CmdID

CmdID / Files

syskey.exe

SAM Lock Tool file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real syskey.exe?

file version info and known copies
Original namesamlock.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSAM Lock Tool

4 known copies

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\syskey.exe · signed by Microsoft Windows

29d60aa6c35719216cabe7e2290b08dbf6d7be0e1ecc66b88e8760ea0ad54459

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\syskey.exe · signed by Microsoft Windows

c33f6532e98dd6fbff3f30b80982d2b6b97d8a78af19f50d0c8a9c114aa0c510

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\syskey.exe · not signed

27ce005be8ef9a40be2e041c55886fe84f37e445f0dc46f7bfa45e0d49b9c536

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\syskey.exe · not signed

ed1f857082e575e1d2426adb2416de6172bc993174dcc95801fc3516c451d96d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.