CmdID

CmdID / Files

dsmove.exe

Microsoft AD DS/LDS move command line utility. file version info

Program on Windows 2 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dsmove.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft AD DS/LDS move command line utility.

2 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dsmove.exe · signed by Microsoft Windows

9bdde328f1837c2a2414882ec4cb6f2d08dbc87b9504eac62c3704ef809aed2a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dsmove.exe · signed by Microsoft Windows

cbeedfe71149343fef2875c514be9e4fb113e49431f4ea79dbdfeeaf091f8995

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.