CmdID

CmdID / Files

cofire.exe

Corrupted File Recovery Client file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real cofire.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionCorrupted File Recovery Client

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\cofire.exe · signed by Microsoft Windows

7faea0ea3640569c0b95f4f6ca939475873468e9dbcdb5e1cd7849b0f57ea5c6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\cofire.exe · signed by Microsoft Windows

bb4b7c9197803404db85684a5db5528a87e1e0a9d1d6906a608f7fd6dd1659a8

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\cofire.exe · signed by Microsoft Windows

99e466216eee680a3cf320e3b1e44c77e9ea4ef5a0c1ab9cee3dc100f9c68197

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\cofire.exe · signed by Microsoft Windows

a99acdfc69c9a7c3e027a9bec724d3c366d3fc52429bf6e2c1ffc8156beb7d75

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\cofire.exe · signed by Microsoft Windows

bc5c3e946738b49fa8e3ec466244f0549f846b81278bbcc68fab63a544e0e9ca

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\cofire.exe · not signed

57fe5c5932e87e77cad9742efa2216d81e5b496e5081607af982eceff3b94252

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.