CmdID

CmdID / Files

regedt32.exe

Registry Editor Utility file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real regedt32.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRegistry Editor Utility

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\regedt32.exe · signed by Microsoft Windows

23d040ccef1f44f724d052ac8bdba3714746739b055f954b27bdabee6f735a81

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\regedt32.exe · signed by Microsoft Windows

d3008dae96877d54be410280b6c8ed7d8acab7e73c864ab1e3de2aa434ad8afe

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\regedt32.exe · signed by Microsoft Windows

a83d55c6f3fd0e634d4cd570ced654a8bdc1776027680bc3f003476e764cc499

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\regedt32.exe · signed by Microsoft Windows

b9a0659a5f8173629c2cc702f9d786f699be2c1c1bd10ee354494df75c618954

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\regedt32.exe · signed by Microsoft Windows

34de90ad6602150328e106e4e8279e2f3399a729bff54c32fad60b453bc8c718

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\regedt32.exe · signed by Microsoft Windows

757a4758b2faa5d6944bd337ed7da9563e32d2c5e31d5a0363cbbcc0cc4756d1

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\regedt32.exe · signed by Microsoft Windows

8e0afe17637281a257ca5bcae90ce4aa9ef4e9c2ec57b16dfda08b27dcc6c72f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\regedt32.exe · signed by Microsoft Windows

d575c86dd61b1b45314b2015a31a700e4636437f1b1738e60725119d68982603

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\regedt32.exe · signed by Microsoft Windows

22b4cd68f04b2494150715e9d2c0ecefd8be146fe37b764da97da7a1cee8bea5

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\regedt32.exe · signed by Microsoft Windows

b9737529cf058d4f381d645f688396abee74edd9fb87b033475c22dd9ba05b4d

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\regedt32.exe · not signed

066151ea27da27ca88b05235e0b917e4abfcd0544beab1b2ed24e1724c48ab8d

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\regedt32.exe · not signed

1e6361d657ed6a3d2b20c8fa71d2a04e6117b7109a8c1c21d7c510f0965be181

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.