CmdID

CmdID / Files

grv_icons.exe

Microsoft Office component file version info

Program on Windows 1 known copy with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real grv_icons.exe?

file version info and known copies
Original namegrvicons.exe in the file’s header: a renamed copy still carries it
Installed inC:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\
Signed byMicrosoft Corporation
ProductMicrosoft Office, Microsoft Corporation
DescriptionMicrosoft Office component

1 known copy

16.0.12527.20444 · C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe · signed by Microsoft Corporation

SHA-256418f7d3cfb59e3115c66ab9870b20519cb17679a781a7cba2fdeed090f8c8ff9SHA-1d726b22755205d80933d01b9e5f7d967626a9007MD59a5b245b1caeebe18f96825c16a8675c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<hash>".whatis() says which known copy an MD5, SHA-1 or SHA-256 is.