CmdID

CmdID / Files

runas.exe

Run As Utility file version info

Program on Windows 12 known copies with hashes Command runas

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real runas.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRun As Utility

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\runas.exe · signed by Microsoft Windows

062648e40dd2f00d54ab4c32946c4dd50a5cfe35655b325135b56407e16e389b

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\runas.exe · signed by Microsoft Windows

81a1934b17118a5d622a1c9bb080ca8fdef7575bf912ffdc43c923b56b667213

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\runas.exe · signed by Microsoft Windows

4fa830b5e1794ff72c691b19174c3cafc8fb4dae97455560b75866e19a4fff1a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\runas.exe · signed by Microsoft Windows

c42ab0055b380e36bb4a5e5c3824f7abfa5bc028b2747743271964065b1ef8ba

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\runas.exe · signed by Microsoft Windows

3ad838cf790c9beb95cb3a9ca5126be0f99ed59a8a4c9db36f9484c43c481f61

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\runas.exe · signed by Microsoft Windows

f7c6efc0f5eb22af6cf5b7613629452c852611574997477e817d9ee3a7a9a305

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\runas.exe · signed by Microsoft Windows

018394b4655446ec0895601ac25879c80428c72fab4361792ed69c5fa6c97c34

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\runas.exe · signed by Microsoft Windows

f633828387901a9f6db431a410b5f7fe18bdddc4f630c6a839a46b061e59860e

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\runas.exe · signed by Microsoft Windows

06dd3c38bf47d2faaeddebc27c3a1eb1d329f0e8664e0d0308b06f6214ddca96

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\runas.exe · signed by Microsoft Windows

df0f9506081cf4f1037eeb47caae141136a93a11838d7223ed0a6fafdb88011e

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\runas.exe · not signed

d7373a7f576f4bcfa36c31455e54ff20826930b9f824a98544775482b6707b2c

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\runas.exe · not signed

d935670b38c64de5076c5530fcba6599922519629c9e647369d5b8d848434a7d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.