CmdID

CmdID / Files

AuditShD.exe

Audit Mode Desktop Switch Utility file version info

Program on Windows 9 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real AuditShD.exe?

file version info and known copies
Installed inC:\Windows\system32\oobe\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionAudit Mode Desktop Switch Utility

9 known copies

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\system32\oobe\AuditShD.exe · signed by Microsoft Windows

586c8a68640fa836d8a1ac8fdb7d361a598a1cb3ed277812f4e68061194215a0

10.0.19041.572 (WinBuild.160101.0800) · C:\Windows\system32\oobe\AuditShD.exe · signed by Microsoft Windows

13b9f0f81e9ef9f77da064a3dc483d873796beda8355520606c3a10b074d66e1

10.0.19041.450 (WinBuild.160101.0800) · C:\Windows\system32\oobe\AuditShD.exe · signed by Microsoft Windows

86395007a28868b010c38ed2654a12583b8e2ebf86d75d22bb1169cb3e9e9f23

10.0.19041.1202 (WinBuild.160101.0800) · C:\Windows\system32\oobe\AuditShD.exe · signed by Microsoft Windows

1afeb20b44146398f73c48998a50b9ba42257ffe5620cd188d1971555ba9eefc

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\AuditShD.exe · signed by Microsoft Windows

61f3515925c5750fbe4482312c12029adcd88816762559bbed4fbff545c6d1a3

10.0.18362.207 (WinBuild.160101.0800) · C:\WINDOWS\system32\oobe\AuditShD.exe · signed by Microsoft Windows

036729f768ffb1c6c1c2d03bc631d92b3cbae5beae9ae768d631c6a743e556c3

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\AuditShD.exe · signed by Microsoft Windows

ac9284e17feb93f313fa31b5b62cf6e6743f0df3797c3d513e6fd3e55382115f

10.0.14393.3503 (rs1_release.200131-0410) · C:\Windows\system32\oobe\AuditShD.exe · signed by Microsoft Windows

dac0c6cb18f995556f731c89e09fb34ddafdb4c9919c5c5b940d2f00eb63d8ef

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\oobe\AuditShD.exe · not signed

5516375c7bf9f770fc3c31863a9bf217e098e8e45ecbd93464616b458f1b7f35

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.