CmdID

CmdID / Files

RmClient.exe

Restart Manager LUA Restart Client file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real RmClient.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRestart Manager LUA Restart Client

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\RmClient.exe · signed by Microsoft Windows

6a02f8c9ea821c902efc979097ff74806fe01314960feb3303828900d257bb79

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RmClient.exe · signed by Microsoft Windows

9cb68addd097a8be6f7464a999b7454f717eb7741b153202d2812b98fe839f51

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\RmClient.exe · signed by Microsoft Windows

b115961ea25ec6960c7ba788f5c206b1e604748fb26c5eb443fbca02497ab743

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\RmClient.exe · signed by Microsoft Windows

d0e19f73e1e3343a995d3da28aaa88bbebc63b871bdacfed664d4f38cb9c62f9

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RmClient.exe · signed by Microsoft Windows

37cdc6f6c3c697b1ee6eaf74b594a148bfa04ed232e1b0eb8795454c7ead4ba4

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\RmClient.exe · signed by Microsoft Windows

fb0159d2768592d15c9f1c5bdce3dca45cb0c7d1905d4017e92f40486b6150eb

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\RmClient.exe · signed by Microsoft Windows

1aaa904c2afcca523962461f16b5ecbf202c621e06693ddd787c533b17043793

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\RmClient.exe · signed by Microsoft Windows

c87253f2ab5615cae492eb9c5d62fca55e78616dbfb991a6fb1f88215458f674

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\RmClient.exe · signed by Microsoft Windows

00ca4fa7b0294d84fbff76528dfa21ee7f0acfa66045626e3ce6a0a6177f4036

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\RmClient.exe · signed by Microsoft Windows

5d9931eba106bad07e18aae7160d7f074a3659b72489449e77e7f0328560e33c

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\RmClient.exe · not signed

93ca178ddbd4f17b9be409cd4aab5e8108671381d66ad8ee089e81951108c513

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\RmClient.exe · not signed

cd66254ca7c5478f2a470f205e3d5bc09b153d7622d6b090121fe24f00a9d618

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.