CmdID

CmdID / Files

RMActivate_isv.exe

Windows Rights Management Services Activation for Desktop Security Processor file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real RMActivate_isv.exe?

file version info and known copies
Original namermactivate.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Rights Management Services Activation for Desktop Security Processor

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\RMActivate_isv.exe · signed by Microsoft Windows

6080e5728549a5d56daa4f665041156585925bd59b8797fc4cb495da559e840b

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RMActivate_isv.exe · signed by Microsoft Windows

73afd04a881b3debdccd3fde976e30e99199357ce296f4178704e1e0939ece39

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\RMActivate_isv.exe · signed by Microsoft Windows

29638e099f526f7ac9e85099bd380122a6cb4c656bc24837639b62ff11910254

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\RMActivate_isv.exe · signed by Microsoft Windows

2a2ca139764fd9449f547da29be38b660c1e89bdf5b56ad01055b122a12d9c73

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RMActivate_isv.exe · signed by Microsoft Windows

006cc54f38386b20fa29306e141288e7f456d1b0ea690b9471e71b005258b42e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\RMActivate_isv.exe · signed by Microsoft Windows

5214b5660b21b4d218f7c464c90132ab19a687555dbd01b88034b84f2d96b86b

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\RMActivate_isv.exe · signed by Microsoft Windows

cda1f53a70a83b13b48c10af395d94d6a76a21cfe43ffe34be76d3099683dc3a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\RMActivate_isv.exe · signed by Microsoft Windows

f983d1a5eaa26f8300dc6d8cc7b15782e6f0bf3f7b3a57c845bc4b2c470e0879

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\RMActivate_isv.exe · signed by Microsoft Windows

0624cb2039059451187ec7a01214683147e6f6b619dd480062855b2c533ee540

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\RMActivate_isv.exe · signed by Microsoft Windows

3110b65fba2d94768c96a31cb9ad59a579aac08517db996cbe85548e1ea0ec29

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\RMActivate_isv.exe · not signed

5efd030627da896f72a0795b48a2b2101d2cddd99dfc8c4e0c59f521c2b21b9d

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\RMActivate_isv.exe · not signed

d3a5a774d6352a13c74bbfcad5f667bcfd754fd959946ffb4919dfdc11db6adf

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.