CmdID

CmdID / Files

misc.exe

Microsoft Office 2016 component file version info

Program on Windows 2 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real misc.exe?

file version info and known copies
Original nameicons.exe in the file’s header: a renamed copy still carries it
Installed inC:\Program Files (x86)\Microsoft Office\root\Office16\
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\
Signed byMicrosoft Corporation
ProductMicrosoft Office 2016, Microsoft Corporation
DescriptionMicrosoft Office 2016 component

2 known copies

16.0.12527.20448 · C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe · signed by Microsoft Corporation

08e7f8d0ebc52102e189fb01d68234a5658212d428c524923c5b01a50c213d96

16.0.8528.2126 · C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe · signed by Microsoft Corporation

16c5973b959bd4de0a6df995ad3ba43a624a52cd6b99c399404ea3d3f136c9d3

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.