CmdID

CmdID / Files

FirstLogonAnim.exe

First Sign-in Animation file version info

Program on Windows 5 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real FirstLogonAnim.exe?

file version info and known copies
Installed inC:\Windows\system32\oobe\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionFirst Sign-in Animation

5 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\oobe\FirstLogonAnim.exe · signed by Microsoft Windows

0a4ede493bec533390646e6eefe811b5a6c405f719e986a038f8fa10bfcd2001

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\FirstLogonAnim.exe · signed by Microsoft Windows

96ec7820603a983285a982ff7d26a688c7de3184fdd73041655044162b9a35c4

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\oobe\FirstLogonAnim.exe · signed by Microsoft Windows

b3c98f6a217e70dcbb84f565e2ffd2b5b3cb7b4e2e62285d9bee04426e501665

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\FirstLogonAnim.exe · signed by Microsoft Windows

7fb56536d846405d6b9be71bc8bc485e01b54aa336ac9a6be47adfe7410d2b2c

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\oobe\FirstLogonAnim.exe · signed by Microsoft Windows

45ae2e1d19f8044ed6854a5a5781e6e2841c18d1be2a0bb84adc4f100b79e575

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.