CmdID

CmdID / Files

FileHistory.exe

File History file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real FileHistory.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionFile History

4 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\FileHistory.exe · signed by Microsoft Windows

7406fcdf9a773caefb0d85911766d4aefe6dc7d4940dd139af56ad9121592596

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\FileHistory.exe · signed by Microsoft Windows

a495f0059e9a68c99be88fca44b2c5e75e6345374c44f58dc3218839a1cbf05a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\FileHistory.exe · signed by Microsoft Windows

bee0799a52fe65b8dc291de32f0c8b03b5a067915b1868bc8ba2a1b139c90b87

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\FileHistory.exe · signed by Microsoft Windows

bb57d7e4c140288ea7af30f54f2b825d24ff6951213463aa5526b87f7cb55b67

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.