CmdID

CmdID / Files

chglogon.exe

Change Logon Utility file version info

Program on Windows 9 known copies with hashes Command chglogon

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real chglogon.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionChange Logon Utility

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\chglogon.exe · signed by Microsoft Windows

41dd31fed7c8af3e2ee6786f863ba48d5f599e214dfda58ad1c1fbf9c54b00e4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\chglogon.exe · signed by Microsoft Windows

a9cc2b03783896c6596d8f4e4cc3db555a9096264bc8253478d1f0f0fbb2b74b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\chglogon.exe · signed by Microsoft Windows

f4fd41e25fa4e35606e00ba7edb7572a6d130444da0198b3fce0fb740aa042da

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\chglogon.exe · signed by Microsoft Windows

af8efca7d19796276a3b6a9fcb352a9b15b2626ddce0ee0aeeabcd756cf3788e

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\chglogon.exe · signed by Microsoft Windows

c91f6b286b59ae125bc039512ff9801354c10e74dca9cd803067d2cd1441592f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\chglogon.exe · signed by Microsoft Windows

1c83a61f2fbcf0713498086e22786e105557caeedc9a9daa8064dd19baa85f0b

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\chglogon.exe · signed by Microsoft Windows

6d44581317be1a78b4624157969408827e2ddab396147dfae90f44ca461d023a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\chglogon.exe · not signed

1d8ee4a0b49293560ab4f735a4aa0aeb44ace7c53b7ab4f28526e3b76a27be83

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\chglogon.exe · not signed

fcb898e09585e060ab52f5105d9c0f5aab5e1fa03abd2182370f2ea8bfcf0a38

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.