CmdID

CmdID / Files

logoff.exe

Session Logoff Utility file version info

Program on Windows 9 known copies with hashes Command logoff

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real logoff.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSession Logoff Utility

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\logoff.exe · signed by Microsoft Windows

32362c85ba2f3389a9cf950123720fc8cfe46926a375a56aecb0ddd3af9aeef6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\logoff.exe · signed by Microsoft Windows

4b5df4ce25bcd9cf635cded7333f5f53d23f57b2adaca1ddf987c4b717f7ffb4

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\logoff.exe · signed by Microsoft Windows

fd250a61f9bdfea9e9f726bbf9f1d6840bc6d0bf8e7aff8841e554ed688bfc84

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\logoff.exe · signed by Microsoft Windows

44c5395e75badae29dffdca73f3327d3ee64f70e2e60ba7d7ea367693e622ef5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\logoff.exe · signed by Microsoft Windows

a8801f55523961a7dc8b38cbf48fbc1e46ae8e993e09153a240ac8f996c3a46f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\logoff.exe · signed by Microsoft Windows

0069ef09c0fa4113dd6e4eb62361382f1745d8a5fb9c68d45e2f03378275bf44

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\logoff.exe · signed by Microsoft Windows

ec35aeededead912b65247bebf6b87d010182aca99ea78b6ee2d80bd267fbd40

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\logoff.exe · not signed

16047e4459719867b6cc25bef0b38f21b3c2f885ff4d37b6b9aede9ed65a3a9b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\logoff.exe · not signed

9c05d671e08bd2310204e4c4f1d2c6d4cf06378ef00d208eb96639b4b4b0e770

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.