CmdID

CmdID / Files

escUnattend.exe

IE ESC 7.0 Unattended Install Utility file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real escUnattend.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductInternet Explorer, Microsoft Corporation
DescriptionIE ESC 7.0 Unattended Install Utility

4 known copies

11.00.17763.529 (WinBuild.160101.0800) · C:\Windows\SysWOW64\escUnattend.exe · signed by Microsoft Windows

85e0158058f46066d7ec6f4f9c1400f7239188267a31dcd82037614b1350a316

11.00.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\escUnattend.exe · signed by Microsoft Windows

10bbc02017496413f6d31ad21561b96443d9582d5a4fe528f54fcb479eef4fc9

11.00.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\escUnattend.exe · signed by Microsoft Windows

8683e1a4b7a52dfa6b6edca8e16fd5b81667fd7f3f4d18f687759dba6a7fa40f

11.00.9600.19326 (winblue_ltsb_escrow.190325-1700) · C:\windows\system32\escUnattend.exe · not signed

9df89a17def9bdd715141a343e069fc8422dcfc534a91d97ac9e58a3d98a77f0

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.