CmdID

CmdID / Files

ShapeCollector.exe

Personalize Handwriting Recognition UI file version info

Program on Windows 3 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ShapeCollector.exe?

file version info and known copies
Installed inC:\Program Files\Common Files\microsoft shared\ink\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionPersonalize Handwriting Recognition UI

3 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe · signed by Microsoft Windows

2c0decb7df8df6ff79ff9de4febae78b4d40a68a2f96d6beae5a9c911d56a65e

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe · signed by Microsoft Windows

98e70dee6e6f8cb0bc86f7fed3df8786285389c79af1e48ceda07e274298e449

10.0.17763.1 (WinBuild.160101.0800) · C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe · signed by Microsoft Windows

5718c40a309aad4db4f616ef89af0c823948ee157a3f3e843533cff4618a85f9

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.