CmdID

CmdID / Files

dcpromo.exe

Active Directory Domain Services Installer file version info

Program on Windows 3 known copies with hashes Command dcpromo

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dcpromo.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionActive Directory Domain Services Installer

3 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dcpromo.exe · signed by Microsoft Windows

dc0761b7c8b4732715674e7d5cadeb3bb4917a48ecdfe37200236a112a10c76f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\dcpromo.exe · signed by Microsoft Windows

673b7844466f95d10780c5ecf267fa938d51c7818bbbab6c49c989a5b2619084

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\dcpromo.exe · not signed

008fa2b9697f9a173e40572face100410e51975e34a5cef2be08dfa8e04ed3c0

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.