CmdID

CmdID / Files

dsregcmd.exe

DSREG commandline tool file version info

Program on Windows 9 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dsregcmd.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDSREG commandline tool

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dsregcmd.exe · signed by Microsoft Windows

0537182720ea005ce15fddd92f426f1941719e844741bcacd2e52bd67fea3690

10.0.19041.906 (WinBuild.160101.0800) · C:\Windows\system32\dsregcmd.exe · signed by Microsoft Windows

47a44a548c462510301785b3d849e7fa731b911fa0b174574876a1367c88cbd2

10.0.19041.662 (WinBuild.160101.0800) · C:\Windows\system32\dsregcmd.exe · signed by Microsoft Windows

3ab0bd7713bfefd5b8c3c9614ee62f7d6c66d57d6408d20d54cd994e38c29c83

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dsregcmd.exe · signed by Microsoft Windows

94e9c63044e4c789896c9747340319e85053a16a69ae5be0f22a2645bf11d472

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dsregcmd.exe · signed by Microsoft Windows

c07bcd7cdf0a82209e77648cb32b6cafaa43748846f468abddcf82b24ceeec7c

10.0.18362.836 (WinBuild.160101.0800) · C:\WINDOWS\system32\dsregcmd.exe · signed by Microsoft Windows

4921b19d3c43cc0cf9921cc37ac0adf10cedf20c61aa52f7fc8ba6e717168635

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dsregcmd.exe · signed by Microsoft Windows

bb2e36193782ed2de2444309ed95206b8abbd4665d348c4faf9eb3e4a7481d3f

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\system32\dsregcmd.exe · signed by Microsoft Windows

d5c2940f0f94354e4adf8238185ecdba91137656a634d336d9e81c7d23a5e96e

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\dsregcmd.exe · signed by Microsoft Windows

55af68beeec8f56f931c497ef876d5e204e55257dcdb8e4fcde498bfcaeda0d8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.