CmdID

CmdID / Files

icsunattend.exe

ICS Unattend Utility file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real icsunattend.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionICS Unattend Utility

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\icsunattend.exe · signed by Microsoft Windows

240e1e55a5b1ffb2def161394c84b912f543ade488fed3d731f582d044e835f7

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\icsunattend.exe · signed by Microsoft Windows

381b5b760ed12d19e9b34f97d84a1aa19090337ad10559c58ad3f156e29cd3c3

10.0.19041.207 (WinBuild.160101.0800) · C:\Windows\system32\icsunattend.exe · signed by Microsoft Windows

0faa0037a7d81eff82e067cceb34da2a71ed5b24c9d009f1bf431d47619d4765

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\icsunattend.exe · signed by Microsoft Windows

732b8722b6c44dfb9db2e28c22638150dd64540bc4480ddf585e6e5890dcf72a

10.0.18362.778 (WinBuild.160101.0800) · C:\WINDOWS\system32\icsunattend.exe · signed by Microsoft Windows

aa445cde9c881382a3e1211432dc35e132bb9cbd75baafaa3e9f5e5c0ab9f449

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\icsunattend.exe · signed by Microsoft Windows

06935a731f63d8d0a2ba5f3ade764d6f8543d5cc44fad7de991bfcd59de60b5f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\icsunattend.exe · signed by Microsoft Windows

b10cb64a755f67c25d42a5716d9c89094c799dd736d0a4e0639574b1ed5e7096

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\icsunattend.exe · signed by Microsoft Windows

e9793c8a4a3008f0b60f0717e96b67ee68b0f113c5e3928b9abeabe63e74be4f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\icsunattend.exe · signed by Microsoft Windows

640a1e62c18231fd6eae880e5429fd3cc6dd0d1b264bf1fbd13618901771c575

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\icsunattend.exe · signed by Microsoft Windows

921abb7221aa090479cd6a9739b57b37e096b999bbc2d87c22e9e6a3e57b5aa2

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\icsunattend.exe · not signed

a077e63dd3e8713ad5433faf385c6a2b48b56d1fc6b48f0dd9ab541cfce810f3

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\icsunattend.exe · not signed

a84d9f2e299a329f2c84d4c1dfd0eb7a3aa22ef8c497baabac81127af721f4eb

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.