CmdID

CmdID / Files

wbengine.exe

Microsoft Block Level Backup Engine Service EXE file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wbengine.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Block Level Backup Engine Service EXE

4 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbengine.exe · signed by Microsoft Windows

a61c92e436c09bacb128c8558b20d94115275a55ca0485088121a265a1ac81db

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbengine.exe · signed by Microsoft Windows

5ae95f3f77aaed3067cba39c5b2cd1790b949027e837b5af580f2a8d4714fb68

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbengine.exe · signed by Microsoft Windows

9954394b43783061f9290706320cc65597c29176d5b8e7a26fa1d6b3536832b4

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbengine.exe · signed by Microsoft Windows

9279f0a909c8e1a950f82918b09ae0c0ff7e8ff9f8a0edbeae62d44d869642ab

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.