CmdID

CmdID / Files

VSSUIRUN.exe

Configure Shadow Copies file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real VSSUIRUN.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionConfigure Shadow Copies

6 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\VSSUIRUN.exe · signed by Microsoft Windows

02e2f77451d995d053e0fd296a1cdea7c3e3d24933c961987ae672a865a01d60

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\VSSUIRUN.exe · signed by Microsoft Windows

5fb2a2ab658633c67eb870009bef09307cfcac8fec25f00c1f358c602c340705

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\VSSUIRUN.exe · signed by Microsoft Windows

3a430604733ce135da6b421928cb9ecdcf2e1166ee185bb009d23a1d91259d2c

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\VSSUIRUN.exe · signed by Microsoft Windows

e36b0ca8e734ef9c9fa3612d29dfa769ff79f185e24b9bf1207eb5c0ec4d8812

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\VSSUIRUN.exe · not signed

663e604dc83eccdf109b8d5b0c9896338d15e8b599f8ec754226983d78d9f187

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\VSSUIRUN.exe · not signed

9c9c7ea0965fe1b6b34b07921e5c46ff2bd45b1583b26f5e78f3edc202470c63

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.