secinit.exe
Security Init file version info
Program on Windows 11 known copies with hashes
Is it the real secinit.exe?
secinit in the file’s header: a renamed copy still carries itC:\Windows\system32\C:\Windows\SysWOW64\11 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\secinit.exe · signed by Microsoft Windows
044d0f8e34b67105d3ff2c2407c8018998a415100dc5beb53fd80a463e9e2bc710.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\secinit.exe · signed by Microsoft Windows
64bbb3bdd619b1ae5eafd9f4f9487af2d8a9450ecaf1fad025a881d36e94c40210.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\secinit.exe · signed by Microsoft Windows
2cdd87c41c0865de240aa3324492c66eded2ee0acac2e0532a92cdc0d664cd2310.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\secinit.exe · signed by Microsoft Windows
aa365888ab4e37156f06edf20049831ba7cd9203f6617a9632f1c8f3bcafe15a10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\secinit.exe · signed by Microsoft Windows
2972c67b2c60c5a4653be2413a1a7f0879cd2917a9db2d4745459ee2c4adf58d10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\secinit.exe · signed by Microsoft Windows
e05872644d9a819f5e5c97a8cebb9a547747c84b79c08f6bcf1a16ec76704c4d10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\secinit.exe · signed by Microsoft Windows
207a29388719600501b533360575a1d44e46db6d0e670f24b12e36a7ec9c422110.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\secinit.exe · signed by Microsoft Windows
ddce139b59faffe5abdb12fb6c7fbd256e6e18ca7fa5938cb164e94857ba07e910.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\secinit.exe · signed by Microsoft Windows
ec2f3d5b85d6ef1d057e86d1f40bf14d02734a421256c6c996d0d68aaa7f2b4410.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\secinit.exe · signed by Microsoft Windows
edae64c64950cc90554c45065c85fa807a8825c2076ad9c97f48d56d472966466.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\secinit.exe · not signed
25b54326cc1a1388f60a34df319a665d8a9679d251829de498320b221dafc64cFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.