CmdID

CmdID / Files

WinMgmt.exe

WMI Service Control Utility file version info

Program on Windows 15 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real WinMgmt.exe?

file version info and known copies
Installed inC:\Windows\system32\wbem\
C:\Windows\SysWOW64\wbem\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWMI Service Control Utility

15 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbem\WinMgmt.exe · signed by Microsoft Windows

9b9b92eb2f7d0ee54bad71b4d91627362dd8a14489cfa962e5a4f15547b1e9ed

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wbem\WinMgmt.exe · signed by Microsoft Windows

f9f9a0811dc55b0effe71eec1e8a513ab194e45e29a8b1fcbf5ed17ab0c1bf9a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wbem\WinMgmt.exe · signed by Microsoft Windows

3815fc3fa1dcccfa9b698a93501c9ab1fb466cbfb2b218630bcaa7b26f0d3fd1

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WinMgmt.exe · signed by Microsoft Windows

7e869ab16b76f5eb785b6ff4f33766574e3cd414ed42a900e97ccebfe071611a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WinMgmt.exe · signed by Microsoft Windows

9587494c2ccb011bd1dd77500b4d6840268afd6c567dfd0beac51ed3c92147d0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WinMgmt.exe · signed by Microsoft Windows

acf5cb14318c8ccd2645f9f72a8885ef3631ced88ebf2b832dfa541373b062e3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WinMgmt.exe · signed by Microsoft Windows

fbfb47d271b109973e3e7678d83d2fc20448775c26374dbcfffae445c932c592

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wbem\WinMgmt.exe · signed by Microsoft Windows

1c68b6b46aeae66ebcb853d9e12b7d4828959974bdde690407ef1953e58ac45c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbem\WinMgmt.exe · signed by Microsoft Windows

66083d9b1c3f89f20b29cc4cc1275527122c5e9cb66a996929f399415d2e288c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WinMgmt.exe · signed by Microsoft Windows

720a7adb445f98c7a71f406711a4aff6c0e3143aa18a12df851b806d2d5b00fd

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wbem\WinMgmt.exe · signed by Microsoft Windows

a733b3e7c718371fd75855b43d778710016e3545c9ac3705e26c080c43763140

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\wbem\WinMgmt.exe · signed by Microsoft Windows

99f019d890f61a347afa059fd82cf1a875363d8dfa50d14d040ba289f72aba92

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\wbem\WinMgmt.exe · signed by Microsoft Windows

a2fc74c6f75fc247659a6b26165116d9e76ae0ef9e540d231698fea5f61c8273

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\wbem\WinMgmt.exe · not signed

1350196dc351b56cde07ad7eb17b594407cf0dc20d4626b4112d46b68d47d631

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\wbem\WinMgmt.exe · not signed

dd22ebe045ef8643484e127eaab1180c0aad29c2da2ca25296da3084bbc0f947

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.