CmdID

CmdID / Files

PnPUnattend.exe

PnP unattend action file version info

Program on Windows 7 known copies with hashes Command pnpunattend

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real PnPUnattend.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionPnP unattend action

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\PnPUnattend.exe · signed by Microsoft Windows

342711b8af90b020c4226ee1af7da5cf444bb373ca4497ce6dddf16a20c6b635

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\PnPUnattend.exe · signed by Microsoft Windows

daaa6f8dfaffda95dcd17c30bebd41a9c6f1b913ec37b34e0f137e35d5ba33a6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\PnPUnattend.exe · signed by Microsoft Windows

e60dc999784f55e11bfc8170d810bb4eee2cfce7b46b7d91bb6bc2649a44e8c5

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\PnPUnattend.exe · signed by Microsoft Windows

af11d70be2da461c4c4dfcc085b2eac0a736e630f6e84fb508661fb904d71730

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\PnPUnattend.exe · signed by Microsoft Windows

1bd75ed2adbb32c2863b5a3b117dec61ee2bfbdf4aa6892670ca5e23c2d9424f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\PnPUnattend.exe · signed by Microsoft Windows

203cac6b3b737623ff0a3ffb755a9cc9955090da74a2eb799245f329ba38728f

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\PnPUnattend.exe · not signed

a4f8c322fdb17b22770aee031c3ddc1068273b301385c36ff6564dd8eb65f683

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.