CmdID

CmdID / Files

rwinsta.exe

Reset Session Utility file version info

Program on Windows 9 known copies with hashes Command rwinsta

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real rwinsta.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionReset Session Utility

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rwinsta.exe · signed by Microsoft Windows

508f5509eb4adc95cf1d205b7d67643455f944042af024c398fc430da88c190c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rwinsta.exe · signed by Microsoft Windows

44b1c84811495b426ec69a15888d5824a894421df052cc378fd6ada5c32a112f

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rwinsta.exe · signed by Microsoft Windows

514620bbe95e8408df43faa2d85740722581756c7ac3b32b7f51c6b007a91f78

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rwinsta.exe · signed by Microsoft Windows

0c5b4f925d9eaee1f899b5497b807402f00b20bb19706285218f1a7d8eeb85c2

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\rwinsta.exe · signed by Microsoft Windows

1689688b1d2f5f75fa038d340ca6ffb379c99df9137e6be57861b80d68727a23

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\rwinsta.exe · signed by Microsoft Windows

86e0f9aee3c5676360f82049d1039419179857390243f9f07c36091343056304

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\rwinsta.exe · signed by Microsoft Windows

dd736d92d7889e04d001486f0434ab7006a6688aa1842e1b4278a0baddef8aad

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\rwinsta.exe · not signed

bdb16bf6b4f2467b5a30d59c4b544c1a23a1daca6cb113273e0c3d3d69782553

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\rwinsta.exe · not signed

d423c3516e89d288272aa1e3784c7a256f9b45a259d4f4aae7792814f8c15ece

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.