CmdID

CmdID / Files

openfiles.exe

Displays the current open files list file version info

Program on Windows 12 known copies with hashes Command openfiles

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real openfiles.exe?

file version info and known copies
Original nameopnfiles.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDisplays the current open files list

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\openfiles.exe · signed by Microsoft Windows

0bc4eb1731e746dff639479ca848dea6cb420907fc7df297a06dbad610e0e189

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\openfiles.exe · signed by Microsoft Windows

9735ab2623d42595905635d62df661cb6f2a63c8fd7259791559e45a6c542930

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\openfiles.exe · signed by Microsoft Windows

8c8ead6b2fff2bece455b6b43be47ddd177b5803f1ce9d0ab7cf5f23aefc3221

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\openfiles.exe · signed by Microsoft Windows

f559eb1de240cc388d2d1b612d45b8ad962822783fcf36ec8c541ed0f29c9d48

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\openfiles.exe · signed by Microsoft Windows

85482b4678b0a0a8da65122c872375ad5a5c27368cda228c00a1b4a030bb2570

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\openfiles.exe · signed by Microsoft Windows

edb368cb40cec43a6c4f9ee9ee7acf056e0f35b39797a93e80f502c4aa3739c3

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\openfiles.exe · signed by Microsoft Windows

4b27c43035b1c35d4f3185709f7d097bb52751a066180f4979a5ad49ff8c5a62

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\openfiles.exe · signed by Microsoft Windows

ae663f66615f66a4f5970fff2ebc7b50142bb5fa809b472d942b50887daf9f0f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\openfiles.exe · signed by Microsoft Windows

5116a06f6ada4d7bf44f545763c80f140eb1757869ee6da6f94d96f49307963e

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\openfiles.exe · signed by Microsoft Windows

6a77e3cb63cc83eecfeefc218f07ba02fd124690fc535475fd139acc22b921a6

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\openfiles.exe · not signed

5b6256e8c1590c938b3bfdc3d03ffc90d1855dbc1a1c25d0570483ff08779cf5

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\openfiles.exe · not signed

6374e1c9d3647f9c04ae42fff152aa3f9986cf2e778b76a62db4e2b1d53f0bce

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.