CmdID

CmdID / Files

hcsdiag.exe

Hyper-V Host Compute Service Diagnostics Tool file version info

Program on Windows 2 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real hcsdiag.exe?

file version info and known copies
Original nameHyper-V Host Compute Service Diagnostics Tool in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionHyper-V Host Compute Service Diagnostics Tool

2 known copies

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\hcsdiag.exe · signed by Microsoft Windows

278d57d46fa9a5cd4098115397469270fefa66e0b8206e242a0772cc0c064220

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\hcsdiag.exe · signed by Microsoft Windows

22bf5143fa2b7b4e8ce0a8fd7a54354b7729d72b34f9baca2b3844717c2fbbb1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.