CmdID

CmdID / Files

CIDiag.exe

CodeIntegrity Diagnostic Tool file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real CIDiag.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionCodeIntegrity Diagnostic Tool

4 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\CIDiag.exe · signed by Microsoft Windows

c115b25fba04596c344b100689c723e32998b27b0e42bd41f498b0845a4591e3

10.0.19041.985 (WinBuild.160101.0800) · C:\Windows\system32\CIDiag.exe · signed by Microsoft Windows

e9e387db5c134dd7779379f56e0eb4069e4d8196bdfcc6809197dcd3faaeca40

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\system32\CIDiag.exe · signed by Microsoft Windows

5837847870a5aceb61e8aa826875495e73ad05e8cc544424a431a2b4ccc48252

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\CIDiag.exe · signed by Microsoft Windows

a396eed148d521c65e9c76097f649258698856d5bea8d7c5109a6b42ab6395d7

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.