CmdID

CmdID / Files

help.exe

Command Line Help Utility file version info

Program on Windows 13 known copies with hashes Command help

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real help.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
C:\program files\GIMP 2\lib\gimp\2.0\plug-ins\help\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionCommand Line Help Utility

13 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\help.exe · signed by Microsoft Windows

368f9de5f9198eb8fd3cd057d8ff0943993b53d6a021aa23224ec8026b71b755

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\help.exe · signed by Microsoft Windows

3bac7f4c58d01d7a72e54a19a46ef05bc8a5558c49368e2bb97c82df4b847925

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\help.exe · signed by Microsoft Windows

53827a12373901fca002c3fc012d0bce0c4af422a7cf12cad19c655c903314e3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\help.exe · signed by Microsoft Windows

cdcc70d77775a9fadc1d6d70d8c8f0c83d7c9abdb3507254af5cbe64c86a3aa1

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\help.exe · signed by Microsoft Windows

1c89739c752705bf6d2b1173dceed6306a4b571507f25736568442cb63e9babe

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\help.exe · signed by Microsoft Windows

419c5215958daaa3f4e47684dd104413831dbc0f273cbfd6501e8f2153b7ce07

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\help.exe · signed by Microsoft Windows

09948762942fc066eb07c479fa49b63f3cff299af2ee8256904ba9b098ec50df

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\help.exe · signed by Microsoft Windows

11863176a0fad587304c0ee21474dbaa8f40650f34bc47f2666d379bd3a7d7ab

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\help.exe · signed by Microsoft Windows

029dff1542e2fd42c7f19dcb993f6d2189324c0c196d8b433b5202d782511e4b

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\help.exe · signed by Microsoft Windows

35d0c29dd223f03c58906a00b5ce3c1be7fbdb493a8a4c9f4849b9b8c6e2df80

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\help.exe · not signed

9397ea5962b20bff5e3648489686825ebf9f774443cd21d7ae2200d0c49df45a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\help.exe · not signed

d72c15d9d553257168ba21581412ebd7bd99ba6519baf379175040c6d845d399

2.10.20.0 · C:\program files\GIMP 2\lib\gimp\2.0\plug-ins\help\help.exe · signed by Jernej Simoni

a0749bf24afc684f41a3ceaf99cc13ed0cdb183f8b660ace18ada9e794763aba

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.