CmdID

CmdID / Files

omadmclient.exe

Host Process for OMA-DM Client file version info

Program on Windows 9 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real omadmclient.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionHost Process for OMA-DM Client

9 known copies

10.0.22000.51 (WinBuild.160101.0800) · C:\WINDOWS\system32\omadmclient.exe · signed by Microsoft Windows

28e13a4cdf390b0844ebc2c62d0eb60a3b4f3afbce647fe2d1c3a4d8ca62fce0

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\system32\omadmclient.exe · signed by Microsoft Windows

c81c43cd22f5985933fb5b4a734c0329c0134a740947c91c9f2199fa52b68784

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\system32\omadmclient.exe · signed by Microsoft Windows

e143654d373c1700a585a9e7dbafb714b7bcda13d9ff9c37d163ece11c7c70f7

10.0.19041.1151 (WinBuild.160101.0800) · C:\Windows\system32\omadmclient.exe · signed by Microsoft Windows

e0c6c1b082c5d61be95b7fad95155b7cb2e516d6dcd51b8e1554a176876699e7

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\omadmclient.exe · signed by Microsoft Windows

ee59b30d35b990b55e2e3d1fbb978d4c5636bcab328b7e1d4581fbe71c904725

10.0.18362.815 (WinBuild.160101.0800) · C:\WINDOWS\system32\omadmclient.exe · signed by Microsoft Windows

4994607275b5fd3104ef760cecc912428db723b466fcf61392c09282d70c0745

10.0.17763.1432 (WinBuild.160101.0800) · C:\Windows\system32\omadmclient.exe · signed by Microsoft Windows

c4fa3f2b3569cf99e865709d437e2d60d432ab4d48dfcc56b0dd2f316bc76f42

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\system32\omadmclient.exe · signed by Microsoft Windows

765897d9f2917e44224d313bb4aab92b269b37a56d683fbbdbff79d2c9a75f95

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\omadmclient.exe · signed by Microsoft Windows

1b9205fb39b95facdee1a93311afde7de2a33916cfa74bc168486ed41ed3c452

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.