CmdID

CmdID / Files

dsrm.exe

Microsoft AD DS/LDS deletion command line utility file version info

Program on Windows 2 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dsrm.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft AD DS/LDS deletion command line utility

2 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dsrm.exe · signed by Microsoft Windows

d0b1577512d1f1023221bca12ee221624255c843d35c0d5d21941f76c3f36231

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dsrm.exe · signed by Microsoft Windows

f9f811dbd19372d3fd2c64adaeb97ddc33f37b747ba6222e9d57e611ce59c4d8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.