CmdID

CmdID / Files

mountvol.exe

Mount Volume Utility file version info

Program on Windows 12 known copies with hashes Command mountvol

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real mountvol.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMount Volume Utility

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\mountvol.exe · signed by Microsoft Windows

6c52f7a534820bf3b59482c66884d58acf083eaf928bc7e7d2890d7eed376c31

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\mountvol.exe · signed by Microsoft Windows

89fbc91b6b91b83a7d58f7d4942b205c110980d36e86941c16f9893617ef5541

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\mountvol.exe · signed by Microsoft Windows

caf29650446db3842e1c1e8e5e1bafadaf90fc82c5c37b9e2c75a089b7476131

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mountvol.exe · signed by Microsoft Windows

f247be88f22b07a36f4b71707ed7a96bd989bad37a7500da03b81709749ded7e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\mountvol.exe · signed by Microsoft Windows

1031661048c6ef1cd70b29470d9b012c6f18c6e2d81bc7e8862f6c2223c0e0bb

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\mountvol.exe · signed by Microsoft Windows

cb3cd8ed33ea7a5754e171e41c2f1fff1ee0f4c341e321481d9e4cb6d20fbe56

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\mountvol.exe · signed by Microsoft Windows

0b6bbfd83c4a34df78289470ff338e93f5a769317015043a121349a7836d8862

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mountvol.exe · signed by Microsoft Windows

3408b443926447c03a7575c563163b8e9adf54aae9f4fad959a4a61d588fa234

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\mountvol.exe · signed by Microsoft Windows

9b3d74a45abace6b7b20b5a7e52045910444bdc906195d2aaadeb4eb2ce99575

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\mountvol.exe · signed by Microsoft Windows

ce3c232d94ff7940d89f4d5f4888bd19a1e9d71bd6ec9a50715e785400c84652

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\mountvol.exe · not signed

abe94659f6a4aa670705ee1c8f948e765f7e7d5c43be98f34825b31bb24c2919

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\mountvol.exe · not signed

e04bfb63f79bb4e28926ec82afa3601ee06704af0ebcb66858b9e014635dcc63

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.