CmdID

CmdID / Files

MdRes.exe

Windows Memory Diagnostic file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real MdRes.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Memory Diagnostic

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\MdRes.exe · signed by Microsoft Windows

dc751ac0e1397bdcca9a4dd4fd9d21c1aaa79c8dbb60b0a548f5569f10551175

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\MdRes.exe · signed by Microsoft Windows

017f58759130eb04830148c5f71d866d9d9c0a231ca67440d335b8790c19afe0

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\MdRes.exe · signed by Microsoft Windows

d0d1ff3026085b35eb40f1a00d5c238824964c39e9c19d9ce41aa3ff43a45a64

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\MdRes.exe · signed by Microsoft Windows

d1a6fd804666268f55416b5aa0e0cd127738febc0ec62181e68e676de4a028a9

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\MdRes.exe · signed by Microsoft Windows

5f81350f8147e8632c6514f06f4487daaee7ce2ff1ec53b821d14d862c21a08e

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\MdRes.exe · not signed

09bc5032927ae5ec5edaa71dff73372b9391c82d1fd6ae0bc1318d36749506e3

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.