CmdID

CmdID / Files

dcgpofix.exe

Microsoft (C) Default Group Policy Object Restore Utility file version info

Program on Windows 8 known copies with hashes Command dcgpofix

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dcgpofix.exe?

file version info and known copies
Original nameDefaultGPOFix in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft (C) Default Group Policy Object Restore Utility

8 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dcgpofix.exe · signed by Microsoft Windows

0b95cddf622d0edfaca0eb88f798e7a3076c49c8ed860e90b776728345247cb3

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dcgpofix.exe · signed by Microsoft Windows

5942323f73597499d9fc6d5e24ce23ee357b24e432c81349103d4db8e47f3d74

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dcgpofix.exe · signed by Microsoft Windows

bc85d2fcffc0b1231a3c867ddc7f72c4715c39c94c94fe952932545691dd92dc

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dcgpofix.exe · signed by Microsoft Windows

e6c6951cca541ff83da924c6b15efed8101a08f863ca44afcc8128c63379e53b

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\dcgpofix.exe · signed by Microsoft Windows

32b2012c038dd49e96dd2f0de5a2a2a17bc29e166b94c4b21b984b7a3b09a2f7

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\dcgpofix.exe · signed by Microsoft Windows

cec0758a9b0ed22dce339a73823e9e04f78c51bac4de5adb09d975aafd130b37

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\dcgpofix.exe · not signed

47bf6ee4c567a90287af05dc8ffea98eaf1f908337f24b5c168473abfcf31a1d

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\dcgpofix.exe · not signed

f2e81ab35f0e9f78a75b2a3a92c92f5a53b8138a686f672f5196bc5115da4fab

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.