CmdID

CmdID / Files

srdelayed.exe

Microsoft Windows System Restore Delayed File Renamer file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real srdelayed.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Windows System Restore Delayed File Renamer

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\srdelayed.exe · signed by Microsoft Windows

6a07ab63ec1160f98718eb386e8a2d46e64733921896f03b7b8bd0905d376ec1

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\srdelayed.exe · signed by Microsoft Windows

f836ecf7042c8a82161024047692f6f1763ba8d92dc1952751a8a8c5e27526cd

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\srdelayed.exe · signed by Microsoft Windows

873232bc7da9a9c6c572cf00e7c95b3d74b863403de1784bd031bca1eded5106

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\srdelayed.exe · signed by Microsoft Windows

f5f969345107e3b968c539106f6d759d440d264619e798a762be30b63e3fdf17

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\srdelayed.exe · signed by Microsoft Windows

9d974610f0def6e4ed9e97e0d32668a3c4c779d3e3598bf6e4885c798784db9b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\srdelayed.exe · signed by Microsoft Windows

cdf5dde44714dc7b41f9cc3402cb1244a25ea607477a28ef424f7f01fec4d16f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.