CmdID

CmdID / Files

ktmutil.exe

Kernel Transaction Management Utility file version info

Program on Windows 12 known copies with hashes Command ktmutil

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ktmutil.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionKernel Transaction Management Utility

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ktmutil.exe · signed by Microsoft Windows

7c2bb802b42af63fccf5d27fdd7820ccaab372cad102f947fc9049bf6f2c146f

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ktmutil.exe · signed by Microsoft Windows

e37f0e57bac96df33550e435cf01370ec85b04746e9afaf129f2d981a7a89086

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ktmutil.exe · signed by Microsoft Windows

180305260da3dd77215dca061c10b869cd69307e9d0cfffcafa27ccec0af71b3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ktmutil.exe · signed by Microsoft Windows

81765113b2df32f13ef09fc96645c183f6064b27fcf4f3a3575088f016bbb5a5

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ktmutil.exe · signed by Microsoft Windows

1afbbe861f01f4d29707ea260aabd546cb25fef939ef615f5354b3383dee1038

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ktmutil.exe · signed by Microsoft Windows

d5e6ab8f2c873f0a62e14e05a74db3b671657f417d7143b04c743543b76577db

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\ktmutil.exe · signed by Microsoft Windows

87883cf0dbe0893ae99305ec110e9b0359bf2844865beb44706a4c2a14f72481

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ktmutil.exe · signed by Microsoft Windows

a436c4ff2539b2a65f4787a0af777075a0e40ef019b78f7276273266f439873c

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\ktmutil.exe · signed by Microsoft Windows

8567448c90730513c238d6efb0350e0a645ebc23cbc4a69e88ad78cd5f70cdeb

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\ktmutil.exe · signed by Microsoft Windows

a86d1e0c37653bc2e0419d745f15d592ab953ff73dbac70fca1745a92f2f4a97

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\ktmutil.exe · not signed

0390a231502c8744a7ac4191d948a9126a974c08bfb890f40e8bc32e087f2429

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\ktmutil.exe · not signed

0d3bef6ef8809e17f5eb943825c76813198f32aa8bd49b3db7e9c2b0dec184d2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.