CmdID

CmdID / Files

chgusr.exe

Change INI File Mapping Utility file version info

Program on Windows 9 known copies with hashes Command chgusr

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real chgusr.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionChange INI File Mapping Utility

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\chgusr.exe · signed by Microsoft Windows

866fa19c2f5e84c01870f6838dd8ab12bad9c0d0c41a567b693da797c0adcf6e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\chgusr.exe · signed by Microsoft Windows

074b4a36e0cc697e4146ea3873bfd25ebb067f2a937930e4d8393340f84f0d32

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\chgusr.exe · signed by Microsoft Windows

f7be88e8869b9d252fc52ba6fad6acdd9946aae226f1db35309e8f7db64ad6ce

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\chgusr.exe · signed by Microsoft Windows

1e393b27f64524042c49e1b34f1fc48389421e16169d7f08b205e810ad101074

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\chgusr.exe · signed by Microsoft Windows

4da3797b3aab0bdc53a2b923c43a84e16269c4683a556fae0f491b827baee1c8

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\chgusr.exe · signed by Microsoft Windows

20c936ea1dcad8ebc899f336ed29bf0d08737c12a99020bde1770576a7c185fa

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\chgusr.exe · signed by Microsoft Windows

51fe407785a2b1164b5313c981968a6eb100ab21a3b9deba25de223ba96a22be

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\chgusr.exe · not signed

3768dbbb83c7ee7d87ec008d271c0d1288273e62191fc87acd6572e8f55c22ed

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\chgusr.exe · not signed

859843b16a80fe37cf1aee29f0483bd7c8d73122b035643041c3b9f93efce61a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.