CmdID

CmdID / Files

winload.exe

OS Loader file version info

Program on Windows 15 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real winload.exe?

file version info and known copies
Original nameosloader.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\system32\Boot\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionOS Loader

15 known copies

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\system32\winload.exe · signed by Microsoft Windows

64fe4e3fcfeb427bc76cba9c1e58990c607f280a10be253787d7665e0b3e7975

10.0.19041.662 (WinBuild.160101.0800) · C:\Windows\system32\winload.exe · signed by Microsoft Windows

0e2db883e483794631804947d433f29d0d469c9585935e052166076c71ba4495

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\system32\winload.exe · signed by Microsoft Windows

5b2aebaecac16325cb6e123f06ac882c7c9adef6287d2e596f535c24861d6cbb

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\system32\winload.exe · signed by Microsoft Windows

050ecfe3ec1ae3814b29fc938171616d37d763f1822f15290b2f022c4b0a821b

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\system32\winload.exe · signed by Microsoft Windows

e80aeccefbd2e2ee8b35c4de3616e472f0d790e746fa512dab52f1045d3ae0ed

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\system32\winload.exe · signed by Microsoft Windows

9a383cce437df43adde97c0e8500a2849495496126c4cf66c88d438f715aca9a

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\system32\winload.exe · signed by Microsoft Windows

892fa34d5e304c7f23bfbd1a89a1dfcedd3c80c4282da406d4009456920ff450

10.0.18362.752 (WinBuild.160101.0800) · C:\WINDOWS\system32\winload.exe · signed by Microsoft Windows

d58108217bcf11fb5224a10c3d27076cc354eb4dcbcd4c301d07aa0bf1113c94

10.0.17763.1490 (WinBuild.160101.0800) · C:\Windows\system32\winload.exe · signed by Microsoft Windows

e291e5754c31cd14a4b81899dc8ed14953c922274f77bae35117b76c9957c862

10.0.17763.1369 (WinBuild.160101.0800) · C:\Windows\system32\winload.exe · signed by Microsoft Windows

435c9ac981f82a1e2e95bd8ffa08afbbcdaa08dbbe40be53592325ab502d20d3

10.0.17763.1217 (WinBuild.160101.0800) · C:\windows\system32\winload.exe · signed by Microsoft Windows

ae71186d292984992eb43514732093c65badd9948c93b830d51613a7db206337

10.0.14393.3686 (rs1_release.200504-1524) · C:\Windows\system32\winload.exe · signed by Microsoft Windows

1d522fe44613b1e6894fb4972be5111cb92ea274029cc168d56c11d216e26e64

10.0.14393.3503 (rs1_release.200131-0410) · C:\Windows\system32\Boot\winload.exe · signed by Microsoft Windows

5e6cb59c670d753ee00f3bd72d104266ed46f28859843f203558797cef327fad

6.3.9600.19629 (winblue_ltsb_escrow.200127-1700) · C:\windows\system32\winload.exe · signed by Microsoft Windows

218d7bd238755b14cc3cbada3ea566ec2a1134b0442307385c5010bef90072bb

6.3.9600.19345 (winblue_ltsb.190406-0600) · C:\windows\system32\Boot\winload.exe · signed by Microsoft Windows

4f612367acff85a1d70efc0458231cfc47fdc567f98c3832e7d032e46ead31ba

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.