CmdID

CmdID / Files

RMActivate.exe

Windows Rights Management Services Activation for Desktop Security Processor file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real RMActivate.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Rights Management Services Activation for Desktop Security Processor

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\RMActivate.exe · signed by Microsoft Windows

889c7c13f2f0c5fad33729842ea0f4b8bd6fe5ade3f0757dff6078afdb72483a

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RMActivate.exe · signed by Microsoft Windows

aa7172c7ca94f4bee16d9b629e7ff8322f8b6568dd722afdca4c09fe67b8c5d5

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\RMActivate.exe · signed by Microsoft Windows

62e94cb99bd3207951211b8566bcaadf19be925090404bd7aa0191bfc83fd08f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\RMActivate.exe · signed by Microsoft Windows

e5aed34eea1160d2e0674c3373420cb486e68dfa81c3b32a8174963140ab2a5d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RMActivate.exe · signed by Microsoft Windows

b7cc50ad01fa1765619b1f0cddbd61575ff60c110da6df4c959125a79eb85df6

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\RMActivate.exe · signed by Microsoft Windows

d80c933d2d39efd3e6ed61513d952e7fb64f1a574ede9fb5bf93b33d232ca71a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\RMActivate.exe · signed by Microsoft Windows

847dc04d5e873c130027d901309339f490a01085a8beff2fc475bc3c8f117c04

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\RMActivate.exe · signed by Microsoft Windows

9162b0ff6453363794763bfcf06bd80f560780a20f8a2b590bae987034f3a48e

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\RMActivate.exe · signed by Microsoft Windows

5194ce53b1b4dc952f093ab1933415ab21ac9cb42ebccbf46f7e09bae4332329

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\RMActivate.exe · signed by Microsoft Windows

5bb429c69a6031f8c94aacf953341d5a28d0cfc2b01ebf266e9dcb8f48744316

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\RMActivate.exe · not signed

7870240a230355ae6446183ee800e219c475d97f96569f0ae35c4b6d1fc905e0

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\RMActivate.exe · not signed

d7238eef40e9d624f8b6feb49fb3e05bf63e841f0a703a17c927f86a801eeb25

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.