CmdID

CmdID / Files

audit.exe

Audit file version info

Program on Windows 10 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real audit.exe?

file version info and known copies
Installed inC:\Windows\system32\oobe\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionAudit

10 known copies

10.0.22000.120 (WinBuild.160101.0800) · C:\WINDOWS\system32\oobe\audit.exe · signed by Microsoft Windows

b9e65643f65b75feb6469705e8b0306f67d457b7f58ec3bf277e638da2cf7839

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\audit.exe · signed by Microsoft Windows

4bf33e9de3635d54a163d5371dd1a02f684becaf8830af7b0cd0e882405ce48d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\audit.exe · signed by Microsoft Windows

546d48d5801d34f7725ec91c0049ae34942c17e715b18457fe679588221ab3a3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\audit.exe · signed by Microsoft Windows

eb56d3b18533cbe231764c542c792b1fe2841647dd4c527bbc6e27ec2e357c6a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\audit.exe · signed by Microsoft Windows

f655840b7e70fac7459e09ebe5407087c9e8e1e0d42dcd72ac3990904f425338

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\oobe\audit.exe · signed by Microsoft Windows

d16d01491d2eff0e6d03bcb8d75625919e214d1237907b7a89e63555bb355cc5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\audit.exe · signed by Microsoft Windows

1b17921adc27fd0d29f5f1f02a333596fc25cca27e2ae010f7b42fd8ac9ea80e

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\audit.exe · signed by Microsoft Windows

ec9f9f6e77f243ed783819194d2cb88ec6e64bd6696ca49ca4227f763cb9cad3

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\oobe\audit.exe · signed by Microsoft Windows

9d839c0ba2ebc419838463a7da07e4e9f052ec6dbba548339eedfddcec7fb77e

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\oobe\audit.exe · not signed

1dfff55f4fd929f04aaea59ffd69ab8e31474ce0fed11ad034af17b9ea0d0bba

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.