CmdID

CmdID / Files

msg.exe

Message Utility file version info

Program on Windows 9 known copies with hashes Command msg

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real msg.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMessage Utility

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\msg.exe · signed by Microsoft Windows

81782e9f3f0816d1e242fccbeb1d3589c6d2825d92d964cca8d1e1c48e973f68

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\msg.exe · signed by Microsoft Windows

2bdab404df6e4990bc1fd8f7464dba325fb993c67e592ba1c5dc4f07c02a8e85

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\msg.exe · signed by Microsoft Windows

0157bd32c17bedadedd95c1fe59a33d0201f1c77422b40c05f2a81a5ff503f4f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\msg.exe · signed by Microsoft Windows

9dbca701e0a0f9cf7d98f5bc7a5e7d0c844f992ee4e2670f124f6344fa182e42

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\msg.exe · signed by Microsoft Windows

bcdd7f71b81bb24f6dcc0ddda5280e2db3e268cd8e0ee869b7daa768f1db7438

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\msg.exe · signed by Microsoft Windows

548856653546e145c32c1b0cc6c89dbacaa14faf3bc7107ad332666ddd1cbd2d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\msg.exe · signed by Microsoft Windows

d0ba68097e58029d22d9e7baa07f124cf42189ee497465d126bd5a6a625a707c

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\msg.exe · not signed

6fe1ff95b3c6ab578445bf126ec2bc7eb0b5244d2f27c6e443ac9a645fc23152

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\msg.exe · not signed

cbc559d2a2553d3bb60326a42be32d0b42a75b17f88e4e0e46e0b6d091d03068

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.