windows

18f25c1f71bfba5bb2d159228c0563caa54beeaf2f732dd2b614e77024a97a6c

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\SysWOW64\CertEnrollCtrl.exe · signed by Microsoft Windows

4def81210878dc626ffa5f677e12577e831b6c286c67d83a6c30dcf8fb434671

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\CertEnrollCtrl.exe · signed by Microsoft Windows

91b5e9129f86ad6ed9ab1259a7e78b1dac0ec0bda78089365a6f3b6fd79b0a9d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\CertEnrollCtrl.exe · signed by Microsoft Windows

c180f87dd7f7bd58ad85be08b0c59f95fa4a5d3ec748931ff4a89d1afcfe8449

10.0.18362.387 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\CertEnrollCtrl.exe · signed by Microsoft Windows

6a9d55b1550fc218d64d63e420467e99a662dbb646a5cadbb465091fa400e7a6

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\CertEnrollCtrl.exe · signed by Microsoft Windows

347e3c64bd6f5318d635498945cca1a299b779723d042ec4236c1cd1a3cab34d

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\CertEnrollCtrl.exe · signed by Microsoft Windows

8de895a62785c1294f402260671cfdbb2223e3448947c3ace893b8a298a1d37a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\CertEnrollCtrl.exe · signed by Microsoft Windows

e127afce74594a9c51cc0b22b3e7650a1bae2b6f00ee976b4b0c1280dcaeff6c

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\CertEnrollCtrl.exe · signed by Microsoft Windows

912ef3f36892c013566988d86796abfde12ac513d32408e83db589fa64bdffc4

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\CertEnrollCtrl.exe · signed by Microsoft Windows

9954eafa1ea7991358b9c0fb2d48c16d37030215bb0f46d2448eadeadfe1b720

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\CertEnrollCtrl.exe · not signed

6364647244c9f38a9e51a6ed7ebd922ceaff2a375512fabfcbd1b73ba40e27fa

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\CertEnrollCtrl.exe · not signed

694ef1583b1ae4655f4729a61430ad2afbdbc7767e83f1a9b71556a02a75c8fc

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.