CmdID

CmdID / Files

imecfmui.exe

Microsoft IME file version info

Program on Windows 14 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real imecfmui.exe?

file version info and known copies
Installed inC:\Windows\system32\IME\SHARED\
C:\Windows\SysWOW64\IME\SHARED\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft IME

14 known copies

15.0.9600.18514 · C:\windows\SysWOW64\IME\SHARED\imecfmui.exe · not signed

d9de84565a9cd6898065ce18909b388dacecbb79e62f3373c967cd9817ea1600

15.0.9600.18514 · C:\windows\system32\IME\SHARED\imecfmui.exe · not signed

e9bb4e7857b873f237d02e4be922ce79ad36d0d45e26b9cbf42d47015e2a3fcd

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\IME\SHARED\imecfmui.exe · signed by Microsoft Windows

ca41c3b463df63c969393669ac18bfb02c3807db4ae7e12e129823344274458c

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\IME\SHARED\imecfmui.exe · signed by Microsoft Windows

ee72bea1268c260f43e8d0b11574ab8e16f796ee2f9cffe271b0d150ac1abc83

10.0.19041.844 (WinBuild.160101.0800) · C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe · signed by Microsoft Windows

07c45696f4a2a6808c370632600b9e674ff945c5846b3a38721014a10f7e497f

10.0.19041.844 (WinBuild.160101.0800) · C:\Windows\system32\IME\SHARED\imecfmui.exe · signed by Microsoft Windows

e9725ee1872c91076b6e5228c015f23bd9dd987f17d973cd6c8cbd9793bf5a8d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe · signed by Microsoft Windows

858efa815920ddbaa9a09f84cbd771d0983f128a16949e44dc57c6b328e22994

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\IME\SHARED\imecfmui.exe · signed by Microsoft Windows

aa0b99d00a342be0b5bcdd26d6aead470301081cee2e1f8d73a5b86f222afbf0

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\IME\SHARED\imecfmui.exe · signed by Microsoft Windows

4578385760863817393384557dc37d616b33c7df8b086abee5baa1da16fc6de6

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\IME\SHARED\imecfmui.exe · signed by Microsoft Windows

5eb0064245ac26e24712b55bdc0de132791c0431fb054aaa3f5f0e89c6330fb2

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\SysWOW64\IME\shared\imecfmui.exe · signed by Microsoft Windows

1a738f2f470dc27c3a32314895328a847b6afe27bc6524d01727514c868a45a0

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\system32\IME\shared\imecfmui.exe · signed by Microsoft Windows

eef2ec581be0420b5bf7e95373a7a183366a40a89dc05e32f835e5a9f38127d7

10.0.14393.2457 (rs1_release_inmarket.180822-1743) · C:\Windows\system32\IME\SHARED\imecfmui.exe · signed by Microsoft Windows

5b754325d4cd261940e38d647e73c7210947ef40a1f8f73ab7cc8c2a1d7b5909

10.0.14393.2457 (rs1_release_inmarket.180822-1743) · C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe · signed by Microsoft Windows

aa9666530ab692b288bffacf91b73e2b84df3d111922277d52a88d546c6b92de

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.