CmdID

CmdID / Files

dmcfghost.exe

Host Process for Push Router Client of OMA-CP file version info

Program on Windows 5 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dmcfghost.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionHost Process for Push Router Client of OMA-CP

5 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dmcfghost.exe · signed by Microsoft Windows

30e603b182fc49f0b68ce9d646032e8026ba4322a7ed49af9bf103109c6b236d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dmcfghost.exe · signed by Microsoft Windows

460d46fd4f0196d3483d5c3831017c931b8e34837cc873fb68c1d3239907f455

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dmcfghost.exe · signed by Microsoft Windows

4b326361a54f4e903e3fd004caef336240ac4dc35a752cadf3b14b5854ffbfbe

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dmcfghost.exe · signed by Microsoft Windows

b9b24776156d0448ec1ea55019ae85f2e17a2d0d133d1a7d1a86d82561073da5

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\dmcfghost.exe · signed by Microsoft Windows

bbf2cd3259d4ee211f1ec4a0c5f62c5400ee77584aaa1f09e33cd880825528ea

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.