CmdID

CmdID / Files

winresume.exe

Resume From Hibernate boot application file version info

Program on Windows 16 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real winresume.exe?

file version info and known copies
Original namehiberrsm.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\system32\Boot\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionResume From Hibernate boot application

16 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\winresume.exe · signed by Microsoft Windows

2e8dcc11086a97ded6c1ad9b963134a1be885b610d8a978bf642eb2708ac758e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Boot\winresume.exe · signed by Microsoft Windows

093a8bbf4407fcb92e6d70ccbeadb7f7489c81c91a5149976f04fa923132407c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\winresume.exe · signed by Microsoft Windows

0f621876ea2fe9cb79503a1852bcd922d9825b579e86296f5d82ab88c0bf942e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Boot\winresume.exe · signed by Microsoft Windows

1e80a085d52770dcd3670f788ea3ea86613abcf9e9d7036f265d6fe3e491e278

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\winresume.exe · signed by Microsoft Windows

5567a9b7542cb5e273b53fc33d10716643d0bcbdf95c371ab502aa35e0de1751

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\winresume.exe · signed by Microsoft Windows

5961bc573daf3be2774c7585ca09938b2b6c4e61660ec80f86c90e7162509d62

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Boot\winresume.exe · signed by Microsoft Windows

622e54b86250ebd695eb62ec39d4d6039775e3f5a1672f11fa65a87fea6ec33d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\winresume.exe · signed by Microsoft Windows

9088e8382ef526edcb9cd68f31643a9bff0487834a6b3c89dc6b1a4057d1baf5

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\winresume.exe · signed by Microsoft Windows

9767eaee9fff56e2536d314912090cd2ea02e92b72010c77d256ac2fe4a403ca

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\winresume.exe · signed by Microsoft Windows

ff57b3ecad4a51913d87cbb581cbca7082aa53f619e83c05c0f088cad2309df5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\winresume.exe · signed by Microsoft Windows

5f55d1a1deb8508a31f5630f9716f81e58a8e05fa1a7b8043f26be618149b9ea

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\winresume.exe · signed by Microsoft Windows

6efa3d02199a0f642ccf9473defb2033b1f5bc3a7579e4768265980da0ecfb5b

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\system32\winresume.exe · signed by Microsoft Windows

8c7b268ffe07729937063812aaf8d65ccd7004e36e7f1c803f9b3d46054ae260

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\winresume.exe · signed by Microsoft Windows

846e4db91b435d8b2cc7ff6dba208633c4fde16d9c781bc712eb5baa14318e23

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\Boot\winresume.exe · signed by Microsoft Windows

47ad7012a9f441aa8c693a289d9b91eb6e57679e3e798256179a61bce64f773f

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\winresume.exe · signed by Microsoft Windows

84ae4c7b424a58781e7a59ac306031baf6b111eaefb6e50d01c66ab0ebce3e46

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.