CmdID

CmdID / Files

oobeldr.exe

OOBE Loader file version info

Program on Windows 9 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real oobeldr.exe?

file version info and known copies
Installed inC:\Windows\system32\oobe\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionOOBE Loader

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\oobe\oobeldr.exe · signed by Microsoft Windows

61bdb0202ae3d18517814d69c7534c18e6fa7d8118b23bc5a5c12a7adb0a6ba6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\oobeldr.exe · signed by Microsoft Windows

454d43d4370925d8306ac185714e0aeba0280e854a804348079dd8b48be641a1

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\oobeldr.exe · signed by Microsoft Windows

67fe654b8b277df364e596c2ac7466bd307f28c244425aac7bc79f1de3269a5a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\oobeldr.exe · signed by Microsoft Windows

b5f65b8bc7dcb4f000e14d71ccc27caed1ce7f6f26d95b3e3f7a84b802275451

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\oobe\oobeldr.exe · signed by Microsoft Windows

b98e1ffb925bed48e9a4e0ab9d747f50fce056eebc3d43927ed0b5d3d34cfc7c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\oobeldr.exe · signed by Microsoft Windows

4f424dc5e0c16cbbac4a12c3750297f0f58697e102fb2001c655868ed829274f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\oobeldr.exe · signed by Microsoft Windows

741557d1144af05a7445f95ee200ea772bdf8c50d2c9798604b1d322fa24e87f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\oobe\oobeldr.exe · signed by Microsoft Windows

bc0f4eac6f5a966126d29d0b4a058f72487cdd20340ab4ffdb24574e86a5eb49

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\oobe\oobeldr.exe · not signed

142c996c5081f1be1d343fbf5f7f65ec535e94db0381d348137da61a46d793e3

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.