CmdID

CmdID / Files

IEChooser.exe

F12 Attach Chooser executable file version info

Program on Windows 10 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real IEChooser.exe?

file version info and known copies
Original nameF12Chooser.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\F12\
C:\Windows\SysWOW64\F12\
Signed byMicrosoft Windows
ProductInternet Explorer, Microsoft Corporation
DescriptionF12 Attach Chooser executable

10 known copies

11.00.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\F12\IEChooser.exe · signed by Microsoft Windows

6181345fc231e492026aed72a21587ddc1701f21a05c6d55b41fd7c2f545ecb5

11.00.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\F12\IEChooser.exe · signed by Microsoft Windows

7eed016b70cea553da8373f9e5ae9c90843e10eb0b61a2de664fc1677fcbde65

11.00.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\F12\IEChooser.exe · signed by Microsoft Windows

08e4be0eb2f1db877b87a9677c1e140d02f3d67977b207fa3fd3e5c925b38973

11.00.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\F12\IEChooser.exe · signed by Microsoft Windows

0b822960532db8b1f75e9233038f74b64532248972b2f8fb701d3692d30f538d

11.00.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\F12\IEChooser.exe · signed by Microsoft Windows

b89e23e33782a969eb03d975a486a5eac0291cdb45f9a14ecd929d7d77a92784

11.00.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\F12\IEChooser.exe · signed by Microsoft Windows

bba5fec2a2d386e537ae22bd7ee2c389cc06efc263900318ef1748276b22e620

11.00.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\F12\IEChooser.exe · signed by Microsoft Windows

b335e9c16bc51168230903c125c9c1faafed5a05a4c738c113a87502340c25dc

11.00.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\F12\IEChooser.exe · signed by Microsoft Windows

b9a4f5293fecc3619d436a45a4be1ab3b90f6c9b6aef2ca13e21b5dc5b0e3da9

11.00.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\F12\IEChooser.exe · signed by Microsoft Windows

07646115e1b288fdb859ff72253956e2aad7ad8ab0f8ed83cf4745bb02b8c659

11.00.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\F12\IEChooser.exe · signed by Microsoft Windows

91df9f47f5b6f1d81be0f79c48fce1cda78d4acad95e938a8fd71e279ecf16d2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.