CmdID

CmdID / Files

symstore.exe

Symbol Server Builder file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real symstore.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\
Signed byMicrosoft Windows Kits Publisher
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSymbol Server Builder

4 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\symstore.exe · signed by Microsoft Windows Kits Publisher

cadaf22923895212447b25090f567b1f0cf3c10173db9fa202ce060b57c1e1e8

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\symstore.exe · signed by Microsoft Windows Kits Publisher

eb642f9a78c736132c0d193c5a1e4bc0800dfbcd01d0c57d8542e80f169cdd6f

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\symstore.exe · signed by Microsoft Corporation

ed986351c69c556416a950744c2209c136812f3cbb376a1fbf15fe11607c39c4

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\symstore.exe · signed by Microsoft Corporation

f08332d60604f0020682bc613072e9628fa4bf21bc61a73eff9ecfb5ad683a7e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.