CmdID

CmdID / Files

ApplyTrustOffline.exe

"ApplyTrustOffline.PROGRAM" file version info

Program on Windows 11 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ApplyTrustOffline.exe?

file version info and known copies
Original name"ApplyTrustOffline.PROGRAM" in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
Description"ApplyTrustOffline.PROGRAM"

11 known copies

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\system32\ApplyTrustOffline.exe · signed by Microsoft Windows

a228c92c52fba2f3eeb04cd1e5606fd286d2da4cbbe459e0b32be886be0dd436

10.0.19041.662 (WinBuild.160101.0800) · C:\Windows\system32\ApplyTrustOffline.exe · signed by Microsoft Windows

a9d9c18f27dacb14580d13f5d12dd3a02b4385f86cadfe975f6a47124c7b6c3a

10.0.19041.610 (WinBuild.160101.0800) · C:\Windows\system32\ApplyTrustOffline.exe · signed by Microsoft Windows

3a68d7e8c0d380c98c6adb36ea1633cedc7f07d43ecdab3d3bccbc8b062e2a27

10.0.19041.508 (WinBuild.160101.0800) · C:\Windows\system32\ApplyTrustOffline.exe · signed by Microsoft Windows

aa9464658a64334f7beafa2f06247e34487020cd288e2c69591b497fc04e3741

10.0.19041.450 (WinBuild.160101.0800) · C:\Windows\system32\ApplyTrustOffline.exe · signed by Microsoft Windows

01d976b150180b6b628041c37df2c4c0e07c438df4f27a3c7457bd5bd03537a3

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\system32\ApplyTrustOffline.exe · signed by Microsoft Windows

d3ce775d0aca8263926d5da8b7ccf4bd900422d038f70cfd2bbf7582e55800fe

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\system32\ApplyTrustOffline.exe · signed by Microsoft Windows

1a295b076e12948d7cf3d6ea37149a247e2b43aadf6e7bf5eedc985f07ea0b5a

10.0.18362.815 (WinBuild.160101.0800) · C:\WINDOWS\system32\ApplyTrustOffline.exe · signed by Microsoft Windows

c178d4ff6c842e9b7cd4e4df866bc87fc99409fba5b5e80ead9b45f5ea5c5dee

10.0.17763.1518 (WinBuild.160101.0800) · C:\Windows\system32\ApplyTrustOffline.exe · signed by Microsoft Windows

bbd53941261c777991a8235191105b13cc8ef7f1e375493e9cbe5fea8fd13eec

10.0.17763.1397 (WinBuild.160101.0800) · C:\Windows\system32\ApplyTrustOffline.exe · signed by Microsoft Windows

bb4147a7cf66cc0748a69d0e93970f481eb662da58b3c1a30c164e23f07e57ee

10.0.17763.1282 (WinBuild.160101.0800) · C:\windows\system32\ApplyTrustOffline.exe · signed by Microsoft Windows

1abfc5ecef4859609b8b49970380f60ac7973d7abea9a22aa0cd6bb374b0a91e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.