CmdID

CmdID / Files

ServiceModelReg.exe

WCF Generic Command for Vista Setup file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ServiceModelReg.exe?

file version info and known copies
Installed inC:\Windows\Microsoft.NET\Framework64\v4.0.30319\
C:\Windows\Microsoft.NET\Framework\v4.0.30319\
Signed byMicrosoft Windows
ProductMicrosoft .NET Framework, Microsoft Corporation
DescriptionWCF Generic Command for Vista Setup

4 known copies

4.8.4161.0 built by: NET48REL1 · C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe · signed by Microsoft Windows

73315373b0f6cb3ca57e7808a47bb538b44e84cedbf2b2f76982036d1d7a94ac

4.8.4161.0 built by: NET48REL1 · C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe · signed by Microsoft Windows

f1449d7e36137720fb1244dbeec256e11986891adf7d36250428dbc48e3b163b

4.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe · signed by Microsoft Windows

2b7e4dd728f186ad6f6e55f53f863a560006773cc97d17ac847a305b29f96782

4.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe · signed by Microsoft Windows

4e6240e12755d0f48534a42f78b860ffba993d94d386a7d64063a89afa250814

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.