CmdID

CmdID / Files

CapturePicker.exe

Program on Windows 2 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real CapturePicker.exe?

file version info and known copies
Installed inC:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\
Signed byMicrosoft Windows

2 known copies

Version not recorded · C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe · signed by Microsoft Windows

8dedbf59904814ff1e455a29712451816a50fc9dd66066f617f09233fff6e100

Version not recorded · C:\WINDOWS\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe · signed by Microsoft Windows

a7b2a847e45df8ff19db6036b2c0d12d829cbe8aeeb50f298bdeab8a3ff7efe6

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.