CmdID

CmdID / Files

sort.exe

Sort Utility file version info

Program on Windows 14 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real sort.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
C:\Users\user\AppData\Local\GitHubDesktop\app-2.5.3\resources\app\git\usr\bin\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSort Utility

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sort.exe · signed by Microsoft Windows

3d22a6462dac0c8f3f5533466d26eb52b177b6a0cf4d324730fcad4589861d95

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\sort.exe · signed by Microsoft Windows

4bde538273f8b885184253e583d68770280b74d257a7875629316a2efe2af062

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\sort.exe · signed by Microsoft Windows

a0a4fb16f2e2469624e82d6f87c5180b40d6213c3a993b0a85e391be1b149897

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sort.exe · signed by Microsoft Windows

c9d8c048beec3aa7d0494a36e77d5692391dff26bd32b07a3358c010d8c84c79

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\sort.exe · signed by Microsoft Windows

acf748f1f1b9cca9ce63a2c5ed8619820c4f21d95bc3bce3a5f466eadfa19c8f

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sort.exe · signed by Microsoft Windows

f6bf1f1f4046eaedbf9b36965fca8de6f8e5ed5d15f7e3f6f102edfd42bd0c11

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\sort.exe · signed by Microsoft Windows

50a2f167cc31f53a9fbd23c5b9f0c28f72db92aae6d6638f25d41e9f5a30a4bd

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\sort.exe · signed by Microsoft Windows

ac5fff22f5b5e2b94d8c95203bdc9ab30e883cbe2e9ad07477bd0284d84d1916

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\sort.exe · signed by Microsoft Windows

15058d3d03436ca20805750697c289f8f3b40e218ba2a1bb74de12f68e572183

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\sort.exe · signed by Microsoft Windows

4529b7450ea09756edc9eae43c1dc4edd29d1a7a19321be810654997f26a0f8b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\sort.exe · not signed

6c190a2205122c65c196283b32bdcc1549c465e730793cb1c6169857de781eae

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\sort.exe · not signed

e589ce8e69251502cf1fff510142b3ebdc4a87d4874324435e257ad4e5d5f72a

Version not recorded · C:\Users\user\AppData\Local\GitHubDesktop\app-2.5.4\resources\app\git\usr\bin\sort.exe · signed by GitHub

9135bcc7ebdc79b2a669ae1ec696d4dfc139ff9beead520187ce84d5382659ab

Version not recorded · C:\Users\user\AppData\Local\GitHubDesktop\app-2.5.3\resources\app\git\usr\bin\sort.exe · signed by GitHub

a37cc2b276fae7465d903834664f540157b2a197c9638ff9936588c7d3e87c3d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.