CmdID

CmdID / Files

relog.exe

Performance Relogging Utility file version info

Program on Windows 14 known copies with hashes Command relog

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real relog.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionPerformance Relogging Utility

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\relog.exe · signed by Microsoft Windows

16750bd44a1aa215985c5e33149c8ccba62b8f04558569ee756c9408a2470b61

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\relog.exe · signed by Microsoft Windows

95ea354f6aa22d0f04333908c851c29a24d4471de46c07c9511d52b63252cfcf

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\SysWOW64\relog.exe · signed by Microsoft Windows

2030c6509cee45e3629a9b47d09bd421b83f48f356ed597a03c89306610d720c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\relog.exe · signed by Microsoft Windows

245c64930182b28134a2e2a79bb8a9601f00e41bef9dfe345887c7fa5c346bcd

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\relog.exe · signed by Microsoft Windows

67a91a332e3fe5444ac17489806709e5430a47aafbcf3ad57ef2a849f599a3cc

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\relog.exe · signed by Microsoft Windows

fa6b86965e740987905eecfc510922c2f1335afe06148b660a31edb4b67f477a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\relog.exe · signed by Microsoft Windows

0d716c8c79c9c304fd15e2ddaa4be994dba8da7c758b02b590694646c257fdb5

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\relog.exe · signed by Microsoft Windows

1429c59f52fb140c21fd536fb47e85262f29f789a160659f7467ea32f66225ed

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\relog.exe · signed by Microsoft Windows

100af46c952e58105dbc51eb92510f6990377a3ffc57e82074a8bfb64c56c529

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\relog.exe · signed by Microsoft Windows

74f5b521d214d9dbbdfbb46f2124b87b9585098ac68a23c6ff101055e7a1c3b3

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\relog.exe · signed by Microsoft Windows

cd0f9b1132fd4b0350c2d87626695c3a02391611376bf0077614250261239f68

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\relog.exe · signed by Microsoft Windows

ef2fb9eaebdfa842e076c8c2ed9a0c8f9616fb81f654b1df21575951d3d728e4

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\relog.exe · not signed

9c3b9def86e340419c324ebd3de0c6f3c9a97694cebbfc3224f94bec30b7e098

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\relog.exe · not signed

e662b75446e5367566fef260e523f346d5d6d690443395a05f0e587c8f36d366

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.