CmdID

CmdID / Files

convert-moftoprovider.exe

WMI V2 provider code generation tool file version info

Program on Windows 3 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real convert-moftoprovider.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\
Signed byMicrosoft Corporation
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWMI V2 provider code generation tool

3 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\convert-moftoprovider.exe · signed by Microsoft Corporation

0c14a5e99c861e3a393a78e23d85da1aacd43ab29fe017eb56babd3bf447dbfa

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\convert-moftoprovider.exe · signed by Microsoft Windows Kits Publisher

30bba3573cc732acff0a625b572977c9168758692dc42331b0e710c37438b09a

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\convert-moftoprovider.exe · signed by Microsoft Corporation

ec764a419fa1d1cffc69ad4dbb3ae25beb34e3f60cc04309c3fb7e3f3161cc98

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.