CmdID

CmdID / Files

chgport.exe

Change port Utility file version info

Program on Windows 9 known copies with hashes Command chgport

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real chgport.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionChange port Utility

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\chgport.exe · signed by Microsoft Windows

ba4f045bc2871371d2c83cd50ff6ffa5f32e657aebb41dc61c0931c6f77dd7af

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\chgport.exe · signed by Microsoft Windows

e68aa9ecd4ecf58618ef794a9b493b5d070ccd5b435b7b850c95a3302c39fa59

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\chgport.exe · signed by Microsoft Windows

d84aba580fabdf6e5b2207780bc5fd4f2f7203a892702c97319a276eec8bb7b2

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\chgport.exe · signed by Microsoft Windows

7b58fd0e18bc8969ce5e5b3c790e032d7e29af591f374075c645073c236b148d

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\chgport.exe · signed by Microsoft Windows

92e224a1e945b43143d74d1396b391c0fe9e123fd075c8ff368a7800b1fcd985

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\chgport.exe · signed by Microsoft Windows

0fe597ad95b4878cc62e79abe423cf4f757763c0a9c1415745c80dce3cf31372

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\chgport.exe · signed by Microsoft Windows

99a70044f8d5f46d46fdd4552b4405164a0ff740366829e25e149af711ea070f

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\chgport.exe · not signed

6e8c6c77560972a400827ceec38dd4d24f5781debc8414c9e01c6b309c28366a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\chgport.exe · not signed

86292e7b6c5dd275922c8888bf8de91293748af4d5ec4676ecd13c6effab5c00

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.